Files
OmniRoute/tests/unit
NOXX - Commiter ece4bf7b53 feat(kiro): support enterprise External IdP (Your organization) logins (#6363)
* feat(kiro): support enterprise External IdP ("Your organization") logins

Kiro's enterprise "Your organization" sign-in federates through the org's own
identity provider (e.g. Microsoft Entra ID) and produces an `external_idp`
token that is fundamentally different from AWS Builder ID / IAM Identity Center
(AWS SSO-OIDC, refresh token starts with `aorAAAAAG`) and the Google/GitHub
social flow. Its `~/.aws/sso/cache/kiro-auth-token.json` carries an org-IdP JWT
access token, an IdP refresh token, a per-tenant `tokenEndpoint`, a public
`clientId` (no secret) and `scopes` (`codewhisperer:conversations …`).

Before this change every import path rejected these tokens (the
`aorAAAAAG` format gate + no client secret), and the runtime/quota calls would
have failed even if imported, so organization accounts could not be used.

This adds full external_idp support:

- New `open-sse/services/kiroExternalIdp.ts`: public-client refresh_token grant
  builder (`buildExternalIdpRefreshParams`), a token-endpoint SSRF allowlist
  (`validateExternalIdpTokenEndpoint` — Microsoft/Okta/Auth0/OneLogin/Ping/
  Google/Cognito, https only), scope normalization, JWT identity extraction
  (`preferred_username`/`upn`/`email`), and the `TokenType: EXTERNAL_IDP`
  header constants.
- Runtime executor (`open-sse/executors/kiro.ts`): send
  `TokenType: EXTERNAL_IDP` for external_idp accounts. CodeWhisperer only binds
  the org-IdP bearer to the Amazon Q Developer profile with this header;
  without it every call returns `ValidationException: Invalid ARN <clientId>`.
- Runtime + import token refresh (`open-sse/services/tokenRefresh.ts`,
  `src/lib/oauth/services/kiro.ts`): refresh external_idp tokens with a
  form-encoded public-client `refresh_token` grant against the org IdP's
  `tokenEndpoint` instead of AWS OIDC / the Kiro social endpoint.
- Quota (`open-sse/services/usage/kiro.ts`): send the same header on
  `GetUsageLimits` so organization quota resolves.
- Import routes: `POST /api/oauth/kiro/import` gains an external_idp branch
  (skips the `aorAAAAAG` gate, refreshes via the org IdP, stores
  clientId/tokenEndpoint/scope/region/profileArn); `GET /auto-import` now
  recognizes external_idp tokens in `~/.aws/sso/cache`, reads the profile ARN
  from the Kiro IDE `profile.json` (org tokens can't enumerate it via
  `ListAvailableProfiles`), and persists the connection. The profile.json
  reader is factored into a shared `readKiroIdeProfileArn()` helper.
- Validation schema (`kiroImportSchema`): accept `tokenEndpoint` + `scopes`.

Tests: new `tests/unit/kiro-external-idp.test.ts` (endpoint allowlist, scope
normalization, identity extraction, public-client refresh body, the org IdP
refresh path, and the `TokenType: EXTERNAL_IDP` header gating). Also hardens
`kiro-windows-auto-import-3363.test.ts` to isolate `USERPROFILE` (Windows
`os.homedir()` reads it, not `HOME`) so the probe never reads a real on-host
Kiro login.

* fix(changelog): restore #6363 bullet after release resync (CHANGELOG-eat guard)

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* fix(changelog): re-restore #6363 bullet after release sync

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* fix(merge): restore #6126 clinepass files reverted by release auto-resolve + rebaseline own tokenRefresh growth

The release sync's merge auto-resolve silently reverted sibling PR #6126's
clinepass work (registry entry, catalog, oauth constants, clineAuth.ts, the
clinepass token-refresh case, and its tests) — all outside this PR's Kiro
external-IdP scope. Restored every affected file to the release version; the
remaining diff is Kiro-IdP-only. Rebaselined tokenRefresh.ts 2182->2249 (+67,
this PR's own external_idp refresh branch) with justification, and restored
the #6126 CHANGELOG bullet (re-inserting only this PR's own).

