@acarmisc/backstage-plugin-litellm-backend 0.9.0 → 0.11.0

package/dist/index.cjs.js

@@ -38,7 +38,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var require_api_cjs = __commonJS({
   "node_modules/@backstage/plugin-permission-common/dist/types/api.cjs.js"(exports2) {
     "use strict";
-    var AuthorizeResult2 = {
+    var AuthorizeResult3 = {
       /**
        * The authorization request is denied.
        */
@@ -52,7 +52,7 @@ var require_api_cjs = __commonJS({
        */
       CONDITIONAL: "CONDITIONAL"
     };
-    exports2.AuthorizeResult = AuthorizeResult2;
+    exports2.AuthorizeResult = AuthorizeResult3;
   }
 });
 
@@ -7976,28 +7976,39 @@ __export(index_exports, {
   LiteLLMClient: () => LiteLLMClient,
   ProvisioningError: () => ProvisioningError,
   applyRoleOverrides: () => applyRoleOverrides,
+  assertTeamAdmin: () => assertTeamAdmin,
   bridgeGenerateKey: () => bridgeGenerateKey,
   bridgeListKeys: () => bridgeListKeys,
   createRouter: () => createRouter,
   default: () => litellmPlugin,
   getOrProvisionUser: () => getOrProvisionUser,
   getOrProvisionUserFromClaims: () => getOrProvisionUserFromClaims,
+  isTeamManagementEnabled: () => isTeamManagementEnabled,
   litellmAuditReadPermission: () => litellmAuditReadPermission,
   litellmKeyCreatePermission: () => litellmKeyCreatePermission,
   litellmKeyManagePermission: () => litellmKeyManagePermission,
   litellmKeyRevokePermission: () => litellmKeyRevokePermission,
   litellmPermissions: () => litellmPermissions,
   litellmPlugin: () => litellmPlugin,
+  litellmTeamCreatePermission: () => litellmTeamCreatePermission,
+  litellmTeamDeletePermission: () => litellmTeamDeletePermission,
+  litellmTeamKnowledgebaseManagePermission: () => litellmTeamKnowledgebaseManagePermission,
+  litellmTeamManagePermission: () => litellmTeamManagePermission,
+  litellmTeamMcpManagePermission: () => litellmTeamMcpManagePermission,
+  litellmTeamMembersManagePermission: () => litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
   provisionUser: () => provisionUser,
   readBridgeConfig: () => readBridgeConfig,
   readProvisioningDefaults: () => readProvisioningDefaults,
   readRoleConfigs: () => readRoleConfigs,
+  readTeamAdminConfig: () => readTeamAdminConfig,
   resolveBridgeUserId: () => resolveBridgeUserId,
   resolveUserId: () => resolveUserId,
   resolveUserProfile: () => resolveUserProfile,
   resolveUserRole: () => resolveUserRole,
-  toLiteLLMUserId: () => toLiteLLMUserId
+  toLiteLLMUserId: () => toLiteLLMUserId,
+  validateTeamPatchInput: () => validateTeamPatchInput,
+  validateTeamWriteInput: () => validateTeamWriteInput
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -8006,7 +8017,7 @@ var import_backend_plugin_api = require("@backstage/backend-plugin-api");
 
 // src/router.ts
 var import_express = __toESM(require("express"));
-var import_plugin_permission_common2 = __toESM(require_index_cjs2());
+var import_plugin_permission_common3 = __toESM(require_index_cjs2());
 var import_catalog_client = require("@backstage/catalog-client");
 
 // src/client.ts
@@ -8276,18 +8287,142 @@ var LiteLLMClient = class {
     const raw = await this.request(
       `/team/info?team_id=${encodeURIComponent(teamId)}`
     );
+    return this.toTeamInfo(raw, teamId);
+  }
+  /**
+   * Normalises a single team row into the TeamInfo contract. Tolerates both
+   * the `/team/info` shape (row wrapped in a `team_info` envelope alongside
+   * sibling arrays) and a bare row as returned per-item by `/team/list`.
+   * `metadata` is always surfaced so callers can read `owning_group`.
+   */
+  toTeamInfo(raw, fallbackId) {
     const inner = raw?.team_info ?? {};
     return {
-      team_id: raw?.team_id ?? inner.team_id ?? teamId,
+      team_id: raw?.team_id ?? inner.team_id ?? fallbackId ?? "",
       team_alias: inner.team_alias ?? raw?.team_alias,
       max_budget: inner.max_budget ?? raw?.max_budget,
+      budget_duration: inner.budget_duration ?? raw?.budget_duration,
       spend: inner.spend ?? raw?.spend ?? 0,
       members_with_roles: inner.members_with_roles ?? raw?.members_with_roles,
       models: inner.models ?? raw?.models,
       tpm_limit: inner.tpm_limit ?? raw?.tpm_limit,
-      rpm_limit: inner.rpm_limit ?? raw?.rpm_limit
+      rpm_limit: inner.rpm_limit ?? raw?.rpm_limit,
+      metadata: inner.metadata ?? raw?.metadata,
+      object_permission: inner.object_permission ?? raw?.object_permission,
+      blocked: inner.blocked ?? raw?.blocked,
+      team_member_budget: inner.team_member_budget ?? raw?.team_member_budget
     };
   }
+  /**
+   * Lists every team known to the LiteLLM proxy. Tolerates the observed
+   * response shapes — a bare array, `{ teams: [...] }`, or `{ data: [...] }` —
+   * and normalises each row through the same unwrap as `getTeamInfo`.
