@magpie-community/opencode-kiro-auth 0.1.12 → 0.1.14

package/README.md

@@ -17,8 +17,21 @@ Power) and makes its requests, in OpenCode and in magpie. Provider id:
   - Builder ID and Identity Center come back with an AWS sign-in URL and
     region. The plugin registers a client with AWS's OIDC service, sends
     the browser to AWS, and trades the code AWS returns.
-  - The account is named by the email Kiro has for it (`Get-Usage-Limits`),
-    and its plan is read from the same call.
+  - The account is named by the email Kiro has for it (`Get-Usage-Limits`)
+    and the way it was signed in to: `email (Google)`, `email (GitHub)`,
+    `email (Builder ID)`, `email (IAM Identity Center)`, `email
+    (Internal)`. Its plan is read from the same call, and its usage names
+    it the same way.
+  - Kiro keeps a Google, a GitHub, a Builder ID and an Identity Center
+    sign-in of one email as different accounts. The sign-in carries a `uid`
+    (`google`, `github`, `builderid`, `enterprise`), so magpie keeps each one
+    beside the others, and a sign-in again the same way replaces only its
+    own account. An account signed in before 0.1.13 is given its `uid`,
+    and one named by its bare email before 0.1.14 its name, on its first
+    request, model listing, usage read or renewal. Until then, a sign-in
+    again the same way goes beside it rather than replacing it: magpie
+    matches a sign-in by its name, and the plugin can't see the other
+    accounts to match it by `uid`.
   - A company's own identity provider (`external_idp`) is not supported
     here. Sign in with `kiro-cli login` and use the next method instead.
 - **Kiro CLI's or Kiro IDE's sign-in**: uses the account kiro-cli is signed

package/index.mjs

@@ -50,6 +50,21 @@ const SIGN_IN_TIMEOUT = 10 * 60 * 1000
 const BUILDER_ID_START = "https://view.awsapps.com/start"
 const BUILDER_ID_PROFILE = "arn:aws:codewhisperer:us-east-1:638616132270:profile/AAAACCCCXXXX"
 const isBuilderID = (provider) => String(provider ?? "").toLowerCase() === "builderid"
+// uidOf is what tells two Kiro accounts of one email apart: the way it was
+// signed in to. Kiro keeps a Google and a GitHub sign-in of one email (or
+// Builder ID's, or Identity Center's) as different accounts, and magpie
+// keeps a sign-in of an email already signed in as that account unless
+// both have a uid and the two differ (#309). "" when it isn't known.
+const uidOf = (loginProvider) => String(loginProvider ?? "").trim().toLowerCase()
+// nameOf is what an account is called: its email and the way it was signed
+// in to, as Kiro's sign-in page names it, so two accounts of one email read
+// apart (#309; magpie names a plugin's account by its accountId). A way not
+// known, kiro-cli's or the Kiro IDE's sign-in among them, leaves the email
+// as it is, and magpie tells two such apart by their slot.
+const WAYS = { google: "Google", github: "GitHub", builderid: "Builder ID", enterprise: "IAM Identity Center", internal: "Internal" }
+const nameOf = (email, loginProvider) => (WAYS[uidOf(loginProvider)] ? `${email} (${WAYS[uidOf(loginProvider)]})` : email)
+// a bare email: what an account was called before nameOf
+const bareEmail = (id) => typeof id === "string" && /^[^\s()]+@[^\s()]+$/.test(id)
 
