@acarmisc/backstage-plugin-litellm-backend 0.8.2 → 0.10.0

package/dist/teamAdmin.d.ts

@@ -0,0 +1,150 @@
+import { Request } from 'express';
+import { Config } from '@backstage/config';
+import { AuthService, PermissionsService } from '@backstage/backend-plugin-api';
+import { BasicPermission } from '@backstage/plugin-permission-common';
+import { CatalogClient } from '@backstage/catalog-client';
+/**
+ * Governance limits for the team-administration feature. Every field is
+ * fail-closed: an unset array means "nothing allowed", an unset boolean means
+ * "deny", and an unset ceiling means "no admin-settable budget". An absent
+ * `litellm.teamAdmin` block therefore leaves the feature completely dark.
+ */
+export interface TeamAdminConfig {
+    /**
+     * Backstage group entity ref whose members may manage teams,
+     * e.g. "group:default/litellm-team-admins".
+     * Undefined => feature stays disabled.
+     */
+    group?: string;
+    /**
+     * LiteLLM model names an admin may assign to a team.
+     * Empty => none assignable (fail-closed).
+     */
+    allowedModels: string[];
+    /**
+     * LiteLLM model access-group names an admin may assign.
+     * Empty => none.
+     */
+    allowedModelAccessGroups: string[];
+    /**
+     * Hard USD ceiling for a team's max_budget an admin may set.
+     * Undefined => no admin-settable budget allowed unless allowUnlimitedBudget.
+     */
+    maxBudgetCeiling?: number;
+    /**
+     * Allow an admin to create a team with no budget cap.
+     */
+    allowUnlimitedBudget: boolean;
+    /**
+     * Vector-store ids/names an admin may attach as team knowledge bases.
+     * Empty => none.
+     */
+    allowedVectorStores: string[];
+    /**
+     * MCP server ids/names an admin may attach to a team.
+     * Empty => none.
+     */
+    allowedMcpServers: string[];
+    /**
+     * MCP access-group names an admin may attach.
+     * Empty => none.
+     */
+    allowedMcpAccessGroups: string[];
+    /**
+     * Allow an admin to delete a team (vs. only block/deactivate).
+     */
+    allowTeamDelete: boolean;
+}
+/**
+ * Whether team-management routes should be mounted.
+ * Requires permission.enabled AND a designated admin group.
+ * Returns false when either is missing (fail-closed).
+ */
+export declare function isTeamManagementEnabled(config: Config): boolean;
+/**
+ * Whether the object-permission routes (knowledge bases / MCP servers) should
+ * be mounted. Requires team management to be enabled AND an explicit
+ * `litellm.teamAdmin.objectPermissions.enabled: true` opt-in, because these
+ * routes grant data access (vector stores) and tool execution (MCP) to every
+ * team key. Fail-closed: any missing piece disables the whole surface.
+ */
+export declare function isObjectPermissionsEnabled(config: Config): boolean;
+/**
+ * Discriminated result: either successful auth or a failure with HTTP status + error message.
+ */
+export type TeamAdminCheck = {
+    ok: true;
+    userEntityRef: string;
+} | {
+    ok: false;
+    status: 401 | 403;
+    error: string;
+};
+/**
+ * Layered fail-closed authz check for team-management operations.
+ *
+ * This is the security primitive that gates all team-write routes. It checks in order:
+ * 1. Authentication (user identity from token)
+ * 2. Group membership (user in the designated litellm-team-admins group)
+ * 3. Permission framework decision (via assertPermission, defaults to DENY if no policy)
+ *
+ * ALL three must pass. The group membership check exists because the permission
+ * framework alone cannot be trusted — its default depends on the policy engine
+ * (permissive if unconfigured), so we layer a guaranteed group check on top.
+ *
+ * Callers: check `result.ok` and respond with `status` + `error` when false.
+ */
+export declare function assertTeamAdmin(opts: {
+    req: Request;
+    auth: AuthService;
+    permissions: PermissionsService;
+    catalogClient: CatalogClient;
+    teamAdminGroup: string;
+    permission: BasicPermission;
+    logger: any;
+}): Promise<TeamAdminCheck>;
+/**
+ * Reads the team-admin governance block from config, applying fail-closed
+ * defaults for every field: unset arrays remain empty (nothing allowed), unset
+ * booleans stay false (deny by default), and an undefined ceiling means no
+ * admin-settable budget.
+ *
+ * Fail-closed rationale: a governance feature is only safe when absent config
+ * defaults to "deny all". An unconfigured teamAdmin block must leave the feature
+ * completely dark, ready to be explicitly enabled only once an operator has
+ * reviewed and understood the delegation policy.
