{"record":{"id":"fb3a8cb01a800e0b","repo":"decolua/9router","slug":"only-external-idp-kiro-auth-is-supported-by-this-i","errorCode":null,"errorMessage":"Only external_idp Kiro auth is supported by this importer","messagePattern":"Only external_idp Kiro auth is supported by this importer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/kiroExternalIdp.js","lineNumber":93,"sourceCode":"}\n\nexport function normalizeKiroExternalIdpAuth(rawAuth) {\n  let input = rawAuth;\n  if (typeof input === \"string\") {\n    try {\n      input = JSON.parse(input);\n    } catch {\n      throw new Error(\"CLIProxyAPI auth JSON is invalid\");\n    }\n  }\n\n  if (!input || typeof input !== \"object\") {\n    throw new Error(\"CLIProxyAPI auth JSON is required\");\n  }\n\n  const authMethod = normalizeString(input.auth_method || input.authMethod);\n  if (authMethod && authMethod !== \"external_idp\") {\n    throw new Error(\"Only external_idp Kiro auth is supported by this importer\");\n  }\n\n  const accessToken = normalizeString(input.access_token || input.accessToken);\n  const refreshToken = normalizeString(input.refresh_token || input.refreshToken);\n  const clientId = normalizeString(input.client_id || input.clientId);\n  const tokenEndpoint = validateMicrosoftTokenEndpoint(input.token_endpoint || input.tokenEndpoint);\n  const profileArn = normalizeString(input.profile_arn || input.profileArn);\n  const region = normalizeString(input.region) || DEFAULT_REGION;\n  const scope = normalizeScope(input.scopes || input.scope);\n\n  if (!accessToken) throw new Error(\"access_token is required\");\n  if (!refreshToken) throw new Error(\"refresh_token is required\");\n  if (!clientId) throw new Error(\"client_id is required\");\n  if (!scope) throw new Error(\"scopes is required\");\n  if (!profileArn) throw new Error(\"profile_arn is required\");\n\n  const payload = decodeJwtPayload(accessToken);\n  const email = input.email || payload?.email || payload?.preferred_username || payload?.upn || payload?.sub || null;","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/lib/oauth/kiroExternalIdp.js#L75-L111","documentation":"The importer only supports Kiro auth entries whose auth_method (or authMethod) is 'external_idp'. If the parsed auth document declares a different auth method, this error is thrown to stop the import early. Omitting auth_method entirely is allowed (treated as external_idp).","triggerScenarios":"Calling normalizeKiroExternalIdpAuth with an auth JSON whose auth_method is e.g. 'social', 'builderid', 'idc', or any value other than 'external_idp'.","commonSituations":"Importing a Kiro auth file produced by a different login flow (Google/BuilderID/IdC login) instead of the Microsoft external IdP flow; an outdated CLIProxyAPI writing a new auth_method value the importer predates.","solutions":["Re-authenticate via the Microsoft external IdP flow so the auth file has auth_method: 'external_idp'","Remove the auth_method field if you are certain the entry is external-IdP-based (absent means accepted)","Use the importer path appropriate for the auth method present instead of this external-IdP importer","Check for CLIProxyAPI/9router updates in case new auth methods gained importer support"],"exampleFix":"// before\n{ \"auth_method\": \"builderid\", \"access_token\": \"...\", ... }\n// after\n{ \"auth_method\": \"external_idp\", \"access_token\": \"...\", ... }","handlingStrategy":"validation","validationCode":"const method = typeof auth.auth_method === 'string' ? auth.auth_method.trim() : (auth.authMethod || '');\nif (method && method !== 'external_idp') {\n  throw new Error(`Auth method '${method}' not supported; only external_idp`);\n}","typeGuard":"function isExternalIdpAuth(auth) {\n  const m = (auth.auth_method ?? auth.authMethod ?? 'external_idp').trim();\n  return m === 'external_idp';\n}","tryCatchPattern":"try {\n  normalizeKiroExternalIdpAuth(auth);\n} catch (e) {\n  if (e.message.startsWith('Only external_idp')) {\n    console.error('Re-authenticate via the Microsoft external IdP flow for this importer');\n  }\n  throw e;\n}","preventionTips":["Check auth_method in the file before choosing which importer to use","Route non-external_idp auth files to their own importer path","Keep CLIProxyAPI and the 9router importer versions in sync","Never hand-edit auth_method; it reflects the login flow that produced the tokens"],"tags":["oauth","auth-method","unsupported","validation"],"backgroundTag":"unsupported-auth-method","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}