cartethyia 2.7.3 → 2.7.5

package/src/console/providers/detail/routes.ts

@@ -1,4 +1,4 @@
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { ConsoleDomainError, errorResponse, requireTenantScope } from "../../shared/errors";
 import { literalUnion } from "../../shared/elysia-schema";
 import type { AccessDecision } from "../../../security/access-control";
@@ -30,7 +30,7 @@ const ROUTING_BOUNDS = {
   maxInflightPerProxy: PROVIDER_ROUTING_MAX_INFLIGHT_BOUNDS,
 } as const;
 
-export function createProviderDetailOperations(deps: ProviderDetailConfig) {
+function createProviderDetailOperations(deps: ProviderDetailConfig) {
   const operations = {
     async getRouting(
       access: AccessDecision | undefined,
@@ -160,7 +160,7 @@ const updateRoutingBody = t.Object({
 });
 
 
-export function createProviderDetailRoutes(config: ProviderDetailConfig): Elysia {
+export function createProviderDetailRoutes(config: ProviderDetailConfig): AnyElysia {
   const factory = createProviderDetailOperations(config);
   return new Elysia({ prefix: "/providers" })
     .get("/:providerId/routing", async ({ request, params, set }) => {
@@ -191,5 +191,5 @@ export function createProviderDetailRoutes(config: ProviderDetailConfig): Elysia
           return providerDetailErrorResponse(e, set);
         }
       },
-    ) as unknown as Elysia;
+    )
 }

package/src/console/providers/oauth/callback-listener.ts

@@ -28,7 +28,7 @@ import { log } from "../../../observability/logger";
 import { ConsoleDomainError } from "../../shared/errors";
 
 /** A loopback endpoint a callback can actually be delivered to. */
-export interface LoopbackCallbackEndpoint {
+interface LoopbackCallbackEndpoint {
   readonly port: number;
   readonly path: string;
 }
@@ -44,7 +44,7 @@ const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
  * installed app and a remote host is delivered over the network; neither is
  * something this process can bind, and both keep the manual path.
  */
-export function loopbackCallbackEndpoint(redirectUri: string): LoopbackCallbackEndpoint | undefined {
+function loopbackCallbackEndpoint(redirectUri: string): LoopbackCallbackEndpoint | undefined {
   let url: URL;
   try {
     url = new URL(redirectUri);
@@ -59,12 +59,19 @@ export function loopbackCallbackEndpoint(redirectUri: string): LoopbackCallbackE
 }
 
 /** Completes one callback once its code and state have been read. */
-export interface OAuthCallbackCompleter {
+interface OAuthCallbackCompleter {
   complete(
     providerId: string,
     code: string,
     state: string,
-  ): Promise<{ readonly ok: boolean; readonly message: string }>;
+    /** Extra query params the callback carried (e.g. Kiro's `login_option`). */
+    callbackParams?: Readonly<Record<string, string>>,
+  ): Promise<{
+    readonly ok: boolean;
+    readonly message: string;
+    readonly redirectUrl?: string;
+    readonly continueState?: string;
+  }>;
 }
 
 /** Minimal `Bun.serve` surface this module depends on. */
@@ -79,7 +86,7 @@ type ServeFn = (options: {
   readonly fetch: (request: Request) => Response | Promise<Response>;
 }) => LoopbackServer;
 
-export interface CallbackListenerOptions {
+interface CallbackListenerOptions {
   readonly completer: OAuthCallbackCompleter;
   /** Injected in tests; defaults to `Bun.serve`. */
   readonly serve?: ServeFn;
@@ -92,7 +99,10 @@ const DEFAULT_TTL_MS = 900_000;
 
 interface RegisteredFlow {
   readonly providerId: string;
+  /** Paths this flow's callback may arrive on (e.g. Kiro serves both `/oauth/callback` and `/signin/callback`). */
+  readonly paths: readonly string[];
   readonly timer: ReturnType<typeof setTimeout>;
+  inFlight: boolean;
 }
 
