{"record":{"id":"d420a1b10933f065","repo":"decolua/9router","slug":"profile-arn-is-required","errorCode":null,"errorMessage":"profile_arn is required","messagePattern":"profile_arn is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/kiroExternalIdp.js","lineNumber":108,"sourceCode":"\n  const authMethod = normalizeString(input.auth_method || input.authMethod);\n  if (authMethod && authMethod !== \"external_idp\") {\n    throw new Error(\"Only external_idp Kiro auth is supported by this importer\");\n  }\n\n  const accessToken = normalizeString(input.access_token || input.accessToken);\n  const refreshToken = normalizeString(input.refresh_token || input.refreshToken);\n  const clientId = normalizeString(input.client_id || input.clientId);\n  const tokenEndpoint = validateMicrosoftTokenEndpoint(input.token_endpoint || input.tokenEndpoint);\n  const profileArn = normalizeString(input.profile_arn || input.profileArn);\n  const region = normalizeString(input.region) || DEFAULT_REGION;\n  const scope = normalizeScope(input.scopes || input.scope);\n\n  if (!accessToken) throw new Error(\"access_token is required\");\n  if (!refreshToken) throw new Error(\"refresh_token is required\");\n  if (!clientId) throw new Error(\"client_id is required\");\n  if (!scope) throw new Error(\"scopes is required\");\n  if (!profileArn) throw new Error(\"profile_arn is required\");\n\n  const payload = decodeJwtPayload(accessToken);\n  const email = input.email || payload?.email || payload?.preferred_username || payload?.upn || payload?.sub || null;\n\n  return {\n    accessToken,\n    refreshToken,\n    expiresAt: resolveExpiresAt(input),\n    email,\n    providerSpecificData: {\n      profileArn,\n      region,\n      authMethod: \"external_idp\",\n      provider: \"CLIProxyAPI\",\n      clientId,\n      tokenEndpoint,\n      scope,\n    },","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/lib/oauth/kiroExternalIdp.js#L90-L126","documentation":"profile_arn (or profileArn) — the AWS CodeWhriter/Kiro profile ARN — is required by this importer. It identifies which Kiro profile the credential operates against and is stored in providerSpecificData for API calls. Missing or empty profile_arn aborts the import.","triggerScenarios":"Auth JSON lacking profile_arn/profileArn or containing an empty/whitespace value; importing a generic Microsoft OAuth document that has tokens but no Kiro profile metadata.","commonSituations":"Building the auth JSON manually from an Entra token response and forgetting the Kiro-specific profile_arn; copying only the OAuth half of a CLIProxyAPI auth file; ARN field stored under a custom key the importer doesn't recognize.","solutions":["Add profile_arn (or profileArn) with the ARN from the CLIProxyAPI auth file (arn:aws:...:profile/... form)","Re-export the auth document from CLIProxyAPI — the Kiro login flow records profile_arn automatically","Verify the ARN string has no leading/trailing whitespace-only content (trim is applied, then emptiness checked)","Confirm you are importing a Kiro external-IdP auth file, not a plain Microsoft OAuth blob"],"exampleFix":"// before\n{ \"access_token\": \"...\", \"refresh_token\": \"...\", \"client_id\": \"...\", \"scopes\": \"openid\" }\n// after\n{ \"access_token\": \"...\", \"refresh_token\": \"...\", \"client_id\": \"...\", \"scopes\": \"openid\", \"profile_arn\": \"arn:aws:codewhisperer:us-east-1:123456789012:profile/ABCDEF\" }","handlingStrategy":"validation","validationCode":"const arn = auth.profile_arn ?? auth.profileArn;\nif (typeof arn !== 'string' || !arn.trim()) throw new Error('profile_arn missing from Kiro auth');","typeGuard":"function hasProfileArn(a) {\n  return typeof a === 'object' && a !== null &&\n    ['profile_arn', 'profileArn'].some(k => typeof a[k] === 'string' && a[k].trim() !== '');\n}","tryCatchPattern":"try {\n  normalizeKiroExternalIdpAuth(auth);\n} catch (e) {\n  if (e.message === 'profile_arn is required') {\n    console.error('Auth doc lacks the Kiro profile ARN; re-export from CLIProxyAPI');\n  }\n  throw e;\n}","preventionTips":["Import genuine Kiro auth files, not generic Microsoft OAuth responses","Keep profile_arn together with the OAuth fields in the same document","Validate the ARN format (arn:aws:...) in your pre-flight checks","Take all fields from a single export — do not mix documents"],"tags":["aws","kiro","missing-field","arn"],"backgroundTag":"missing-required-field","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}