@magpie-community/opencode-kiro-auth 0.1.13 → 0.1.15

package/README.md

@@ -17,14 +17,21 @@ Power) and makes its requests, in OpenCode and in magpie. Provider id:
   - Builder ID and Identity Center come back with an AWS sign-in URL and
     region. The plugin registers a client with AWS's OIDC service, sends
     the browser to AWS, and trades the code AWS returns.
-  - The account is named by the email Kiro has for it (`Get-Usage-Limits`),
-    and its plan is read from the same call.
+  - The account is named by the email Kiro has for it (`Get-Usage-Limits`)
+    and the way it was signed in to: `email (Google)`, `email (GitHub)`,
+    `email (Builder ID)`, `email (IAM Identity Center)`, `email
+    (Internal)`. Its plan is read from the same call, and its usage names
+    it the same way.
   - Kiro keeps a Google, a GitHub, a Builder ID and an Identity Center
     sign-in of one email as different accounts. The sign-in carries a `uid`
     (`google`, `github`, `builderid`, `enterprise`), so magpie keeps each one
     beside the others, and a sign-in again the same way replaces only its
-    own account. An account signed in before 0.1.13 is given its `uid` on
-    its first request, model listing, usage read or renewal.
+    own account. An account signed in before 0.1.13 is given its `uid`,
+    and one named by its bare email before 0.1.14 its name, on its first
+    request, model listing, usage read or renewal. Until then, a sign-in
+    again the same way goes beside it rather than replacing it: magpie
+    matches a sign-in by its name, and the plugin can't see the other
+    accounts to match it by `uid`.
   - A company's own identity provider (`external_idp`) is not supported
     here. Sign in with `kiro-cli login` and use the next method instead.
 - **Kiro CLI's or Kiro IDE's sign-in**: uses the account kiro-cli is signed
@@ -39,8 +46,12 @@ Power) and makes its requests, in OpenCode and in magpie. Provider id:
   kiro-cli refreshes its own token first (`kiro-cli debug refresh-auth-token`).
   A token the plugin refreshes itself is written back, so kiro-cli and the
   IDE go on with it.
-- **Kiro API key (`ksk_…`)**: sent with `tokentype: API_KEY`. Its profile is
-  found with `GetProfile`.
+- **Kiro API key (`ksk_…`)**: sent with `tokentype: API_KEY`, as kiro-cli
+  sends it. `GetProfile` is asked in us-east-1, then eu-central-1, for the
+  region the key's profile is in; a key it finds none for is used in
+  us-east-1, as kiro-cli uses it. Its models are listed with the control
+  plane's `ListAvailableModels` and its credits with `GetUsageLimits`, and
+  no profile is named in its calls, as kiro-cli names none.
 
 A browser sign-in is kept where OpenCode keeps sign-ins (`auth.json`; in
 magpie, `plugin-auth.json`) as an `oauth` entry. The entry holds the

package/index.mjs

@@ -56,6 +56,15 @@ const isBuilderID = (provider) => String(provider ?? "").toLowerCase() === "buil
 // keeps a sign-in of an email already signed in as that account unless
 // both have a uid and the two differ (#309). "" when it isn't known.
 const uidOf = (loginProvider) => String(loginProvider ?? "").trim().toLowerCase()
+// nameOf is what an account is called: its email and the way it was signed
+// in to, as Kiro's sign-in page names it, so two accounts of one email read
+// apart (#309; magpie names a plugin's account by its accountId). A way not
+// known, kiro-cli's or the Kiro IDE's sign-in among them, leaves the email
+// as it is, and magpie tells two such apart by their slot.
+const WAYS = { google: "Google", github: "GitHub", builderid: "Builder ID", enterprise: "IAM Identity Center", internal: "Internal" }
+const nameOf = (email, loginProvider) => (WAYS[uidOf(loginProvider)] ? `${email} (${WAYS[uidOf(loginProvider)]})` : email)
+// a bare email: what an account was called before nameOf
+const bareEmail = (id) => typeof id === "string" && /^[^\s()]+@[^\s()]+$/.test(id)
 
 const env = (k) => process.env[k] ?? ""
 const home = () => env("HOME") || homedir()
@@ -324,25 +333,48 @@ async function managementCall(region, a, method, query, body) {
   return JSON.parse(text)
 }
 