 interface PortListener {
@@ -134,17 +144,30 @@ export class OAuthCallbackListener {
     if (endpoint === undefined) return false;
     const existing = this.#ports.get(endpoint.port);
     if (existing !== undefined) {
-      this.#remember(existing, state, providerId);
+      this.#remember(existing, state, providerId, this.#callbackPaths(endpoint.path));
       return true;
     }
     const servers = this.#bind(endpoint);
     const listener: PortListener = { port: endpoint.port, servers, flows: new Map() };
     this.#ports.set(endpoint.port, listener);
-    this.#remember(listener, state, providerId);
+    this.#remember(listener, state, providerId, this.#callbackPaths(endpoint.path));
     log.info(`[oauth] callback listener bound on 127.0.0.1:${endpoint.port}${endpoint.path}`);
     return true;
   }
 
+  /**
+   * The paths one login may deliver its callback on. Kiro's portal is observed
+   * (unpacked IDE 1.4.62) to redirect to both `/oauth/callback` and
+   * `/signin/callback`; binding only the advertised path left a redirect to the
+   * other one hitting a 404 and the login hanging. Other providers neither
+   * register nor expect `/signin/callback`, so adding it is harmless.
+   */
+  #callbackPaths(advertised: string): readonly string[] {
+    return advertised === "/signin/callback"
+      ? [advertised]
+      : [advertised, "/signin/callback"];
+  }
+
   /** Drops a flow and frees its port when nothing else is waiting on it. */
   release(redirectUri: string, state: string): void {
     const endpoint = loopbackCallbackEndpoint(redirectUri);
@@ -154,6 +177,25 @@ export class OAuthCallbackListener {
     this.#forget(endpoint.port, listener, state);
   }
 
+  /**
+   * Re-registers an existing flow state under a new callback state.
+   *
+   * Kiro's two-phase portal login starts a second authorization leg with a
+   * *fresh* state (the IDE mints a new UUID for the IdC authorize step), so
+   * the loopback listener must retain the pending flow under that second
+   * state too — otherwise the phase-2 callback answers "OAuth session not
+   * found or expired" even though the flow is still alive.
+   */
+  track(redirectUri: string, state: string, newState: string): void {
+    const endpoint = loopbackCallbackEndpoint(redirectUri);
+    if (endpoint === undefined) return;
+    const listener = this.#ports.get(endpoint.port);
+    if (listener === undefined) return;
+    const flow = listener.flows.get(state);
+    if (flow === undefined) return;
+    this.#remember(listener, newState, flow.providerId, flow.paths);
+  }
+
   /**
    * Drops every flow for `providerId` on `redirectUri`'s port.
    *
@@ -182,7 +224,7 @@ export class OAuthCallbackListener {
     }
   }
 
-  #remember(listener: PortListener, state: string, providerId: string): void {
+  #remember(listener: PortListener, state: string, providerId: string, paths: readonly string[]): void {
     const previous = listener.flows.get(state);
     if (previous !== undefined) clearTimeout(previous.timer);
     const timer = setTimeout(() => {
@@ -190,7 +232,7 @@ export class OAuthCallbackListener {
     }, this.#ttlMs);
     // A pending login must not hold the process open on its own.
     (timer as unknown as { unref?: () => void }).unref?.();
-    listener.flows.set(state, { providerId, timer });
+    listener.flows.set(state, { providerId, paths, timer, inFlight: false });
   }
 
