@aspan-corporation/ac-shared 1.2.35 → 1.2.37

package/lib/lambda/index.js

@@ -14,7 +14,11 @@ export { MetricUnit } from "@aws-lambda-powertools/metrics";
 export const tracer = new Tracer();
 export const metrics = new Metrics({ namespace: "aspan-corporation" });
 export const withMiddlewares = (handler) => middy(handler)
-    .use(injectLambdaContext(logger, { logEvent: true }))
+    // logEvent is deliberately false: several handlers are fronted by API
+    // Gateway, whose proxy event carries the caller's `Authorization` header
+    // (a live Cognito token). Logging the full event would persist those
+    // tokens to CloudWatch. Handlers log the specific fields they need.
+    .use(injectLambdaContext(logger, { logEvent: false }))
     .use(captureLambdaHandler(tracer))
     .use(logMetrics(metrics, { captureColdStartMetric: true }))
     .use({

package/lib/services/sts.d.ts

@@ -1,5 +1,10 @@
 import { Logger } from "@aws-lambda-powertools/logger";
-import { AssumeRoleCommandInput, STSClient } from "@aws-sdk/client-sts";
+import { AssumeRoleCommandInput, AssumeRoleCommandOutput, STSClient } from "@aws-sdk/client-sts";
+/**
+ * Clear the module-scoped assume-role credential cache. Intended for tests
+ * only, so each case starts from a known state.
+ */
+export declare const clearAssumeRoleCache: () => void;
 export declare class STSService {
     logger: Logger;
     client: STSClient;
@@ -9,6 +14,6 @@ export declare class STSService {
         client?: STSClient;
     });
     getCallerIdentity(): Promise<import("@aws-sdk/client-sts").GetCallerIdentityCommandOutput>;
-    assumeRole(assumeRoleCommandInput: AssumeRoleCommandInput): Promise<import("@aws-sdk/client-sts").AssumeRoleCommandOutput>;
+    assumeRole(assumeRoleCommandInput: AssumeRoleCommandInput): Promise<AssumeRoleCommandOutput>;
 }
 export type { AssumeRoleCommandInput, AssumeRoleCommandOutput } from "@aws-sdk/client-sts";

package/lib/services/sts.js

@@ -1,6 +1,34 @@
 import { Logger } from "@aws-lambda-powertools/logger";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import assert from "node:assert/strict";
+// Module-scoped cache of assumed-role credentials, shared across every
+// STSService instance in the same execution environment. Lambda handlers
+// construct a fresh STSService per invocation (usually in a middy `before`
+// hook), so an instance-level cache would never hit. Keying at module scope
+// means a warm container assumes the role once and reuses the credentials
+// until they are close to expiry, removing an STS round-trip (~50-150ms) from
+// every invocation.
+const REFRESH_BUFFER_MS = 5 * 60 * 1000;
+const credentialCache = new Map();
+const cacheKey = (input) => [
+    input.RoleArn,
+    input.RoleSessionName,
+    input.ExternalId ?? "",
+    input.DurationSeconds ?? "",
+    input.SerialNumber ?? ""
+].join("|");
+const isFresh = (output) => {
+    const expiration = output.Credentials?.Expiration;
+    return (expiration instanceof Date &&
+        expiration.getTime() - REFRESH_BUFFER_MS > Date.now());
+};
+/**
+ * Clear the module-scoped assume-role credential cache. Intended for tests
+ * only, so each case starts from a known state.
+ */
+export const clearAssumeRoleCache = () => {
+    credentialCache.clear();
+};
 export class STSService {
     logger;
     client;
@@ -27,7 +55,20 @@ export class STSService {
         return await this.client.send(new GetCallerIdentityCommand({}));
     }
     async assumeRole(assumeRoleCommandInput) {
+        const key = cacheKey(assumeRoleCommandInput);
+        const cached = credentialCache.get(key);
+        if (cached && isFresh(cached)) {
+            this.logger.debug("assumeRole cache hit", {
+                roleArn: assumeRoleCommandInput.RoleArn
+            });
+            return cached;
+        }
         this.logger.debug("assumeRole", { assumeRoleCommandInput });
-        return await this.client.send(new AssumeRoleCommand(assumeRoleCommandInput));
+        const output = await this.client.send(new AssumeRoleCommand(assumeRoleCommandInput));
+        // Only cache credentials that carry an expiry we can reason about.
+        if (output.Credentials?.Expiration) {
+            credentialCache.set(key, output);
+        }
+        return output;
     }
 }