+ */
+export declare function readTeamAdminConfig(config: Config): TeamAdminConfig;
+export interface TeamWriteInput {
+    team_alias?: string;
+    models?: string[];
+    max_budget?: number | null;
+    budget_duration?: string;
+    tpm_limit?: number;
+    rpm_limit?: number;
+}
+export type TeamWriteValidation = {
+    ok: true;
+    value: {
+        team_alias: string;
+        models: string[];
+        max_budget?: number;
+        budget_duration?: string;
+        tpm_limit?: number;
+        rpm_limit?: number;
+    };
+} | {
+    ok: false;
+    error: string;
+};
+export declare function validateTeamWriteInput(input: TeamWriteInput, cfg: TeamAdminConfig): TeamWriteValidation;
+export type TeamPatchValidation = {
+    ok: true;
+    value: Record<string, unknown>;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function validateTeamPatchInput(input: TeamWriteInput & {
+    blocked?: boolean;
+}, cfg: TeamAdminConfig): TeamPatchValidation;

package/dist/teamAdmin.js

@@ -0,0 +1,235 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTeamManagementEnabled = isTeamManagementEnabled;
+exports.isObjectPermissionsEnabled = isObjectPermissionsEnabled;
+exports.assertTeamAdmin = assertTeamAdmin;
+exports.readTeamAdminConfig = readTeamAdminConfig;
+exports.validateTeamWriteInput = validateTeamWriteInput;
+exports.validateTeamPatchInput = validateTeamPatchInput;
+const plugin_permission_common_1 = require("@backstage/plugin-permission-common");
+const provisioning_1 = require("./provisioning");
+/**
+ * Whether team-management routes should be mounted.
+ * Requires permission.enabled AND a designated admin group.
+ * Returns false when either is missing (fail-closed).
+ */
+function isTeamManagementEnabled(config) {
+    const permEnabled = config.getOptionalBoolean('permission.enabled') ?? false;
+    const adminConfig = readTeamAdminConfig(config);
+    return permEnabled && !!adminConfig.group;
+}
+/**
+ * Whether the object-permission routes (knowledge bases / MCP servers) should
+ * be mounted. Requires team management to be enabled AND an explicit
+ * `litellm.teamAdmin.objectPermissions.enabled: true` opt-in, because these
+ * routes grant data access (vector stores) and tool execution (MCP) to every
+ * team key. Fail-closed: any missing piece disables the whole surface.
+ */
+function isObjectPermissionsEnabled(config) {
+    return (isTeamManagementEnabled(config) &&
+        (config.getOptionalBoolean('litellm.teamAdmin.objectPermissions.enabled') ??
+            false));
+}
+/**
+ * Layered fail-closed authz check for team-management operations.
+ *
+ * This is the security primitive that gates all team-write routes. It checks in order:
+ * 1. Authentication (user identity from token)
+ * 2. Group membership (user in the designated litellm-team-admins group)
+ * 3. Permission framework decision (via assertPermission, defaults to DENY if no policy)
+ *
+ * ALL three must pass. The group membership check exists because the permission
+ * framework alone cannot be trusted — its default depends on the policy engine
+ * (permissive if unconfigured), so we layer a guaranteed group check on top.
+ *
+ * Callers: check `result.ok` and respond with `status` + `error` when false.
+ */
+async function assertTeamAdmin(opts) {
+    const { req, auth, permissions, catalogClient, teamAdminGroup, permission, logger, } = opts;
+    // Step 1: Resolve authenticated user
+    const userEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+    if (!userEntityRef) {
+        return { ok: false, status: 401, error: 'Authentication required' };
+    }
+    // Step 2: Verify credentials can be resolved (needed for permission check)
+    const credentials = await (0, provisioning_1.resolveCredentials)(req, auth);
+    if (!credentials) {
+        return { ok: false, status: 401, error: 'Authentication required' };
+    }
+    // Step 3: Check group membership
+    const isMember = await (0, provisioning_1.isUserMemberOfGroup)(userEntityRef, teamAdminGroup, catalogClient, auth, logger);
+    if (!isMember) {
+        return {
+            ok: false,
+            status: 403,
+            error: `Access denied: not a member of ${teamAdminGroup}`,
+        };
+    }
+    // Step 4: Check permission framework decision
+    const [decision] = await permissions.authorize([{ permission }], {
+        credentials,
+    });
+    if (decision.result !== plugin_permission_common_1.AuthorizeResult.ALLOW) {
+        return {
+            ok: false,
+            status: 403,
+            error: `Access denied: missing permission "${permission.name}"`,
+        };
+    }
+    // All checks passed
+    return { ok: true, userEntityRef };
+}
+/**
+ * Reads the team-admin governance block from config, applying fail-closed
+ * defaults for every field: unset arrays remain empty (nothing allowed), unset
+ * booleans stay false (deny by default), and an undefined ceiling means no
+ * admin-settable budget.