+   *
+   * This returns the GLOBAL team list and must never be exposed directly to
+   * end users; callers are responsible for scoping the result (e.g. to teams
+   * whose `metadata.owning_group` matches the caller's admin group).
+   */
+  async listTeams() {
+    const raw = await this.request("/team/list");
+    let rows = [];
+    if (Array.isArray(raw)) rows = raw;
+    else if (Array.isArray(raw?.teams)) rows = raw.teams;
+    else if (Array.isArray(raw?.data)) rows = raw.data;
+    return rows.map((row) => this.toTeamInfo(row));
+  }
+  async createTeam(payload) {
+    return this.request("/team/new", {
+      method: "POST",
+      body: JSON.stringify(payload)
+    });
+  }
+  async updateTeam(payload) {
+    return this.request("/team/update", {
+      method: "POST",
+      body: JSON.stringify(payload)
+    });
+  }
+  async deleteTeam(teamId) {
+    return this.request("/team/delete", {
+      method: "POST",
+      body: JSON.stringify({ team_ids: [teamId] })
+    });
+  }
+  async blockTeam(teamId) {
+    return this.request("/team/block", {
+      method: "POST",
+      body: JSON.stringify({ team_id: teamId })
+    });
+  }
+  async unblockTeam(teamId) {
+    return this.request("/team/unblock", {
+      method: "POST",
+      body: JSON.stringify({ team_id: teamId })
+    });
+  }
+  /**
+   * Adds a member to a team. LiteLLM's `/team/member_add` nests the member
+   * under a `member` object; `role` is 'user' or 'admin' (we only ever send
+   * 'user' from Backstage). `max_budget_in_team` optionally caps that member's
+   * spend within the team.
+   */
+  async teamMemberAdd(payload) {
+    return this.request("/team/member_add", {
+      method: "POST",
+      body: JSON.stringify({
+        team_id: payload.team_id,
+        member: { user_id: payload.user_id, role: payload.role ?? "user" },
+        ...payload.max_budget_in_team !== void 0 && {
+          max_budget_in_team: payload.max_budget_in_team
+        }
+      })
+    });
+  }
+  /** Removes a member from a team via LiteLLM's `/team/member_delete`. */
+  async teamMemberDelete(payload) {
+    return this.request("/team/member_delete", {
+      method: "POST",
+      body: JSON.stringify({
+        team_id: payload.team_id,
+        user_id: payload.user_id
+      })
+    });
+  }
+  /**
+   * Lists the vector stores (knowledge bases) registered on the LiteLLM proxy.
+   * Tolerates a bare array, `{ data: [...] }`, or `{ vector_stores: [...] }`.
+   * Each entry is normalised to `{ id, name? }` — `id` prefers
+   * `vector_store_id` then `id` then `name`.
+   */
+  async listVectorStores() {
+    const raw = await this.request("/vector_store/list");
+    let rows = [];
+    if (Array.isArray(raw)) rows = raw;
+    else if (Array.isArray(raw?.data)) rows = raw.data;
+    else if (Array.isArray(raw?.vector_stores)) rows = raw.vector_stores;
+    return rows.map((r) => ({
+      id: r?.vector_store_id ?? r?.id ?? r?.name ?? "",
+      name: r?.vector_store_name ?? r?.name ?? void 0
+    })).filter((r) => r.id);
+  }
+  /**
+   * Lists the MCP servers registered on the LiteLLM proxy. Path is
+   * `/mcp/server/list`; tolerates a bare array, `{ data: [...] }` or
+   * `{ servers: [...] }`. Normalised to `{ id, name?, url? }` — `id` prefers
+   * `server_id` then `id` then `alias`/`name`.
