@vizamodo/aws-sts-core 0.1.30 → 0.1.34

package/dist/sigv4/headers.js

@@ -11,26 +11,29 @@
  * This function is PURE and side‑effect free.
  */
 export function canonicalizeHeaders(headers) {
-    const normalized = {};
-    for (const [key, value] of Object.entries(headers)) {
-        if (value === undefined)
+    const map = new Map();
+    for (const [rawName, rawValue] of Object.entries(headers)) {
+        if (rawValue === undefined)
             continue;
-        const name = key.toLowerCase().trim();
+        const name = rawName.toLowerCase().trim();
         if (!name)
             continue;
-        // AWS requires:
-        // - trim
-        // - collapse multiple spaces into one
-        const cleanedValue = value
+        const value = rawValue
             .trim()
-            .replace(/\s+/g, " ");
-        normalized[name] = cleanedValue;
+            .replace(/[ \t]+/g, " ");
+        if (!map.has(name)) {
+            map.set(name, []);
+        }
+        map.get(name).push(value);
     }
-    const sortedHeaderNames = Object.keys(normalized).sort();
-    const canonicalHeaders = sortedHeaderNames
-        .map((name) => `${name}:${normalized[name]}\n`)
+    const sortedNames = Array.from(map.keys()).sort();
+    const canonicalHeaders = sortedNames
+        .map((name) => {
+        const combined = map.get(name).join(",");
+        return `${name}:${combined}\n`;
+    })
         .join("");
-    const signedHeaders = sortedHeaderNames.join(";");
+    const signedHeaders = sortedNames.join(";");
     return {
         canonicalHeaders,
         signedHeaders,

package/dist/sts/issue.js

@@ -98,11 +98,37 @@ export async function issueAwsCredentials(input) {
         });
         if (!res.ok) {
             const errorBody = await res.text();
-            // Log cực kỳ chi tiết để soi Signature của AWS vs của mình
-            console.error("[aws-rejected]", {
+            console.error("[aws-rejected][FULL-REQUEST-DUMP]", {
                 status: res.status,
+                statusText: res.statusText,
                 awsResponse: errorBody,
-                myCanonicalRequest: canonicalRequest, // Copy cái này ra so với AWS
+                // ---- Input parameters ----
+                roleArn,
+                profileArn,
+                trustAnchorArn,
+                region,
+                profile,
+                // ---- Derived signing values ----
+                host,
+                path,
+                amzDate,
+                dateStamp,
+                credentialScope,
+                signedHeaders,
+                signatureHex,
+                // ---- Body & payload ----
+                requestBody: body,
+                payloadHash,
+                // ---- Canonical ----
+                canonicalRequest,
+                stringToSign,
+                // ---- Headers actually sent ----
+                sentHeaders: {
+                    "Content-Type": "application/json",
+                    "X-Amz-Date": amzDate,
+                    "X-Amz-X509-Chain": normalizedCert,
+                    "Authorization": `AWS4-X509-ECDSA-SHA256 Credential=${roleArn}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`
+                }
             });
             throw new InternalError("aws_rejected");
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.1.30",
+  "version": "0.1.34",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",