auth

Documentation

Index

• Constants
• Variables
• func OpenDB(path string) (*sql.DB, error)
• type AuthManager
  • func NewAuthManager(dbPath string, opts ...Option) *AuthManager
  • func (m *AuthManager) GetToken(ctx context.Context) (*Credentials, error)
  • func (m *AuthManager) InvalidateCache()
  • func (m *AuthManager) UsesAPIKey() bool
• type Credentials
  • func ReadCredentials(db *sql.DB) (*Credentials, error)
• type Option
  • func WithAPIKey(key, region string) Option
  • func WithHTTPClient(c *http.Client) Option

Constants

const (
	AuthTypeSocial = "social"
	AuthTypeIDC    = "idc"
	AuthTypeAPIKey = "api_key"
)

Auth types. Social and IDC are read from Kiro CLI's SQLite database and are refreshable; APIKey is supplied directly via KIRO_API_KEY and is not.

Variables

var ErrNoCredentials = errors.New("no kiro credentials found")

ErrNoCredentials is returned when no token key is found in the database.

Functions

func OpenDB

func OpenDB(path string) (*sql.DB, error)

OpenDB opens the Kiro CLI SQLite database at path in read-only mode.

Types

type AuthManager

type AuthManager struct {
	// contains filtered or unexported fields
}

AuthManager manages Kiro credentials with caching and automatic refresh.

func NewAuthManager

func NewAuthManager(dbPath string, opts ...Option) *AuthManager

NewAuthManager creates an AuthManager that reads credentials from the given SQLite DB path.

func (*AuthManager) GetToken

func (m *AuthManager) GetToken(ctx context.Context) (*Credentials, error)

GetToken returns valid credentials, refreshing if necessary. It is safe for concurrent use. Concurrent refresh requests are deduplicated via singleflight.

func (*AuthManager) InvalidateCache

func (m *AuthManager) InvalidateCache()

InvalidateCache clears the cached credentials, forcing the next GetToken call to re-read from DB and potentially refresh. Used when a 403 indicates the cached token is rejected by the upstream API.

func (*AuthManager) UsesAPIKey

func (m *AuthManager) UsesAPIKey() bool

UsesAPIKey reports whether credentials come from a Kiro API key rather than from the Kiro CLI database.

type Credentials

type Credentials struct {
	AccessToken  string
	RefreshToken string
	ExpiresAt    int64
	Region       string // API region
	SSORegion    string // OIDC region (may differ from API region)
	ClientID     string
	ClientSecret string
	ProfileARN   string // from state table, key "api.codewhisperer.profile"
	AuthType     string // "social", "idc", or "api_key"
}

Credentials holds authentication credentials, either read from Kiro CLI's SQLite database or, for AuthTypeAPIKey, supplied directly by the user.

func ReadCredentials

func ReadCredentials(db *sql.DB) (*Credentials, error)

ReadCredentials reads authentication credentials from the Kiro CLI SQLite database.

type Option

type Option func(*AuthManager)

Option configures an AuthManager.

func WithAPIKey

func WithAPIKey(key, region string) Option

WithAPIKey configures a Kiro API key ("ksk_…", normally from KIRO_API_KEY) as the credential source. Such a key is long-lived and presented directly to the API, so the SQLite database is never opened and no refresh ever happens — which is what lets kirocc run with no Kiro CLI login, in CI or a container. An empty key is ignored, leaving the database path in effect.

func WithHTTPClient

func WithHTTPClient(c *http.Client) Option

WithHTTPClient sets a custom HTTP client for token refresh requests.