 const env = (k) => process.env[k] ?? ""
 const home = () => env("HOME") || homedir()
@@ -438,11 +453,21 @@ function account(client) {
     lock = run.catch(() => {})
     return run
   }
+  // an account signed in here before its uid was kept is given it, so a
+  // sign-in with another way to the same email no longer replaces it
+  const uidSaved = new Set()
+  const uidField = (auth) => (!auth?.uid && uidOf(auth?.loginProvider) ? { uid: uidOf(auth.loginProvider) } : {})
+  // and one called by its bare email is given its name, the way it was
+  // signed in to with it
+  const nameField = (auth) =>
+    bareEmail(auth?.accountId) && nameOf(auth.accountId, auth.loginProvider) !== auth.accountId
+      ? { accountId: nameOf(auth.accountId, auth.loginProvider) } : {}
+  const idFields = (auth) => ({ ...uidField(auth), ...nameField(auth) })
   const save = async (auth, c) => {
     if (!c.own || !client?.auth?.set) return
     const { type: _t, ...rest } = auth
     await client.auth.set({ path: { id: ID }, body: { ...rest, type: "oauth", access: c.access, refresh: c.refresh, expires: c.expires,
-      profileArn: c.profile, region: c.region } }).catch(() => {})
+      profileArn: c.profile, region: c.region, ...idFields(auth) } }).catch(() => {})
   }
   const creds = (auth, stale = false) =>
     locked(async () => {
@@ -460,6 +485,7 @@ function account(client) {
       }
       read = newest(read)
       let c = held?.id === id ? held.c : null
+      let saved = false
       if (!c || read.access !== c.access || !fresh(c) || stale) {
         if (!read.profile && c && read.access === c.access) read.profile = c.profile
         if (stale && c && read.access !== c.access && fresh(read)) stale = false // the owner refreshed it already
@@ -468,11 +494,20 @@ function account(client) {
           if (c.method === "apikey") throw gone("Kiro turned down the API key saved on the provider")
           c = renewed(c, await refresh(c))
           await save(auth, c)
+          saved = true
         }
       }
       if (!c.profile) {
         c.profile = await profileOf(c)
-        if (!auth?.profileArn) await save(auth, c)
+        if (!auth?.profileArn && !saved) {
+          await save(auth, c)
+          saved = true
+        }
+      }
+      // once per token: a save that didn't take isn't tried on every request
+      if (!saved && c.own && Object.keys(idFields(auth)).length && !uidSaved.has(c.access)) {
+        uidSaved.add(c.access)
+        await save(auth, c)
       }
       held = { id, c }
       return { token: c.access, tokenType: tokenType(c), profile: c.profile, region: regionOf(c.profile, c.region) }
@@ -493,7 +528,7 @@ function account(client) {
       const out = { access: c.access, expires: c.expires }
       if (c.refresh !== auth.refresh) out.refresh = c.refresh
       if (c.profile && c.profile !== auth.profileArn) out.profileArn = c.profile
-      return out
+      return { ...out, ...idFields(auth) }
     })
   return creds
 }
@@ -1403,8 +1438,9 @@ async function browserSignIn() {
       return fail(e.message)
     }
     const who = await whoIs(c)
-    const user = who.email || "Kiro account"
+    const user = who.email ? nameOf(who.email, c.loginProvider) : "Kiro account"
     finish({ type: "success", provider: ID, refresh: c.refresh, access: c.access, expires: c.expires, accountId: user,
+      ...(uidOf(c.loginProvider) ? { uid: uidOf(c.loginProvider) } : {}),
       method: c.method, loginProvider: c.loginProvider, region: c.region, profileArn: who.profile,
       ...(c.clientId ? { clientId: c.clientId, clientSecret: c.clientSecret } : {}), ...(who.plan ? { plan: who.plan } : {}) })
     html(200, page(true, "You're signed in", `${user} is signed in. You can close this tab.`))
@@ -1494,7 +1530,10 @@ export async function KiroAuthPlugin({ client } = {}) {
         const auth = await getAuth()
         if (!(auth?.type === "api" && auth.key) && auth?.type !== "oauth") return { error: "not signed in", signIn: "kept" }
         try {
-          return { ...usageOf(await usageLimits(await creds(auth), true)), signIn: "kept" }
+          const u = usageOf(await usageLimits(await creds(auth), true))
+          // named as the account is
+          if (u.user && auth.type === "oauth" && !auth.source) u.user = nameOf(u.user, auth.loginProvider)
+          return { ...u, signIn: "kept" }
         } catch (e) {
           return { error: e.message, signIn: "kept" }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-kiro-auth",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Kiro subscriptions (Free, Pro, Pro+, Power) in OpenCode and magpie",
   "type": "module",
   "main": "./index.mjs",