+   */
+  async listMcpServers() {
+    const raw = await this.request("/mcp/server/list");
+    let rows = [];
+    if (Array.isArray(raw)) rows = raw;
+    else if (Array.isArray(raw?.data)) rows = raw.data;
+    else if (Array.isArray(raw?.servers)) rows = raw.servers;
+    return rows.map((r) => ({
+      id: r?.server_id ?? r?.id ?? r?.alias ?? r?.name ?? "",
+      name: r?.alias ?? r?.name ?? void 0,
+      url: r?.url ?? void 0
+    })).filter((r) => r.id);
+  }
   emptyUsage() {
     return {
       total_spend: 0,
@@ -10457,14 +10592,241 @@ var litellmAuditReadPermission = (0, import_plugin_permission_common.createPermi
   name: "litellm.audit.read",
   attributes: { action: "read" }
 });
+var litellmTeamCreatePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.create",
+  attributes: { action: "create" }
+});
+var litellmTeamManagePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.manage",
+  attributes: { action: "update" }
+});
+var litellmTeamMembersManagePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.members.manage",
+  attributes: { action: "update" }
+});
+var litellmTeamKnowledgebaseManagePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.knowledgebase.manage",
+  attributes: { action: "update" }
+});
+var litellmTeamMcpManagePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.mcp.manage",
+  attributes: { action: "update" }
+});
+var litellmTeamDeletePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.delete",
+  attributes: { action: "delete" }
+});
 var litellmPermissions = [
   litellmKeyCreatePermission,
   litellmKeyRevokePermission,
   litellmKeyManagePermission,
-  litellmAuditReadPermission
+  litellmAuditReadPermission,
+  litellmTeamCreatePermission,
+  litellmTeamManagePermission,
+  litellmTeamMembersManagePermission,
+  litellmTeamKnowledgebaseManagePermission,
+  litellmTeamMcpManagePermission,
+  litellmTeamDeletePermission
 ];
 
+// src/teamAdmin.ts
+var import_plugin_permission_common2 = __toESM(require_index_cjs2());
+var DEFAULT_TEAM_BUDGET_CEILING = 1e3;
+function isTeamManagementEnabled(config) {
+  const permEnabled = config.getOptionalBoolean("permission.enabled") ?? false;
+  const adminConfig = readTeamAdminConfig(config);
+  return permEnabled && !!adminConfig.group;
+}
+function isObjectPermissionsEnabled(config) {
+  return isTeamManagementEnabled(config) && (config.getOptionalBoolean("litellm.teamAdmin.objectPermissions.enabled") ?? false);
+}
+async function assertTeamAdmin(opts) {
+  const {
+    req,
+    auth,
+    permissions,
+    catalogClient,
+    teamAdminGroup,
+    permission,
+    logger
+  } = opts;
+  const userEntityRef = await resolveUserId(req, auth);
+  if (!userEntityRef) {
+    return { ok: false, status: 401, error: "Authentication required" };
+  }
+  const credentials = await resolveCredentials(req, auth);
+  if (!credentials) {
+    return { ok: false, status: 401, error: "Authentication required" };
+  }
+  const isMember = await isUserMemberOfGroup(
+    userEntityRef,
+    teamAdminGroup,
+    catalogClient,
+    auth,
+    logger
+  );
+  if (!isMember) {
+    return {
+      ok: false,
+      status: 403,
+      error: `Access denied: not a member of ${teamAdminGroup}`
+    };
+  }
+  const [decision] = await permissions.authorize([{ permission }], {
+    credentials
+  });
+  if (decision.result !== import_plugin_permission_common2.AuthorizeResult.ALLOW) {
+    return {
+      ok: false,
+      status: 403,
+      error: `Access denied: missing permission "${permission.name}"`
+    };
+  }
+  return { ok: true, userEntityRef };
+}
+function readTeamAdminConfig(config) {
+  return {
+    group: config.getOptionalString("litellm.teamAdmin.group"),
+    allowedModels: config.getOptionalStringArray("litellm.teamAdmin.allowedModels") ?? [],
+    allowedModelAccessGroups: config.getOptionalStringArray(
+      "litellm.teamAdmin.allowedModelAccessGroups"
+    ) ?? [],
+    maxBudgetCeiling: config.getOptionalNumber("litellm.teamAdmin.maxBudgetCeiling") ?? DEFAULT_TEAM_BUDGET_CEILING,
+    allowUnlimitedBudget: config.getOptionalBoolean("litellm.teamAdmin.allowUnlimitedBudget") ?? false,
+    allowedVectorStores: config.getOptionalStringArray("litellm.teamAdmin.allowedVectorStores") ?? [],
+    allowedMcpServers: config.getOptionalStringArray("litellm.teamAdmin.allowedMcpServers") ?? [],
+    allowedMcpAccessGroups: config.getOptionalStringArray(
+      "litellm.teamAdmin.allowedMcpAccessGroups"
+    ) ?? [],
+    allowTeamDelete: config.getOptionalBoolean("litellm.teamAdmin.allowTeamDelete") ?? false
+  };
+}
+function validateTeamWriteInput(input, cfg) {
+  const trimmedAlias = (input.team_alias ?? "").trim();
+  if (!trimmedAlias) {
+    return { ok: false, error: "team_alias is required" };
+  }
+  const models = input.models ?? [];
+  if (!Array.isArray(models) || models.length === 0) {
+    return { ok: false, error: "models must list at least one allowed model (a team with no explicit models grants access to every proxy model)" };
+  }
+  const allowedSet = /* @__PURE__ */ new Set([...cfg.allowedModels, ...cfg.allowedModelAccessGroups]);
+  if (allowedSet.size === 0) {
+    return { ok: false, error: "models are not allowed (team admin has configured no allowlist)" };
+  }
+  for (const model of models) {
+    if (!allowedSet.has(model)) {
+      return { ok: false, error: `model "${model}" is not in the allowed set for team admins` };
+    }
+  }
+  let maxBudget;
+  if (input.max_budget !== void 0 && input.max_budget !== null) {
+    if (!Number.isFinite(input.max_budget) || input.max_budget <= 0) {
+      return { ok: false, error: "max_budget must be a positive number" };
