@sunerpy/opencode-kiro-auth 0.1.0

package/dist/plugin/accounts.js

@@ -0,0 +1,266 @@
+import { createHash } from 'node:crypto';
+import { decodeRefreshToken, encodeRefreshToken } from '../kiro/auth.js';
+import { isPermanentError } from './health.js';
+import * as logger from './logger.js';
+import { kiroDb } from './storage/sqlite.js';
+import { writeToKiroCli } from './sync/kiro-cli.js';
+export function createDeterministicAccountId(email, method, clientId, profileArn) {
+    return createHash('sha256')
+        .update(`${email}:${method}:${clientId || ''}:${profileArn || ''}`)
+        .digest('hex');
+}
+export class AccountManager {
+    accounts;
+    cursor;
+    strategy;
+    lastToastTime = 0;
+    lastUsageToastTime = 0;
+    constructor(accounts, strategy = 'sticky') {
+        this.accounts = accounts;
+        this.cursor = 0;
+        this.strategy = strategy;
+    }
+    static async loadFromDisk(strategy) {
+        const rows = kiroDb.getAccounts();
+        const accounts = rows.map((r) => ({
+            id: r.id,
+            email: r.email,
+            authMethod: r.auth_method,
+            region: r.region,
+            oidcRegion: r.oidc_region || undefined,
+            clientId: r.client_id,
+            clientSecret: r.client_secret,
+            profileArn: r.profile_arn,
+            startUrl: r.start_url || undefined,
+            refreshToken: r.refresh_token,
+            accessToken: r.access_token,
+            expiresAt: r.expires_at,
+            rateLimitResetTime: r.rate_limit_reset,
+            isHealthy: r.is_healthy === 1,
+            unhealthyReason: r.unhealthy_reason,
+            recoveryTime: r.recovery_time,
+            failCount: r.fail_count || 0,
+            lastUsed: r.last_used,
+            usedCount: r.used_count,
+            limitCount: r.limit_count
+        }));
+        return new AccountManager(accounts, strategy || 'sticky');
+    }
+    getAccountCount() {
+        return this.accounts.length;
+    }
+    getAccounts() {
+        return [...this.accounts];
+    }
+    shouldShowToast(debounce = 10000) {
+        if (Date.now() - this.lastToastTime < debounce)
+            return false;
+        this.lastToastTime = Date.now();
+        return true;
+    }
+    shouldShowUsageToast(debounce = 10000) {
+        if (Date.now() - this.lastUsageToastTime < debounce)
+            return false;
+        this.lastUsageToastTime = Date.now();
+        return true;
+    }
+    getMinWaitTime() {
+        const now = Date.now();
+        const waits = this.accounts.map((a) => (a.rateLimitResetTime || 0) - now).filter((t) => t > 0);
+        return waits.length > 0 ? Math.min(...waits) : 0;
+    }
+    getCurrentOrNext() {
+        const now = Date.now();
+        const available = this.accounts.filter((a) => {
+            if (!a.isHealthy) {
+                if (isPermanentError(a.unhealthyReason)) {
+                    return false;
+                }
+                if (a.failCount < 10 && a.recoveryTime && now >= a.recoveryTime) {
+                    a.isHealthy = true;
+                    delete a.unhealthyReason;
+                    delete a.recoveryTime;
+                    return true;
+                }
+                return false;
+            }
+            return !(a.rateLimitResetTime && now < a.rateLimitResetTime);
+        });
+        let selected;
+        if (available.length > 0) {
+            if (this.strategy === 'sticky') {
+                selected = available.find((_, i) => i === this.cursor) || available[0];
+            }
+            else if (this.strategy === 'round-robin') {
+                selected = available[this.cursor % available.length];
+                this.cursor = (this.cursor + 1) % available.length;
+            }
+            else if (this.strategy === 'lowest-usage') {
+                selected = [...available].sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
+            }
+        }
+        if (!selected) {
+            const fallback = this.accounts
+                .filter((a) => !a.isHealthy && a.failCount < 10 && !isPermanentError(a.unhealthyReason))
+                .sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
+            if (fallback) {
+                fallback.isHealthy = true;
+                delete fallback.unhealthyReason;
+                delete fallback.recoveryTime;
+                selected = fallback;
+            }
+        }
+        if (selected) {
+            selected.lastUsed = now;
+            selected.usedCount = (selected.usedCount || 0) + 1;
+            this.cursor = this.accounts.indexOf(selected);
+            return selected;
+        }
+        return null;
+    }
+    updateUsage(id, meta) {
+        const a = this.accounts.find((x) => x.id === id);
+        if (a) {
+            a.usedCount = meta.usedCount;
+            a.limitCount = meta.limitCount;
