@sunerpy/opencode-kiro-auth 0.1.0

package/dist/core/auth/auth-handler.js

@@ -0,0 +1,236 @@
+import { RegionSchema } from '../../plugin/config/schema.js';
+import * as logger from '../../plugin/logger.js';
+import { IdcAuthMethod } from './idc-auth-method.js';
+export class AuthHandler {
+    config;
+    repository;
+    accountManager;
+    constructor(config, repository) {
+        this.config = config;
+        this.repository = repository;
+    }
+    async initialize(showToast) {
+        const { syncFromKiroCli } = await import('../../plugin/sync/kiro-cli.js');
+        logger.log('Auth init', { autoSyncKiroCli: !!this.config.auto_sync_kiro_cli });
+        if (this.config.auto_sync_kiro_cli) {
+            logger.log('Kiro CLI sync: start');
+            await syncFromKiroCli();
+            this.repository.invalidateCache();
+            const accounts = await this.repository.findAll();
+            if (this.accountManager) {
+                for (const a of accounts)
+                    this.accountManager.addAccount(a);
+            }
+            logger.log('Kiro CLI sync: done', { importedAccounts: accounts.length });
+        }
+        this.logUsageSummary(showToast);
+    }
+    logUsageSummary(showToast) {
+        if (!this.accountManager)
+            return;
+        const accounts = this.accountManager.getAccounts();
+        if (!accounts.length)
+            return;
+        for (const acc of accounts) {
+            const used = acc.usedCount ?? 0;
+            const limit = acc.limitCount ?? 0;
+            if (limit > 0) {
+                const pct = Math.round((used / limit) * 100);
+                const msg = `Kiro usage (${acc.email}): ${used}/${limit} (${pct}%)`;
+                logger.log(msg);
+                if (showToast) {
+                    const variant = pct >= 90 ? 'warning' : 'info';
+                    setTimeout(() => showToast(msg, variant), 3000);
+                }
+            }
+            else if (used > 0) {
+                const msg = `Kiro usage (${acc.email}): ${used} requests used`;
+                logger.log(msg);
+                if (showToast)
+                    setTimeout(() => showToast(msg, 'info'), 3000);
+            }
+        }
+    }
+    setAccountManager(am) {
+        this.accountManager = am;
+    }
+    /** Summarize stored accounts for a label; guards limit=0 divide-by-zero. */
+    buildUsageSummary(accounts) {
+        if (!accounts.length)
+            return '';
+        const CAP = 3;
+        const parts = accounts.slice(0, CAP).map((acc) => {
+            const email = acc.email || 'unknown';
+            const used = acc.usedCount ?? 0;
+            const limit = acc.limitCount ?? 0;
+            if (limit > 0) {
+                const pct = Math.round((used / limit) * 100);
+                return `${email} ${used}/${limit} (${pct}%)`;
+            }
+            return `${email} ${used} used`;
+        });
+        const remaining = accounts.length - Math.min(accounts.length, CAP);
+        const body = remaining > 0 ? `${parts.join(' · ')} +${remaining} more` : parts.join(' · ');
+        return `[current: ${body}]`;
+    }
+    /** Format a single account as a select-option label for the remove flow. */
+    formatAccountOption(acc) {
+        const email = acc.email || 'unknown';
+        const used = acc.usedCount ?? 0;
+        const limit = acc.limitCount ?? 0;
+        const region = acc.region || 'unknown-region';
+        const health = acc.isHealthy ? 'healthy' : 'unhealthy';
+        return `${email} — ${used}/${limit} (${region}, ${health})`;
+    }
+    getMethods() {
+        if (!this.accountManager) {
+            return [];
+        }
+        const currentAccounts = this.accountManager.getAccounts?.() ?? [];
+        const usageSummary = this.buildUsageSummary(currentAccounts);
+        const firstLabelBase = 'Add account · AWS Builder ID / IAM Identity Center';
+        const firstLabel = usageSummary ? `${firstLabelBase}  ${usageSummary}` : firstLabelBase;
+        const idcMethod = new IdcAuthMethod(this.config, this.repository, this.accountManager);
+        const configStartUrl = this.config.idc_start_url;
+        const configRegion = this.config.idc_region;
+        const methods = [
+            {
+                label: firstLabel,
+                type: 'oauth',
+                prompts: [
+                    {
+                        type: 'text',
+                        key: 'start_url',
+                        message: configStartUrl
+                            ? `IAM Identity Center Start URL (current: ${configStartUrl}, leave blank to keep)`
+                            : 'IAM Identity Center Start URL (leave blank for AWS Builder ID)',
+                        placeholder: 'https://your-company.awsapps.com/start',
+                        validate: (value) => {
+                            if (!value)
+                                return undefined;
+                            try {
+                                new URL(value);
+                                return undefined;
+                            }
+                            catch {
+                                return 'Please enter a valid URL';
+                            }
+                        }
+                    },
+                    {
+                        type: 'text',
+                        key: 'idc_region',
+                        message: configRegion && configRegion !== 'us-east-1'
+                            ? `IAM Identity Center region (sso_region) (current: ${configRegion}, leave blank to keep)`
