fix(auth): support importing external_idp credentials and Kiro IDE cache for Azure tenant SSO

[0xharryriddle]

Summary

This PR builds on top of feat/azure-tenant-sso from PR Quorinex#131 and fixes several follow-up issues around importing Microsoft 365 / Entra ID external_idp credentials into Kiro-Go.

It adds support for:

• importing CLIProxyAPI_*.json files generated by helper tooling
• accepting both snake_case and camelCase credential JSON
• preserving external IdP refresh metadata during import
• zero-touch Docker import via data/imports/
• importing directly from the local Kiro IDE AWS SSO cache
• portable Docker cache mounting for Linux and macOS
• avoiding Docker port mismatches caused by stale data/config.json

This PR is intended as a support/fix layer for Quorinex#131, not a replacement for it.

Why

PR Quorinex#131 adds the main Microsoft 365 / Entra ID hosted Enterprise SSO flow.

However, real-world usage exposed additional issues:

1. external_idp helper JSON could not be imported reliably because fields like token_endpoint, issuer_url, scopes, and profile_arn were not preserved through the import path.
2. Importing credentials by editing config.json manually could be overwritten by the running app's in-memory config.
3. Docker could publish host port 8080 while the app listened on a stale configured port like 8081, making localhost:8080 unreachable.
4. The Import from Kiro IDE (this host) path failed inside Docker because the container runs as root and looked for the cache at /root/.aws/sso/cache/kiro-auth-token.json.
5. A host-user-specific Docker cache mount is not portable across Linux and macOS, so the cache mount now uses a $HOME-based directory mount.

Changes

1. Normalize helper JSON imports

Adds proxy/cli_json_import.go.

The import path now accepts both helper-native snake_case and app-native camelCase fields, including:

token_endpoint / tokenEndpoint
issuer_url / issuerUrl
profile_arn / profileArn
refresh_token / refreshToken
access_token / accessToken
client_id / clientId
auth_method / authMethod

For external_idp imports, the normalizer preserves refresh-critical fields:

tokenEndpoint
issuerUrl
clientId
scopes
profileArn

This fixes the issue where imported Microsoft 365 credentials failed refresh because the IdP token endpoint/client ID were dropped.

2. Shared import core

Refactors credential importing around a shared importOne path.

This ensures all import mechanisms behave consistently:

• existing /auth/import-credentials
• new /auth/import-cli-json
• Docker watcher imports
• Kiro IDE cache imports

external_idp credentials now go through the same mandatory refresh/persistence path as interactive SSO credentials.

3. New helper JSON import endpoint

Adds:

POST /admin/api/auth/import-cli-json

Supports:

• one JSON object
• array of objects
• { "files": [...] }
• { "accounts": [...] }
• concatenated/newline-separated JSON objects

This makes CLIProxyAPI_*.json files directly importable.

4. Admin UI support

Adds UI support in the Enterprise SSO modal for:

• selecting one or more CLIProxyAPI_*.json files
• pasting JSON manually
• importing directly from the Kiro IDE cache on this host

New UI action:

Import from Kiro IDE (this host)

Locale strings added for English and Chinese.

5. Zero-touch Docker import watcher

Adds an optional watcher controlled by:

KIRO_IMPORT_WATCH=1

Docker Compose enables it by default.

The watcher scans:

data/imports/

and imports matching credential files automatically.

Processed files are moved to:

data/imports/processed/
data/imports/failed/

Failed imports get a .error.txt sidecar.

This avoids manual config.json edits and prevents races with the running app's in-memory config.

6. Kiro IDE cache import

Adds:

POST /admin/api/auth/import-ide-cache

This reads the local Kiro IDE AWS SSO cache:

~/.aws/sso/cache/kiro-auth-token.json

The cache is camelCase and maps directly onto the existing credential decoder.

The stale expiresAt in the IDE cache is intentionally ignored; import performs a mandatory refresh and persists the fresh upstream expiry.

7. Portable Docker support for IDE cache import

Docker cannot use the host user's ~ automatically because the app runs as root inside the container.

