Repository navigation
bedrock aws option - #9
brunobuzzi wants to merge 1 commit into
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
|
||
| final canonicalRequest = [ | ||
| method, | ||
| uri.path, |
There was a problem hiding this comment.
When a Bedrock model ID contains a character such as :, the request URL contains its encoded form (%3A), but uri.path supplies the decoded character to the signer. Bedrock therefore receives a request whose path differs from the signed path and rejects it with a signature error. Sign the encoded path that is sent.
| Future<(String, String)> _registerClient() async { | ||
| final stored = await _store.read(); | ||
| final clientId = stored?['clientId'] as String?; | ||
| final clientSecret = stored?['clientSecret'] as String?; | ||
| if (clientId != null && clientId.isNotEmpty && clientSecret != null && clientSecret.isNotEmpty) { | ||
| return (clientId, clientSecret); |
There was a problem hiding this comment.
After a user changes the SSO region or start URL, this method can reuse the client registration from the previous configuration for the new device-authorization request, causing sign-in to fail. The stored access token is likewise checked without reference to the current configuration, so reopening the panel can skip sign-in with an unrelated token. Scope or invalidate stored credentials when the Identity Center configuration changes.
| if (!mounted) { | ||
| return; | ||
| } | ||
| setState(() => _pendingAuth = null); | ||
| await _startServices(BedrockAiBackend(config: config, session: session)); |
There was a problem hiding this comment.
The provider picker remains available while beginLogin() is running, but changing providers does not cancel that sign-in. If the user switches to and saves an API key during this interval, the old sign-in can later install a Bedrock service anyway. This replaces the selected key-backed service without disposing it. Check that the sign-in is still current before starting Bedrock.
| /// Bedrock serves Claude under an `anthropic.` provider prefix, and newer | ||
| /// models are reachable only through a cross-region inference profile — the | ||
| /// leading `eu.` here. Change the prefix if [bedrockRegion] leaves the EU. | ||
| static const String defaultModelId = 'eu.anthropic.claude-sonnet-5-5'; |
There was a problem hiding this comment.
The model field defaults to an EU-prefixed inference-profile ID even when the user selects a non-EU Bedrock region. Accepting the prefilled model sends that EU ID to the selected regional endpoint, where the default configuration cannot serve requests. Choose a region-compatible default or require an explicit model choice.
| if (response.statusCode == 401 || response.statusCode == 403) { | ||
| // The access token has been revoked or has aged out server-side. | ||
| await _store.clear(); | ||
| throw const AwsSsoLoginRequired('AWS SSO session expired. Please sign in again.'); |
There was a problem hiding this comment.
If the configured account or role returns 403 because access is denied, this branch clears the SSO token and reports an expired session. Signing in again will not fix the role configuration, and the user must repeat authorization without seeing the useful role-access error. Distinguish a rejected token from denied access to the requested role.
| Future<void> write(Map<String, dynamic> value) async { | ||
| final prefs = await SharedPreferences.getInstance(); |
There was a problem hiding this comment.
The new preference entry contains the SSO bearer token and client secret. If someone can read the app's preference storage, they can obtain a still-valid token and use it to request AWS role credentials. Token expiry limits the exposure window but does not remove it; use platform-protected secret storage instead.
How this was verified: The approval flow stores the token and client secret in unencrypted preferences, and the credentials flow uses the stored token to request role credentials.
Add an additional pane to configure connection to Claude through AWS Bedrock with SSO
The PR does not appear safe to merge until Bedrock signing and the provider-selection and SSO-configuration failures are addressed.
Findings
Summary
The PR adds AWS Bedrock access through an in-app SSO device flow while retaining API-key access.
Reviews (1) · Last reviewed commit: "bedrock aws option"