fix(auth): reload SQLite credentials before token refresh#17
fix(auth): reload SQLite credentials before token refresh#17bhaskoro-muthohar wants to merge 2 commits into
Conversation
|
Thank you for your pull request and welcome to our community. We could not parse the GitHub identity of the following contributors: PTN 677.
|
66881c7 to
dbef53f
Compare
|
Thanks for the PR! 🎉 Before merge, we need a one-time CLA confirmation. Full CLA text: Please reply with: |
When using AWS SSO OIDC with kiro-cli, the gateway caches credentials at startup. If the user re-logs in via kiro-cli, the new refresh_token is written to SQLite but the gateway keeps using the stale cached token, causing auth failures. This fix re-reads credentials from SQLite before attempting a token refresh, ensuring the gateway picks up fresh tokens after kiro-cli re-login without requiring a gateway restart.
dbef53f to
345a585
Compare
|
Thanks for the PR! 🎉 Before merge, we need a one-time CLA confirmation. Full CLA text: Please reply with: |
|
I have read the CLA and I accept its terms |
The AWS SSO OIDC /token endpoint expects JSON body with camelCase keys, not form-urlencoded with snake_case. This was causing 400 invalid_request errors when the gateway tried to refresh tokens. Changes: - Use JSON body instead of form-urlencoded - Use camelCase keys (grantType, clientId, clientSecret, refreshToken) - Update tests to match new format
|
Thanks for the PR! 🎉 Before merge, we need a one-time CLA confirmation. Full CLA text: Please reply with: |
|
@cla-bot check |
|
The cla-bot has been summoned, and re-checked this pull request! |
Problem
When using AWS SSO OIDC with kiro-cli, the gateway caches credentials at startup. If the user re-logs in via kiro-cli (e.g., after SSO token expiration), the new
refresh_tokenis written to SQLite but the gateway keeps using the stale cached token, causing authentication failures.This requires manually restarting the gateway after every kiro-cli re-login, which is inconvenient.
Solution
Re-read credentials from SQLite before attempting a token refresh in
_refresh_token_aws_sso_oidc(). This ensures the gateway picks up fresh tokens after kiro-cli re-login without requiring a restart.Changes
_refresh_token_aws_sso_oidc()to reload credentials from SQLite before refreshTesting