feat: add SSO auth support

[phoenix-ru]

Summary

Adds AWS SSO auth mode alongside existing static AWS credentials.

Changes

• Added ssm-secrets auth --sso-start-url <url> SSO login flow.
• Uses AWS SSO/OIDC SDKs for:
  • client registration
  • device authorization
  • token polling/refresh
  • account and role discovery
  • temporary role credentials
• Stores SSO auth state in system keyring.
• Automatically refreshes cached credentials when possible.
• Opens browser for device login when deep refresh is needed and user allowed it.
• Migrates legacy static credentials to new { mode: 'static' } format.
• Added ssm-secrets wipe-credentials.
• Updated docs and exports.

Try from the PR

Checkout the repository:

git clone git@github.com:sidebase/ssm-secrets.git

Checkout the PR:

# Using `gh` CLI
gh pr checkout 9

# Using Git
git checkout feat/add-sso-oidc-auth

Install and build:

pnpm i && pnpm build

(Optional) Create session alias for convenience:

alias ssm-secrets="node dist/cli.js"

Alternatively, simply replace ssm-secrets below with node dist/cli.js yourself.

Usage

Static credentials still work:

ssm-secrets auth

SSO auth:

ssm-secrets auth --sso-start-url https://d-zzzzzz.awsapps.com/start

Optional account/role hints:

ssm-secrets auth \
  --sso-start-url https://d-zzzzzz.awsapps.com/start \
  --region eu-central-1 \
  --account-id 123456789012 \
  --role-name Developer

Remove stored credentials:

ssm-secrets wipe-credentials

[DeusAvalon]

Repost:
Followed ur instructions and could verify that ssm-secrets via sso works as intended on my local machine.

⚡
ssm-secrets get aws/ssm path
{
  "Name": "/aws/ssm/path",
  "Type": "SecureString",
  "Value": "eu-central-1",
  "Version": 1,
  "LastModifiedDate": "2023-03-31T08:42:15.141Z",
  "ARN": "arn:aws:ssm:eu-central-1:xxxxxxx:parameter/aws/ssm/path",
  "DataType": "text"
}