Documentation
¶
Overview ¶
Package kiroauth reads (and refreshes) the ambient kiro-cli SSO access token so vibekit can answer the v3 (KAS) host-mediated auth callback (_kiro/auth/getAccessToken) over the ACP bridge.
kiro-cli acp --agent-engine v3 runs with --auth=acp-callback: the agent asks the CLIENT for the bearer token instead of reading its own store, and it REJECTS any token inside a ~180s expiry buffer (TokenInvalidError) — the host is expected to refresh. So this package both reads and, when the token nears expiry, refreshes it via the standard AWS SSO-OIDC CreateToken (refresh_token grant) and writes the rotated token back to the AWS SSO cache atomically, mirroring what ambient kiro-cli does. That keeps a single cooperative token store rather than forking a private refresh chain.
Token file: ~/.aws/sso/cache/kiro-auth-token.json
{accessToken, refreshToken, expiresAt, clientIdHash, region, ...}
Registration: ~/.aws/sso/cache/<clientIdHash>.json {clientId, clientSecret}
Index ¶
Constants ¶
const RefreshLeeway = 5 * time.Minute
RefreshLeeway matches KAS's TOKEN_REFRESH_LEEWAY (~180s): a token expiring within this window is refreshed before vending. Slightly wider than KAS's own buffer so we refresh before KAS would reject.
Variables ¶
This section is empty.
Functions ¶
func DefaultProfileDBPath ¶
func DefaultProfileDBPath() string
DefaultProfileDBPath returns kiro-cli's state DB path, honouring XDG_DATA_HOME (falling back to $HOME/.local/share). Empty if neither XDG_DATA_HOME nor HOME resolves.
func DefaultTokenPath ¶
func DefaultTokenPath() string
DefaultTokenPath returns the SSO cache token path under HOME (in the vibekit container HOME=/config/home): the freshest existing candidate file, or the CLI-name default when none exists yet. Empty if HOME can't be resolved.
Types ¶
type ProfileReader ¶
type ProfileReader struct {
// contains filtered or unexported fields
}
ProfileReader reads the active CodeWhisperer profile ARN from kiro-cli's state DB, caching by modtime and serialising reads through a mutex.
func NewProfileReader ¶
func NewProfileReader(path string) *ProfileReader
NewProfileReader returns a ProfileReader for the given DB path (empty uses DefaultProfileDBPath).
func (*ProfileReader) Arn ¶
func (r *ProfileReader) Arn() (string, error)
Arn returns the active CodeWhisperer profile ARN, or an error when the DB is missing/unreadable or carries no recognisable profile entry. Cached by modtime so repeated getAccessToken callbacks don't re-scan.
type Reader ¶
type Reader struct {
// contains filtered or unexported fields
}
Reader loads + refreshes the SSO access token. The mutex serializes all access so concurrent getAccessToken callbacks (one per bridge) never double-refresh and invalidate the rotating refresh token.
func NewReader ¶
NewReader returns a Reader for the given token path. An empty path enables dynamic resolution: every load re-runs DefaultTokenPath so a login that lands in the other candidate file (or a first login after vibekit booted logged-out) is picked up without a restart.
func (*Reader) Token ¶
Token returns a currently-valid access token and its ISO-8601 expiry, refreshing (and writing back) when the cached token is within RefreshLeeway of expiry. On refresh failure it logs and returns the stale token best-effort (KAS may still reject it, but that surfaces as a clear auth error rather than a vibekit crash).
Source Files