@vizamodo/aws-sts-core 0.2.21 → 0.2.39

package/dist/sts/issue.js

@@ -3,17 +3,40 @@ import { buildCanonicalRequest } from "../sigv4/canonical";
 import { buildStringToSign } from "../sigv4/string-to-sign";
 import { signStringToSign } from "./signer";
 import { InternalError } from "./errors";
+// ---- constants (cleaner configuration, no runtime cost) ----
+const ALGORITHM = "AWS4-X509-ECDSA-SHA256";
+const SERVICE = "rolesanywhere";
+const PATH = "/sessions";
+const PROFILE_TTL = {
+    Runtime: 90 * 60,
+    ConsoleReadOnly: 12 * 60 * 60,
+    ConsoleViewOnlyProd: 12 * 60 * 60,
+    BillingReadOnly: 2 * 60 * 60,
+    BillingAdmin: 2 * 60 * 60,
+    BillingAccountant: 2 * 60 * 60,
+};
+const DEFAULT_TTL = 2 * 60 * 60;
 // ---- isolate-level cached signing material ----
 let cachedSigningKey = null;
 let cachedCertBase64 = null;
+let cachedPrivateKeyBase64 = null;
+// ---- shared encoder + payload hash cache ----
+const textEncoder = new TextEncoder();
+let lastBody = null;
+let lastPayloadHash = null;
 async function getSigningMaterial(input) {
-    if (cachedSigningKey && cachedCertBase64) {
+    if (cachedSigningKey &&
+        cachedCertBase64 === input.certBase64 &&
+        cachedPrivateKeyBase64 === input.privateKeyPkcs8Base64) {
+        console.debug("[sts-cache] signingKey HIT");
         return { signingKey: cachedSigningKey, certBase64: cachedCertBase64 };
     }
+    console.debug("[sts-cache] signingKey MISS → importing key");
     try {
-        cachedCertBase64 = input.certBase64;
         const keyBuffer = base64ToArrayBuffer(input.privateKeyPkcs8Base64);
         cachedSigningKey = await crypto.subtle.importKey("pkcs8", keyBuffer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+        cachedCertBase64 = input.certBase64;
+        cachedPrivateKeyBase64 = input.privateKeyPkcs8Base64;
         return { signingKey: cachedSigningKey, certBase64: cachedCertBase64 };
     }
     catch {
@@ -21,22 +44,7 @@ async function getSigningMaterial(input) {
     }
 }
 function resolveSessionTtlByProfile(profile) {
-    switch (profile) {
-        // Runtime
-        case "Runtime":
-            return 90 * 60; // 90 minutes
-        // Console profiles
-        case "ConsoleReadOnly":
-        case "ConsoleViewOnlyProd":
-            return 12 * 60 * 60; // 12 hours
-        // Billing profiles
-        case "BillingReadOnly":
-        case "BillingAdmin":
-        case "BillingAccountant":
-            return 2 * 60 * 60; // 2 hours
-        default:
-            return 2 * 60 * 60; // fail-safe
-    }
+    return PROFILE_TTL[profile] ?? DEFAULT_TTL;
 }
 /**
  * Issue short-lived AWS credentials via Roles Anywhere.
@@ -45,23 +53,19 @@ export async function issueAwsCredentials(input) {
     const { roleArn, profileArn, trustAnchorArn, region, certBase64, privateKeyPkcs8Base64, profile, } = input;
     // 1. Kiểm tra đầu vào & Fix TTL an toàn
     const sessionTtl = resolveSessionTtlByProfile(profile);
-    console.log("profile:", profile, "sessionTtl:", sessionTtl);
     const { signingKey } = await getSigningMaterial({ certBase64, privateKeyPkcs8Base64 });
     // 2. Setup constants
-    const host = `rolesanywhere.${region}.amazonaws.com`;
-    const path = "/sessions";
+    const host = `${SERVICE}.${region}.amazonaws.com`;
+    const path = PATH;
     const now = new Date();
-    const amzDate = now.toISOString().replace(/\.\d{3}Z$/, "Z").replace(/[:-]/g, "");
+    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
     const dateStamp = amzDate.slice(0, 8);
-    const service = "rolesanywhere";
+    const service = SERVICE;
     // 3. Chuẩn bị Body & Cert
     const body = JSON.stringify({ trustAnchorArn, profileArn, roleArn, durationSeconds: sessionTtl });
-    const payloadHash = await sha256Hex(body);
+    const payloadHash = await getPayloadHash(body);
     // --- REFACTOR: Làm sạch chứng chỉ chặt chẽ ---
-    const normalizedCert = certBase64
-        .replace(/-----BEGIN CERTIFICATE-----/g, "")
-        .replace(/-----END CERTIFICATE-----/g, "")
-        .replace(/\s+/g, "");
+    const normalizedCert = normalizeCert(certBase64);
     // --- REFACTOR: Parser ASN.1 an toàn để lấy Serial Number (DECIMAL) ---
     // --- MINIMAL DER WALK: extract serial number ---
     let certSerialDec;
@@ -98,7 +102,11 @@ export async function issueAwsCredentials(input) {
         if (der[offset++] !== 0x02)
             throw new Error("bad serial tag");
         const serialLen = readLen();
-        const serial = der.slice(offset, offset + serialLen);
+        let serial = der.slice(offset, offset + serialLen);
+        // strip leading 0x00 padding if present (DER signed integer rule)
+        if (serial.length > 1 && serial[0] === 0x00) {
+            serial = serial.slice(1);
+        }
         certSerialDec = BigInt("0x" +
             Array.from(serial)
                 .map(b => b.toString(16).padStart(2, "0"))
@@ -115,9 +123,9 @@ export async function issueAwsCredentials(input) {
         "x-amz-date": amzDate,
         "x-amz-x509": normalizedCert,
     };
-    const { canonicalHeaders, signedHeaders } = canonicalizeHeaders(baseHeaders);
+    const { canonicalHeaders, signedHeaders } = getCanonicalizedHeaders(baseHeaders);
