[Bug] Health checker incorrectly marks IDC tokens as invalid - missing client_id/client_secret

[poboll]

Bug Description

The token health checker has two bugs that cause IDC tokens to be incorrectly marked as invalid:

Bug 1: Missing client_id and client_secret for IDC tokens

Location: kiro_gateway/health_checker.py - check_token method

Problem: When checking token validity, the health checker only passes refresh_token to KiroAuthManager, but IDC tokens require client_id and client_secret for token refresh.

Current code:

manager = KiroAuthManager(
    refresh_token=refresh_token,
    region=settings.region,
    profile_arn=settings.profile_arn
)

Fixed code:

creds = user_db.get_token_credentials(token_id)
manager = KiroAuthManager(
    refresh_token=creds["refresh_token"],
    region=settings.region,
    profile_arn=settings.profile_arn,
    client_id=creds.get("client_id"),
    client_secret=creds.get("client_secret"),
)

Bug 2: Health checker does not check invalid tokens or recover them

Location: kiro_gateway/health_checker.py - check_all_tokens method

Problem:

1. The health checker only checks tokens with status "active" (get_all_active_tokens())
2. Once a token is marked as "invalid", it is never checked again
3. Even when a token recovers (becomes valid again), it is not automatically marked back to "active"

Current behavior:

• Only active tokens are checked
• Invalid tokens are never recovered

Expected behavior:

• Both active and invalid tokens should be checked periodically
• When an invalid token passes the health check, it should be automatically marked as "active"

---

Fix

I have submitted a fix that addresses both issues:

1. In check_token method: Use user_db.get_token_credentials() to get full credentials including client_id and client_secret for IDC tokens.

2. In check_all_tokens method: Check both active AND invalid tokens, and automatically restore valid tokens to "active" status.

---

Environment

• KiroGate version: Latest from main branch
• Docker container
• IDC authentication (AWS SSO OIDC)