This PR mounts the host AWS SSO cache directory into the container:

${KIRO_AWS_SSO_CACHE_DIR:-${HOME}/.aws/sso/cache}:/host-aws-sso-cache:ro

and sets:

KIRO_IDE_CACHE=/host-aws-sso-cache/kiro-auth-token.json

This works across:

• Linux: /home/<user>/.aws/sso/cache
• macOS: /Users/<user>/.aws/sso/cache

If needed, users can override:

KIRO_AWS_SSO_CACHE_DIR=/custom/path/to/sso/cache docker compose up -d

8. Docker port mismatch fix

Docker Compose now forces the in-container app listen port to match the published mapping:

PORT=8080
HOST=0.0.0.0

This prevents stale data/config.json values like 8081 from making:

http://localhost:8080/admin

unreachable.

The host port is still customizable:

KIRO_PORT=9090 docker compose up -d

9. Configurable binary port/host

Adds runtime overrides:

./kiro-go -port 9090
./kiro-go -host 0.0.0.0 -port 9090
PORT=9090 ./kiro-go
HOST=0.0.0.0 PORT=9090 ./kiro-go

Precedence:

CLI flag > env var > config.json

Security Notes

• Passwords are never persisted or sent upstream.
• Email/password input is not used for headless ROPC.
• M365 / Entra ID tenants commonly enforce MFA / Conditional Access, so refresh relies on the OAuth refresh token minted by the hosted SSO / IDE flow.
• The Docker IDE cache mount is read-only.
• The Kiro IDE cache is read server-side only.

Docker Usage

Default:

mkdir -p data
docker compose up -d

Open:

http://localhost:8080/admin

Different host port:

KIRO_PORT=9090 docker compose up -d

Open:

http://localhost:9090/admin

Import helper JSON automatically:

mkdir -p data/imports
cp CLIProxyAPI_*.json data/imports/

Import from Kiro IDE cache:

Admin UI -> Enterprise SSO - Microsoft 365 -> Import from Kiro IDE (this host)

If the AWS SSO cache is in a custom location:

KIRO_AWS_SSO_CACHE_DIR=/custom/path/to/sso/cache docker compose up -d

Verification

Ad-hoc verification was run locally because the live Docker container owns the normal app port.

Verified:

• go build ./...
• go vet ./...
• focused IDE-cache tests:
  • TestReadIdeCacheCredentialExternalIdp
  • TestReadIdeCacheCredentialMissingFile
  • TestReadIdeCacheCredentialNoRefreshToken
  • TestReadIdeCacheCredentialExternalIdpMissingEndpoint
  • TestIdeCachePathPrecedence
• JSON locale files parse successfully
• Docker Compose config renders successfully
• Docker container starts successfully
• Admin page returns 200 OK
• Docker container can see the mounted Kiro IDE cache at:
  • /host-aws-sso-cache/kiro-auth-token.json

[zsecducna]

Reviewed — the feature and its security posture look good (import endpoints are admin-gated, the auto-import watcher is opt-in via KIRO_IMPORT_WATCH and traversal-safe, host/port flags preserve the existing bind, testdata is sanitized). Holding merge on one blocker: 3 of the PR's own watcher tests fail.

--- FAIL: TestImportWatcherProcessesValidFile
--- FAIL: TestImportWatcherMovesInvalidFileToFailed
--- FAIL: TestImportWatcherSkipsDuplicate

Cause: scanImportDir skips files whose mtime is younger than importMinFileAgeSeconds (2s) — a deliberate anti-race guard against importing a half-written file. But the tests write a fixture and call scanImportDir immediately, so the file is ~0s old and always skipped -> 0 imported, nothing moved to processed//failed/.

Fix is test-only (impl is correct): backdate the fixture mtime after writing, e.g.

old := time.Now().Add(-3 * time.Second)
os.Chtimes(path, old, old)

in the test helper, so the file clears the min-age gate deterministically.

(The 2 translator failures on this branch — TestClaudeToolResultMixedTextAndImage, TestOpenAIToolResultImageCarriedWhenFollowedByUser — are pre-existing on main and unrelated to this PR.)

Once the watcher tests are green I'll resolve the conflicts (handler.go, web/app.js, en/zh locales, import_credentials_test.go) and merge into feat/azure-tenant-sso.

[zsecducna]

@0xharryriddle following up on my earlier review — this is still blocked, and I don't see any new commits since fd06da3 (2026-06-29). Two things need doing before I can merge:

1. The 3 watcher tests still fail

Re-confirmed just now on the current head:

--- FAIL: TestImportWatcherProcessesValidFile      (expected 1 account imported, got 0)
--- FAIL: TestImportWatcherMovesInvalidFileToFailed
--- FAIL: TestImportWatcherSkipsDuplicate

The implementation is correct — this is a test-only issue. scanImportDir skips files younger than importMinFileAgeSeconds (2s) to avoid importing a half-written file (proxy/import_watcher.go:104). But the tests write a fixture and scan immediately, so the file is ~0s old and always skipped → 0 imported, nothing moved to processed//failed/.