   #forget(port: number, listener: PortListener, state: string): void {
@@ -250,9 +292,6 @@ export class OAuthCallbackListener {
     endpoint: LoopbackCallbackEndpoint,
   ): Promise<Response> {
     const url = new URL(request.url);
-    if (url.pathname !== endpoint.path) {
-      return new Response("Not found", { status: 404 });
-    }
     const listener = this.#ports.get(endpoint.port);
     if (listener === undefined) {
       return new Response("OAuth session not found or expired.", { status: 400 });
@@ -278,7 +317,7 @@ export class OAuthCallbackListener {
         { status: 400, headers: { "content-type": "text/html; charset=utf-8" } },
       );
     }
-    if (code.length === 0) {
+    if (code.length === 0 && !url.searchParams.has("login_option")) {
       return new Response("Missing authorization code.", { status: 400 });
     }
     // `state` is the correlation key and the replay guard. An authorization
@@ -297,14 +336,45 @@ export class OAuthCallbackListener {
     if (matched === undefined) {
       return new Response("OAuth session not found or expired.", { status: 400 });
     }
-    // Claim the flow before awaiting: a browser that retries the redirect must
-    // not start a second exchange with a code that is already being spent.
+    // Some providers (Kiro's portal) can land the callback on any of several
+    // registered paths — `/oauth/callback` or `/signin/callback`. Accept the
+    // path the flow registered for, not only the advertised default.
+    if (!matched.paths.includes(url.pathname)) {
+      return new Response("Not found", { status: 404 });
+    }
+    if (matched.inFlight) {
+      return new Response("OAuth callback is already being processed.", { status: 409 });
+    }
+    // Claim while the exchange is in flight. A multi-step flow (Kiro OIDC) may
+    // return a redirect and reuse this listener/state for its next callback.
+    matched.inFlight = true;
     const matchedState = state.length > 0 ? state : this.#stateOf(listener, matched);
-    if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState);
-    let result: { ok: boolean; message: string };
+    let result: {
+      ok: boolean;
+      message: string;
+      redirectUrl?: string;
+      continueState?: string;
+    };
+    // Some authorization servers (Kiro's portal) append provider-specific query
+    // params — `login_option` names the social/enterprise family that approved.
+    // The exchange needs them to rebuild the exact redirect URI the portal saw,
+    // and the OIDC families carry `issuer_url`/`idc_region`/`client_id`/`scopes`
+    // that the continuation flow needs. Forward every param other than the ones
+    // this handler already consumed.
+    const callbackParams: Record<string, string> = {};
+    for (const [key, value] of url.searchParams) {
+      if (key === "code" || key === "state" || key === "error" || key === "error_description") continue;
+      callbackParams[key] = value;
+    }
     try {
-      result = await this.#completer.complete(matched.providerId, code, state);
+      result = await this.#completer.complete(
+        matched.providerId,
+        code,
+        state,
+        Object.keys(callbackParams).length > 0 ? callbackParams : undefined,
+      );
     } catch (failure) {
+      if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState);
       const message = failure instanceof Error ? failure.message : "OAuth login failed";
       log.error(`[oauth] callback completion failed for ${matched.providerId}: ${message}`);
       return new Response(
@@ -312,6 +382,18 @@ export class OAuthCallbackListener {
         { status: 500, headers: { "content-type": "text/html; charset=utf-8" } },
       );
     }
+    if (result.redirectUrl !== undefined) {
+      // Phase 1 of a two-phase login (Kiro OIDC): the flow is still pending, so
+      // continue by sending the browser to the phase-2 authorize URL. The phase-2
+      // authorize URL carries a fresh state (`continueState`), which the completer
+      // already registered under — keep the current matcher alive for it.
+      matched.inFlight = false;
+      return new Response(null, {
+        status: 302,
+        headers: { location: result.redirectUrl },
+      });
+    }
+    if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState);
     if (!result.ok) {
       return new Response(
         `<!doctype html><html><body><p>OAuth login failed: ${escapeHtml(result.message)}</p></body></html>`,

package/src/console/providers/oauth/routes.ts

@@ -9,7 +9,7 @@ import type { ProviderRegistry } from "../../../providers/provider-registry";
 import { browserAuthorizeRedirectUri } from "../../../config/providers";
 import { log } from "../../../observability/logger";
 import { GatewayError } from "../../../protocol/gateway-error";
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { ConsoleDomainError, errorResponse, requireScope } from "../../shared/errors";
 import { generateOAuthState, generatePkcePair } from "../../../providers/authentication/oauth-flow-store";
 import type { OAuthFlowStorage } from "../../../providers/authentication/oauth-flow-store";
@@ -171,7 +171,7 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
  * server the redirect arrives at; `callback-listener.ts` is what makes those
  * the same endpoint.
  */
-export interface PersistedOAuthAccount {
+interface PersistedOAuthAccount {
   readonly accountId: string;
 }
 