+                            : 'IAM Identity Center region (sso_region) (leave blank for us-east-1)',
+                        placeholder: 'us-east-1',
+                        validate: (value) => {
+                            if (!value)
+                                return undefined;
+                            return RegionSchema.safeParse(value.trim()).success
+                                ? undefined
+                                : 'Please enter a valid AWS region';
+                        }
+                    }
+                ],
+                authorize: (inputs) => idcMethod.authorize(inputs)
+            },
+            {
+                label: 'Add account · IAM Identity Center (with Profile ARN)',
+                type: 'oauth',
+                prompts: [
+                    {
+                        type: 'text',
+                        key: 'start_url',
+                        message: configStartUrl
+                            ? `IAM Identity Center Start URL (current: ${configStartUrl}, leave blank to keep)`
+                            : 'IAM Identity Center Start URL (leave blank for AWS Builder ID)',
+                        placeholder: 'https://your-company.awsapps.com/start',
+                        validate: (value) => {
+                            if (!value)
+                                return undefined;
+                            try {
+                                new URL(value);
+                                return undefined;
+                            }
+                            catch {
+                                return 'Please enter a valid URL';
+                            }
+                        }
+                    },
+                    {
+                        type: 'text',
+                        key: 'idc_region',
+                        message: configRegion && configRegion !== 'us-east-1'
+                            ? `IAM Identity Center region (sso_region) (current: ${configRegion}, leave blank to keep)`
+                            : 'IAM Identity Center region (sso_region) (leave blank for us-east-1)',
+                        placeholder: 'us-east-1',
+                        validate: (value) => {
+                            if (!value)
+                                return undefined;
+                            return RegionSchema.safeParse(value.trim()).success
+                                ? undefined
+                                : 'Please enter a valid AWS region';
+                        }
+                    },
+                    {
+                        type: 'text',
+                        key: 'profile_arn',
+                        message: this.config.idc_profile_arn
+                            ? `Profile ARN (current: ${this.config.idc_profile_arn}, leave blank to keep)`
+                            : 'Profile ARN (e.g. arn:aws:codewhisperer:eu-central-1:428597928572:profile/HE7XVERQ9VXW)',
+                        placeholder: 'arn:aws:codewhisperer:us-east-1:123456789012:profile/XXXXXXXXXX',
+                        validate: (value) => {
+                            if (!value && this.config.idc_profile_arn)
+                                return undefined;
+                            if (!value)
+                                return 'Profile ARN is required for this method';
+                            return value.startsWith('arn:aws:codewhisperer:') ||
+                                value.startsWith('arn:aws:qdeveloper:')
+                                ? undefined
+                                : 'Please enter a valid CodeWhisperer or Q Developer profile ARN';
+                        }
+                    }
+                ],
+                authorize: (inputs) => idcMethod.authorize(inputs)
+            }
+        ];
+        const count = currentAccounts.length;
+        const removeLabel = count > 0 ? `Remove account · ${count} stored` : 'Remove account · none stored';
+        const removeOptions = currentAccounts.map((acc) => ({
+            label: this.formatAccountOption(acc),
+            value: String(acc.id)
+        }));
+        removeOptions.push({ label: 'Cancel', value: '__cancel__' });
+        methods.push({
+            label: removeLabel,
+            type: 'api',
+            prompts: [
+                {
+                    type: 'select',
+                    key: 'account_id',
+                    message: 'Select the account to remove',
+                    options: removeOptions
+                }
+            ],
+            authorize: async (inputs) => {
+                const accountId = inputs?.account_id;
+                if (!accountId || accountId === '__cancel__') {
+                    logger.log('Remove Kiro account: cancelled (no-op)');
+                    return { type: 'failed' };
+                }
+                const target = currentAccounts.find((acc) => String(acc.id) === accountId);
+                if (!target) {
+                    logger.warn('Remove Kiro account: id not found', { accountId });
+                    return { type: 'failed' };
+                }
+                this.accountManager.removeAccount(target);
+                logger.log('Removed Kiro account', { email: target.email, accountId });
+                // Return 'failed' after the deletion side-effect: 'success' would make
+                // OpenCode persist a bogus auth.json credential for a removal action.
+                return { type: 'failed' };
+            }
+        });
+        return methods;
+    }
+}

