@vizamodo/aws-sts-core 0.3.13 → 0.3.14

package/dist/federation/login.js

@@ -1,15 +1,28 @@
+import { sha256Hex } from "../crypto/sha256";
+import { getEdgeCache, setEdgeCache } from "../runtime/edge-cache";
 export async function buildFederationLoginUrl(input) {
     const session = {
         sessionId: input.accessKeyId,
         sessionKey: input.secretAccessKey,
         sessionToken: input.sessionToken
     };
+    const cacheKey = `aws-signin:${await sha256Hex(input.sessionToken)}`;
     const sessionJson = JSON.stringify(session);
     const encoded = encodeURIComponent(sessionJson);
-    const tokenResp = await fetch(`https://signin.aws.amazon.com/federation?Action=getSigninToken&Session=${encoded}`);
-    const { SigninToken } = await tokenResp.json();
-    if (!SigninToken)
-        throw new Error("federation_failed");
+    let SigninToken;
+    const cached = await getEdgeCache(cacheKey);
+    if (cached) {
+        SigninToken = cached.SigninToken;
+    }
+    else {
+        const tokenResp = await fetch(`https://signin.aws.amazon.com/federation?Action=getSigninToken&Session=${encoded}`);
+        const json = await tokenResp.json();
+        SigninToken = json.SigninToken;
+        if (!SigninToken)
+            throw new Error("federation_failed");
+        // cache SigninToken (AWS token ~15 min → cache 10 min)
+        await setEdgeCache(cacheKey, { SigninToken }, 10 * 60).catch(() => { });
+    }
     const baseLogin = `https://signin.aws.amazon.com/federation?Action=login` +
         `&Issuer=viza` +
         `&SigninToken=${SigninToken}`;

package/dist/runtime/edge-cache.d.ts

@@ -0,0 +1,14 @@
+import type { AwsCredentialResult } from "../types";
+/**
+ * Generic edge cache GET helper
+ */
+export declare function getEdgeCache<T>(key: string): Promise<T | null>;
+/**
+ * Generic edge cache SET helper
+ */
+export declare function setEdgeCache(key: string, value: unknown, ttlSec: number): Promise<void>;
+/**
+ * ---- STS credential cache helpers ----
+ */
+export declare function getCachedCredentials(cacheKey: string): Promise<AwsCredentialResult | null>;
+export declare function setCachedCredentials(cacheKey: string, result: AwsCredentialResult): Promise<void>;

package/dist/runtime/edge-cache.js

@@ -0,0 +1,62 @@
+const CACHE_KEY_PREFIX = "https://edge-cache.internal/";
+const CACHE_TTL_BUFFER_SEC = 5 * 60; // 5 minutes safety buffer
+/**
+ * Generic edge cache GET helper
+ */
+export async function getEdgeCache(key) {
+    try {
+        const cache = caches.default;
+        const req = new Request(CACHE_KEY_PREFIX + key);
+        const res = await cache.match(req);
+        if (!res)
+            return null;
+        try {
+            return (await res.json());
+        }
+        catch {
+            // corrupted cache entry → ignore
+            return null;
+        }
+    }
+    catch {
+        // cache API failure should not break runtime
+        return null;
+    }
+}
+/**
+ * Generic edge cache SET helper
+ */
+export async function setEdgeCache(key, value, ttlSec) {
+    if (ttlSec <= 0)
+        return;
+    const cache = caches.default;
+    const req = new Request(CACHE_KEY_PREFIX + key);
+    const body = JSON.stringify(value);
+    const res = new Response(body, {
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": `max-age=${ttlSec}`,
+        },
+    });
+    try {
+        await cache.put(req, res);
+    }
+    catch {
+        // cache write failure is non-fatal
+    }
+}
+/**
+ * ---- STS credential cache helpers ----
+ */
+export async function getCachedCredentials(cacheKey) {
+    return getEdgeCache(cacheKey);
+}
+export async function setCachedCredentials(cacheKey, result) {
+    if (!result.expiration)
+        return;
+    const expiresAt = Date.parse(result.expiration);
+    if (!Number.isFinite(expiresAt))
+        return;
+    const ttlSec = Math.floor((expiresAt - Date.now()) / 1000) - CACHE_TTL_BUFFER_SEC;
+    await setEdgeCache(cacheKey, result, ttlSec);
+}

package/dist/sts/issue.js

@@ -1,4 +1,4 @@
-import { getCachedCredentials, setCachedCredentials } from "./cache";
+import { getEdgeCache, setEdgeCache } from "../runtime/edge-cache";
 import { canonicalizeHeaders } from "../sigv4/headers";
 import { buildCanonicalRequest } from "../sigv4/canonical";
 import { buildStringToSign } from "../sigv4/string-to-sign";
@@ -136,7 +136,7 @@ export async function issueAwsCredentials(input) {
     }
     // ---- cross-request cache lookup (Cloudflare Cache API) ----
     cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
-    const externalCached = await getCachedCredentials(cacheKey);
+    const externalCached = await getEdgeCache(cacheKey);
     if (externalCached) {
         console.log("[sts-cache] edge-hit", { cacheKey });
         return externalCached;
@@ -246,7 +246,13 @@ export async function issueAwsCredentials(input) {
                 expiration: creds.expiration,
             };
             // persist credential in edge cache (best effort)
-            setCachedCredentials(cacheKey, result).catch(() => { });
+            if (result.expiration) {
+                const expiresAt = Date.parse(result.expiration);
+                if (Number.isFinite(expiresAt)) {
+                    const ttlSec = Math.floor((expiresAt - Date.now()) / 1000) - (5 * 60);
+                    setEdgeCache(cacheKey, result, ttlSec).catch(() => { });
+                }
+            }
             // subtract small clock‑skew safety window (5s)
             const exp = new Date(creds.expiration).getTime() - 5000;
             // update cache expiration after success

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",

package/dist/sts/cache.d.ts

@@ -1,3 +0,0 @@
-import type { AwsCredentialResult } from "../types";
-export declare function getCachedCredentials(cacheKey: string): Promise<AwsCredentialResult | null>;
-export declare function setCachedCredentials(cacheKey: string, result: AwsCredentialResult): Promise<void>;

package/dist/sts/cache.js

@@ -1,40 +0,0 @@
-const CACHE_KEY_PREFIX = "https://sts-cache.internal/";
-const CACHE_TTL_BUFFER_SEC = 5 * 60; // 5 minutes safety buffer
-export async function getCachedCredentials(cacheKey) {
-    const cache = caches.default;
-    const req = new Request(CACHE_KEY_PREFIX + cacheKey);
-    const res = await cache.match(req);
-    if (!res)
-        return null;
-    try {
-        return (await res.json());
-    }
-    catch {
-        // corrupted cache entry → ignore
-        return null;
-    }
-}
-export async function setCachedCredentials(cacheKey, result) {
-    if (!result.expiration) {
-        // cache is optional; skip caching if expiration missing
-        return;
-    }
-    const expiresAt = Date.parse(result.expiration);
-    if (!Number.isFinite(expiresAt)) {
-        // invalid expiration → skip caching
-        return;
-    }
-    const ttlSec = Math.floor((expiresAt - Date.now()) / 1000) - CACHE_TTL_BUFFER_SEC;
-    if (ttlSec <= 0)
-        return;
-    const cache = caches.default;
-    const req = new Request(CACHE_KEY_PREFIX + cacheKey);
-    const body = JSON.stringify(result);
-    const res = new Response(body, {
-        headers: {
-            "Content-Type": "application/json",
-            "Cache-Control": `max-age=${ttlSec}`,
-        },
-    });
-    await cache.put(req, res);
-}