@vizamodo/aws-sts-core 0.3.12 → 0.3.14

package/dist/federation/login.js

@@ -1,15 +1,28 @@
+import { sha256Hex } from "../crypto/sha256";
+import { getEdgeCache, setEdgeCache } from "../runtime/edge-cache";
 export async function buildFederationLoginUrl(input) {
     const session = {
         sessionId: input.accessKeyId,
         sessionKey: input.secretAccessKey,
         sessionToken: input.sessionToken
     };
+    const cacheKey = `aws-signin:${await sha256Hex(input.sessionToken)}`;
     const sessionJson = JSON.stringify(session);
     const encoded = encodeURIComponent(sessionJson);
-    const tokenResp = await fetch(`https://signin.aws.amazon.com/federation?Action=getSigninToken&Session=${encoded}`);
-    const { SigninToken } = await tokenResp.json();
-    if (!SigninToken)
-        throw new Error("federation_failed");
+    let SigninToken;
+    const cached = await getEdgeCache(cacheKey);
+    if (cached) {
+        SigninToken = cached.SigninToken;
+    }
+    else {
+        const tokenResp = await fetch(`https://signin.aws.amazon.com/federation?Action=getSigninToken&Session=${encoded}`);
+        const json = await tokenResp.json();
+        SigninToken = json.SigninToken;
+        if (!SigninToken)
+            throw new Error("federation_failed");
+        // cache SigninToken (AWS token ~15 min → cache 10 min)
+        await setEdgeCache(cacheKey, { SigninToken }, 10 * 60).catch(() => { });
+    }
     const baseLogin = `https://signin.aws.amazon.com/federation?Action=login` +
         `&Issuer=viza` +
         `&SigninToken=${SigninToken}`;

package/dist/runtime/edge-cache.d.ts

@@ -0,0 +1,14 @@
+import type { AwsCredentialResult } from "../types";
+/**
+ * Generic edge cache GET helper
+ */
+export declare function getEdgeCache<T>(key: string): Promise<T | null>;
+/**
+ * Generic edge cache SET helper
+ */
+export declare function setEdgeCache(key: string, value: unknown, ttlSec: number): Promise<void>;
+/**
+ * ---- STS credential cache helpers ----
+ */
+export declare function getCachedCredentials(cacheKey: string): Promise<AwsCredentialResult | null>;
+export declare function setCachedCredentials(cacheKey: string, result: AwsCredentialResult): Promise<void>;

package/dist/runtime/edge-cache.js

@@ -0,0 +1,62 @@
+const CACHE_KEY_PREFIX = "https://edge-cache.internal/";
+const CACHE_TTL_BUFFER_SEC = 5 * 60; // 5 minutes safety buffer
+/**
+ * Generic edge cache GET helper
+ */
+export async function getEdgeCache(key) {
+    try {
+        const cache = caches.default;
+        const req = new Request(CACHE_KEY_PREFIX + key);
+        const res = await cache.match(req);
+        if (!res)
+            return null;
+        try {
+            return (await res.json());
+        }
+        catch {
+            // corrupted cache entry → ignore
+            return null;
+        }
+    }
+    catch {
+        // cache API failure should not break runtime
+        return null;
+    }
+}
+/**
+ * Generic edge cache SET helper
+ */
+export async function setEdgeCache(key, value, ttlSec) {
+    if (ttlSec <= 0)
+        return;
+    const cache = caches.default;
+    const req = new Request(CACHE_KEY_PREFIX + key);
+    const body = JSON.stringify(value);
+    const res = new Response(body, {
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": `max-age=${ttlSec}`,
+        },
+    });
+    try {
+        await cache.put(req, res);
+    }
+    catch {
+        // cache write failure is non-fatal
+    }
+}
+/**
+ * ---- STS credential cache helpers ----
+ */
+export async function getCachedCredentials(cacheKey) {
+    return getEdgeCache(cacheKey);
+}
+export async function setCachedCredentials(cacheKey, result) {
+    if (!result.expiration)
+        return;
+    const expiresAt = Date.parse(result.expiration);
+    if (!Number.isFinite(expiresAt))
+        return;
+    const ttlSec = Math.floor((expiresAt - Date.now()) / 1000) - CACHE_TTL_BUFFER_SEC;
+    await setEdgeCache(cacheKey, result, ttlSec);
+}

package/dist/sts/issue.js

@@ -1,3 +1,4 @@
+import { getEdgeCache, setEdgeCache } from "../runtime/edge-cache";
 import { canonicalizeHeaders } from "../sigv4/headers";
 import { buildCanonicalRequest } from "../sigv4/canonical";
 import { buildStringToSign } from "../sigv4/string-to-sign";
@@ -133,18 +134,24 @@ export async function issueAwsCredentials(input) {
             throw new InternalError("invalid_cert_der");
         }
     }
-    // ---- STS credential cache lookup (using certificate serial) ----
+    // ---- cross-request cache lookup (Cloudflare Cache API) ----
     cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
+    const externalCached = await getEdgeCache(cacheKey);
+    if (externalCached) {
+        console.log("[sts-cache] edge-hit", { cacheKey });
+        return externalCached;
+    }
+    // ---- isolate-level cache lookup (dedupe concurrent refresh within isolate) ----
     const cachedEntry = stsCredentialCache.get(cacheKey);
     if (cachedEntry) {
-        console.log("[sts-cache] hit", {
+        console.log("[sts-cache] isolate-hit", {
             cacheKey,
             expiresAt: cachedEntry.expiresAt,
             now: Date.now(),
         });
     }
     else {
-        console.log("[sts-cache] miss", { cacheKey });
+        console.log("[sts-cache] isolate-miss", { cacheKey });
     }
     // Only reuse cached credentials if they still have >10p remaining
     const MIN_REMAINING_MS = 5 * 60 * 1000;
@@ -238,6 +245,14 @@ export async function issueAwsCredentials(input) {
                 sessionToken: creds.sessionToken,
                 expiration: creds.expiration,
             };
+            // persist credential in edge cache (best effort)
+            if (result.expiration) {
+                const expiresAt = Date.parse(result.expiration);
+                if (Number.isFinite(expiresAt)) {
+                    const ttlSec = Math.floor((expiresAt - Date.now()) / 1000) - (5 * 60);
+                    setEdgeCache(cacheKey, result, ttlSec).catch(() => { });
+                }
+            }
             // subtract small clock‑skew safety window (5s)
             const exp = new Date(creds.expiration).getTime() - 5000;
             // update cache expiration after success

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.12",
+  "version": "0.3.14",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",