+ *
+ * Fail-closed rationale: a governance feature is only safe when absent config
+ * defaults to "deny all". An unconfigured teamAdmin block must leave the feature
+ * completely dark, ready to be explicitly enabled only once an operator has
+ * reviewed and understood the delegation policy.
+ */
+function readTeamAdminConfig(config) {
+    return {
+        group: config.getOptionalString('litellm.teamAdmin.group'),
+        allowedModels: config.getOptionalStringArray('litellm.teamAdmin.allowedModels') ?? [],
+        allowedModelAccessGroups: config.getOptionalStringArray('litellm.teamAdmin.allowedModelAccessGroups') ?? [],
+        maxBudgetCeiling: config.getOptionalNumber('litellm.teamAdmin.maxBudgetCeiling'),
+        allowUnlimitedBudget: config.getOptionalBoolean('litellm.teamAdmin.allowUnlimitedBudget') ??
+            false,
+        allowedVectorStores: config.getOptionalStringArray('litellm.teamAdmin.allowedVectorStores') ??
+            [],
+        allowedMcpServers: config.getOptionalStringArray('litellm.teamAdmin.allowedMcpServers') ?? [],
+        allowedMcpAccessGroups: config.getOptionalStringArray('litellm.teamAdmin.allowedMcpAccessGroups') ?? [],
+        allowTeamDelete: config.getOptionalBoolean('litellm.teamAdmin.allowTeamDelete') ?? false,
+    };
+}
+function validateTeamWriteInput(input, cfg) {
+    const trimmedAlias = (input.team_alias ?? '').trim();
+    if (!trimmedAlias) {
+        return { ok: false, error: 'team_alias is required' };
+    }
+    const models = input.models ?? [];
+    if (!Array.isArray(models) || models.length === 0) {
+        return { ok: false, error: 'models must list at least one allowed model (a team with no explicit models grants access to every proxy model)' };
+    }
+    const allowedSet = new Set([...cfg.allowedModels, ...cfg.allowedModelAccessGroups]);
+    if (allowedSet.size === 0) {
+        return { ok: false, error: 'models are not allowed (team admin has configured no allowlist)' };
+    }
+    for (const model of models) {
+        if (!allowedSet.has(model)) {
+            return { ok: false, error: `model "${model}" is not in the allowed set for team admins` };
+        }
+    }
+    let maxBudget;
+    if (input.max_budget !== undefined && input.max_budget !== null) {
+        if (!Number.isFinite(input.max_budget) || input.max_budget <= 0) {
+            return { ok: false, error: 'max_budget must be a positive number' };
+        }
+        maxBudget = input.max_budget;
+    }
+    if (!cfg.allowUnlimitedBudget) {
+        if (maxBudget === undefined) {
+            return { ok: false, error: 'max_budget is required' };
+        }
+        if (cfg.maxBudgetCeiling === undefined) {
+            return { ok: false, error: 'team budget ceiling is not configured (litellm.teamAdmin.maxBudgetCeiling)' };
+        }
+        if (maxBudget > cfg.maxBudgetCeiling) {
+            return { ok: false, error: `max_budget $${maxBudget} exceeds the ceiling $${cfg.maxBudgetCeiling}` };
+        }
+    }
+    else if (maxBudget !== undefined && cfg.maxBudgetCeiling !== undefined && maxBudget > cfg.maxBudgetCeiling) {
+        return { ok: false, error: `max_budget $${maxBudget} exceeds the ceiling $${cfg.maxBudgetCeiling}` };
+    }
+    let budgetDuration = input.budget_duration;
+    if (!budgetDuration || typeof budgetDuration !== 'string' || budgetDuration.trim() === '') {
+        if (maxBudget !== undefined) {
+            budgetDuration = '30d';
+        }
+    }
+    const tpmLimit = input.tpm_limit !== undefined && Number.isFinite(input.tpm_limit) && input.tpm_limit >= 0 ? input.tpm_limit : undefined;
+    const rpmLimit = input.rpm_limit !== undefined && Number.isFinite(input.rpm_limit) && input.rpm_limit >= 0 ? input.rpm_limit : undefined;
+    return {
+        ok: true,
+        value: {
+            team_alias: trimmedAlias,
+            models,
+            ...(maxBudget !== undefined && { max_budget: maxBudget }),
+            ...(budgetDuration && { budget_duration: budgetDuration }),
+            ...(tpmLimit !== undefined && { tpm_limit: tpmLimit }),
+            ...(rpmLimit !== undefined && { rpm_limit: rpmLimit }),
+        },
+    };
+}
+function validateTeamPatchInput(input, cfg) {
+    const result = {};
+    let hasRecognizedField = false;
+    if (input.team_alias !== undefined) {
+        hasRecognizedField = true;
+        const trimmedAlias = (input.team_alias ?? '').trim();
