@magpie-community/opencode-kiro-auth 0.1.13 → 0.1.14

package/README.md

@@ -17,14 +17,21 @@ Power) and makes its requests, in OpenCode and in magpie. Provider id:
   - Builder ID and Identity Center come back with an AWS sign-in URL and
     region. The plugin registers a client with AWS's OIDC service, sends
     the browser to AWS, and trades the code AWS returns.
-  - The account is named by the email Kiro has for it (`Get-Usage-Limits`),
-    and its plan is read from the same call.
+  - The account is named by the email Kiro has for it (`Get-Usage-Limits`)
+    and the way it was signed in to: `email (Google)`, `email (GitHub)`,
+    `email (Builder ID)`, `email (IAM Identity Center)`, `email
+    (Internal)`. Its plan is read from the same call, and its usage names
+    it the same way.
   - Kiro keeps a Google, a GitHub, a Builder ID and an Identity Center
     sign-in of one email as different accounts. The sign-in carries a `uid`
     (`google`, `github`, `builderid`, `enterprise`), so magpie keeps each one
     beside the others, and a sign-in again the same way replaces only its
-    own account. An account signed in before 0.1.13 is given its `uid` on
-    its first request, model listing, usage read or renewal.
+    own account. An account signed in before 0.1.13 is given its `uid`,
+    and one named by its bare email before 0.1.14 its name, on its first
+    request, model listing, usage read or renewal. Until then, a sign-in
+    again the same way goes beside it rather than replacing it: magpie
+    matches a sign-in by its name, and the plugin can't see the other
+    accounts to match it by `uid`.
   - A company's own identity provider (`external_idp`) is not supported
     here. Sign in with `kiro-cli login` and use the next method instead.
 - **Kiro CLI's or Kiro IDE's sign-in**: uses the account kiro-cli is signed

package/index.mjs

@@ -56,6 +56,15 @@ const isBuilderID = (provider) => String(provider ?? "").toLowerCase() === "buil
 // keeps a sign-in of an email already signed in as that account unless
 // both have a uid and the two differ (#309). "" when it isn't known.
 const uidOf = (loginProvider) => String(loginProvider ?? "").trim().toLowerCase()
+// nameOf is what an account is called: its email and the way it was signed
+// in to, as Kiro's sign-in page names it, so two accounts of one email read
+// apart (#309; magpie names a plugin's account by its accountId). A way not
+// known, kiro-cli's or the Kiro IDE's sign-in among them, leaves the email
+// as it is, and magpie tells two such apart by their slot.
+const WAYS = { google: "Google", github: "GitHub", builderid: "Builder ID", enterprise: "IAM Identity Center", internal: "Internal" }
+const nameOf = (email, loginProvider) => (WAYS[uidOf(loginProvider)] ? `${email} (${WAYS[uidOf(loginProvider)]})` : email)
+// a bare email: what an account was called before nameOf
+const bareEmail = (id) => typeof id === "string" && /^[^\s()]+@[^\s()]+$/.test(id)
 
 const env = (k) => process.env[k] ?? ""
 const home = () => env("HOME") || homedir()
@@ -448,11 +457,17 @@ function account(client) {
   // sign-in with another way to the same email no longer replaces it
   const uidSaved = new Set()
   const uidField = (auth) => (!auth?.uid && uidOf(auth?.loginProvider) ? { uid: uidOf(auth.loginProvider) } : {})
+  // and one called by its bare email is given its name, the way it was
+  // signed in to with it
+  const nameField = (auth) =>
+    bareEmail(auth?.accountId) && nameOf(auth.accountId, auth.loginProvider) !== auth.accountId
+      ? { accountId: nameOf(auth.accountId, auth.loginProvider) } : {}
+  const idFields = (auth) => ({ ...uidField(auth), ...nameField(auth) })
   const save = async (auth, c) => {
     if (!c.own || !client?.auth?.set) return
     const { type: _t, ...rest } = auth
     await client.auth.set({ path: { id: ID }, body: { ...rest, type: "oauth", access: c.access, refresh: c.refresh, expires: c.expires,
-      profileArn: c.profile, region: c.region, ...uidField(auth) } }).catch(() => {})
+      profileArn: c.profile, region: c.region, ...idFields(auth) } }).catch(() => {})
   }
   const creds = (auth, stale = false) =>
     locked(async () => {
@@ -490,7 +505,7 @@ function account(client) {
         }
       }
       // once per token: a save that didn't take isn't tried on every request
-      if (!saved && c.own && uidField(auth).uid && !uidSaved.has(c.access)) {
+      if (!saved && c.own && Object.keys(idFields(auth)).length && !uidSaved.has(c.access)) {
         uidSaved.add(c.access)
         await save(auth, c)
       }
@@ -513,7 +528,7 @@ function account(client) {
       const out = { access: c.access, expires: c.expires }
       if (c.refresh !== auth.refresh) out.refresh = c.refresh
       if (c.profile && c.profile !== auth.profileArn) out.profileArn = c.profile
-      return { ...out, ...uidField(auth) }
+      return { ...out, ...idFields(auth) }
     })
   return creds
 }
@@ -1423,7 +1438,7 @@ async function browserSignIn() {
       return fail(e.message)
     }
     const who = await whoIs(c)
-    const user = who.email || "Kiro account"
+    const user = who.email ? nameOf(who.email, c.loginProvider) : "Kiro account"
     finish({ type: "success", provider: ID, refresh: c.refresh, access: c.access, expires: c.expires, accountId: user,
       ...(uidOf(c.loginProvider) ? { uid: uidOf(c.loginProvider) } : {}),
       method: c.method, loginProvider: c.loginProvider, region: c.region, profileArn: who.profile,
@@ -1515,7 +1530,10 @@ export async function KiroAuthPlugin({ client } = {}) {
         const auth = await getAuth()
         if (!(auth?.type === "api" && auth.key) && auth?.type !== "oauth") return { error: "not signed in", signIn: "kept" }
         try {
-          return { ...usageOf(await usageLimits(await creds(auth), true)), signIn: "kept" }
+          const u = usageOf(await usageLimits(await creds(auth), true))
+          // named as the account is
+          if (u.user && auth.type === "oauth" && !auth.source) u.user = nameOf(u.user, auth.loginProvider)
+          return { ...u, signIn: "kept" }
         } catch (e) {
           return { error: e.message, signIn: "kept" }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-kiro-auth",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Kiro subscriptions (Free, Pro, Pro+, Power) in OpenCode and magpie",
   "type": "module",
   "main": "./index.mjs",