+    }
+    maxBudget = input.max_budget;
+  }
+  if (!cfg.allowUnlimitedBudget) {
+    if (maxBudget === void 0) {
+      return { ok: false, error: "max_budget is required" };
+    }
+    if (maxBudget > cfg.maxBudgetCeiling) {
+      return { ok: false, error: `max_budget $${maxBudget} exceeds the ceiling $${cfg.maxBudgetCeiling}` };
+    }
+  } else if (maxBudget !== void 0 && maxBudget > cfg.maxBudgetCeiling) {
+    return { ok: false, error: `max_budget $${maxBudget} exceeds the ceiling $${cfg.maxBudgetCeiling}` };
+  }
+  let budgetDuration = input.budget_duration;
+  if (!budgetDuration || typeof budgetDuration !== "string" || budgetDuration.trim() === "") {
+    if (maxBudget !== void 0) {
+      budgetDuration = "30d";
+    }
+  }
+  const tpmLimit = input.tpm_limit !== void 0 && Number.isFinite(input.tpm_limit) && input.tpm_limit >= 0 ? input.tpm_limit : void 0;
+  const rpmLimit = input.rpm_limit !== void 0 && Number.isFinite(input.rpm_limit) && input.rpm_limit >= 0 ? input.rpm_limit : void 0;
+  return {
+    ok: true,
+    value: {
+      team_alias: trimmedAlias,
+      models,
+      ...maxBudget !== void 0 && { max_budget: maxBudget },
+      ...budgetDuration && { budget_duration: budgetDuration },
+      ...tpmLimit !== void 0 && { tpm_limit: tpmLimit },
+      ...rpmLimit !== void 0 && { rpm_limit: rpmLimit }
+    }
+  };
+}
+function validateTeamPatchInput(input, cfg) {
+  const result = {};
+  let hasRecognizedField = false;
+  if (input.team_alias !== void 0) {
+    hasRecognizedField = true;
+    const trimmedAlias = (input.team_alias ?? "").trim();
+    if (!trimmedAlias) {
+      return { ok: false, error: "team_alias must not be empty" };
+    }
+    result.team_alias = trimmedAlias;
+  }
+  if (input.models !== void 0) {
+    hasRecognizedField = true;
+    if (!Array.isArray(input.models) || input.models.length === 0) {
+      return { ok: false, error: "models must list at least one allowed model (a team with no explicit models grants access to every proxy model)" };
+    }
+    const allowedSet = /* @__PURE__ */ new Set([...cfg.allowedModels, ...cfg.allowedModelAccessGroups]);
+    if (allowedSet.size === 0) {
+      return { ok: false, error: "models are not allowed (team admin has configured no allowlist)" };
+    }
+    for (const model of input.models) {
+      if (!allowedSet.has(model)) {
+        return { ok: false, error: `model "${model}" is not in the allowed set for team admins` };
+      }
+    }
+    result.models = input.models;
+  }
+  if (input.max_budget !== void 0) {
+    hasRecognizedField = true;
+    if (input.max_budget === null) {
+      if (!cfg.allowUnlimitedBudget) {
+        return { ok: false, error: "max_budget cannot be cleared (unlimited budgets are disabled)" };
+      }
+      result.max_budget = null;
+    } else {
+      if (!Number.isFinite(input.max_budget) || input.max_budget <= 0) {
+        return { ok: false, error: "max_budget must be a positive number" };
+      }
+      if (input.max_budget > cfg.maxBudgetCeiling) {
+        return { ok: false, error: `max_budget $${input.max_budget} exceeds the ceiling $${cfg.maxBudgetCeiling}` };
+      }
+      result.max_budget = input.max_budget;
+    }
+  }
+  if (input.blocked !== void 0) {
+    hasRecognizedField = true;
+    if (typeof input.blocked !== "boolean") {
+      return { ok: false, error: "blocked must be a boolean" };
+    }
+    result.blocked = input.blocked;
+  }
+  if (input.budget_duration !== void 0 && typeof input.budget_duration === "string" && input.budget_duration.trim() !== "") {
+    hasRecognizedField = true;
+    result.budget_duration = input.budget_duration;
+  }
+  if (input.tpm_limit !== void 0 && Number.isFinite(input.tpm_limit) && input.tpm_limit >= 0) {
+    hasRecognizedField = true;
+    result.tpm_limit = input.tpm_limit;
+  }
+  if (input.rpm_limit !== void 0 && Number.isFinite(input.rpm_limit) && input.rpm_limit >= 0) {
+    hasRecognizedField = true;
+    result.rpm_limit = input.rpm_limit;
+  }
+  if (!hasRecognizedField) {
+    return { ok: false, error: "no updatable fields provided" };
+  }
+  return { ok: true, value: result };
+}
+
 // src/router.ts
+var teamCreateInFlight = /* @__PURE__ */ new Map();
 async function createRouter(options) {
   const { config, logger, auth, discovery, permissions } = options;
   const baseUrl = config.getString("litellm.baseUrl");
@@ -10477,12 +10839,20 @@ async function createRouter(options) {
   const auditGroup = config.getOptionalString("litellm.audit.group");
   const allowUnlimitedBudget = config.getOptionalBoolean("litellm.keyGeneration.allowUnlimitedBudget") ?? false;
   const teamRequired = config.getOptionalBoolean("litellm.keyGeneration.teamRequired") ?? true;
-  const catalogClient = new import_catalog_client.CatalogClient({ discoveryApi: discovery });
+  const teamMgmtEnabled = isTeamManagementEnabled(config);
+  const objectPermsEnabled = isObjectPermissionsEnabled(config);
+  const teamAdminCfg = readTeamAdminConfig(config);
+  const catalogClient = options.catalogClient ?? new import_catalog_client.CatalogClient({ discoveryApi: discovery });
   if (provisioningEnabled) {
     logger.info(
       `LiteLLM auto-provisioning enabled \u2014 defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length ? provisioningDefaults.models.join(",") : "all"}, teams=[${provisioningDefaults.teams.join(",")}]`
     );
   }
+  if (config.getOptional("litellm.teamAdmin") && !teamMgmtEnabled) {
+    logger.warn(
+      "litellm.teamAdmin is configured but team management is disabled \u2014 set permission.enabled: true and litellm.teamAdmin.group to enable it."
