[artickc]

Summary

Adds support for Kiro enterprise "Your organization" (External IdP) logins — the enterprise SSO flow that federates through an org's own identity provider (most commonly Microsoft Entra ID). These accounts were previously impossible to use: every import path rejected them and the runtime/quota calls would fail even if imported.

An External IdP Kiro token (~/.aws/sso/cache/kiro-auth-token.json) is fundamentally different from the three flows already supported:

	Builder ID / IDC	Google/GitHub social	External IdP (new)
authMethod	builder-id / idc	imported	external_idp
refresh token	aorAAAAAG… (AWS SSO-OIDC)	Kiro-social	org-IdP (e.g. 1.AXoA…)
refresh endpoint	oidc.{region}.amazonaws.com	prod.…auth.desktop.kiro.dev	org IdP tokenEndpoint
client secret	yes	yes (registered)	none (public client)
runtime header	—	—	TokenType: EXTERNAL_IDP

What was failing

1. POST /api/oauth/kiro/import → validateImportToken throws Invalid token format. Token should start with aorAAAAAG….
2. GET /api/oauth/kiro/auto-import → tryAwsSsoCache only matches aorAAAAAG tokens, so the org token is never found.
3. Even if imported, runtime generateAssistantResponse and GetUsageLimits return ValidationException: Invalid ARN <clientId> because the org-IdP bearer isn't bound to the Amazon Q Developer profile.

Changes

• New open-sse/services/kiroExternalIdp.ts — buildExternalIdpRefreshParams (public-client refresh_token grant: client_id + refresh_token + scope, no secret), validateExternalIdpTokenEndpoint (https + IdP host allowlist — Microsoft/Okta/Auth0/OneLogin/Ping/Google/Cognito — SSRF guard), normalizeScope, emailFromExternalIdpToken (preferred_username/upn/email), and the TokenType: EXTERNAL_IDP constants.
• open-sse/executors/kiro.ts — send TokenType: EXTERNAL_IDP for external_idp accounts (gated on authMethod; AWS SSO/social must not send it).
• open-sse/services/tokenRefresh.ts + src/lib/oauth/services/kiro.ts — refresh external_idp tokens against the org IdP tokenEndpoint.
• open-sse/services/usage/kiro.ts — send TokenType: EXTERNAL_IDP on GetUsageLimits so org quota resolves.
• src/app/api/oauth/kiro/import/route.ts — dedicated external_idp import branch.
• src/app/api/oauth/kiro/auto-import/route.ts — recognize external_idp tokens in ~/.aws/sso/cache, read the profile ARN from the Kiro IDE profile.json (org tokens can't enumerate it via ListAvailableProfiles, which returns an empty list), persist the connection. Factors the profile.json reader into readKiroIdeProfileArn().
• kiroImportSchema — accept tokenEndpoint + scopes.

Verification

Validated end-to-end against a live Microsoft Entra org Kiro account:

• Refresh: POST login.microsoftonline.com/{tenant}/oauth2/v2.0/token (form-encoded public client) → new access + rotated refresh token. ✅
• Chat: generateAssistantResponse with TokenType: EXTERNAL_IDP + profileArn → HTTP 200, streamed assistant content + metering. ✅ (Without the header: ValidationException: Invalid ARN <clientId>.)
• Quota: GetUsageLimits with TokenType: EXTERNAL_IDP → full usageBreakdownList (plan "KIRO POWER", credits used/limit). ✅

Tests

• New tests/unit/kiro-external-idp.test.ts — endpoint allowlist, scope normalization, identity extraction, public-client refresh body, the org-IdP refresh path (asserts it does NOT hit AWS OIDC / Kiro social), and TokenType: EXTERNAL_IDP header gating.
• Hardens tests/unit/kiro-windows-auto-import-3363.test.ts to isolate USERPROFILE (Windows os.homedir() reads USERPROFILE, not HOME), so the probe never reads a real on-host Kiro login.

