", error: string }],
+ * // Single-token success path also includes `connection` for backwards compat.
+ * connection?: { id, provider, email }
+ * }
*/
export async function POST(request) {
+ let payload;
try {
- const { refreshToken } = await request.json();
+ payload = await request.json();
+ } catch {
+ return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+ }
+
+ const tokens = collectRefreshTokens(payload);
+ if (tokens.length === 0) {
+ return NextResponse.json(
+ { error: "Refresh token is required" },
+ { status: 400 }
+ );
+ }
- if (!refreshToken || typeof refreshToken !== "string") {
- return NextResponse.json(
- { error: "Refresh token is required" },
- { status: 400 }
- );
- }
+ const kiroService = new KiroService();
+ // Validate + persist each token in parallel. One bad token must not block
+ // the rest.
+ const results = await Promise.all(
+ tokens.map((rt) => importOne(rt, kiroService))
+ );
- const kiroService = new KiroService();
+ const imported = [];
+ const failed = [];
+ for (const r of results) {
+ if (r.ok) imported.push(r.payload);
+ else failed.push(r.payload);
+ }
+
+ const wasSingle = tokens.length === 1 && !Array.isArray(payload?.refreshTokens);
+ const success = imported.length > 0;
+
+ const body = { success, imported, failed };
+ if (wasSingle && success) {
+ // Preserve the legacy single-token response shape so existing clients keep
+ // working without changes.
+ body.connection = {
+ id: imported[0].id,
+ provider: "kiro",
+ email: imported[0].email,
+ };
+ }
- // Validate and refresh token
- const tokenData = await kiroService.validateImportToken(refreshToken.trim());
+ return NextResponse.json(body, { status: success ? 200 : 422 });
+}
- // Extract email from JWT if available
+/**
+ * Validate and persist a single refresh token. Failures are returned (not
+ * thrown) so `Promise.all` won't short-circuit when one token is bad.
+ */
+async function importOne(refreshToken, kiroService) {
+ const masked = maskToken(refreshToken);
+ try {
+ const tokenData = await kiroService.validateImportToken(refreshToken);
const email = kiroService.extractEmailFromJWT(tokenData.accessToken);
- // Save to database
const connection = await createProviderConnection({
provider: "kiro",
authType: "oauth",
@@ -41,16 +95,22 @@ export async function POST(request) {
testStatus: "active",
});
- return NextResponse.json({
- success: true,
- connection: {
+ return {
+ ok: true,
+ payload: {
id: connection.id,
- provider: connection.provider,
email: connection.email,
+ refreshToken: masked,
},
- });
+ };
} catch (error) {
- console.log("Kiro import token error:", error);
- return NextResponse.json({ error: error.message }, { status: 500 });
+ console.log("Kiro import token error:", error?.message || error);
+ return {
+ ok: false,
+ payload: {
+ refreshToken: masked,
+ error: error?.message || String(error),
+ },
+ };
}
}
diff --git a/src/shared/components/KiroAuthModal.js b/src/shared/components/KiroAuthModal.js
index 6f567c6d594..a8d7f3655ce 100644
--- a/src/shared/components/KiroAuthModal.js
+++ b/src/shared/components/KiroAuthModal.js
@@ -1,43 +1,66 @@
"use client";
-import { useState, useEffect } from "react";
+import { useState, useEffect, useMemo } from "react";
import PropTypes from "prop-types";
import { Modal, Button, Input } from "@/shared/components";
/**
* Kiro Auth Method Selection Modal
- * Auto-detects token from AWS SSO cache or allows manual import
+ * Auto-detects token from AWS SSO cache or allows manual import.
+ *
+ * Manual import accepts multiple refresh tokens at once — paste one per line
+ * (or whitespace / comma / semicolon separated). Each token is validated and
+ * persisted independently; the modal reports a per-token summary on completion.
*/
export default function KiroAuthModal({ isOpen, onMethodSelect, onClose }) {
const [selectedMethod, setSelectedMethod] = useState(null);
const [idcStartUrl, setIdcStartUrl] = useState("");
const [idcRegion, setIdcRegion] = useState("us-east-1");
- const [refreshToken, setRefreshToken] = useState("");
+ const [refreshTokens, setRefreshTokens] = useState("");
const [error, setError] = useState(null);
const [importing, setImporting] = useState(false);
const [autoDetecting, setAutoDetecting] = useState(false);
- const [autoDetected, setAutoDetected] = useState(false);
-
- // Auto-detect token when import method is selected
+ const [autoDetected, setAutoDetected] = useState(0);
+ const [importResult, setImportResult] = useState(null);
+
+ // Live token count (handles whitespace / comma / semicolon separators).