package/dist/core/auth/idc-auth-method.d.ts

@@ -0,0 +1,9 @@
+import type { AuthOuathResult } from '@opencode-ai/plugin';
+import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
+export declare class IdcAuthMethod {
+    private config;
+    private repository;
+    private accountManager;
+    constructor(config: any, repository: AccountRepository, accountManager: any);
+    authorize(inputs?: Record<string, string>): Promise<AuthOuathResult>;
+}

package/dist/core/auth/idc-auth-method.js

@@ -0,0 +1,169 @@
+import { exec } from 'node:child_process';
+import { extractRegionFromArn, normalizeRegion } from '../../constants.js';
+import { authorizeKiroIDC, pollKiroIDCToken } from '../../kiro/oauth-idc.js';
+import { createDeterministicAccountId } from '../../plugin/accounts.js';
+import * as logger from '../../plugin/logger.js';
+import { makePlaceholderEmail } from '../../plugin/sync/kiro-cli-parser.js';
+import { readActiveProfileArnFromKiroCli } from '../../plugin/sync/kiro-cli-profile.js';
+import { fetchUsageLimits } from '../../plugin/usage.js';
+const openBrowser = (url) => {
+    const escapedUrl = url.replace(/"/g, '\\"');
+    const platform = process.platform;
+    const cmd = platform === 'win32'
+        ? `cmd /c start "" "${escapedUrl}"`
+        : platform === 'darwin'
+            ? `open "${escapedUrl}"`
+            : `xdg-open "${escapedUrl}"`;
+    exec(cmd, (error) => {
+        if (error)
+            logger.warn(`Browser error: ${error.message}`);
+    });
+};
+function normalizeStartUrl(raw) {
+    if (!raw)
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return undefined;
+    const url = new URL(trimmed);
+    url.hash = '';
+    url.search = '';
+    // Normalize common portal URL shapes to end in `/start` (AWS Builder ID and IAM Identity Center)
+    if (url.pathname.endsWith('/start/'))
+        url.pathname = url.pathname.replace(/\/start\/$/, '/start');
+    if (!url.pathname.endsWith('/start'))
+        url.pathname = url.pathname.replace(/\/+$/, '') + '/start';
+    return url.toString();
+}
+function buildDeviceUrl(startUrl, userCode) {
+    const url = new URL(startUrl);
+    url.search = '';
+    // Prefer `/start/` (with trailing slash) to match AWS portal URLs like `/start/#/device?...`.
+    if (url.pathname.endsWith('/start'))
+        url.pathname = `${url.pathname}/`;
+    url.pathname = url.pathname.replace(/\/start\/?$/, '/start/');
+    url.hash = `#/device?user_code=${encodeURIComponent(userCode)}`;
+    return url.toString();
+}
+export class IdcAuthMethod {
+    config;
+    repository;
+    accountManager;
+    constructor(config, repository, accountManager) {
+        this.config = config;
+        this.repository = repository;
+        this.accountManager = accountManager;
+    }
+    async authorize(inputs) {
+        const configuredServiceRegion = this.config.default_region;
+        const invokedWithoutPrompts = !inputs || Object.keys(inputs).length === 0;
+        const startUrl = normalizeStartUrl(inputs?.start_url || this.config.idc_start_url) || undefined;
+        const oidcRegion = normalizeRegion(inputs?.idc_region || this.config.idc_region);
+        const configuredProfileArn = this.config.idc_profile_arn;
+        logger.log('IDC authorize: resolved defaults', {
+            hasInputs: !!inputs && Object.keys(inputs).length > 0,
+            invokedWithoutPrompts,
+            startUrlSource: inputs?.start_url ? 'inputs' : this.config.idc_start_url ? 'config' : 'none',
+            oidcRegion,
+            startUrl: startUrl ? new URL(startUrl).origin : undefined
+        });
+        // Step 1: get device code + verification URL (fast)
+        const auth = await authorizeKiroIDC(oidcRegion, startUrl);
+        // If a custom Identity Center start URL is provided, prefer the portal device page.
+        // This avoids the AWS Builder ID device page (which often prompts for an email)
+        // and routes the user into their org's IAM Identity Center sign-in.
+        const verificationUrl = startUrl
+            ? buildDeviceUrl(startUrl, auth.userCode)
+            : auth.verificationUriComplete || auth.verificationUrl;
+        // Open the *AWS* verification page directly (no local web server).
+        openBrowser(verificationUrl);
+        return {
+            url: verificationUrl,
+            instructions: `Open the verification URL and complete sign-in.\nCode: ${auth.userCode}`,
+            method: 'auto',
+            callback: async () => {
+                try {
+                    // Step 2: poll until token is issued (standard device-code flow)