@@ -212,9 +212,20 @@ async function requireClient(
 }
 
 /** The result of exchanging one authorization code, as the caller should report it. */
-export interface OAuthCompleteOutcome {
+interface OAuthCompleteOutcome {
   readonly ok: boolean;
   readonly message: string;
+  /**
+   * When set, the exchange is not finished: the browser must be redirected to
+   * this URL to continue (Kiro's OIDC families need a second authorization
+   * leg after the portal callback).
+   */
+  readonly redirectUrl?: string;
+  /**
+   * New callback state the phase-2 authorize URL carries (Kiro mints a fresh
+   * state for the IdC leg; the console retains the pending flow under it).
+   */
+  readonly continueState?: string;
 }
 
 /**
@@ -231,29 +242,41 @@ export async function completeLogin(
   providerId: string,
   code: string,
   state: string,
+  callbackParams?: Readonly<Record<string, string>>,
 ): Promise<OAuthCompleteOutcome> {
   // An empty `state` means the authorization server does not echo one
   // (OpenRouter omits it from the callback entirely); correlate by provider in
   // that case, and by state otherwise so the stronger check stays in force
   // wherever the server supports it.
+  //
+  // The flow is peeked, not consumed, until the exchange succeeds: consuming
+  // first means a failed exchange (a transient upstream blip, a paste that
+  // missed a parameter) burns the state and every retry answers "unknown or
+  // expired state". The state is deleted only after the account persists.
   const flow = state
-    ? await config.oauthFlowStore.consumePending(state)
+    ? await config.oauthFlowStore.peekPending(state)
     : await config.oauthFlowStore.consumePendingByProvider(providerId);
   if (!flow || flow.providerId !== providerId) {
     return { ok: false, message: "unknown or expired state" };
   }
-  // The flow is spent, so its listener registration has nothing left to wait
-  // for; releasing it here keeps a manual paste from leaving the port bound.
-  // Stateless callbacks arrive with `""`, which matches no filed state —
-  // release by provider so the OpenRouter port does not linger until TTL.
-  if (state.length > 0) config.callbackListener.release(flow.redirectUri, state);
-  else config.callbackListener.releaseProvider(flow.redirectUri, providerId);
+  // Release the listener registration for this flow. The pending state itself
+  // stays available so a manual re-paste can retry the exchange. The release is
+  // deferred until after the exchange for two-phase flows: Kiro's OIDC portal
+  // callback (phase 1) must keep the loopback listener alive so the second
+  // authorization leg can land on it.
   const client = await requireClient(config.providerRegistry, providerId);
   if (!client.exchangeCode) {
     return { ok: false, message: "provider does not support browser authorization" };
   }
+  const releaseListener = () => {
+    if (state.length > 0) config.callbackListener.release(flow.redirectUri, state);
+    else config.callbackListener.releaseProvider(flow.redirectUri, providerId);
+  };
   try {
-    const result = await client.exchangeCode(code, flow.codeVerifier, flow.redirectUri, state);
+    const result = await client.exchangeCode(code, flow.codeVerifier, flow.redirectUri, state, {
+      ...(callbackParams === undefined ? {} : { parameters: callbackParams }),
+      ...(flow.providerState === undefined ? {} : { providerState: flow.providerState }),
+    });
     const tokenCheck = await validateIssuedAccessToken(
       result.access,
       providerJwtVerification(providerId),
@@ -270,9 +293,51 @@ export async function completeLogin(
       label: result.accountLabel ?? flow.accountLabel,
       ...result,
     });
+    // The exchange succeeded and the account is persisted; now the flow is
+    // spent. Consuming it here (peeked above) frees the state and the provider
+    // pointer so a replayed callback cannot re-create the account.
+    releaseListener();
+    if (state.length > 0) await config.oauthFlowStore.consumePending(state);
+    else await config.oauthFlowStore.consumePendingByProvider(providerId);
     await config.snapshotInvalidator?.invalidate();
     return { ok: true, message: `${providerId} account connected. You may close this tab.` };
   } catch (error) {
+    // Kiro's OIDC families: the portal callback carries no code — only
+    // `login_option` + issuer/region. The client responded with the second-leg
+    // authorize URL plus a fresh PKCE verifier and the OIDC registration.
+    // Rewrite the pending flow so phase 2 exchanges against that verifier, keep
+    // the listener alive, and tell the caller to redirect the browser there.
+    // dynamic-import: B-02 lazy graph — 58KB kiro OIDC path, only for Kiro flows.
+    // The kiro-oauth graph is 58KB, so it is imported lazily here — only the
+    // Kiro OIDC path needs the error class — instead of on the console boot
+    // graph (B-02).
+    const { KiroOidcPendingError } = await import(
+      "../../../providers/integrations/kiro/kiro-oauth"
+    );
+    if (error instanceof KiroOidcPendingError) {
+      // Phase 1 of Kiro's OIDC portal login: the portal callback carried no
+      // code — only `login_option` + issuer/region. The client answered with the
+      // phase-2 authorize URL, a fresh PKCE verifier, and the OIDC client
+      // registration. Mirror the 1.4.62 IDE: the second leg uses a *new* state
+      // (not the portal's), so mint it here, keep the pending flow reachable
+      // under both states, and tell the caller which state to expect back.
+      const continueState = error.continueState;
+      if (state.length > 0 && continueState.length > 0) {
+        await config.oauthFlowStore.savePending(continueState, {
+          ...flow,
+          codeVerifier: error.codeVerifier,
+          providerState: error.providerState,
+        });
+        config.callbackListener.track(flow.redirectUri, state, continueState);
+      }
+      return {
+        ok: false,
+        message: error.message,
+        redirectUrl: error.authorizeUrl,
+        continueState,
+      };
+    }
+    releaseListener();
     // Upstream token-endpoint bodies can echo credentials or sensitive
     // diagnostics — the browser gets a generic failure; the bounded detail
     // stays server-side in the console log.
@@ -351,7 +416,7 @@ function failurePage(message: string, wantsJson: boolean): Response {
   );
 }
 
