diegosouzapw/OmniRoute · error

Invalid region

Error message

Invalid region

What it means

Error "Invalid region" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/oauth/constants/oauth.ts:325

  tokenUrl: GITLAB_DUO_ENDPOINTS.tokenUrl,
  userInfoUrl: GITLAB_DUO_ENDPOINTS.userUrl,
  directAccessUrl: GITLAB_DUO_ENDPOINTS.directAccessUrl,
  scope: "ai_features read_user",
  codeChallengeMethod: "S256",
};

// AWS region allowlist — prevents SSRF via region injection into upstream URLs
// (GHSA-6mwv-4mrm-5p3m). Region values flow user-supplied through the kiro OAuth
// import surfaces (request body, providerSpecificData) and are interpolated into
// URLs like `https://oidc.${region}.amazonaws.com/...`. Without this guard, a
// region like "127.0.0.1" or "evil.com" would redirect the proxy's outbound
// fetch to an attacker-controlled host. Canonical AWS region shape only:
// two letters, dash, one-or-more letters, dash, one-or-two digits.
export const AWS_REGION_PATTERN = /^[a-z]{2}-[a-z]+-\d{1,2}$/;

export function assertValidAwsRegion(region: string): string {
  if (typeof region !== "string" || !AWS_REGION_PATTERN.test(region)) {
    throw new Error("Invalid region");
  }
  return region;
}

// Kiro OAuth Configuration
// Supports multiple auth methods:
// 1. AWS Builder ID (Device Code Flow)
// 2. AWS IAM Identity Center/IDC (Device Code Flow with custom startUrl/region)
// 3. Google/GitHub Social Login (Authorization Code Flow - manual callback)
// 4. Import Token (paste refresh token from Kiro IDE)
export const KIRO_CONFIG = {
  // AWS SSO OIDC endpoints for Builder ID/IDC (Device Code Flow)
  ssoOidcEndpoint: "https://oidc.us-east-1.amazonaws.com",
  registerClientUrl: "https://oidc.us-east-1.amazonaws.com/client/register",
  deviceAuthUrl: "https://oidc.us-east-1.amazonaws.com/device_authorization",
  tokenUrl: "https://oidc.us-east-1.amazonaws.com/token",
  // AWS Builder ID default start URL
  startUrl: "https://view.awsapps.com/start",

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/oauth/constants/oauth.ts:325 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/20ad93abe746654e. Report an issue: GitHub.