+                    const token = await pollKiroIDCToken(auth.clientId, auth.clientSecret, auth.deviceCode, auth.interval, auth.expiresIn, oidcRegion);
+                    const profileArn = inputs?.profile_arn?.trim() || configuredProfileArn || readActiveProfileArnFromKiroCli();
+                    const serviceRegion = extractRegionFromArn(profileArn) || configuredServiceRegion;
+                    let usage = { usedCount: 0, limitCount: 0, email: undefined };
+                    try {
+                        usage = await fetchUsageLimits({
+                            refresh: '',
+                            access: token.accessToken,
+                            expires: token.expiresAt,
+                            authMethod: 'idc',
+                            region: serviceRegion,
+                            clientId: token.clientId,
+                            clientSecret: token.clientSecret,
+                            profileArn
+                        });
+                    }
+                    catch (e) {
+                        logger.warn('fetchUsageLimits failed during auth', {
+                            error: e instanceof Error ? e.message : String(e)
+                        });
+                        if (startUrl && !profileArn) {
+                            throw new Error(`Missing profile ARN for IAM Identity Center. Set "idc_profile_arn" in ~/.config/opencode/kiro.json, or run "kiro-cli profile" once so it can be auto-detected. Original error: ${e instanceof Error ? e.message : String(e)}`);
+                        }
+                        const errMsg = e instanceof Error ? e.message : String(e);
+                        if (errMsg.includes('FEATURE_NOT_SUPPORTED')) {
+                            logger.warn('fetchUsageLimits returned FEATURE_NOT_SUPPORTED; skipping usage check', {
+                                serviceRegion,
+                                profileArn
+                            });
+                            usage = {
+                                usedCount: 0,
+                                limitCount: 0,
+                                email: undefined
+                            };
+                        }
+                        else {
+                            throw e;
+                        }
+                    }
+                    if (!usage.email) {
+                        try {
+                            const tokenParts = token.accessToken.split('.');
+                            if (tokenParts.length === 3 && tokenParts[1]) {
+                                const payload = JSON.parse(Buffer.from(tokenParts[1], 'base64').toString());
+                                usage.email = payload.email || payload.sub;
+                            }
+                        }
+                        catch { }
+                    }
+                    const email = usage.email || makePlaceholderEmail('idc', serviceRegion, token.clientId, profileArn);
+                    const id = createDeterministicAccountId(email, 'idc', token.clientId, profileArn);
+                    const acc = {
+                        id,
+                        email,
+                        authMethod: 'idc',
+                        region: serviceRegion,
+                        oidcRegion,
+                        clientId: token.clientId,
+                        clientSecret: token.clientSecret,
+                        profileArn,
+                        startUrl: startUrl || undefined,
+                        refreshToken: token.refreshToken,
+                        accessToken: token.accessToken,
+                        expiresAt: token.expiresAt,
+                        rateLimitResetTime: 0,
+                        isHealthy: true,
+                        failCount: 0,
+                        usedCount: usage.usedCount,
+                        limitCount: usage.limitCount
+                    };
+                    await this.repository.save(acc);
+                    this.accountManager?.addAccount?.(acc);
+                    return { type: 'success', key: token.accessToken };
+                }
+                catch (e) {
+                    const err = e instanceof Error ? e : new Error(String(e));
+                    logger.error('IDC auth callback failed', err);
+                    throw new Error(`IDC authorization failed: ${err.message}. Check ~/.config/opencode/kiro-logs/plugin.log for details. If this is an Identity Center account, ensure you have selected an AWS Q Developer/CodeWhisperer profile (try: kiro-cli profile).`);
+                }
+            }
+        };
+    }
+}