+        if (!trimmedAlias) {
+            return { ok: false, error: 'team_alias must not be empty' };
+        }
+        result.team_alias = trimmedAlias;
+    }
+    if (input.models !== undefined) {
+        hasRecognizedField = true;
+        if (!Array.isArray(input.models) || input.models.length === 0) {
+            return { ok: false, error: 'models must list at least one allowed model (a team with no explicit models grants access to every proxy model)' };
+        }
+        const allowedSet = new Set([...cfg.allowedModels, ...cfg.allowedModelAccessGroups]);
+        if (allowedSet.size === 0) {
+            return { ok: false, error: 'models are not allowed (team admin has configured no allowlist)' };
+        }
+        for (const model of input.models) {
+            if (!allowedSet.has(model)) {
+                return { ok: false, error: `model "${model}" is not in the allowed set for team admins` };
+            }
+        }
+        result.models = input.models;
+    }
+    if (input.max_budget !== undefined) {
+        hasRecognizedField = true;
+        if (input.max_budget === null) {
+            if (!cfg.allowUnlimitedBudget) {
+                return { ok: false, error: 'max_budget cannot be cleared (unlimited budgets are disabled)' };
+            }
+            result.max_budget = null;
+        }
+        else {
+            if (!Number.isFinite(input.max_budget) || input.max_budget <= 0) {
+                return { ok: false, error: 'max_budget must be a positive number' };
+            }
+            if (cfg.maxBudgetCeiling !== undefined && input.max_budget > cfg.maxBudgetCeiling) {
+                return { ok: false, error: `max_budget $${input.max_budget} exceeds the ceiling $${cfg.maxBudgetCeiling}` };
+            }
+            result.max_budget = input.max_budget;
+        }
+    }
+    if (input.blocked !== undefined) {
+        hasRecognizedField = true;
+        if (typeof input.blocked !== 'boolean') {
+            return { ok: false, error: 'blocked must be a boolean' };
+        }
+        result.blocked = input.blocked;
+    }
+    if (input.budget_duration !== undefined && typeof input.budget_duration === 'string' && input.budget_duration.trim() !== '') {
+        hasRecognizedField = true;
+        result.budget_duration = input.budget_duration;
+    }
+    if (input.tpm_limit !== undefined && Number.isFinite(input.tpm_limit) && input.tpm_limit >= 0) {
+        hasRecognizedField = true;
+        result.tpm_limit = input.tpm_limit;
+    }
+    if (input.rpm_limit !== undefined && Number.isFinite(input.rpm_limit) && input.rpm_limit >= 0) {
+        hasRecognizedField = true;
+        result.rpm_limit = input.rpm_limit;
+    }
+    if (!hasRecognizedField) {
+        return { ok: false, error: 'no updatable fields provided' };
+    }
+    return { ok: true, value: result };
+}

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n  /** Backstage-computed: true when the user is a member of litellm.audit.group */\n  can_view_audit?: boolean;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  user_email?: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  spend: number;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n  max_input_tokens?: number;\n  max_output_tokens?: number;\n  /** Access group names this model belongs to (litellm.model_info.access_groups). A team's `models` list can reference a group name instead of a literal model_name. */\n  access_groups?: string[];\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\nexport interface AuditLogEntry {\n  id: string;\n  updated_at: string;\n  changed_by?: string;\n  changed_by_api_key?: string;\n  action?: string;\n  table_name?: string;\n  object_id?: string;\n  before_value?: Record<string, unknown> | null;\n  updated_values?: Record<string, unknown> | null;\n}\n\nexport interface PaginatedAuditLogs {\n  audit_logs: AuditLogEntry[];\n  total: number;\n  page: number;\n  page_size: number;\n  total_pages: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n  /** Backstage-computed: true when the user is a member of litellm.audit.group */\n  can_view_audit?: boolean;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  user_email?: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamObjectPermission {\n  /** Vector store ids/names attached to the team. */\n  vector_stores?: string[];\n  /** MCP