@vizamodo/aws-sts-core 0.3.15 → 0.3.18

package/dist/runtime/edge-cache.d.ts

@@ -1,4 +1,3 @@
-import type { AwsCredentialResult } from "../types";
 /**
  * Generic edge cache GET helper
  */
@@ -7,8 +6,3 @@ export declare function getEdgeCache<T>(key: string): Promise<T | null>;
  * Generic edge cache SET helper
  */
 export declare function setEdgeCache(key: string, value: unknown, ttlSec: number): Promise<void>;
-/**
- * ---- STS credential cache helpers ----
- */
-export declare function getCachedCredentials(cacheKey: string): Promise<AwsCredentialResult | null>;
-export declare function setCachedCredentials(cacheKey: string, result: AwsCredentialResult): Promise<void>;

package/dist/runtime/edge-cache.js

@@ -1,5 +1,4 @@
 const CACHE_KEY_PREFIX = "https://edge-cache.internal/";
-const CACHE_TTL_BUFFER_SEC = 5 * 60; // 5 minutes safety buffer
 /**
  * Generic edge cache GET helper
  */
@@ -45,18 +44,3 @@ export async function setEdgeCache(key, value, ttlSec) {
         // cache write failure is non-fatal
     }
 }
-/**
- * ---- STS credential cache helpers ----
- */
-export async function getCachedCredentials(cacheKey) {
-    return getEdgeCache(cacheKey);
-}
-export async function setCachedCredentials(cacheKey, result) {
-    if (!result.expiration)
-        return;
-    const expiresAt = Date.parse(result.expiration);
-    if (!Number.isFinite(expiresAt))
-        return;
-    const ttlSec = Math.floor((expiresAt - Date.now()) / 1000) - CACHE_TTL_BUFFER_SEC;
-    await setEdgeCache(cacheKey, result, ttlSec);
-}

package/dist/sts/issue.js

@@ -10,12 +10,12 @@ const ALGORITHM = "AWS4-X509-ECDSA-SHA256";
 const SERVICE = "rolesanywhere";
 const PATH = "/sessions";
 const PROFILE_TTL = {
-    Runtime: 30 * 60,
+    Runtime: 45 * 60,
     ConsoleReadOnly: 12 * 60 * 60,
     ConsoleViewOnlyProd: 12 * 60 * 60,
-    BillingReadOnly: 2 * 60 * 60,
-    BillingAdmin: 2 * 60 * 60,
-    BillingAccountant: 2 * 60 * 60,
+    BillingReadOnly: 3 * 60 * 60,
+    BillingAdmin: 3 * 60 * 60,
+    BillingAccountant: 3 * 60 * 60,
 };
 const DEFAULT_TTL = 2 * 60 * 60;
 // ---- isolate-level cached signing material ----
@@ -62,7 +62,12 @@ async function getSigningMaterial(input) {
     }
 }
 function resolveSessionTtlByProfile(profile) {
-    return PROFILE_TTL[profile] ?? DEFAULT_TTL;
+    const ttl = PROFILE_TTL[profile] ?? DEFAULT_TTL;
+    // Guard rails
+    const MIN_PROFILE_TTL = 45 * 60; // 45 minutes
+    const MAX_PROFILE_TTL = 12 * 60 * 60; // 12 hours
+    // Clamp TTL to safe range
+    return Math.min(Math.max(ttl, MIN_PROFILE_TTL), MAX_PROFILE_TTL);
 }
 /**
  * Issue short-lived AWS credentials via Roles Anywhere.
@@ -142,8 +147,9 @@ export async function issueAwsCredentials(input) {
     }
     // ---- isolate-level cache lookup (dedupe concurrent refresh within isolate) ----
     const cachedEntry = stsCredentialCache.get(cacheKey);
-    // Only reuse cached credentials if they still have >10p remaining
-    const MIN_REMAINING_MS = 5 * 60 * 1000;
+    // Ensure remaining TTL is at least 2/3 of the profile session TTL
+    // so console sessions (e.g. 12h) don't receive credentials close to expiry
+    const MIN_REMAINING_MS = Math.floor((sessionTtl * 2) / 3) * 1000;
     if (cachedEntry) {
         // If refresh already in-flight → await the same promise
         if (cachedEntry.expiresAt === 0) {
@@ -233,7 +239,9 @@ export async function issueAwsCredentials(input) {
             if (result.expiration) {
                 const expiresAt = Date.parse(result.expiration);
                 if (Number.isFinite(expiresAt)) {
-                    const ttlSec = Math.floor((expiresAt - Date.now()) / 1000) - (5 * 60);
+                    // Cache only the last 1/3 of credential lifetime so refresh happens early
+                    const remainingSec = Math.floor((expiresAt - Date.now()) / 1000);
+                    const ttlSec = Math.max(0, remainingSec - Math.floor(sessionTtl / 3));
                     setEdgeCache(cacheKey, result, ttlSec).catch(() => { });
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.15",
+  "version": "0.3.18",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",