package/dist/core/auth/token-refresher.d.ts

@@ -0,0 +1,23 @@
+import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
+import type { AccountManager } from '../../plugin/accounts.js';
+import type { KiroAuthDetails, ManagedAccount } from '../../plugin/types.js';
+type ToastFunction = (message: string, variant: 'info' | 'warning' | 'success' | 'error') => void;
+interface TokenRefresherConfig {
+    token_expiry_buffer_ms: number;
+    auto_sync_kiro_cli: boolean;
+    account_selection_strategy: 'sticky' | 'round-robin' | 'lowest-usage';
+}
+export declare class TokenRefresher {
+    private config;
+    private accountManager;
+    private syncFromKiroCli;
+    private repository;
+    constructor(config: TokenRefresherConfig, accountManager: AccountManager, syncFromKiroCli: () => Promise<void>, repository: AccountRepository);
+    refreshIfNeeded(account: ManagedAccount, auth: KiroAuthDetails, showToast: ToastFunction): Promise<{
+        account: ManagedAccount;
+        shouldContinue: boolean;
+    }>;
+    forceRefresh(account: ManagedAccount, showToast: ToastFunction): Promise<boolean>;
+    private handleRefreshError;
+}
+export {};

package/dist/core/auth/token-refresher.js

@@ -0,0 +1,85 @@
+import { accessTokenExpired } from '../../kiro/auth.js';
+import { KiroTokenRefreshError } from '../../plugin/errors.js';
+import * as logger from '../../plugin/logger.js';
+import { refreshAccessToken } from '../../plugin/token.js';
+export class TokenRefresher {
+    config;
+    accountManager;
+    syncFromKiroCli;
+    repository;
+    constructor(config, accountManager, syncFromKiroCli, repository) {
+        this.config = config;
+        this.accountManager = accountManager;
+        this.syncFromKiroCli = syncFromKiroCli;
+        this.repository = repository;
+    }
+    async refreshIfNeeded(account, auth, showToast) {
+        if (!accessTokenExpired(auth, this.config.token_expiry_buffer_ms)) {
+            return { account, shouldContinue: false };
+        }
+        try {
+            const newAuth = await refreshAccessToken(auth);
+            this.accountManager.updateFromAuth(account, newAuth);
+            await this.repository.batchSave(this.accountManager.getAccounts());
+            return { account, shouldContinue: false };
+        }
+        catch (e) {
+            return await this.handleRefreshError(e, account, showToast);
+        }
+    }
+    async forceRefresh(account, showToast) {
+        const auth = this.accountManager.toAuthDetails(account);
+        try {
+            const newAuth = await refreshAccessToken(auth);
+            this.accountManager.updateFromAuth(account, newAuth);
+            await this.repository.batchSave(this.accountManager.getAccounts());
+            return true;
+        }
+        catch (e) {
+            logger.error('Forced token refresh failed', {
+                email: account.email,
+                code: e instanceof KiroTokenRefreshError ? e.code : undefined,
+                message: e instanceof Error ? e.message : String(e)
+            });
+            showToast('403: Token refresh failed after stale-token detection.', 'warning');
+            return false;
+        }
+    }
+    async handleRefreshError(error, account, showToast) {
+        logger.error('Token refresh failed', {
+            email: account.email,
+            code: error instanceof KiroTokenRefreshError ? error.code : undefined,
+            message: error instanceof Error ? error.message : String(error)
+        });
+        if (this.config.auto_sync_kiro_cli) {
+            await this.syncFromKiroCli();
+        }
+        this.repository.invalidateCache();
+        const accounts = await this.repository.findAll();