+ const tokenCount = useMemo(() => {
+ return refreshTokens
+ .split(/[\s,;]+/g)
+ .map((t) => t.trim())
+ .filter(Boolean).length;
+ }, [refreshTokens]);
+
+ // Auto-detect token(s) from AWS SSO cache when import method is selected.
useEffect(() => {
if (selectedMethod !== "import" || !isOpen) return;
const autoDetect = async () => {
setAutoDetecting(true);
setError(null);
- setAutoDetected(false);
+ setAutoDetected(0);
+ setImportResult(null);
try {
- const res = await fetch("/api/oauth/kiro/auto-import");
+ const res = await fetch("/api/oauth/kiro/auto-import?all=1");
const data = await res.json();
if (data.found) {
- setRefreshToken(data.refreshToken);
- setAutoDetected(true);
+ const list = Array.isArray(data.tokens) && data.tokens.length > 0
+ ? data.tokens.map((t) => t.refreshToken)
+ : data.refreshToken
+ ? [data.refreshToken]
+ : [];
+ if (list.length > 0) {
+ setRefreshTokens(list.join("\n"));
+ setAutoDetected(list.length);
+ } else {
+ setError(data.error || "No tokens found in AWS SSO cache");
+ }
} else {
setError(data.error || "Could not auto-detect token");
}
- } catch (err) {
+ } catch {
setError("Failed to auto-detect token");
} finally {
setAutoDetecting(false);
@@ -50,37 +73,60 @@ export default function KiroAuthModal({ isOpen, onMethodSelect, onClose }) {
const handleMethodSelect = (method) => {
setSelectedMethod(method);
setError(null);
+ setImportResult(null);
};
const handleBack = () => {
setSelectedMethod(null);
setError(null);
+ setImportResult(null);
+ setRefreshTokens("");
};
- const handleImportToken = async () => {
- if (!refreshToken.trim()) {
- setError("Please enter a refresh token");
+ const handleImportTokens = async () => {
+ const tokens = refreshTokens
+ .split(/[\s,;]+/g)
+ .map((t) => t.trim())
+ .filter(Boolean);
+
+ if (tokens.length === 0) {
+ setError("Please paste at least one refresh token");
return;
}
setImporting(true);
setError(null);
+ setImportResult(null);
try {
const res = await fetch("/api/oauth/kiro/import", {
method: "POST",
headers: { "Content-Type": "application/json" },
- body: JSON.stringify({ refreshToken: refreshToken.trim() }),
+ body: JSON.stringify({ refreshTokens: tokens }),
});
const data = await res.json();
- if (!res.ok) {
- throw new Error(data.error || "Import failed");
+ // The API returns 200/422 with imported/failed arrays. 4xx/5xx with an
+ // `error` field only happens for malformed payloads.
+ if (!data || (typeof data.success !== "boolean" && data.error)) {
+ throw new Error(data?.error || "Import failed");
}
- // Success - notify parent to refresh connections
- onMethodSelect("import");
+ const imported = Array.isArray(data.imported) ? data.imported : [];
+ const failed = Array.isArray(data.failed) ? data.failed : [];
+ setImportResult({ imported, failed });
+
+ if (imported.length === 0 && failed.length > 0) {
+ setError(
+ failed.length === 1
+ ? failed[0].error || "Token validation failed"
+ : `All ${failed.length} tokens failed to import`
+ );
+ }
+ // Stay open so the user can review the per-token outcome. The "Done"
+ // button below calls onMethodSelect("import") which triggers parent
+ // refresh + close.
} catch (err) {
setError(err.message);
} finally {
@@ -88,6 +134,16 @@ export default function KiroAuthModal({ isOpen, onMethodSelect, onClose }) {
}
};
+ const handleImportDone = () => {
+ if (importResult && importResult.imported.length > 0) {
+ // Tell parent to refresh its connection list and close the modal.
+ onMethodSelect("import");
+ } else {
+ // No imports succeeded — just go back to method selection.
+ handleBack();
+ }
+ };
+
const handleIdcContinue = () => {
if (!idcStartUrl.trim()) {
setError("Please enter your IDC start URL");
@@ -184,7 +240,7 @@ export default function KiroAuthModal({ isOpen, onMethodSelect, onClose }) {
Import Token
- Paste refresh token from Kiro IDE.
+ Paste one or more refresh tokens from Kiro IDE. Bulk import supported.
@@ -307,7 +363,7 @@ export default function KiroAuthModal({ isOpen, onMethodSelect, onClose }) {
progress_activity
- Auto-detecting token...
+ Auto-detecting tokens...
Reading from AWS SSO cache
@@ -318,24 +374,26 @@ export default function KiroAuthModal({ isOpen, onMethodSelect, onClose }) {
{!autoDetecting && (
<>
{/* Success message if auto-detected */}
- {autoDetected && (
+ {autoDetected > 0 && !importResult && (
check_circle
- Token auto-detected from Kiro IDE successfully!
+ {autoDetected === 1
+ ? "Token auto-detected from Kiro IDE successfully!"
+ : `${autoDetected} tokens auto-detected from AWS SSO cache.`}
)}
{/* Info message if not auto-detected */}
- {!autoDetected && !error && (
+ {autoDetected === 0 && !error && !importResult && (
info
- Kiro IDE not detected. Please paste your refresh token manually.
+ Kiro IDE not detected. Paste one or more refresh tokens below — one per line.
@@ -343,28 +401,86 @@ export default function KiroAuthModal({ isOpen, onMethodSelect, onClose }) {
- setRefreshToken(e.target.value)}
- placeholder="Token will be auto-filled..."
- className="font-mono text-sm"
+