luulam/9router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(kiro): route IdC auth to regional CodeWhisperer surface (#2297)

Browse Source 
IAM Identity Center (authMethod=idc) tokens failed every request with 403
"bearer token invalid". Treat idc like api_key/external_idp:

- executors/kiro.js: route idc to *.amazonaws.com CodeWhisperer surface,
  region-aware from credentials.region instead of hardcoded us-east-1.
- openai-to-kiro.js / claude-to-kiro.js: send resolved profileArn or empty
  for idc/external_idp, never the shared builder-id placeholder ARN.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Volodymyr Saakian
2026-07-03 11:05:32 +07:00
committed by decolua
parent 9102c4c6d8
commit abc0add031
3 changed files with 28 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
open-sse/translator/request/claude-to-kiro.js
View File

@@ -393,9 +393,12 @@ export function claudeToKiroRequest(model, body, stream, credentials) {
reconcileOrphanedToolResults(history, currentMessage);
}
// API-key auth must never use the shared default ARN (403); OAuth/social fall back to it.
// api_key / idc / external_idp must never use the shared default ARN (belongs
// to another account → 403 "bearer token invalid"); OAuth/social fall back to it.
const authMethod = credentials?.providerSpecificData?.authMethod;
const profileArn = authMethod === "api_key"
const accountBoundAuth =
authMethod === "api_key" || authMethod === "idc" || authMethod === "external_idp";
const profileArn = accountBoundAuth
? (credentials?.providerSpecificData?.profileArn || "")
: (credentials?.providerSpecificData?.profileArn || resolveDefaultProfileArn(authMethod));

9
open-sse/translator/request/openai-to-kiro.js
View File

@@ -530,8 +530,15 @@ export function openaiToKiroRequest(model, body, stream, credentials) {
// (the ARN doesn't belong to the key's account). So for api_key, only send a
// profileArn that was actually resolved for this connection — never the default.
// OAuth/social keep the default fallback (their tokens accept it).
// api_key / idc / external_idp carry an account-specific (or token-bound)
// profile. The shared builder-id/social default ARN belongs to a different
// account and triggers 403 "bearer token invalid", so never fall back to it —
// send the resolved ARN, or an empty string so CodeWhisperer uses the token's
// own default profile. Only OAuth/social keep the shared placeholder.
const authMethod = credentials?.providerSpecificData?.authMethod;
const profileArn = authMethod === "api_key"
const accountBoundAuth =
authMethod === "api_key" || authMethod === "idc" || authMethod === "external_idp";
const profileArn = accountBoundAuth
? (credentials?.providerSpecificData?.profileArn || "")
: (credentials?.providerSpecificData?.profileArn || resolveDefaultProfileArn(authMethod));