+            if (meta.email)
+                a.email = meta.email;
+            if (!isPermanentError(a.unhealthyReason)) {
+                a.failCount = 0;
+                a.isHealthy = true;
+                delete a.unhealthyReason;
+                delete a.recoveryTime;
+            }
+            kiroDb.upsertAccount(a).catch((e) => logger.warn('DB write failed', {
+                method: 'updateUsage',
+                email: a.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
+        }
+    }
+    addAccount(a) {
+        const i = this.accounts.findIndex((x) => x.id === a.id);
+        if (i === -1)
+            this.accounts.push(a);
+        else
+            this.accounts[i] = a;
+        kiroDb.upsertAccount(a).catch((e) => logger.warn('DB write failed', {
+            method: 'addAccount',
+            email: a.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
+    }
+    removeAccount(a) {
+        const removedIndex = this.accounts.findIndex((x) => x.id === a.id);
+        if (removedIndex === -1)
+            return;
+        this.accounts = this.accounts.filter((x) => x.id !== a.id);
+        kiroDb.deleteAccount(a.id).catch((e) => logger.warn('DB write failed', {
+            method: 'removeAccount',
+            email: a.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
+        if (this.accounts.length === 0)
+            this.cursor = 0;
+        else if (this.cursor >= this.accounts.length)
+            this.cursor = this.accounts.length - 1;
+        else if (removedIndex <= this.cursor && this.cursor > 0)
+            this.cursor--;
+    }
+    updateFromAuth(a, auth) {
+        const acc = this.accounts.find((x) => x.id === a.id);
+        if (acc) {
+            acc.accessToken = auth.access;
+            acc.expiresAt = auth.expires;
+            acc.lastUsed = Date.now();
+            if (auth.email)
+                acc.email = auth.email;
+            const p = decodeRefreshToken(auth.refresh);
+            acc.refreshToken = p.refreshToken;
+            if (p.profileArn)
+                acc.profileArn = p.profileArn;
+            if (p.clientId)
+                acc.clientId = p.clientId;
+            acc.failCount = 0;
+            acc.isHealthy = true;
+            delete acc.unhealthyReason;
+            delete acc.recoveryTime;
+            kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+                method: 'updateFromAuth',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
+            writeToKiroCli(acc).catch((e) => logger.warn('CLI write failed', {
+                method: 'updateFromAuth',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
+        }
+    }
+    markRateLimited(a, ms) {
+        const acc = this.accounts.find((x) => x.id === a.id);
+        if (acc) {
+            acc.rateLimitResetTime = Date.now() + ms;
+            kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+                method: 'markRateLimited',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
+        }
+    }
+    markUnhealthy(a, reason, recovery) {
+        const acc = this.accounts.find((x) => x.id === a.id);
+        if (!acc)
+            return;
+        const isPermanent = isPermanentError(reason);
+        if (isPermanent) {
+            logger.warn('Account marked as permanently unhealthy', {
+                email: acc.email,
+                reason,
+                accountId: acc.id
+            });
+            acc.failCount = 10;
+            acc.isHealthy = false;
+            acc.unhealthyReason = reason;
+            delete acc.recoveryTime;
+        }
+        else {
+            acc.failCount = (acc.failCount || 0) + 1;
+            acc.unhealthyReason = reason;
+            acc.lastUsed = Date.now();
+            if (acc.failCount >= 10) {
+                acc.isHealthy = false;
+                acc.recoveryTime = recovery || Date.now() + 3600000;
+            }
+        }
+        kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+            method: 'markUnhealthy',
+            email: acc.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
+    }
+    async saveToDisk() {
+        await kiroDb.batchUpsertAccounts(this.accounts);
+    }
+    toAuthDetails(a) {
+        const p = {
+            refreshToken: a.refreshToken,
+            profileArn: a.profileArn,
+            clientId: a.clientId,
+            clientSecret: a.clientSecret,
+            authMethod: a.authMethod
+        };
+        return {
+            refresh: encodeRefreshToken(p),
+            access: a.accessToken,
+            expires: a.expiresAt,
+            authMethod: a.authMethod,
+            region: a.region,
+            oidcRegion: a.oidcRegion,
+            profileArn: a.profileArn,
+            clientId: a.clientId,
+            clientSecret: a.clientSecret,
+            email: a.email
+        };
+    }
+}