+    );
+  }
   const router = (0, import_express.Router)();
   router.use(import_express.default.json());
   router.get("/health", (_req, res) => {
@@ -10491,7 +10861,13 @@ async function createRouter(options) {
   router.get("/config", (_req, res) => {
     res.json({
       baseUrl: publicBaseUrl,
-      keyGeneration: { allowUnlimitedBudget, teamRequired }
+      keyGeneration: { allowUnlimitedBudget, teamRequired },
+      teamManagement: {
+        enabled: teamMgmtEnabled,
+        maxBudgetCeiling: teamAdminCfg.maxBudgetCeiling,
+        allowUnlimitedBudget: teamAdminCfg.allowUnlimitedBudget,
+        objectPermissionsEnabled: objectPermsEnabled
+      }
     });
   });
   router.get("/openapi.json", (_req, res) => {
@@ -10635,7 +11011,7 @@ async function createRouter(options) {
     const [decision] = await permissions.authorize([{ permission }], {
       credentials
     });
-    return decision.result === import_plugin_permission_common2.AuthorizeResult.ALLOW;
+    return decision.result === import_plugin_permission_common3.AuthorizeResult.ALLOW;
   }
   function sendPermissionDenied(res, permission) {
     res.status(403).json({
@@ -10900,6 +11276,536 @@ async function createRouter(options) {
       res.status(500).json({ error: error.message });
     }
   });
+  function requireTeamMgmt(res) {
+    if (!teamMgmtEnabled) {
+      res.status(403).json({
+        error: "Team management is disabled (requires permission.enabled and litellm.teamAdmin.group)"
+      });
+      return false;
+    }
+    return true;
+  }
+  function requireObjectPerms(res) {
+    if (!requireTeamMgmt(res)) return false;
+    if (!objectPermsEnabled) {
+      res.status(403).json({
+        error: "Knowledge-base / MCP management is disabled (set litellm.teamAdmin.objectPermissions.enabled: true, with a permission policy and the allowlists in place)"
+      });
+      return false;
+    }
+    return true;
+  }
+  function sendTeamError(err, res) {
+    if (err instanceof LiteLLMUpstreamError) {
+      res.status(err.status).json({
+        error: err.message,
+        ...err.param ? { param: err.param } : {}
+      });
+    } else {
+      logger.error("Team operation failed", err);
+      res.status(500).json({ error: err.message });
+    }
+  }
+  router.post("/teams", async (req, res) => {
+    if (!requireTeamMgmt(res)) return;
+    const check = await assertTeamAdmin({
+      req,
+      auth,
+      permissions,
+      catalogClient,
+      teamAdminGroup: teamAdminCfg.group,
+      permission: litellmTeamCreatePermission,
+      logger
+    });
+    if (!check.ok) {
+      res.status(check.status).json({ error: check.error });
+      return;
+    }
+    const v = validateTeamWriteInput(req.body ?? {}, teamAdminCfg);
+    if (!v.ok) {
+      res.status(400).json({ error: v.error });
+      return;
+    }
+    const key = v.value.team_alias.trim().toLowerCase();
+    const pending = teamCreateInFlight.get(key);
+    if (pending) {
+      logger.info(`Team creation already in flight for ${key} \u2014 joining`);
+      try {
+        const result = await pending;
+        res.json(result);
+      } catch (err) {
+        sendTeamError(err, res);
+      }
+      return;
+    }
+    const payload = {
+      team_alias: v.value.team_alias,
+      models: v.value.models,
+      ...v.value.max_budget !== void 0 && { max_budget: v.value.max_budget },
+      ...v.value.budget_duration && { budget_duration: v.value.budget_duration },
+      ...v.value.tpm_limit !== void 0 && { tpm_limit: v.value.tpm_limit },
+      ...v.value.rpm_limit !== void 0 && { rpm_limit: v.value.rpm_limit },
+      metadata: {
+        owning_group: teamAdminCfg.group,
+        created_by_backstage_user: check.userEntityRef,
+        created_via: "backstage",
+        created_at_iso: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+    const createPromise = (async () => {
+      const result = await client.createTeam(payload);
+      logger.info({
+        action: "team.create",
+        actor: check.userEntityRef,
+        teamAlias: v.value.team_alias,
+        owningGroup: teamAdminCfg.group
+      });
+      return result;
+    })();
+    teamCreateInFlight.set(key, createPromise);
+    try {
+      const result = await createPromise;
+      res.json(result);
+    } catch (err) {
+      sendTeamError(err, res);
+    } finally {
+      teamCreateInFlight.delete(key);
+    }
+  });
+  router.patch("/teams/:teamId", async (req, res) => {
+    const authz = await authorizeTeamSubresource(
+      req,
+      res,
+      litellmTeamManagePermission
+    );
+    if (!authz) return;
+    const { teamId, owningGroup, actor, team: existing } = authz;
+    const v = validateTeamPatchInput(req.body ?? {}, teamAdminCfg);
+    if (!v.ok) {
+      res.status(400).json({ error: v.error });
+      return;
+    }
+    const expected = (req.body ?? {}).expectedUpdatedAtIso;
+    if (expected !== void 0 && expected !== existing.metadata?.updated_at_iso) {
+      res.status(409).json({
+        error: "This team was modified since you loaded it. Reload and re-apply your change."