-// profileOf finds the profile a sign-in that doesn't name one uses: an API
-// key's own, Builder ID's, or the first Kiro lists in either of its regions.
-async function profileOf(c) {
-  if (c.method === "apikey") {
-    const res = await fetch(management("us-east-1") + "/", {
-      method: "POST",
-      headers: { ...authHeaders({ token: c.access, tokenType: "API_KEY" }), "Content-Type": "application/x-amz-json-1.0",
-        "X-Amz-Target": "AmazonCodeWhispererService.GetProfile" },
-      body: "{}",
-      signal: AbortSignal.timeout(20_000),
-    })
-    if (!res.ok) {
-      const msg = `Kiro didn't take the API key: ${res.status} ${STATUS_TEXT[res.status] ?? ""}`.trimEnd()
-      throw res.status === 401 || res.status === 403 ? gone(msg) : new Error(msg)
-    }
-    const arn = (await res.json().catch(() => null))?.profile?.arn
-    if (!arn) throw new Error("Kiro didn't say which profile the API key is for")
-    return arn
+// controlCall is one of Kiro's management operations as kiro-cli sends it
+// for an API key: AWS JSON 1.0, the operation named in X-Amz-Target, POSTed
+// to the endpoint's root (with ?origin=KIRO_CLI where kiro-cli adds it).
+async function controlCall(region, a, target, body, query) {
+  const res = await fetch(management(region) + "/" + (query ? "?" + new URLSearchParams(query) : ""), {
+    method: "POST",
+    headers: { ...authHeaders(a), "Content-Type": "application/x-amz-json-1.0", "X-Amz-Target": target,
+      "x-amzn-codewhisperer-optout": "false" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(20_000),
+  })
+  const text = await res.text()
+  if (!res.ok) throw new KiroError(res.status, text)
+  return JSON.parse(text)
+}
+
+// KEY_REGIONS are where kiro-cli asks GetProfile for an API key's profile,
+// in its order (the GovCloud and ISO ones after them aren't Kiro's
+// subscriptions).
+const KEY_REGIONS = ["us-east-1", "eu-central-1"]
+
+// keyProfile is an API key's profile, as kiro-cli finds it: GetProfile in
+// each region until one answers with a profile. kiro-cli goes on without
+// one when every region turns it down (a key from an account with no
+// CodeWhisperer profile answers 400), and so does this: "" then, and the
+// key's calls are made in us-east-1 without a profile, as kiro-cli makes
+// them (Hollowhere, on magpie's Discord: a key kiro-cli 2.33.1 served
+// failed every request here with "Kiro didn't take the API key: 400").
+async function keyProfile(c) {
+  for (const region of KEY_REGIONS) {
+    try {
+      const arn = (await controlCall(region, { token: c.access, tokenType: "API_KEY" }, "AmazonCodeWhispererService.GetProfile", {}))
+        ?.profile?.arn
+      if (arn) return arn
+    } catch {}
   }
+  return ""
+}
+
+// profileOf finds the profile a sign-in that doesn't name one uses:
+// Builder ID's, or the first Kiro lists in either of its regions.
+async function profileOf(c) {
   if (c.builderID) return BUILDER_ID_PROFILE
   let last
   for (const region of ["us-east-1", "eu-central-1"]) {
@@ -361,6 +393,8 @@ async function profileOf(c) {
 