package/dist/plugin/auth-bootstrap.d.ts

@@ -0,0 +1,9 @@
+/**
+ * OpenCode only calls the auth loader when there is a stored auth entry for the
+ * provider in auth.json. The plugin syncs credentials from the Kiro IDE's local
+ * SQLite database, so it doesn't need the user to go through an OAuth flow first.
+ *
+ * This writes a minimal placeholder entry into auth.json so OpenCode calls the
+ * loader on the next startup, where real credentials are synced from Kiro CLI DB.
+ */
+export declare function bootstrapAuthIfNeeded(providerId: string): void;

package/dist/plugin/auth-bootstrap.js

@@ -0,0 +1,69 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import * as logger from './logger.js';
+import { getCliDbPath } from './sync/kiro-cli-parser.js';
+function getOpenCodeAuthPath() {
+    const dataRoot = process.platform === 'win32'
+        ? process.env.LOCALAPPDATA || join(homedir(), 'AppData', 'Local')
+        : process.env.XDG_DATA_HOME || join(homedir(), '.local', 'share');
+    return join(dataRoot, 'opencode', 'auth.json');
+}
+function readAuthFile(authPath) {
+    if (!existsSync(authPath))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(authPath, 'utf-8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            logger.warn('Bootstrap: auth.json is not an object, skipping placeholder auth setup');
+            return null;
+        }
+        return parsed;
+    }
+    catch (e) {
+        logger.warn(`Bootstrap: invalid auth.json, skipping placeholder auth setup: ${e instanceof Error ? e.message : String(e)}`);
+        return null;
+    }
+}
+function writeAuthFile(authPath, auth) {
+    mkdirSync(dirname(authPath), { recursive: true });
+    const mode = existsSync(authPath) ? statSync(authPath).mode & 0o777 : 0o600;
+    const tempPath = `${authPath}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tempPath, JSON.stringify(auth, null, 2), { encoding: 'utf-8', mode });
+    chmodSync(tempPath, mode);
+    renameSync(tempPath, authPath);
+}
+/**
+ * OpenCode only calls the auth loader when there is a stored auth entry for the
+ * provider in auth.json. The plugin syncs credentials from the Kiro IDE's local
+ * SQLite database, so it doesn't need the user to go through an OAuth flow first.
+ *
+ * This writes a minimal placeholder entry into auth.json so OpenCode calls the
+ * loader on the next startup, where real credentials are synced from Kiro CLI DB.
+ */
+export function bootstrapAuthIfNeeded(providerId) {
+    try {
+        const cliDbPath = getCliDbPath();
+        if (!existsSync(cliDbPath)) {
+            logger.log('Bootstrap: Kiro CLI DB not found, skipping');
+            return;
+        }
+        const authPath = getOpenCodeAuthPath();
+        const auth = readAuthFile(authPath);
+        if (!auth)
+            return;
+        if (auth[providerId]) {
+            return;
+        }
+        logger.log(`Bootstrap: writing placeholder auth entry for provider "${providerId}"`);
+        auth[providerId] = {
+            type: 'api',
+            key: 'kiro-bootstrap-placeholder'
+        };
+        writeAuthFile(authPath, auth);
+        logger.log('Bootstrap: auth.json updated — loader will run on next request');
+    }
+    catch (e) {
+        logger.warn(`Bootstrap failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}

package/dist/plugin/auth-page.d.ts

@@ -0,0 +1,4 @@
+export declare function getIDCAuthHtml(verificationUrl: string, userCode: string, statusUrl: string): string;
+export declare function getSuccessHtml(): string;
+export declare function getErrorHtml(message: string): string;
+export declare function getStartUrlInputHtml(defaultStartUrl: string, submitUrl: string): string;