fix(auth): reload SQLite credentials before AWS SSO OIDC token refresh#22
Conversation
When kiro-cli refreshes tokens and updates the SQLite database, kiro-gateway was continuing to use stale credentials from memory, causing 400 errors from AWS SSO OIDC endpoint. This change reloads credentials from SQLite at the beginning of _refresh_token_aws_sso_oidc() to pick up fresh tokens after kiro-cli re-login. Related: jwadow#14
|
Thanks for the PR! 🎉 Before merge, we need a one-time CLA confirmation. Full CLA text: Please reply once with: |
|
I have read the CLA and I accept its terms |
|
@cla-bot check |
|
Thanks for the PR! 🎉 Before merge, we need a one-time CLA confirmation. Full CLA text: Please reply once with: |
|
The cla-bot has been summoned, and re-checked this pull request! |
|
I have read the CLA and I accept its terms |
jwadow
left a comment
jwadow
left a comment
There was a problem hiding this comment.
Thanks, good fix. The approach of reloading SQLite credentials before token refresh correctly handles the case where kiro-cli updates tokens while the gateway is running in a container.
Code is clean - reuses existing method, minimal changes, appropriate log level. Test covers the main scenario well.
One minor notee: sqlite3 and json imports are inside the test function rather than at the top of the file, which differs from the rest of the project. Not a blocker, just noting for consistency.
|
@cla-bot check |
|
The cla-bot has been summoned, and re-checked this pull request! |
3 participants
Problem
When kiro-cli refreshes tokens and updates the SQLite database, kiro-gateway continues using stale credentials from memory, causing 400 errors from AWS SSO OIDC endpoint.
Users had to manually restart the container after every
kiro login.Error Pattern
Solution
Reload credentials from SQLite at the beginning of
_refresh_token_aws_sso_oidc()to pick up fresh tokens after kiro-cli re-login.Changes
kiro_gateway/auth.py: Add SQLite reload before token refresh (4 lines)tests/unit/test_auth_manager.py: Add test for reload behaviorRelated
Testing