Existing Kiro / token-refresh suites remain green; scoped typecheck is clean.

[gemini-code-assist]

Code Review

This pull request introduces support for Kiro / Amazon Q External IdP (enterprise "Your organization" SSO) accounts, including dedicated token refresh logic, token endpoint validation, and automatic profile ARN importing. The review feedback highlights several key improvement opportunities: validating the presence of access_token in refresh responses to prevent saving broken connections, safeguarding JSON parsing against non-object payloads in both JWT decoding and profile parsing, and optimizing performance by caching the profile ARN read operation outside of the cache-probing loop.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If the External IdP refresh endpoint returns a successful response (HTTP 200) but is missing the access_token field, returning an undefined accessToken will result in a broken connection being saved. Validate that tokens.access_token is present and log an error/return null if it is missing.

      const tokens = await response.json();
      if (!tokens?.access_token) {
        log?.error?.("TOKEN_REFRESH", "Kiro external_idp refresh response missing access_token");
        return null;
      }
      log?.info?.("TOKEN_REFRESH", "Successfully refreshed Kiro external_idp token", {
        hasNewAccessToken: !!tokens.access_token,
        hasNewRefreshToken: !!tokens.refresh_token,
        expiresIn: tokens.expires_in,
      });
      return {
        accessToken: tokens.access_token,
        refreshToken: tokens.refresh_token || refreshToken,
        expiresIn: tokens.expires_in || 3600,
      };

[gemini-code-assist]

Ensure that the response from the External IdP refresh endpoint actually contains an access_token. If it is missing, throw an explicit error to prevent returning a broken token object to the caller.

      const data = await response.json();
      if (!data?.access_token) {
        throw new Error("Response from External IdP is missing access_token");
      }
      return {
        accessToken: data.access_token,
        refreshToken: data.refresh_token || refreshToken,
        expiresIn: data.expires_in || 3600,
      };

[gemini-code-assist]

The decodeJwtPayload function parses the JWT payload using JSON.parse, which can return null, arrays, or other primitive types if the JSON is valid but not an object. To ensure type safety and prevent downstream runtime errors, verify that the parsed payload is a non-null object and not an array before returning it.

export function decodeJwtPayload(jwt: unknown): Record<string, unknown> | null {
  try {
    if (typeof jwt !== "string") return null;
    const parts = jwt.split(".");
    if (parts.length !== 3) return null;
    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
    const padding = (4 - (base64.length % 4)) % 4;
    const json = Buffer.from(`${base64}${"=".repeat(padding)}`, "base64").toString("utf8");
    const payload = JSON.parse(json);
    if (payload && typeof payload === "object" && !Array.isArray(payload)) {
      return payload as Record<string, unknown>;
    }
    return null;
  } catch {
    return null;
  }
}

[gemini-code-assist]

If profile.json contains a non-object JSON value (such as null or a primitive), JSON.parse will succeed but accessing profileData.arn will throw a runtime TypeError. Guard against this by checking that profileData is a non-null object.

Suggested change

	const profileData = JSON.parse(profileContent);
	if (profileData.arn) {
	return profileData.arn.replace(
	/arn:aws:codewhisperer:[^:]+:/,
	"arn:aws:codewhisperer:us-east-1:"
	);
	}
	const profileData = JSON.parse(profileContent);
	if (profileData && typeof profileData === "object" && "arn" in profileData && typeof profileData.arn === "string") {
	return profileData.arn.replace(
	/arn:aws:codewhisperer:[^:]+:/,
	"arn:aws:codewhisperer:us-east-1:"
	);
	}

[gemini-code-assist]

Performance/Efficiency Optimization: readKiroIdeProfileArn is called inside the loop of tryAwsSsoCache for each file found in the cache directory. Since this function performs disk I/O on multiple paths, it is highly recommended to read the profile ARN once before the loop starts and reuse the cached value.