Fix is to backdate the fixture mtime after writing it, so it clears the min-age gate deterministically:

old := time.Now().Add(-3 * time.Second)
if err := os.Chtimes(path, old, old); err != nil {
    t.Fatal(err)
}

2. Please retarget the PR base to main

Right now the base is feat/azure-tenant-sso, which is fully merged into main (0 ahead, 62 behind) — merging into it wouldn't reach anything. The PR is also CONFLICTING against that base. Please retarget onto main and resolve the conflicts (they're in proxy/handler.go, web/app.js, web/locales/en.json, web/locales/zh.json, and proxy/import_credentials_test.go).

Once tests are green against main, I'll re-review and merge. The feature and security posture already looked good on my last pass — this is purely the test fix + rebase.

[0xharryriddle]

@zsecducna Thanks for the precise diagnosis on both points — both are done and pushed.

1. Watcher tests: fixed (test-only, as you called it)

Your read was exactly right: the fixture was ~0s old and always failed the
importMinFileAgeSeconds gate at proxy/import_watcher.go:104. The implementation
was correct and is untouched.

Fixed via a backdateForWatcher helper in import_watcher_test.go that backdates the
fixture after writing it. One small deviation from your snippet: the offset is derived
from the constant rather than hardcoded to 3s —

old := time.Now().Add(-(importMinFileAgeSeconds + 1) * time.Second)

so the tests won't silently start skipping again if that gate is ever retuned.

All three pass: TestImportWatcherProcessesValidFile,
TestImportWatcherMovesInvalidFileToFailed, TestImportWatcherSkipsDuplicate.

2. Retargeted to main — and it needed more than a conflict resolution

Base is now main, and GitHub reports MERGEABLE. The branch is 10 ahead / 0 behind
main.

Worth flagging: my fork's main was 102 commits stale against this repo, so I merged
the real upstream base. That surfaced something more than textual conflicts — main had
independently implemented its own external_idp import path carrying security work my
branch did not have:

• SSRF allow-listing of tokenEndpoint / issuerUrl
• Azure tenant derivation from userId or the access-token JWT
• trust-on-import for pasted Azure AD JWTs
• a 1MB request body cap

Rather than pick a side, I merged them: that hardening now lives inside the shared
importOne funnel, so all four import paths (API, cli-json, IDE cache, and the
watcher) inherit the allow-list — previously only the one endpoint on main was gated.
Your newer api_key (ksk_...) import branch is preserved ahead of the OAuth path.

Three things I'd ask you to look at specifically

a) firstNonEmpty collision. main has one that does not trim; mine did. I
renamed mine to firstNonBlank rather than collapsing them, since unifying would have
silently changed trimming behaviour for the bedrock callers.

b) api_key region default — this was a real bug my branch would have introduced.
My normalizer applied a blanket us-east-1 default, which broke
TestApiImportCredentialsApiKeyDiscoversRegion. That default is actively harmful for
api_key accounts: they never re-probe, so a placeholder region gets validated as the
answer and an EU key restores as a permanently-403ing pool slot. The default is now
skipped for api_key and left to the probe.

c) importOne is now the single enforcement point for validation, allow-listing,
tenant derivation, and the refresh-vs-trust-on-import decision. That is the main
semantic change in handler.go and the part most worth a second pair of eyes.

Test status

416 passing. The two translator failures you'd flagged as pre-existing
(TestClaudeToolResultMixedTextAndImage,
TestOpenAIToolResultImageCarriedWhenFollowedByUser) now pass — the fix for them was
among the upstream commits I picked up.

One pre-existing flake you should know about

The full suite intermittently reports 1–2 failures of the form:

TempDir RemoveAll cleanup: unlinkat /tmp/TestXxx.../001: directory not empty

It lands on a different random test each run, and it's a cleanup race rather than an
assertion failure — a background goroutine writes into the temp dir after the test body
returns. I confirmed it reproduces on pristine main in a clean worktree, so it is
unrelated to this PR and I have not touched it. It will make CI flaky though, so it
probably deserves its own issue.

Commits: a3a6a1c (test fix), e3008f3 + f8a8e91 (merges).