 // usageLimits is Get-Usage-Limits: the plan, the account's email, credits.
 function usageLimits(a, email) {
+  // an API key's, as kiro-cli asks for it: no profile, no email asked
+  if (a.tokenType === "API_KEY") return controlCall(a.region, a, "AmazonCodeWhispererService.GetUsageLimits", { origin: "KIRO_CLI" }, { origin: "KIRO_CLI" })
   return managementCall(a.region, a, "Get-Usage-Limits",
     { origin: "KIRO_CLI", profileArn: a.profile, resourceType: "CREDIT", isEmailRequired: String(email) })
 }
@@ -448,11 +482,17 @@ function account(client) {
   // sign-in with another way to the same email no longer replaces it
   const uidSaved = new Set()
   const uidField = (auth) => (!auth?.uid && uidOf(auth?.loginProvider) ? { uid: uidOf(auth.loginProvider) } : {})
+  // and one called by its bare email is given its name, the way it was
+  // signed in to with it
+  const nameField = (auth) =>
+    bareEmail(auth?.accountId) && nameOf(auth.accountId, auth.loginProvider) !== auth.accountId
+      ? { accountId: nameOf(auth.accountId, auth.loginProvider) } : {}
+  const idFields = (auth) => ({ ...uidField(auth), ...nameField(auth) })
   const save = async (auth, c) => {
     if (!c.own || !client?.auth?.set) return
     const { type: _t, ...rest } = auth
     await client.auth.set({ path: { id: ID }, body: { ...rest, type: "oauth", access: c.access, refresh: c.refresh, expires: c.expires,
-      profileArn: c.profile, region: c.region, ...uidField(auth) } }).catch(() => {})
+      profileArn: c.profile, region: c.region, ...idFields(auth) } }).catch(() => {})
   }
   const creds = (auth, stale = false) =>
     locked(async () => {
@@ -482,7 +522,12 @@ function account(client) {
           saved = true
         }
       }
-      if (!c.profile) {
+      if (c.method === "apikey") {
+        if (!c.asked) {
+          c.profile = await keyProfile(c)
+          c.asked = true
+        }
+      } else if (!c.profile) {
         c.profile = await profileOf(c)
         if (!auth?.profileArn && !saved) {
           await save(auth, c)
@@ -490,12 +535,15 @@ function account(client) {
         }
       }
       // once per token: a save that didn't take isn't tried on every request
-      if (!saved && c.own && uidField(auth).uid && !uidSaved.has(c.access)) {
+      if (!saved && c.own && Object.keys(idFields(auth)).length && !uidSaved.has(c.access)) {
         uidSaved.add(c.access)
         await save(auth, c)
       }
       held = { id, c }
-      return { token: c.access, tokenType: tokenType(c), profile: c.profile, region: regionOf(c.profile, c.region) }
+      // kiro-cli names no profile in an API key's calls, even one GetProfile
+      // found; the profile only says the key's region
+      const profile = c.method === "apikey" ? "" : c.profile
+      return { token: c.access, tokenType: tokenType(c), profile, region: regionOf(c.profile, c.region) }
     })
   // renew is auth.refresh's: a sign-in kept here (not kiro-cli's or the
   // IDE's, which their owners keep) renewed under the same lock as the
@@ -513,7 +561,7 @@ function account(client) {
       const out = { access: c.access, expires: c.expires }
       if (c.refresh !== auth.refresh) out.refresh = c.refresh
       if (c.profile && c.profile !== auth.profileArn) out.profileArn = c.profile
-      return { ...out, ...uidField(auth) }
+      return { ...out, ...idFields(auth) }
     })
   return creds
 }
@@ -569,9 +617,25 @@ function runtimeModel(m) {
 // picks a model for each request.
 const MODELS = [{ id: "auto", name: "Auto" }]
 
+// keyModels is an API key's list, asked as kiro-cli asks it: Kiro's
+// control plane's ListAvailableModels, with no profile, each page.
+async function keyModels(a) {
+  const out = { models: [] }
+  let next
+  for (let i = 0; i < 20; i++) {
+    const page = await controlCall(a.region, a, "KiroControlPlaneBearerService.ListAvailableModels",
+      { origin: "KIRO_CLI", ...(next ? { nextToken: next } : {}) }, { origin: "KIRO_CLI" })
+    out.models.push(...(page?.models ?? []))
+    out.defaultModel ??= page?.defaultModel
+    next = page?.nextToken
+    if (!next) break
+  }
+  return out
+}
+
 // listModels is List-Available-Models, the default first.
 async function listModels(a) {
-  const out = await managementCall(a.region, a, "List-Available-Models", { origin: "KIRO_CLI", profileArn: a.profile })
+  const out = a.tokenType === "API_KEY" ? await keyModels(a) : await managementCall(a.region, a, "List-Available-Models", { origin: "KIRO_CLI", profileArn: a.profile })
   const list = []
   for (const m of out?.models ?? []) {
     if (!m?.modelId) continue
@@ -1423,7 +1487,7 @@ async function browserSignIn() {
       return fail(e.message)
     }
     const who = await whoIs(c)
-    const user = who.email || "Kiro account"
+    const user = who.email ? nameOf(who.email, c.loginProvider) : "Kiro account"
     finish({ type: "success", provider: ID, refresh: c.refresh, access: c.access, expires: c.expires, accountId: user,
       ...(uidOf(c.loginProvider) ? { uid: uidOf(c.loginProvider) } : {}),
       method: c.method, loginProvider: c.loginProvider, region: c.region, profileArn: who.profile,
@@ -1515,7 +1579,10 @@ export async function KiroAuthPlugin({ client } = {}) {
         const auth = await getAuth()
         if (!(auth?.type === "api" && auth.key) && auth?.type !== "oauth") return { error: "not signed in", signIn: "kept" }
         try {
-          return { ...usageOf(await usageLimits(await creds(auth), true)), signIn: "kept" }
+          const u = usageOf(await usageLimits(await creds(auth), true))
+          // named as the account is
+          if (u.user && auth.type === "oauth" && !auth.source) u.user = nameOf(u.user, auth.loginProvider)
+          return { ...u, signIn: "kept" }
         } catch (e) {
           return { error: e.message, signIn: "kept" }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-kiro-auth",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Kiro subscriptions (Free, Pro, Pro+, Power) in OpenCode and magpie",
   "type": "module",
   "main": "./index.mjs",