-export function createOAuthLoginOperations(config: OAuthLoginConfig) {
+function createOAuthLoginOperations(config: OAuthLoginConfig) {
   const operations = {
     async beginAuthorize(
         access: AccessDecision | undefined,
@@ -437,8 +502,15 @@ export function createOAuthLoginOperations(config: OAuthLoginConfig) {
         code: string,
         state: string,
         wantsJson = false,
+        callbackParams?: Readonly<Record<string, string>>,
       ): Promise<Response> {
-        const outcome = await completeLogin(config, providerId, code, state);
+        const outcome = await completeLogin(config, providerId, code, state, callbackParams);
+        if (outcome.redirectUrl !== undefined) {
+          return new Response(null, {
+            status: 302,
+            headers: { location: outcome.redirectUrl },
+          });
+        }
         return outcome.ok ? successPage(providerId, wantsJson) : failurePage(outcome.message, wantsJson);
       },
     async handleCallbackError(
@@ -639,7 +711,7 @@ const importBody = t.Object({
   accountLabel: t.Optional(t.String()),
 });
 
-export function createOAuthLoginRoutes(config: OAuthLoginConfig): Elysia {
+export function createOAuthLoginRoutes(config: OAuthLoginConfig): AnyElysia {
   const factory = createOAuthLoginOperations(config);
   return new Elysia({ prefix: "/providers" })
     .post(
@@ -670,7 +742,14 @@ export function createOAuthLoginRoutes(config: OAuthLoginConfig): Elysia {
       // `state` is absent for authorization servers that do not echo it
       // (OpenRouter). The flow is then correlated by provider instead — one
       // browser login is in flight per provider at a time.
-      return factory.handleCallback(params.providerId, code, state, wantsJson);
+      const loginOption = typeof query["login_option"] === "string" ? query["login_option"] : undefined;
+      return factory.handleCallback(
+        params.providerId,
+        code,
+        state,
+        wantsJson,
+        loginOption === undefined ? undefined : { login_option: loginOption },
+      );
     })
     .post(
       "/:providerId/oauth/device/start",
@@ -721,6 +800,6 @@ export function createOAuthLoginRoutes(config: OAuthLoginConfig): Elysia {
           return oauthErrorResponse(e, set);
         }
       },
-    ) as unknown as Elysia;
+    )
 }
 

