feat: configs for self hosted backfill usage export gating (#609)

* feat: configs for self hosted backfill usage export gating

* updates

Author: kenvora

charts/langsmith/README.md

@@ -345,6 +345,7 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | config.observability.tracing.env | string | `"ls_self_hosted"` |  |
 | config.observability.tracing.exporter | string | `"http"` |  |
 | config.observability.tracing.useTls | bool | `true` |  |
+| config.orgAdminsInstallationUsageExportEnabled | bool | `false` | When true, any org admin can use the usage backfill export. |
 | config.personalOrgsDisabled | bool | `true` | Disable personal orgs. |
 | config.security | object | `{"cors":{"allowedOrigins":"*","allowedOriginsRegex":"","alwaysAllowPathsRegex":""}}` | Security configuration for CORS, headers, and other security-related settings. These settings control cross-origin access and help protect against common web vulnerabilities. |
 | config.security.cors | object | `{"allowedOrigins":"*","allowedOriginsRegex":"","alwaysAllowPathsRegex":""}` | CORS (Cross-Origin Resource Sharing) configuration. Controls which origins can make requests to the LangSmith API. By default, CORS is permissive. For production deployments, you should restrict this. |
@@ -354,6 +355,7 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | config.settings | object | `{"redisRunsExpirySeconds":"21600"}` | Application Settings. These are used to tune the application |
 | config.settings.redisRunsExpirySeconds | string | `"21600"` | Optional. Be very careful when lowering this value as it can result in runs being lost if your queue is down/not processing items fast enough. |
 | config.skipValidation | bool | `false` | Skip validation checks in validate.yaml. Used by AWS Marketplace for helm template verification. |
+| config.superAdmins | list | `[]` | Email addresses of super admins who can export usage data. These are the only users allowed to use the usage backfill export unless orgAdminsInstallationUsageExportEnabled is set. |
 | config.telemetry.logs | bool | `true` | Optional. These values are used to send telemetry to the LangChain team to assist with troubleshooting. |
 | config.telemetry.metrics | bool | `true` |  |
 | config.telemetry.traces | bool | `true` |  |

charts/langsmith/templates/config-map.yaml

@@ -62,6 +62,11 @@ data:
   FF_USE_PG_FOR_FEEDBACK_CONFIGS_FETCH_ENABLED_ALL: "true"
   FF_USE_PG_FOR_FEEDBACK_FETCH_ENABLED_ALL: "true"
   IS_SELF_HOSTED: "true"
+  # Usage backfill export gating
+  {{- if .Values.config.superAdmins }}
+  USAGE_EXPORT_ADMIN_EMAILS: {{ .Values.config.superAdmins | toJson | quote }}
+  {{- end }}
+  ORG_ADMINS_INSTALLATION_USAGE_EXPORT_ENABLED: {{ .Values.config.orgAdminsInstallationUsageExportEnabled | quote }}
   # Security - CORS configuration
   {{- if .Values.config.security.cors.allowedOriginsRegex }}
   CORS_ALLOWED_ORIGINS_REGEX: {{ .Values.config.security.cors.allowedOriginsRegex | quote }}

charts/langsmith/values.yaml

@@ -199,6 +199,13 @@ config:
     # Either set the password and JWT secret in plaintext, or set in the secret specified by existingSecretName above.
     initialOrgAdminPassword: ""
     jwtSecret: ""
+  # -- Email addresses of super admins who can export usage data.
+  # These are the only users allowed to use the usage backfill export
+  # unless orgAdminsInstallationUsageExportEnabled is set.
+  superAdmins: []
+  # -- When true, any org admin can use the usage backfill export.
+  orgAdminsInstallationUsageExportEnabled: false
+
   # -- Prevent organization creation by users. This includes admins.
   userOrgCreationDisabled: true
   # -- Disable personal orgs.