+      });
+      return;
+    }
+    const payload = {
+      team_id: teamId,
+      ...v.value,
+      metadata: {
+        ...existing.metadata ?? {},
+        updated_by_backstage_user: actor,
+        updated_at_iso: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+    try {
+      const r = await client.updateTeam(payload);
+      logger.info({
+        action: "team.update",
+        actor,
+        teamId,
+        owningGroup
+      });
+      res.json(r);
+    } catch (err) {
+      sendTeamError(err, res);
+    }
+  });
+  router.delete("/teams/:teamId", async (req, res) => {
+    const authz = await authorizeTeamSubresource(
+      req,
+      res,
+      litellmTeamDeletePermission
+    );
+    if (!authz) return;
+    const { teamId, owningGroup, actor } = authz;
+    if (!teamAdminCfg.allowTeamDelete) {
+      res.status(403).json({
+        error: "Team deletion is disabled (set litellm.teamAdmin.allowTeamDelete: true). Block the team instead."
+      });
+      return;
+    }
+    const provisioningRefs = [
+      ...provisioningDefaults.teams,
+      ...roleConfigs.flatMap((r) => r.teams ?? [])
+    ];
+    const force = String(req.query.force ?? "") === "true";
+    if (provisioningRefs.includes(teamId) && !force) {
+      res.status(409).json({
+        error: `Team ${teamId} is referenced by litellm.provisioning config; deleting it will break user provisioning. Re-send with ?force=true to override.`
+      });
+      return;
+    }
+    try {
+      await client.deleteTeam(teamId);
+      logger.info({ action: "team.delete", actor, teamId, owningGroup, force });
+      res.json({ success: true });
+    } catch (err) {
+      sendTeamError(err, res);
+    }
+  });
+  router.get("/teams/managed", async (req, res) => {
+    if (!requireTeamMgmt(res)) return;
+    const check = await assertTeamAdmin({
+      req,
+      auth,
+      permissions,
+      catalogClient,
+      teamAdminGroup: teamAdminCfg.group,
+      permission: litellmTeamManagePermission,
+      logger
+    });
+    if (!check.ok) {
+      res.status(check.status).json({ error: check.error });
+      return;
+    }
+    try {
+      const all = await client.listTeams();
+      const owned = all.filter(
+        (t) => typeof t.metadata?.owning_group === "string" && t.metadata.owning_group === teamAdminCfg.group
+      );
+      res.json(owned);
+    } catch (err) {
+      sendTeamError(err, res);
+    }
+  });
+  async function authorizeTeamSubresource(req, res, permission) {
+    if (!requireTeamMgmt(res)) return null;
+    const check = await assertTeamAdmin({
+      req,
+      auth,
+      permissions,
+      catalogClient,
+      teamAdminGroup: teamAdminCfg.group,
+      permission,
+      logger
+    });
+    if (!check.ok) {
+      res.status(check.status).json({ error: check.error });
+      return null;
+    }
+    const { teamId } = req.params;
+    if (!teamId) {
+      res.status(400).json({ error: "teamId is required" });
+      return null;
+    }
+    let existing;
+    try {
+      existing = await client.getTeamInfo(teamId);
+    } catch (err) {
+      if (err instanceof LiteLLMUpstreamError && err.status === 404) {
+        res.status(404).json({ error: "Team not found" });
+        return null;
+      }
+      sendTeamError(err, res);
+      return null;
+    }
+    const owningGroup = typeof existing.metadata?.owning_group === "string" ? existing.metadata.owning_group : void 0;
+    if (!owningGroup) {
+      res.status(403).json({
+        error: "This team is not managed by Backstage team admins and cannot be edited here"
+      });
+      return null;
+    }
+    const owns = await isUserMemberOfGroup(
+      check.userEntityRef,
+      owningGroup,
+      catalogClient,
+      auth,
+      logger
+    );
+    if (!owns) {
+      res.status(403).json({ error: `Access denied: team is owned by ${owningGroup}` });
+      return null;
+    }
+    return { teamId, owningGroup, actor: check.userEntityRef, team: existing };
+  }
+  router.post(
+    "/teams/:teamId/members",
+    async (req, res) => {
+      const authz = await authorizeTeamSubresource(req, res, litellmTeamMembersManagePermission);
+      if (!authz) return;
+      const { teamId, owningGroup, actor } = authz;
+      const body = req.body ?? {};
+      const userEntityRef = (body.userEntityRef ?? "").trim();
+      if (!userEntityRef) {
+        res.status(400).json({ error: "userEntityRef is required" });
+        return;
+      }
+      if (body.role !== void 0 && body.role !== "user") {
+        res.status(400).json({
+          error: "only the 'user' team role can be assigned from Backstage"
+        });
+        return;
+      }
+      let maxBudgetInTeam;
+      if (body.maxBudgetInTeam !== void 0) {
+        if (typeof body.maxBudgetInTeam !== "number" || !Number.isFinite(body.maxBudgetInTeam) || body.maxBudgetInTeam <= 0) {
+          res.status(400).json({ error: "maxBudgetInTeam must be a positive number" });
+          return;
+        }
+        maxBudgetInTeam = body.maxBudgetInTeam;
