@vizamodo/aws-sts-core 0.2.34 → 0.2.39

package/dist/sts/issue.js

@@ -20,22 +20,18 @@ const DEFAULT_TTL = 2 * 60 * 60;
 let cachedSigningKey = null;
 let cachedCertBase64 = null;
 let cachedPrivateKeyBase64 = null;
-// ---- shared encoder + canonical request hash cache ----
+// ---- shared encoder + payload hash cache ----
 const textEncoder = new TextEncoder();
-let lastCanonicalRequestKey = null;
-let lastCanonicalRequest = null;
-let lastCanonicalRequestHash = null;
 let lastBody = null;
 let lastPayloadHash = null;
-let lastBaseHeadersKey = null;
-let lastCanonicalHeaders = null;
-let lastSignedHeaders = null;
 async function getSigningMaterial(input) {
     if (cachedSigningKey &&
         cachedCertBase64 === input.certBase64 &&
         cachedPrivateKeyBase64 === input.privateKeyPkcs8Base64) {
+        console.debug("[sts-cache] signingKey HIT");
         return { signingKey: cachedSigningKey, certBase64: cachedCertBase64 };
     }
+    console.debug("[sts-cache] signingKey MISS → importing key");
     try {
         const keyBuffer = base64ToArrayBuffer(input.privateKeyPkcs8Base64);
         cachedSigningKey = await crypto.subtle.importKey("pkcs8", keyBuffer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
@@ -137,21 +133,56 @@ export async function issueAwsCredentials(input) {
         signedHeaders,
         payloadHash,
     });
+    console.debug("[sts-debug] canonicalRequest", {
+        amzDate,
+        signedHeaders,
+        payloadHash,
+        canonicalHeadersPreview: canonicalHeaders.slice(0, 120),
+        canonicalRequestPreview: canonicalRequest.slice(0, 200)
+    });
     const canonicalRequestHash = await getCanonicalRequestHash(canonicalRequest);
+    console.debug("[sts-debug] canonicalRequestHash", canonicalRequestHash);
     const stringToSign = buildStringToSign({
         algorithm: ALGORITHM,
         amzDate,
         credentialScope,
         canonicalRequestHash,
     });
+    console.debug("[sts-debug] stringToSign", {
+        credentialScope,
+        stringPreview: stringToSign.slice(0, 200)
+    });
     const signatureHex = await signStringToSign(stringToSign, signingKey);
+    console.debug("[sts-debug] signature", {
+        length: signatureHex.length,
+        prefix: signatureHex.slice(0, 32)
+    });
     // 5. Build Authorization Header với số Serial (DECIMAL)
     const finalHeaders = new Headers({
         "Content-Type": "application/json",
+        "Host": host,
         "X-Amz-Date": amzDate,
         "X-Amz-X509": normalizedCert,
         "Authorization": `AWS4-X509-ECDSA-SHA256 Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`
     });
+    console.debug("[sts-debug] requestHeaders", {
+        host,
+        amzDate,
+        signedHeaders,
+        certLen: normalizedCert.length
+    });
+    console.debug("[sts-request] issuing rolesanywhere session", {
+        region,
+        profile,
+        roleArn,
+        profileArn,
+        trustAnchorArn,
+        amzDate,
+        cacheState: {
+            hasSigningKey: !!cachedSigningKey,
+            cachedCertMatch: cachedCertBase64 === certBase64,
+        }
+    });
     // 6. Execution
     try {
         const res = await fetch(`https://${host}${path}`, {
@@ -164,7 +195,10 @@ export async function issueAwsCredentials(input) {
             // Debug logs
             console.error("[aws-rejected] Request details", {
                 status: res.status,
-                response: errorBody
+                response: errorBody,
+                region,
+                profile,
+                amzDate
             });
             throw new InternalError("aws_rejected");
         }
@@ -178,6 +212,14 @@ export async function issueAwsCredentials(input) {
         };
     }
     catch (e) {
+        console.error("[sts-debug] fetch failure", {
+            error: String(e),
+            region,
+            roleArn,
+            profileArn,
+            trustAnchorArn,
+            amzDate
+        });
         if (e instanceof InternalError)
             throw e;
         throw new InternalError("aws_unreachable");
@@ -202,52 +244,35 @@ async function sha256Hex(input) {
     return hex.join("");
 }
 async function getCanonicalRequestHash(canonicalRequest) {
-    if (lastCanonicalRequest === canonicalRequest && lastCanonicalRequestHash) {
-        return lastCanonicalRequestHash;
-    }
-    const hash = await sha256Hex(canonicalRequest);
-    lastCanonicalRequest = canonicalRequest;
-    lastCanonicalRequestHash = hash;
-    return hash;
+    return sha256Hex(canonicalRequest);
 }
 async function getPayloadHash(body) {
     if (lastBody === body && lastPayloadHash) {
+        console.debug("[sts-cache] payloadHash HIT");
         return lastPayloadHash;
     }
+    console.debug("[sts-cache] payloadHash MISS");
     const hash = await sha256Hex(body);
     lastBody = body;
     lastPayloadHash = hash;
     return hash;
 }
 function getCanonicalizedHeaders(baseHeaders) {
-    // build deterministic cache key without JSON.stringify allocation
-    const key = baseHeaders["content-type"] + "|" +
-        baseHeaders["host"] + "|" +
-        baseHeaders["x-amz-date"] + "|" +
-        baseHeaders["x-amz-x509"];
-    if (lastBaseHeadersKey === key && lastCanonicalHeaders && lastSignedHeaders) {
-        return { canonicalHeaders: lastCanonicalHeaders, signedHeaders: lastSignedHeaders };
-    }
-    const { canonicalHeaders, signedHeaders } = canonicalizeHeaders(baseHeaders);
-    lastBaseHeadersKey = key;
-    lastCanonicalHeaders = canonicalHeaders;
-    lastSignedHeaders = signedHeaders;
-    return { canonicalHeaders, signedHeaders };
+    // Debug input headers before canonicalization
+    console.debug("[sts-debug] canonicalizeHeaders input", {
+        headers: baseHeaders,
+        keys: Object.keys(baseHeaders),
+    });
+    const result = canonicalizeHeaders(baseHeaders);
+    // Debug canonicalization result
+    console.debug("[sts-debug] canonicalizeHeaders output", {
+        canonicalHeaders: result.canonicalHeaders,
+        signedHeaders: result.signedHeaders,
+    });
+    return result;
 }
 function getCanonicalRequest(input) {
-    const key = input.method + "|" +
-        input.canonicalUri + "|" +
-        input.query + "|" +
-        input.canonicalHeaders + "|" +
-        input.signedHeaders + "|" +
-        input.payloadHash;
-    if (lastCanonicalRequestKey === key && lastCanonicalRequest) {
-        return lastCanonicalRequest;
-    }
-    const req = buildCanonicalRequest(input);
-    lastCanonicalRequestKey = key;
-    lastCanonicalRequest = req;
-    return req;
+    return buildCanonicalRequest(input);
 }
 function base64ToArrayBuffer(base64) {
     const binary = atob(base64);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.2.34",
+  "version": "0.2.39",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",