package/src/console/quota/account-quota-global.ts

@@ -1,10 +1,17 @@
 import { t } from "elysia";
 import type { Elysia } from "elysia";
-import { and, eq, isNull } from "drizzle-orm";
+import { and, eq, inArray, isNull } from "drizzle-orm";
 import { adminAuditLog, providerAccounts } from "../../persistence/schema";
 import { requireGlobalAdmin } from "../shared/errors";
-import { GLOBAL_QUOTA_LENS, invalidateQuotaCache } from "../../providers/quota/cache";
-import { invalidateCredentialCache } from "../../providers/operations/provider-credential-service";
+import {
+  GLOBAL_QUOTA_LENS,
+  invalidateQuotaCache,
+  invalidateQuotaCaches,
+} from "../../providers/quota/cache";
+import {
+  invalidateCredentialCache,
+  invalidateCredentialCaches,
+} from "../../providers/operations/provider-credential-service";
 import {
   QUOTA_REFRESH_TIMEOUT_MS,
   loadQuotaTarget,
@@ -119,6 +126,37 @@ export function registerAccountQuotaGlobalRoutes(
       });
       return { success: true };
     })
+    .post("/global/accounts/batch-delete", {
+      body: t.Object({
+        accountIds: t.Array(t.String()),
+      }),
+    }, async ({ request, body }) => {
+      const access = requireGlobalAdmin(accessResolver(request));
+      const accountIds = [...new Set(body.accountIds)];
+      if (accountIds.length === 0) {
+        return { ok: true, deleted: [], missing: [] };
+      }
+      // One DELETE statement scoped to shared accounts only: a tenant-owned row
+      // (`tenant_id IS NOT NULL`) is never matchable by a global admin, so it
+      // lands in `missing`.
+      const deleted = await db
+        .delete(providerAccounts)
+        .where(and(inArray(providerAccounts.id, accountIds), isNull(providerAccounts.tenantId)))
+        .returning({ id: providerAccounts.id });
+      const deletedIds = deleted.map((row) => row.id);
+      const deletedSet = new Set(deletedIds);
+      const missing = accountIds.filter((id) => !deletedSet.has(id));
+      invalidateCredentialCaches(deletedIds);
+      await invalidateQuotaCaches(GLOBAL_QUOTA_LENS, deletedIds, redis);
+      await snapshotInvalidator?.invalidate();
+      await db.insert(adminAuditLog).values({
+        actor: access.admissionIdentity,
+        action: "provider_account.global.batch_deleted",
+        target: "global",
+        detail: { deleted: deletedIds, missing },
+      });
+      return { ok: true, deleted: deletedIds, missing };
+    })
     .post("/global/accounts/:id/quota/refresh", async ({ request, params, set }) => {
       const access = requireGlobalAdmin(accessResolver(request));
       const target = await loadQuotaTarget(db, params.id, null);

package/src/console/quota/account-quota-shared.ts

@@ -1,6 +1,5 @@
 import type { ConsoleAccessResolver } from "../auth/access";
 import type { AuditRecorder } from "../auth/audit-recorder";
-import { markClineApiKeyCredential } from "../../providers/integrations/cline/cline-quota";
 import { type QuotaRefreshDeps } from "../../providers/quota/refresh";
 import type { AccountTestEgressDeps } from "./account-test-egress";
 
@@ -31,8 +30,16 @@ export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
  * omitted it, so a working account was cooled with `quota_fetch_failed` every
  * minute while refreshing fine from the console.
  */
-export function markProviderApiKeyCredential(providerId: string, credential: string): string {
-  return providerId === "cline" ? markClineApiKeyCredential(credential) : credential;
+export async function markProviderApiKeyCredential(providerId: string, credential: string): Promise<string> {
+  if (providerId !== "cline") return credential;
+  // dynamic-import: B-02 lazy graph — cline-only marker, kept off the boot graph.
+  // The cline-quota graph is loaded lazily: only `cline` accounts ever need
+  // the marker, so a deployment without cline must not pull it into the boot
+  // graph (B-02).
+  const { markClineApiKeyCredential } = await import(
+    "../../providers/integrations/cline/cline-quota"
+  );
+  return markClineApiKeyCredential(credential);
 }
 
 /**