Merge pull request #561 from kaitranntt/fix/552-review-followups

fix(cliproxy): harden Kiro device-code auth flow consistency

tests/unit/cliproxy/provider-capabilities.test.ts

@@ -2,11 +2,24 @@ import { describe, expect, it } from 'bun:test';
 import {
   CLIPROXY_PROVIDER_IDS,
   getOAuthCallbackPort,
+  getOAuthFlowType,
   getProviderDisplayName,
   getProvidersByOAuthFlow,
   isCLIProxyProvider,
   mapExternalProviderName,
 } from '../../../src/cliproxy/provider-capabilities';
+import {
+  OAUTH_CALLBACK_PORTS as DIAGNOSTIC_CALLBACK_PORTS,
+  OAUTH_FLOW_TYPES,
+} from '../../../src/management/oauth-port-diagnostics';
+import {
+  DEFAULT_KIRO_AUTH_METHOD,
+  getKiroCallbackPort,
+  getKiroCLIAuthFlag,
+  normalizeKiroAuthMethod,
+  OAUTH_CALLBACK_PORTS as AUTH_CALLBACK_PORTS,
+  toKiroManagementMethod,
+} from '../../../src/cliproxy/auth/auth-types';
 
 describe('provider-capabilities', () => {
   it('keeps canonical provider IDs backward-compatible', () => {
@@ -56,4 +69,38 @@ describe('provider-capabilities', () => {
     expect(getOAuthCallbackPort('gemini')).toBe(8085);
     expect(getProviderDisplayName('agy')).toBe('AntiGravity');
   });
+
+  it('keeps diagnostics flow metadata in sync with provider capabilities', () => {
+    for (const provider of CLIPROXY_PROVIDER_IDS) {
+      expect(OAUTH_FLOW_TYPES[provider]).toBe(getOAuthFlowType(provider));
+      expect(DIAGNOSTIC_CALLBACK_PORTS[provider]).toBe(getOAuthCallbackPort(provider));
+    }
+  });
+
+  it('does not define callback ports for device code providers in auth constants', () => {
+    for (const provider of getProvidersByOAuthFlow('device_code')) {
+      expect(AUTH_CALLBACK_PORTS[provider]).toBeUndefined();
+    }
+  });
+
+  it('maps Kiro auth methods to upstream CLI/management contracts', () => {
+    expect(DEFAULT_KIRO_AUTH_METHOD).toBe('aws');
+    expect(normalizeKiroAuthMethod()).toBe('aws');
+    expect(normalizeKiroAuthMethod('GOOGLE')).toBe('google');
+    expect(normalizeKiroAuthMethod('not-valid')).toBe('aws');
+
+    expect(getKiroCLIAuthFlag('aws')).toBe('--kiro-aws-login');
+    expect(getKiroCLIAuthFlag('aws-authcode')).toBe('--kiro-aws-authcode');
+    expect(getKiroCLIAuthFlag('google')).toBe('--kiro-google-login');
+
+    expect(getKiroCallbackPort('aws')).toBeNull();
+    expect(getKiroCallbackPort('google')).toBe(9876);
+    expect(getKiroCallbackPort('github')).toBe(9876);
+    expect(getKiroCallbackPort('aws-authcode')).toBe(9876);
+
+    expect(toKiroManagementMethod('aws')).toBe('aws');
+    expect(toKiroManagementMethod('aws-authcode')).toBe('aws');
+    expect(toKiroManagementMethod('google')).toBe('google');
+    expect(toKiroManagementMethod('github')).toBe('github');
+  });
 });

tests/unit/web-server/cliproxy-auth-routes.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'bun:test';
+import { getStartUrlUnsupportedReason } from '../../../src/web-server/routes/cliproxy-auth-routes';
+
+describe('cliproxy-auth-routes start-url guard', () => {
+  it('rejects device code providers', () => {
+    expect(getStartUrlUnsupportedReason('kiro')).toContain("Kiro method 'aws' uses Device Code flow");
+    expect(getStartUrlUnsupportedReason('ghcp')).toContain("Provider 'ghcp' uses Device Code flow");
+    expect(getStartUrlUnsupportedReason('qwen')).toContain("Provider 'qwen' uses Device Code flow");
+  });
+
+  it('allows Kiro social methods on start-url', () => {
+    expect(getStartUrlUnsupportedReason('kiro', { kiroMethod: 'google' })).toBeNull();
+    expect(getStartUrlUnsupportedReason('kiro', { kiroMethod: 'github' })).toBeNull();
+  });
+
+  it('rejects Kiro aws-authcode method on start-url', () => {
+    expect(getStartUrlUnsupportedReason('kiro', { kiroMethod: 'aws-authcode' })).toContain(
+      "Kiro method 'aws-authcode' uses CLI auth flow"
+    );
+  });
+
+  it('allows authorization code providers', () => {
+    expect(getStartUrlUnsupportedReason('gemini')).toBeNull();
+    expect(getStartUrlUnsupportedReason('codex')).toBeNull();
+    expect(getStartUrlUnsupportedReason('claude')).toBeNull();
+  });
+});