@aws-sdk/rds-signer 3.1057.0 → 3.1058.0

package/dist-cjs/index.js

@@ -5,6 +5,7 @@ var protocols = require('@smithy/core/protocols');
 var signatureV4 = require('@smithy/signature-v4');
 var runtimeConfig = require('./runtimeConfig');
 
+const MINUTE_MS = 60_000;
 class Signer {
     credentials;
     hostname;
@@ -16,7 +17,8 @@ class Signer {
     username;
     constructor(configuration) {
         const runtimeConfiguration = runtimeConfig.getRuntimeConfig(configuration);
-        this.credentials = runtimeConfiguration.credentials;
+        const creds = runtimeConfiguration.credentials;
+        this.credentials = typeof creds === "function" ? this.createCredentialsWrapper(creds) : creds;
         this.hostname = runtimeConfiguration.hostname;
         this.port = runtimeConfiguration.port;
         this.region = runtimeConfiguration.region;
@@ -48,6 +50,21 @@ class Signer {
         });
         return util.formatUrl(presigned).replace(`${this.protocol}//`, "");
     }
+    createCredentialsWrapper(provider) {
+        return async (identityProperties) => {
+            const credentials = await provider(identityProperties);
+            if (credentials.expiration && credentials.expiration.getTime() - Date.now() < 15 * MINUTE_MS) {
+                try {
+                    const refreshed = await provider({ ...identityProperties, forceRefresh: true });
+                    if (!refreshed.expiration || refreshed.expiration.getTime() - Date.now() >= 15 * MINUTE_MS) {
+                        return refreshed;
+                    }
+                }
+                catch { }
+            }
+            return credentials;
+        };
+    }
 }
 
 exports.Signer = Signer;

package/dist-es/Signer.js

@@ -2,6 +2,7 @@ import { formatUrl } from "@aws-sdk/core/util";
 import { HttpRequest } from "@smithy/core/protocols";
 import { SignatureV4 } from "@smithy/signature-v4";
 import { getRuntimeConfig as __getRuntimeConfig } from "./runtimeConfig";
+const MINUTE_MS = 60_000;
 export class Signer {
     credentials;
     hostname;
@@ -13,7 +14,8 @@ export class Signer {
     username;
     constructor(configuration) {
         const runtimeConfiguration = __getRuntimeConfig(configuration);
-        this.credentials = runtimeConfiguration.credentials;
+        const creds = runtimeConfiguration.credentials;
+        this.credentials = typeof creds === "function" ? this.createCredentialsWrapper(creds) : creds;
         this.hostname = runtimeConfiguration.hostname;
         this.port = runtimeConfiguration.port;
         this.region = runtimeConfiguration.region;
@@ -45,4 +47,19 @@ export class Signer {
         });
         return formatUrl(presigned).replace(`${this.protocol}//`, "");
     }
+    createCredentialsWrapper(provider) {
+        return async (identityProperties) => {
+            const credentials = await provider(identityProperties);
+            if (credentials.expiration && credentials.expiration.getTime() - Date.now() < 15 * MINUTE_MS) {
+                try {
+                    const refreshed = await provider({ ...identityProperties, forceRefresh: true });
+                    if (!refreshed.expiration || refreshed.expiration.getTime() - Date.now() >= 15 * MINUTE_MS) {
+                        return refreshed;
+                    }
+                }
+                catch { }
+            }
+            return credentials;
+        };
+    }
 }

package/dist-types/Signer.d.ts

@@ -51,4 +51,10 @@ export declare class Signer {
     private readonly username;
     constructor(configuration: SignerConfig);
     getAuthToken(): Promise<string>;
+    /**
+     * Wraps a credential provider to force refresh when the resolved credentials
+     * expire within 15 minutes. A presigned URL cannot outlive the credentials
+     * used to sign it, so near-expiry credentials would produce a short-lived token.
+     */
+    private createCredentialsWrapper;
 }

package/dist-types/ts3.4/Signer.d.ts

@@ -24,4 +24,5 @@ export declare class Signer {
   private readonly username;
   constructor(configuration: SignerConfig);
   getAuthToken(): Promise<string>;
+  private createCredentialsWrapper;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/rds-signer",
-  "version": "3.1057.0",
+  "version": "3.1058.0",
   "description": "RDS utility for generating a password that can be used for IAM authentication to an RDS DB.",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -32,7 +32,7 @@
     "@aws-crypto/sha256-browser": "5.2.0",
     "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/core": "^3.974.15",
-    "@aws-sdk/credential-providers": "3.1057.0",
+    "@aws-sdk/credential-providers": "3.1058.0",
     "@smithy/core": "^3.24.5",
     "@smithy/signature-v4": "^5.4.5",
     "@smithy/types": "^4.14.2",