+      }
+      try {
+        const { token } = await auth.getPluginRequestToken({
+          onBehalfOf: await auth.getOwnServiceCredentials(),
+          targetPluginId: "catalog"
+        });
+        const entity = await catalogClient.getEntityByRef(userEntityRef, {
+          token
+        });
+        if (!entity || entity.kind !== "User") {
+          res.status(400).json({
+            error: `${userEntityRef} is not a User in the Backstage catalog`
+          });
+          return;
+        }
+      } catch (err) {
+        logger.warn(
+          `Catalog lookup failed for ${userEntityRef}: ${err.message}`
+        );
+        res.status(400).json({
+          error: `Could not verify ${userEntityRef} in the Backstage catalog`
+        });
+        return;
+      }
+      const litellmUserId = toLiteLLMUserId(userEntityRef, userIdDomain);
+      try {
+        await getOrProvisionUser(
+          client,
+          userEntityRef,
+          litellmUserId,
+          provisioningEnabled,
+          provisioningDefaults,
+          roleConfigs,
+          catalogClient,
+          auth,
+          logger
+        );
+      } catch (err) {
+        if (err instanceof ProvisioningError) {
+          res.status(err.status).json(err.body);
+          return;
+        }
+        throw err;
+      }
+      try {
+        await client.teamMemberAdd({
+          team_id: teamId,
+          user_id: litellmUserId,
+          role: "user",
+          ...maxBudgetInTeam !== void 0 && {
+            max_budget_in_team: maxBudgetInTeam
+          }
+        });
+        logger.info({
+          action: "team.member.add",
+          actor,
+          teamId,
+          member: litellmUserId,
+          owningGroup
+        });
+        const updated = await client.getTeamInfo(teamId);
+        res.json(updated);
+      } catch (err) {
+        sendTeamError(err, res);
+      }
+    }
+  );
+  router.delete(
+    "/teams/:teamId/members",
+    async (req, res) => {
+      const authz = await authorizeTeamSubresource(req, res, litellmTeamMembersManagePermission);
+      if (!authz) return;
+      const { teamId, owningGroup, actor } = authz;
+      const userEntityRef = String(req.query.userEntityRef ?? "").trim();
+      if (!userEntityRef) {
+        res.status(400).json({ error: "userEntityRef query parameter is required" });
+        return;
+      }
+      const litellmUserId = toLiteLLMUserId(userEntityRef, userIdDomain);
+      try {
+        await client.teamMemberDelete({
+          team_id: teamId,
+          user_id: litellmUserId
+        });
+        logger.info({
+          action: "team.member.remove",
+          actor,
+          teamId,
+          member: litellmUserId,
+          owningGroup
+        });
+        const updated = await client.getTeamInfo(teamId);
+        res.json(updated);
+      } catch (err) {
+        sendTeamError(err, res);
+      }
+    }
+  );
+  router.get("/vector-stores", async (req, res) => {
+    if (!requireObjectPerms(res)) return;
+    const check = await assertTeamAdmin({
+      req,
+      auth,
+      permissions,
+      catalogClient,
+      teamAdminGroup: teamAdminCfg.group,
+      permission: litellmTeamKnowledgebaseManagePermission,
+      logger
+    });
+    if (!check.ok) {
+      res.status(check.status).json({ error: check.error });
+      return;
+    }
+    const allowed = new Set(teamAdminCfg.allowedVectorStores);
+    try {
+      const all = await client.listVectorStores();
+      res.json(all.filter((s) => allowed.has(s.id) || s.name && allowed.has(s.name)));
+    } catch (err) {
+      sendTeamError(err, res);
+    }
+  });
+  router.put(
+    "/teams/:teamId/knowledge-bases",
+    async (req, res) => {
+      if (!requireObjectPerms(res)) return;
+      const authz = await authorizeTeamSubresource(
+        req,
+        res,
+        litellmTeamKnowledgebaseManagePermission
+      );
+      if (!authz) return;
+      const { teamId, owningGroup, actor, team } = authz;
+      const requested = req.body?.vector_stores ?? [];
+      if (!Array.isArray(requested) || !requested.every((v) => typeof v === "string")) {
+        res.status(400).json({ error: "vector_stores must be an array of strings" });
+        return;
+      }
+      const allowed = new Set(teamAdminCfg.allowedVectorStores);
+      const offenders = requested.filter((v) => !allowed.has(v));
+      if (offenders.length) {
+        res.status(400).json({
+          error: `vector store(s) not in the allowed set for team admins: ${offenders.join(
+            ", "
+          )}`
+        });
+        return;
+      }
+      const objectPermission = {
+        ...team.object_permission ?? {},
+        vector_stores: requested
+      };
+      try {
+        const updated = await client.updateTeam({
+          team_id: teamId,
+          object_permission: objectPermission,
+          // /team/update replaces metadata wholesale — re-send the merged
+          // object so owning_group / created_* survive and the change is
+          // attributed.