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

---------

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: artickc <artickc@users.noreply.github.com>
2026-07-09 21:39:09 -03:00
..
2026-07-02 10:47:13 -03:00
2026-06-30 06:54:29 -03:00
2026-06-17 19:26:32 -03:00
2026-07-02 10:47:13 -03:00
2026-07-04 13:00:30 -03:00
2026-06-11 18:52:29 -03:00
2026-07-04 13:00:30 -03:00
2026-07-04 13:00:30 -03:00
2026-07-04 13:00:30 -03:00
2026-07-06 02:25:17 -03:00
2026-06-30 06:54:29 -03:00
2026-06-09 22:57:12 -03:00
2026-06-30 06:54:29 -03:00
2026-07-02 10:47:13 -03:00
2026-06-29 08:40:06 -03:00
2026-07-02 10:47:13 -03:00
2026-06-25 13:17:40 -03:00
2026-06-29 16:51:03 -03:00
2026-05-23 01:46:59 -03:00
2026-06-21 08:56:51 -03:00
2026-06-28 06:58:29 -03:00
2026-06-27 09:07:12 -03:00
2026-04-19 19:50:30 -03:00
2026-07-07 13:14:06 -03:00
2026-05-29 12:44:29 -03:00
2026-06-12 23:49:22 -03:00
2026-06-11 04:01:24 -03:00
2026-06-06 19:13:11 -03:00
2026-06-23 17:06:18 -03:00
2026-06-13 17:27:40 -03:00
2026-06-19 06:49:01 -03:00
2026-07-04 13:00:30 -03:00
2026-07-02 10:47:13 -03:00
2026-05-29 12:44:29 -03:00
2026-06-29 16:51:03 -03:00
2026-05-29 12:44:29 -03:00
2026-06-27 09:07:12 -03:00
2026-05-21 01:29:12 -03:00
2026-05-24 18:05:58 -03:00
2026-06-17 19:26:32 -03:00
2026-05-26 23:51:47 -03:00
2026-06-12 23:49:22 -03:00
2026-06-22 03:17:02 -03:00
2026-06-29 08:40:06 -03:00
2026-06-29 08:40:06 -03:00
2026-06-13 17:27:40 -03:00
2026-06-16 01:00:40 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 08:40:06 -03:00
2026-07-02 10:47:13 -03:00
2026-06-29 08:40:06 -03:00
2026-06-21 08:56:51 -03:00
2026-05-26 23:51:47 -03:00
2026-06-21 08:56:51 -03:00
2026-06-23 03:08:29 -03:00
2026-05-29 12:44:29 -03:00
2026-06-29 08:40:06 -03:00
2026-05-26 23:51:47 -03:00
2026-06-29 08:40:06 -03:00
2026-05-24 18:05:58 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-05-26 23:51:47 -03:00
2026-07-07 13:14:06 -03:00
2026-05-10 00:55:06 -03:00
2026-06-27 09:07:12 -03:00
2026-05-26 23:51:47 -03:00
2026-06-13 17:27:40 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 08:40:06 -03:00
2026-06-29 08:40:06 -03:00
2026-05-29 12:44:29 -03:00
2026-06-29 08:40:06 -03:00
2026-06-12 23:49:22 -03:00
2026-06-27 09:07:12 -03:00
2026-06-29 16:51:03 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-07-07 13:14:06 -03:00
2026-05-26 23:51:47 -03:00
2026-06-25 13:17:40 -03:00
2026-06-23 17:06:18 -03:00
2026-07-04 13:00:30 -03:00
2026-07-04 13:00:30 -03:00
2026-06-26 02:51:06 -03:00
2026-07-02 10:47:13 -03:00
2026-07-07 13:14:06 -03:00
2026-05-10 00:55:06 -03:00
2026-06-29 16:51:03 -03:00
2026-06-29 08:40:06 -03:00
2026-05-26 23:51:47 -03:00
2026-04-30 14:08:50 -03:00
2026-06-29 16:51:03 -03:00
2026-06-11 04:01:24 -03:00
2026-06-29 08:40:06 -03:00
2026-06-29 08:40:06 -03:00
2026-07-06 02:25:17 -03:00
2026-06-17 02:43:21 -03:00
2026-07-04 13:00:30 -03:00
2026-05-26 23:51:47 -03:00
2026-07-06 02:25:17 -03:00
2026-06-15 03:32:11 -03:00
2026-06-19 06:49:01 -03:00
2026-07-02 10:47:13 -03:00