package/lib/utils/diary.d.ts

@@ -49,6 +49,14 @@ export declare const parseDiaryKeyDate: (key: string) => {
  * words. Strips markdown syntax (code fences, image/link targets, formatting),
  * drops stop-words and tokens shorter than 2 chars, and caps the result at
  * `MAX_TEXT_TOKENS` to bound the meta-item size. No stemming (exact-word match).
+ *
+ * Word boundaries and lowercasing are Unicode-aware: tokens are split on any
+ * run of characters that are neither a Unicode letter (`\p{L}`) nor number
+ * (`\p{N}`), so non-Latin scripts (e.g. Cyrillic) survive as searchable words
+ * rather than being discarded. `toLowerCase()` is likewise Unicode-aware; we
+ * deliberately avoid `toLocaleLowerCase()` so tokenisation is deterministic and
+ * independent of the host locale (the indexer lambda and the browser that
+ * builds search queries must produce identical tokens).
  */
 export declare const tokenizeText: (markdown: string) => string[];
 /** Plain-text preview: strip markdown, collapse whitespace, truncate. */

package/lib/utils/diary.js

@@ -91,6 +91,14 @@ const STOP_WORDS = new Set([
  * words. Strips markdown syntax (code fences, image/link targets, formatting),
  * drops stop-words and tokens shorter than 2 chars, and caps the result at
  * `MAX_TEXT_TOKENS` to bound the meta-item size. No stemming (exact-word match).
+ *
+ * Word boundaries and lowercasing are Unicode-aware: tokens are split on any
+ * run of characters that are neither a Unicode letter (`\p{L}`) nor number
+ * (`\p{N}`), so non-Latin scripts (e.g. Cyrillic) survive as searchable words
+ * rather than being discarded. `toLowerCase()` is likewise Unicode-aware; we
+ * deliberately avoid `toLocaleLowerCase()` so tokenisation is deterministic and
+ * independent of the host locale (the indexer lambda and the browser that
+ * builds search queries must produce identical tokens).
  */
 export const tokenizeText = (markdown) => {
     if (!markdown)
@@ -109,11 +117,12 @@ export const tokenizeText = (markdown) => {
         // leftover markdown punctuation
         .replace(/[#>*_~\-]+/g, " ");
     const seen = new Set();
-    for (const raw of stripped.toLowerCase().split(/[^a-z0-9]+/)) {
+    for (const raw of stripped.toLowerCase().split(/[^\p{L}\p{N}]+/u)) {
         if (raw.length < 2)
             continue;
-        // Drop pure numbers (dates/counts add noise); keep alphanumerics like "v2".
-        if (/^\d+$/.test(raw))
+        // Drop pure-number tokens (dates/counts add noise) in any script; keep
+        // alphanumerics like "v2".
+        if (/^\p{N}+$/u.test(raw))
             continue;
         if (STOP_WORDS.has(raw))
             continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aspan-corporation/ac-shared",
-  "version": "1.2.35",
+  "version": "1.2.37",
   "description": "",
   "keywords": [],
   "exports": {
@@ -36,12 +36,15 @@
     "clean": "rm -rf lib",
     "build": "npm run clean && npm run build:code && npm run build:types",
     "build:code": "tsc --declaration false --emitDeclarationOnly false",
-    "build:types": "tsc --emitDeclarationOnly --declaration"
+    "build:types": "tsc --emitDeclarationOnly --declaration",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "devDependencies": {
     "@types/aws-lambda": "^8.10.137",
     "@types/node": "^20.12.5",
-    "typescript": "^5.4.4"
+    "typescript": "^5.4.4",
+    "vitest": "^4.1.9"
   },
   "dependencies": {
     "@aws-lambda-powertools/batch": "^2.30.2",