     const credentialScope = `${dateStamp}/${region}/${service}/aws4_request`;
-    const canonicalRequest = buildCanonicalRequest({
+    const canonicalRequest = getCanonicalRequest({
         method: "POST",
         canonicalUri: path,
         query: "",
@@ -125,20 +133,56 @@ export async function issueAwsCredentials(input) {
         signedHeaders,
         payloadHash,
     });
+    console.debug("[sts-debug] canonicalRequest", {
+        amzDate,
+        signedHeaders,
+        payloadHash,
+        canonicalHeadersPreview: canonicalHeaders.slice(0, 120),
+        canonicalRequestPreview: canonicalRequest.slice(0, 200)
+    });
+    const canonicalRequestHash = await getCanonicalRequestHash(canonicalRequest);
+    console.debug("[sts-debug] canonicalRequestHash", canonicalRequestHash);
     const stringToSign = buildStringToSign({
-        algorithm: "AWS4-X509-ECDSA-SHA256",
+        algorithm: ALGORITHM,
         amzDate,
         credentialScope,
-        canonicalRequestHash: await sha256Hex(canonicalRequest),
+        canonicalRequestHash,
+    });
+    console.debug("[sts-debug] stringToSign", {
+        credentialScope,
+        stringPreview: stringToSign.slice(0, 200)
     });
     const signatureHex = await signStringToSign(stringToSign, signingKey);
+    console.debug("[sts-debug] signature", {
+        length: signatureHex.length,
+        prefix: signatureHex.slice(0, 32)
+    });
     // 5. Build Authorization Header với số Serial (DECIMAL)
     const finalHeaders = new Headers({
         "Content-Type": "application/json",
+        "Host": host,
         "X-Amz-Date": amzDate,
         "X-Amz-X509": normalizedCert,
         "Authorization": `AWS4-X509-ECDSA-SHA256 Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`
     });
+    console.debug("[sts-debug] requestHeaders", {
+        host,
+        amzDate,
+        signedHeaders,
+        certLen: normalizedCert.length
+    });
+    console.debug("[sts-request] issuing rolesanywhere session", {
+        region,
+        profile,
+        roleArn,
+        profileArn,
+        trustAnchorArn,
+        amzDate,
+        cacheState: {
+            hasSigningKey: !!cachedSigningKey,
+            cachedCertMatch: cachedCertBase64 === certBase64,
+        }
+    });
     // 6. Execution
     try {
         const res = await fetch(`https://${host}${path}`, {
@@ -152,7 +196,9 @@ export async function issueAwsCredentials(input) {
             console.error("[aws-rejected] Request details", {
                 status: res.status,
                 response: errorBody,
-                serial: certSerialDec
+                region,
+                profile,
+                amzDate
             });
             throw new InternalError("aws_rejected");
         }
@@ -166,19 +212,67 @@ export async function issueAwsCredentials(input) {
         };
     }
     catch (e) {
+        console.error("[sts-debug] fetch failure", {
+            error: String(e),
+            region,
+            roleArn,
+            profileArn,
+            trustAnchorArn,
+            amzDate
+        });
         if (e instanceof InternalError)
             throw e;
         throw new InternalError("aws_unreachable");
     }
 }
 // ---- helpers ----
+function normalizeCert(raw) {
+    if (raw.includes("BEGIN CERTIFICATE")) {
+        throw new InternalError("pem_not_allowed");
+    }
+    return raw.trim();
+}
 async function sha256Hex(input) {
-    const data = new TextEncoder().encode(input);
+    const data = textEncoder.encode(input);
     const hash = await crypto.subtle.digest("SHA-256", data);
     const bytes = new Uint8Array(hash);
-    return Array.from(bytes)
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
+    const hex = new Array(bytes.length);
+    for (let i = 0; i < bytes.length; i++) {
+        const h = bytes[i].toString(16);
+        hex[i] = h.length === 1 ? "0" + h : h;
+    }
+    return hex.join("");
+}
+async function getCanonicalRequestHash(canonicalRequest) {
+    return sha256Hex(canonicalRequest);
+}
+async function getPayloadHash(body) {
+    if (lastBody === body && lastPayloadHash) {
+        console.debug("[sts-cache] payloadHash HIT");
+        return lastPayloadHash;
+    }
+    console.debug("[sts-cache] payloadHash MISS");
+    const hash = await sha256Hex(body);
+    lastBody = body;
+    lastPayloadHash = hash;
+    return hash;
+}
+function getCanonicalizedHeaders(baseHeaders) {
+    // Debug input headers before canonicalization
+    console.debug("[sts-debug] canonicalizeHeaders input", {
+        headers: baseHeaders,
+        keys: Object.keys(baseHeaders),
+    });
+    const result = canonicalizeHeaders(baseHeaders);
+    // Debug canonicalization result
+    console.debug("[sts-debug] canonicalizeHeaders output", {
+        canonicalHeaders: result.canonicalHeaders,
+        signedHeaders: result.signedHeaders,
+    });
+    return result;
+}
+function getCanonicalRequest(input) {
+    return buildCanonicalRequest(input);
 }
 function base64ToArrayBuffer(base64) {
     const binary = atob(base64);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.2.21",
+  "version": "0.2.39",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",