server ids/names attached to the team. */\n  mcp_servers?: string[];\n  /** MCP access group names attached to the team. */\n  mcp_access_groups?: string[];\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  spend: number;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  /** Arbitrary metadata stored on the team record. */\n  metadata?: Record<string, unknown>;\n  /** Knowledge bases (vector stores) and MCP servers attached to the team. */\n  object_permission?: TeamObjectPermission;\n  /** Whether the team is blocked/deactivated. */\n  blocked?: boolean;\n  /** Max budget available to individual team members (if set per-member). */\n  team_member_budget?: number;\n}\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: TeamObjectPermission;\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\nexport interface CreateTeamResponse {\n  team_id: string;\n  team_alias?: string;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n  max_input_tokens?: number;\n  max_output_tokens?: number;\n  /** Access group names this model belongs to (litellm.model_info.access_groups). A team's `models` list can reference a group name instead of a literal model_name. */\n  access_groups?: string[];\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\nexport interface AuditLogEntry {\n  id: string;\n  updated_at: string;\n  changed_by?: string;\n  changed_by_api_key?: string;\n  action?: string;\n  table_name?: string;\n  object_id?: string;\n  before_value?: Record<string, unknown> | null;\n  updated_values?: Record<string, unknown> | null;\n}\n\nexport interface PaginatedAuditLogs {\n  audit_logs: AuditLogEntry[];\n  total: number;\n  page: number;\n  page_size: number;\n  total_pages: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -17,6 +17,14 @@ export interface TeamMember {
     user_email?: string;
     role: 'admin' | 'user';
 }
+export interface TeamObjectPermission {
+    /** Vector store ids/names attached to the team. */
+    vector_stores?: string[];
+    /** MCP server ids/names attached to the team. */
+    mcp_servers?: string[];
+    /** MCP access group names attached to the team. */
+    mcp_access_groups?: string[];
+}
 export interface TeamInfo {
     team_id: string;
     team_alias?: string;
@@ -26,6 +34,32 @@ export interface TeamInfo {
     models?: string[];
     tpm_limit?: number;
     rpm_limit?: number;
+    /** Arbitrary metadata stored on the team record. */
+    metadata?: Record<string, unknown>;
+    /** Knowledge bases (vector stores) and MCP servers attached to the team. */
+    object_permission?: TeamObjectPermission;
+    /** Whether the team is blocked/deactivated. */
+    blocked?: boolean;
+    /** Max budget available to individual team members (if set per-member). */
+    team_member_budget?: number;
+}
+export interface CreateTeamRequest {
+    team_alias: string;
+    models?: string[];
+    max_budget?: number;
+    budget_duration?: string;
+    tpm_limit?: number;
+    rpm_limit?: number;
+    metadata?: Record<string, unknown>;
+    object_permission?: TeamObjectPermission;
+}
+export interface UpdateTeamRequest extends Partial<CreateTeamRequest> {
+    team_id: string;
+    blocked?: boolean;
+}
+export interface CreateTeamResponse {
+    team_id: string;
+    team_alias?: string;
 }
 export interface VirtualKey {
     key: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.8.2",
+  "version": "0.10.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -31,6 +31,7 @@
     "build": "node build.js && tsc -p tsconfig.json",
     "lint": "eslint src --ext .ts",
     "test": "tsc -p tsconfig.test.json && node --test dist-test/**/*.test.js dist-test/*.test.js",
+    "api-report": "npm run build && api-extractor run --local --verbose",
     "prepack": "npm run build",
     "postpack": ""
   },
@@ -39,16 +40,18 @@
     "@backstage/catalog-client": "^1.9.0",
     "@backstage/catalog-model": "^1.7.0",
     "@backstage/config": "^1.3.0",
+    "@backstage/plugin-permission-common": "^0.9.10",
     "@backstage/types": "^1.2.0",
     "express": "^4.18.2",
     "jose": "^5.9.6"
   },
   "devDependencies": {
     "@backstage/cli": "^0.36.2",
+    "@microsoft/api-extractor": "^7.59.0",
     "@types/express": "^4.17.25",
+    "@types/node": "^20.0.0",
     "esbuild": "^0.28.0",
-    "typescript": "^5.9.3",
-    "@types/node": "^20.0.0"
+    "typescript": "^5.9.3"
   },
   "configSchema": "config.d.ts"
 }