@vizamodo/aws-sts-core 0.3.10 → 0.3.12

package/dist/sigv4/request.js

@@ -53,21 +53,33 @@ export async function buildSignedAwsRequest(input) {
         iso.slice(17, 19) +
         "Z";
     const dateStamp = amzDate.slice(0, 8);
+    // SigV4: canonical headers must be sorted alphabetically by header name.
+    // x-amz-security-token sorts before x-amz-target → must appear first.
     const canonicalHeaders = `content-type:${contentType}\n` +
         `host:${host}\n` +
         `x-amz-date:${amzDate}\n` +
-        `x-amz-target:${target}\n` +
         (credentials.sessionToken
             ? `x-amz-security-token:${credentials.sessionToken}\n`
-            : "");
+            : "") +
+        `x-amz-target:${target}\n`;
+    // signedHeaders must list header names in the same alphabetical order.
     const signedHeaders = credentials.sessionToken
         ? "content-type;host;x-amz-date;x-amz-security-token;x-amz-target"
         : "content-type;host;x-amz-date;x-amz-target";
     const payloadHash = await sha256Hex(body);
+    // SigV4 canonical request format:
+    //   METHOD\n
+    //   URI\n
+    //   QueryString\n
+    //   CanonicalHeaders\n   ← each header ends with \n, so last header already adds one
+    //   \n                   ← required blank line separating headers from signedHeaders
+    //   SignedHeaders\n
+    //   PayloadHash
     const canonicalRequest = "POST\n" +
         "/\n" +
         "\n" +
         canonicalHeaders +
+        "\n" + // ← blank line between canonical headers and signed headers
         signedHeaders +
         "\n" +
         payloadHash;

package/dist/sts/issue.js

@@ -136,15 +136,30 @@ export async function issueAwsCredentials(input) {
     // ---- STS credential cache lookup (using certificate serial) ----
     cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
     const cachedEntry = stsCredentialCache.get(cacheKey);
+    if (cachedEntry) {
+        console.log("[sts-cache] hit", {
+            cacheKey,
+            expiresAt: cachedEntry.expiresAt,
+            now: Date.now(),
+        });
+    }
+    else {
+        console.log("[sts-cache] miss", { cacheKey });
+    }
     // Only reuse cached credentials if they still have >10p remaining
     const MIN_REMAINING_MS = 5 * 60 * 1000;
     if (cachedEntry) {
         // If refresh already in-flight → await the same promise
         if (cachedEntry.expiresAt === 0) {
+            console.log("[sts-cache] reuse-inflight-refresh", { cacheKey });
             return cachedEntry.promise;
         }
         // If credentials still valid with safe remaining window → reuse
         if (cachedEntry.expiresAt > Date.now() + MIN_REMAINING_MS) {
+            console.log("[sts-cache] reuse-valid-credentials", {
+                cacheKey,
+                expiresAt: cachedEntry.expiresAt,
+            });
             return cachedEntry.promise;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",