+        const stillAcc = accounts.find((a) => a.id === account.id);
+        if (stillAcc &&
+            !accessTokenExpired(this.accountManager.toAuthDetails(stillAcc), this.config.token_expiry_buffer_ms)) {
+            showToast('Credentials recovered from Kiro CLI sync.', 'info');
+            return { account: stillAcc, shouldContinue: true };
+        }
+        if (error instanceof KiroTokenRefreshError &&
+            (error.code === 'ExpiredTokenException' ||
+                error.code === 'InvalidTokenException' ||
+                error.code === 'ExpiredClientException' ||
+                error.code === 'HTTP_401' ||
+                error.code === 'HTTP_403' ||
+                error.message.includes('Invalid refresh token provided') ||
+                error.message.includes('Invalid grant provided') ||
+                error.message.includes('Client is expired'))) {
+            this.accountManager.markUnhealthy(account, error.message);
+            await this.repository.batchSave(this.accountManager.getAccounts());
+            return { account, shouldContinue: true };
+        }
+        logger.error('Token refresh unrecoverable', {
+            email: account.email,
+            code: error instanceof KiroTokenRefreshError ? error.code : undefined,
+            message: error instanceof Error ? error.message : String(error)
+        });
+        throw error;
+    }
+}

package/dist/core/index.d.ts

@@ -0,0 +1,9 @@
+export * from './account/account-selector.js';
+export * from './account/usage-tracker.js';
+export * from './auth/auth-handler.js';
+export * from './auth/idc-auth-method.js';
+export * from './auth/token-refresher.js';
+export * from './request/error-handler.js';
+export * from './request/request-handler.js';
+export * from './request/response-handler.js';
+export * from './request/retry-strategy.js';

package/dist/core/index.js

@@ -0,0 +1,9 @@
+export * from './account/account-selector.js';
+export * from './account/usage-tracker.js';
+export * from './auth/auth-handler.js';
+export * from './auth/idc-auth-method.js';
+export * from './auth/token-refresher.js';
+export * from './request/error-handler.js';
+export * from './request/request-handler.js';
+export * from './request/response-handler.js';
+export * from './request/retry-strategy.js';

package/dist/core/request/error-handler.d.ts

@@ -0,0 +1,32 @@
+import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
+import type { AccountManager } from '../../plugin/accounts.js';
+import type { ManagedAccount } from '../../plugin/types.js';
+type ToastFunction = (message: string, variant: 'info' | 'warning' | 'success' | 'error') => void;
+interface RequestContext {
+    retry: number;
+    bearerRefreshAttempted?: boolean;
+}
+type ForceRefreshFn = (account: ManagedAccount, showToast: ToastFunction) => Promise<boolean>;
+interface ErrorHandlerConfig {
+    rate_limit_max_retries: number;
+    rate_limit_retry_delay_ms: number;
+}
+export declare class ErrorHandler {
+    private config;
+    private accountManager;
+    private repository;
+    private forceRefresh?;
+    constructor(config: ErrorHandlerConfig, accountManager: AccountManager, repository: AccountRepository, forceRefresh?: ForceRefreshFn | undefined);
+    handle(error: any, response: Response, account: ManagedAccount, context: RequestContext, showToast: ToastFunction): Promise<{
+        shouldRetry: boolean;
+        newContext?: RequestContext;
+        switchAccount?: boolean;
+    }>;
+    handleNetworkError(error: any, context: RequestContext, showToast: ToastFunction): Promise<{
+        shouldRetry: boolean;
+        newContext?: RequestContext;
+    }>;
+    private isNetworkError;
+    private sleep;
+}
+export {};