2026-05-26 23:51:47 -03:00
2026-07-04 13:00:30 -03:00
2026-06-29 08:40:06 -03:00
2026-07-07 13:14:06 -03:00
2026-07-02 10:47:13 -03:00
2026-06-29 08:40:06 -03:00
2026-06-29 08:40:06 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-06-20 14:55:24 -03:00
2026-06-22 03:17:02 -03:00
2026-05-23 01:46:59 -03:00
2026-07-07 13:14:06 -03:00
2026-07-04 13:00:30 -03:00
2026-06-26 02:51:06 -03:00
2026-07-04 13:00:30 -03:00
2026-06-27 09:07:12 -03:00
2026-06-19 06:49:01 -03:00
2026-06-20 07:09:43 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-04-30 01:27:03 -03:00
2026-06-22 03:17:02 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-06-19 06:49:01 -03:00
2026-06-29 08:40:06 -03:00
2026-06-12 23:49:22 -03:00
2026-06-12 23:49:22 -03:00
2026-06-11 18:52:29 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 08:40:06 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 08:40:06 -03:00
2026-06-30 06:54:29 -03:00
2026-07-04 13:00:30 -03:00
2026-04-30 01:27:03 -03:00
2026-06-30 06:54:29 -03:00
2026-06-29 16:51:03 -03:00
2026-07-04 13:00:30 -03:00
2026-06-29 08:40:06 -03:00
2026-07-07 13:14:06 -03:00
2026-07-04 13:00:30 -03:00
2026-05-23 01:46:59 -03:00
2026-05-23 01:46:59 -03:00
2026-06-09 15:56:24 -03:00
2026-06-10 13:49:08 -03:00
2026-05-29 19:54:00 -03:00
2026-06-29 08:40:06 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-06-17 19:26:32 -03:00
2026-06-29 08:40:06 -03:00
2026-06-13 17:27:40 -03:00
2026-06-17 02:43:21 -03:00
2026-07-07 13:14:06 -03:00
2026-06-30 06:54:29 -03:00
2026-07-04 13:00:30 -03:00
2026-07-04 13:00:30 -03:00
2026-07-04 13:00:30 -03:00
2026-05-24 18:05:58 -03:00
2026-06-30 06:54:29 -03:00
2026-06-29 08:40:06 -03:00
2026-06-07 07:20:02 -03:00
2026-04-28 20:46:25 -03:00
2026-06-29 08:40:06 -03:00
2026-07-07 13:14:06 -03:00
2026-05-29 12:44:29 -03:00
2026-05-29 12:44:29 -03:00
2026-06-19 06:49:01 -03:00
2026-06-29 16:51:03 -03:00
2026-06-29 08:40:06 -03:00
2026-06-23 03:08:29 -03:00
2026-05-26 23:51:47 -03:00
2026-06-30 06:54:29 -03:00
2026-06-12 23:49:22 -03:00
2026-07-04 13:00:30 -03:00
2026-07-02 10:47:13 -03:00
2026-06-30 06:54:29 -03:00
2026-07-02 10:47:13 -03:00
2026-06-27 09:07:12 -03:00
2026-05-26 23:51:47 -03:00
2026-07-07 13:14:06 -03:00
2026-06-16 01:00:40 -03:00
2026-05-26 23:51:47 -03:00
2026-06-29 08:40:06 -03:00
2026-06-04 20:05:38 -03:00
2026-06-29 08:40:06 -03:00
2026-06-12 23:49:22 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 16:51:03 -03:00
2026-06-29 08:40:06 -03:00
2026-05-29 12:44:29 -03:00
2026-07-07 13:14:06 -03:00
2026-06-20 07:09:43 -03:00
2026-06-19 06:49:01 -03:00
2026-06-07 07:20:02 -03:00
2026-06-11 04:01:24 -03:00
2026-06-29 08:40:06 -03:00
2026-06-29 08:40:06 -03:00
2026-05-24 18:05:58 -03:00
2026-05-26 23:51:47 -03:00
2026-06-12 23:49:22 -03:00
2026-06-16 01:00:40 -03:00
2026-06-12 23:49:22 -03:00
2026-06-27 09:07:12 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-07-04 13:00:30 -03:00
2026-07-04 13:00:30 -03:00
2026-06-16 01:00:40 -03:00
2026-07-07 13:14:06 -03:00