kiroauth

Documentation

Overview

Package kiroauth reads (and refreshes) the ambient kiro-cli SSO access token so vibekit can answer the v3 (KAS) host-mediated auth callback (_kiro/auth/getAccessToken) over the ACP bridge.

kiro-cli acp --agent-engine v3 runs with --auth=acp-callback: the agent asks the CLIENT for the bearer token instead of reading its own store, and it REJECTS any token inside a ~180s expiry buffer (TokenInvalidError) — the host is expected to refresh. So this package both reads and, when the token nears expiry, refreshes it via the standard AWS SSO-OIDC CreateToken (refresh_token grant) and writes the rotated token back to the AWS SSO cache atomically, mirroring what ambient kiro-cli does. That keeps a single cooperative token store rather than forking a private refresh chain.

Token file: ~/.aws/sso/cache/kiro-auth-token.json

{accessToken, refreshToken, expiresAt, clientIdHash, region, ...}

Registration: ~/.aws/sso/cache/<clientIdHash>.json {clientId, clientSecret}

Index

• Constants
• func DefaultProfileDBPath() string
• func DefaultTokenPath() string
• func NearExpiry(expiresAt string, leeway time.Duration) bool
• type ProfileReader
  • func NewProfileReader(path string) *ProfileReader
  • func (r *ProfileReader) Arn() (string, error)
• type Reader
  • func NewReader(path string) *Reader
  • func (r *Reader) Token(ctx context.Context) (accessToken, expiresAt string, err error)

Constants

const RefreshLeeway = 5 * time.Minute

RefreshLeeway matches KAS's TOKEN_REFRESH_LEEWAY (~180s): a token expiring within this window is refreshed before vending. Slightly wider than KAS's own buffer so we refresh before KAS would reject.

Functions

func DefaultProfileDBPath

func DefaultProfileDBPath() string

DefaultProfileDBPath returns kiro-cli's state DB path, honouring XDG_DATA_HOME (falling back to $HOME/.local/share). Empty if neither XDG_DATA_HOME nor HOME resolves.

func DefaultTokenPath

func DefaultTokenPath() string

DefaultTokenPath returns the SSO cache token path under HOME (in the vibekit container HOME=/config/home): the freshest existing candidate file, or the CLI-name default when none exists yet. Empty if HOME can't be resolved.

func NearExpiry

func NearExpiry(expiresAt string, leeway time.Duration) bool

NearExpiry reports whether the token expires within leeway of now. An unparseable timestamp is treated as near-expiry (conservative).

Types

type ProfileReader

type ProfileReader struct {
	// contains filtered or unexported fields
}

ProfileReader reads the active CodeWhisperer profile ARN from kiro-cli's state DB, caching by modtime and serialising reads through a mutex.

func NewProfileReader

func NewProfileReader(path string) *ProfileReader

NewProfileReader returns a ProfileReader for the given DB path (empty uses DefaultProfileDBPath).

func (*ProfileReader) Arn

func (r *ProfileReader) Arn() (string, error)

Arn returns the active CodeWhisperer profile ARN, or an error when the DB is missing/unreadable or carries no recognisable profile entry. Cached by modtime so repeated getAccessToken callbacks don't re-scan.

type Reader

type Reader struct {
	// contains filtered or unexported fields
}

Reader loads + refreshes the SSO access token. The mutex serializes all access so concurrent getAccessToken callbacks (one per bridge) never double-refresh and invalidate the rotating refresh token.

func NewReader

func NewReader(path string) *Reader

NewReader returns a Reader for the given token path. An empty path enables dynamic resolution: every load re-runs DefaultTokenPath so a login that lands in the other candidate file (or a first login after vibekit booted logged-out) is picked up without a restart.

func (*Reader) Token

func (r *Reader) Token(ctx context.Context) (accessToken, expiresAt string, err error)

Token returns a currently-valid access token and its ISO-8601 expiry, refreshing (and writing back) when the cached token is within RefreshLeeway of expiry. On refresh failure it logs and returns the stale token best-effort (KAS may still reject it, but that surfaces as a clear auth error rather than a vibekit crash).