@vizamodo/aws-sts-core 0.3.1 → 0.3.2

package/dist/sts/issue.js

@@ -17,6 +17,8 @@ const PROFILE_TTL = {
 };
 const DEFAULT_TTL = 2 * 60 * 60;
 // ---- isolate-level cached signing material ----
+// Promise-based cache to avoid cold-start race during concurrent imports
+let signingKeyPromise = null;
 let cachedSigningKey = null;
 let cachedCertBase64 = null;
 let cachedPrivateKeyBase64 = null;
@@ -34,18 +36,32 @@ async function getSigningMaterial(input) {
     if (cachedSigningKey &&
         cachedCertBase64 === input.certBase64 &&
         cachedPrivateKeyBase64 === input.privateKeyPkcs8Base64) {
-        console.debug("[sts-cache] signingKey HIT");
         return { signingKey: cachedSigningKey, certBase64: cachedCertBase64 };
     }
-    console.debug("[sts-cache] signingKey MISS → importing key");
+    // Reset cache only after a signing key has been resolved and material actually changed
+    if (cachedSigningKey &&
+        (cachedCertBase64 !== input.certBase64 ||
+            cachedPrivateKeyBase64 !== input.privateKeyPkcs8Base64)) {
+        signingKeyPromise = null;
+        cachedSigningKey = null;
+    }
+    if (!signingKeyPromise) {
+        try {
+            const keyBuffer = base64ToBytes(input.privateKeyPkcs8Base64);
+            signingKeyPromise = crypto.subtle.importKey("pkcs8", keyBuffer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+        }
+        catch {
+            throw new InternalError("invalid_signing_material");
+        }
+    }
     try {
-        const keyBuffer = base64ToBytes(input.privateKeyPkcs8Base64);
-        cachedSigningKey = await crypto.subtle.importKey("pkcs8", keyBuffer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+        cachedSigningKey = await signingKeyPromise;
         cachedCertBase64 = input.certBase64;
         cachedPrivateKeyBase64 = input.privateKeyPkcs8Base64;
         return { signingKey: cachedSigningKey, certBase64: cachedCertBase64 };
     }
     catch {
+        signingKeyPromise = null; // allow retry after failure
         throw new InternalError("invalid_signing_material");
     }
 }
@@ -82,11 +98,9 @@ export async function issueAwsCredentials(input) {
     // --- MINIMAL DER WALK: extract serial number ---
     let certSerialDec;
     if (cachedCertSerialDec && cachedCertSerialSource === normalizedCert) {
-        console.debug("[sts-cache] certSerial HIT");
         certSerialDec = cachedCertSerialDec;
     }
     else {
-        console.debug("[sts-cache] certSerial MISS → parsing DER");
         try {
             const der = base64ToBytes(normalizedCert);
             let offset = 0;
@@ -149,30 +163,14 @@ export async function issueAwsCredentials(input) {
         signedHeaders,
         payloadHash,
     });
-    console.debug("[sts-debug] canonicalRequest", {
-        amzDate,
-        signedHeaders,
-        payloadHash,
-        canonicalHeadersPreview: canonicalHeaders.slice(0, 120),
-        canonicalRequestPreview: canonicalRequest.slice(0, 200)
-    });
     const canonicalRequestHash = await getCanonicalRequestHash(canonicalRequest);
-    console.debug("[sts-debug] canonicalRequestHash", canonicalRequestHash);
     const stringToSign = buildStringToSign({
         algorithm: ALGORITHM,
         amzDate,
         credentialScope,
         canonicalRequestHash,
     });
-    console.debug("[sts-debug] stringToSign", {
-        credentialScope,
-        stringPreview: stringToSign.slice(0, 200)
-    });
     const signatureHex = await signStringToSign(stringToSign, signingKey);
-    console.debug("[sts-debug] signature", {
-        length: signatureHex.length,
-        prefix: signatureHex.slice(0, 32)
-    });
     // 5. Build Authorization Header với số Serial (DECIMAL)
     const finalHeaders = new Headers({
         "Content-Type": "application/json",
@@ -180,25 +178,6 @@ export async function issueAwsCredentials(input) {
         "X-Amz-X509": normalizedCert,
         "Authorization": `AWS4-X509-ECDSA-SHA256 Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`
     });
-    console.debug("[sts-debug] requestHeaders", {
-        host,
-        amzDate,
-        signedHeaders,
-        certLen: normalizedCert.length
-    });
-    console.debug("[sts-request] issuing rolesanywhere session", {
-        region,
-        profile,
-        roleArn,
-        profileArn,
-        trustAnchorArn,
-        amzDate,
-        cacheState: {
-            hasSigningKey: !!cachedSigningKey,
-            cachedCertMatch: cachedCertBase64 === normalizedCert,
-        }
-    });
-    // 6. Execution
     try {
         const res = await fetch(`https://${host}${path}`, {
             method: "POST",
@@ -231,14 +210,6 @@ export async function issueAwsCredentials(input) {
         };
     }
     catch (e) {
-        console.error("[sts-debug] fetch failure", {
-            error: String(e),
-            region,
-            roleArn,
-            profileArn,
-            trustAnchorArn,
-            amzDate
-        });
         if (e instanceof InternalError)
             throw e;
         throw new InternalError("aws_unreachable");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",
@@ -13,6 +13,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "test": "vitest run",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run build",
     "dev": "ts-node bin/viza.ts",
@@ -20,6 +21,10 @@
     "release:full": "rm -rf dist && npx npm-check-updates -u && npm install && git add package.json package-lock.json && git commit -m 'chore(deps): auto update dependencies before release' || echo 'No changes' && node versioning.js && npm login && npm publish --tag latest --access public && git push"
   },
   "devDependencies": {
-    "typescript": "^5.9.3"
+    "@aws-crypto/sha256-js": "^5.2.0",
+    "@aws-sdk/signature-v4": "^3.374.0",
+    "@vitest/coverage-v8": "^4.0.18",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
   }
 }