@magpie-community/opencode-kiro-auth 0.1.12 → 0.1.13

package/README.md

@@ -19,6 +19,12 @@ Power) and makes its requests, in OpenCode and in magpie. Provider id:
     the browser to AWS, and trades the code AWS returns.
   - The account is named by the email Kiro has for it (`Get-Usage-Limits`),
     and its plan is read from the same call.
+  - Kiro keeps a Google, a GitHub, a Builder ID and an Identity Center
+    sign-in of one email as different accounts. The sign-in carries a `uid`
+    (`google`, `github`, `builderid`, `enterprise`), so magpie keeps each one
+    beside the others, and a sign-in again the same way replaces only its
+    own account. An account signed in before 0.1.13 is given its `uid` on
+    its first request, model listing, usage read or renewal.
   - A company's own identity provider (`external_idp`) is not supported
     here. Sign in with `kiro-cli login` and use the next method instead.
 - **Kiro CLI's or Kiro IDE's sign-in**: uses the account kiro-cli is signed

package/index.mjs

@@ -50,6 +50,12 @@ const SIGN_IN_TIMEOUT = 10 * 60 * 1000
 const BUILDER_ID_START = "https://view.awsapps.com/start"
 const BUILDER_ID_PROFILE = "arn:aws:codewhisperer:us-east-1:638616132270:profile/AAAACCCCXXXX"
 const isBuilderID = (provider) => String(provider ?? "").toLowerCase() === "builderid"
+// uidOf is what tells two Kiro accounts of one email apart: the way it was
+// signed in to. Kiro keeps a Google and a GitHub sign-in of one email (or
+// Builder ID's, or Identity Center's) as different accounts, and magpie
+// keeps a sign-in of an email already signed in as that account unless
+// both have a uid and the two differ (#309). "" when it isn't known.
+const uidOf = (loginProvider) => String(loginProvider ?? "").trim().toLowerCase()
 
 const env = (k) => process.env[k] ?? ""
 const home = () => env("HOME") || homedir()
@@ -438,11 +444,15 @@ function account(client) {
     lock = run.catch(() => {})
     return run
   }
+  // an account signed in here before its uid was kept is given it, so a
+  // sign-in with another way to the same email no longer replaces it
+  const uidSaved = new Set()
+  const uidField = (auth) => (!auth?.uid && uidOf(auth?.loginProvider) ? { uid: uidOf(auth.loginProvider) } : {})
   const save = async (auth, c) => {
     if (!c.own || !client?.auth?.set) return
     const { type: _t, ...rest } = auth
     await client.auth.set({ path: { id: ID }, body: { ...rest, type: "oauth", access: c.access, refresh: c.refresh, expires: c.expires,
-      profileArn: c.profile, region: c.region } }).catch(() => {})
+      profileArn: c.profile, region: c.region, ...uidField(auth) } }).catch(() => {})
   }
   const creds = (auth, stale = false) =>
     locked(async () => {
@@ -460,6 +470,7 @@ function account(client) {
       }
       read = newest(read)
       let c = held?.id === id ? held.c : null
+      let saved = false
       if (!c || read.access !== c.access || !fresh(c) || stale) {
         if (!read.profile && c && read.access === c.access) read.profile = c.profile
         if (stale && c && read.access !== c.access && fresh(read)) stale = false // the owner refreshed it already
@@ -468,11 +479,20 @@ function account(client) {
           if (c.method === "apikey") throw gone("Kiro turned down the API key saved on the provider")
           c = renewed(c, await refresh(c))
           await save(auth, c)
+          saved = true
         }
       }
       if (!c.profile) {
         c.profile = await profileOf(c)
-        if (!auth?.profileArn) await save(auth, c)
+        if (!auth?.profileArn && !saved) {
+          await save(auth, c)
+          saved = true
+        }
+      }
+      // once per token: a save that didn't take isn't tried on every request
+      if (!saved && c.own && uidField(auth).uid && !uidSaved.has(c.access)) {
+        uidSaved.add(c.access)
+        await save(auth, c)
       }
       held = { id, c }
       return { token: c.access, tokenType: tokenType(c), profile: c.profile, region: regionOf(c.profile, c.region) }
@@ -493,7 +513,7 @@ function account(client) {
       const out = { access: c.access, expires: c.expires }
       if (c.refresh !== auth.refresh) out.refresh = c.refresh
       if (c.profile && c.profile !== auth.profileArn) out.profileArn = c.profile
-      return out
+      return { ...out, ...uidField(auth) }
     })
   return creds
 }
@@ -1405,6 +1425,7 @@ async function browserSignIn() {
     const who = await whoIs(c)
     const user = who.email || "Kiro account"
     finish({ type: "success", provider: ID, refresh: c.refresh, access: c.access, expires: c.expires, accountId: user,
+      ...(uidOf(c.loginProvider) ? { uid: uidOf(c.loginProvider) } : {}),
       method: c.method, loginProvider: c.loginProvider, region: c.region, profileArn: who.profile,
       ...(c.clientId ? { clientId: c.clientId, clientSecret: c.clientSecret } : {}), ...(who.plan ? { plan: who.plan } : {}) })
     html(200, page(true, "You're signed in", `${user} is signed in. You can close this tab.`))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-kiro-auth",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Kiro subscriptions (Free, Pro, Pro+, Power) in OpenCode and magpie",
   "type": "module",
   "main": "./index.mjs",