+          metadata: {
+            ...team.metadata ?? {},
+            updated_by_backstage_user: actor,
+            updated_at_iso: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        });
+        logger.info({
+          action: "team.knowledgebase.set",
+          actor,
+          teamId,
+          owningGroup,
+          vector_stores: requested
+        });
+        res.json(updated);
+      } catch (err) {
+        sendTeamError(err, res);
+      }
+    }
+  );
+  router.get("/mcp-servers", async (req, res) => {
+    if (!requireObjectPerms(res)) return;
+    const check = await assertTeamAdmin({
+      req,
+      auth,
+      permissions,
+      catalogClient,
+      teamAdminGroup: teamAdminCfg.group,
+      permission: litellmTeamMcpManagePermission,
+      logger
+    });
+    if (!check.ok) {
+      res.status(check.status).json({ error: check.error });
+      return;
+    }
+    const allowed = new Set(teamAdminCfg.allowedMcpServers);
+    try {
+      const all = await client.listMcpServers();
+      res.json(all.filter((s) => allowed.has(s.id) || s.name && allowed.has(s.name)));
+    } catch (err) {
+      sendTeamError(err, res);
+    }
+  });
+  router.put(
+    "/teams/:teamId/mcp-servers",
+    async (req, res) => {
+      if (!requireObjectPerms(res)) return;
+      const authz = await authorizeTeamSubresource(
+        req,
+        res,
+        litellmTeamMcpManagePermission
+      );
+      if (!authz) return;
+      const { teamId, owningGroup, actor, team } = authz;
+      const requested = req.body?.mcp_servers ?? [];
+      if (!Array.isArray(requested) || !requested.every((v) => typeof v === "string")) {
+        res.status(400).json({ error: "mcp_servers must be an array of strings" });
+        return;
+      }
+      const allowed = new Set(teamAdminCfg.allowedMcpServers);
+      const offenders = requested.filter((v) => !allowed.has(v));
+      if (offenders.length) {
+        res.status(400).json({
+          error: `MCP server(s) not in the allowed set for team admins: ${offenders.join(
+            ", "
+          )}`
+        });
+        return;
+      }
+      const before = team.object_permission?.mcp_servers ?? [];
+      const objectPermission = {
+        ...team.object_permission ?? {},
+        mcp_servers: requested
+      };
+      try {
+        const updated = await client.updateTeam({
+          team_id: teamId,
+          object_permission: objectPermission,
+          // /team/update replaces metadata wholesale — re-send the merged
+          // object so owning_group / created_* survive and the change is
+          // attributed.
+          metadata: {
+            ...team.metadata ?? {},
+            updated_by_backstage_user: actor,
+            updated_at_iso: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        });
+        logger.info({
+          action: "team.mcp.set",
+          actor,
+          teamId,
+          owningGroup,
+          before,
+          after: requested
+        });
+        res.json(updated);
+      } catch (err) {
+        sendTeamError(err, res);
+      }
+    }
+  );
   router.get("/teams/:teamId/usage", async (req, res) => {
     try {
       const { teamId } = req.params;
@@ -11090,26 +11996,37 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
   LiteLLMClient,
   ProvisioningError,
   applyRoleOverrides,
+  assertTeamAdmin,
   bridgeGenerateKey,
   bridgeListKeys,
   createRouter,
   getOrProvisionUser,
   getOrProvisionUserFromClaims,
+  isTeamManagementEnabled,
   litellmAuditReadPermission,
   litellmKeyCreatePermission,
   litellmKeyManagePermission,
   litellmKeyRevokePermission,
   litellmPermissions,
   litellmPlugin,
+  litellmTeamCreatePermission,
+  litellmTeamDeletePermission,
+  litellmTeamKnowledgebaseManagePermission,
+  litellmTeamManagePermission,
+  litellmTeamMcpManagePermission,
+  litellmTeamMembersManagePermission,
   newDefaultVerifier,
   provisionUser,
   readBridgeConfig,
   readProvisioningDefaults,
   readRoleConfigs,
+  readTeamAdminConfig,
   resolveBridgeUserId,
   resolveUserId,
   resolveUserProfile,
   resolveUserRole,
-  toLiteLLMUserId
+  toLiteLLMUserId,
+  validateTeamPatchInput,
+  validateTeamWriteInput
 });
 //# sourceMappingURL=index.cjs.js.map