@vizamodo/aws-sts-core 0.3.17 → 0.3.18

package/dist/sts/issue.js

@@ -10,12 +10,12 @@ const ALGORITHM = "AWS4-X509-ECDSA-SHA256";
 const SERVICE = "rolesanywhere";
 const PATH = "/sessions";
 const PROFILE_TTL = {
-    Runtime: 30 * 60,
+    Runtime: 45 * 60,
     ConsoleReadOnly: 12 * 60 * 60,
     ConsoleViewOnlyProd: 12 * 60 * 60,
-    BillingReadOnly: 2 * 60 * 60,
-    BillingAdmin: 2 * 60 * 60,
-    BillingAccountant: 2 * 60 * 60,
+    BillingReadOnly: 3 * 60 * 60,
+    BillingAdmin: 3 * 60 * 60,
+    BillingAccountant: 3 * 60 * 60,
 };
 const DEFAULT_TTL = 2 * 60 * 60;
 // ---- isolate-level cached signing material ----
@@ -62,7 +62,12 @@ async function getSigningMaterial(input) {
     }
 }
 function resolveSessionTtlByProfile(profile) {
-    return PROFILE_TTL[profile] ?? DEFAULT_TTL;
+    const ttl = PROFILE_TTL[profile] ?? DEFAULT_TTL;
+    // Guard rails
+    const MIN_PROFILE_TTL = 45 * 60; // 45 minutes
+    const MAX_PROFILE_TTL = 12 * 60 * 60; // 12 hours
+    // Clamp TTL to safe range
+    return Math.min(Math.max(ttl, MIN_PROFILE_TTL), MAX_PROFILE_TTL);
 }
 /**
  * Issue short-lived AWS credentials via Roles Anywhere.
@@ -142,8 +147,9 @@ export async function issueAwsCredentials(input) {
     }
     // ---- isolate-level cache lookup (dedupe concurrent refresh within isolate) ----
     const cachedEntry = stsCredentialCache.get(cacheKey);
-    // Only reuse cached credentials if they still have >10p remaining
-    const MIN_REMAINING_MS = 5 * 60 * 1000;
+    // Ensure remaining TTL is at least 2/3 of the profile session TTL
+    // so console sessions (e.g. 12h) don't receive credentials close to expiry
+    const MIN_REMAINING_MS = Math.floor((sessionTtl * 2) / 3) * 1000;
     if (cachedEntry) {
         // If refresh already in-flight → await the same promise
         if (cachedEntry.expiresAt === 0) {
@@ -233,7 +239,9 @@ export async function issueAwsCredentials(input) {
             if (result.expiration) {
                 const expiresAt = Date.parse(result.expiration);
                 if (Number.isFinite(expiresAt)) {
-                    const ttlSec = Math.floor((expiresAt - Date.now()) / 1000) - (15 * 60);
+                    // Cache only the last 1/3 of credential lifetime so refresh happens early
+                    const remainingSec = Math.floor((expiresAt - Date.now()) / 1000);
+                    const ttlSec = Math.max(0, remainingSec - Math.floor(sessionTtl / 3));
                     setEdgeCache(cacheKey, result, ttlSec).catch(() => { });
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",