@vizamodo/aws-sts-core 0.3.19 → 0.3.21

package/dist/index.d.ts

@@ -2,3 +2,4 @@ export * from "./types";
 export * from "./sts/issue";
 export * from "./federation/login";
 export * from "./sigv4/request";
+export * from "./runtime/cache";

package/dist/index.js

@@ -2,3 +2,4 @@ export * from "./types";
 export * from "./sts/issue";
 export * from "./federation/login";
 export * from "./sigv4/request";
+export * from "./runtime/cache";

package/dist/runtime/cache.d.ts

@@ -0,0 +1,5 @@
+type Options = {
+    ttlSec?: number;
+};
+export declare function getCachedOrFetch<T>(key: string, fetcher: () => Promise<T>, options?: Options): Promise<T>;
+export {};

package/dist/runtime/cache.js

@@ -0,0 +1,20 @@
+import { getEdgeCache, setEdgeCache } from "./edge-cache";
+const memory = new Map();
+export async function getCachedOrFetch(key, fetcher, options) {
+    // L1: memory
+    if (memory.has(key)) {
+        return memory.get(key);
+    }
+    // L2: edge cache
+    const edge = await getEdgeCache(key);
+    if (edge) {
+        memory.set(key, edge);
+        return edge;
+    }
+    // L3: fetch
+    const value = await fetcher();
+    // write back
+    memory.set(key, value);
+    await setEdgeCache(key, value, options?.ttlSec ?? 3000);
+    return value;
+}

package/dist/sts/issue.js

@@ -142,8 +142,13 @@ export async function issueAwsCredentials(input) {
     // ---- cross-request cache lookup (Cloudflare Cache API) ----
     cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
     const externalCached = await getEdgeCache(cacheKey);
-    if (externalCached) {
-        return externalCached;
+    if (externalCached?.expiration) {
+        const exp = Date.parse(externalCached.expiration);
+        // Ensure cached credentials still have at least 2/3 of session TTL remaining
+        const MIN_REMAINING_MS = Math.floor((sessionTtl * 2) / 3) * 1000;
+        if (Number.isFinite(exp) && exp > Date.now() + MIN_REMAINING_MS) {
+            return externalCached;
+        }
     }
     // ---- isolate-level cache lookup (dedupe concurrent refresh within isolate) ----
     const cachedEntry = stsCredentialCache.get(cacheKey);
@@ -239,9 +244,11 @@ export async function issueAwsCredentials(input) {
             if (result.expiration) {
                 const expiresAt = Date.parse(result.expiration);
                 if (Number.isFinite(expiresAt)) {
-                    // Cache only the last 1/3 of credential lifetime so refresh happens early
                     const remainingSec = Math.floor((expiresAt - Date.now()) / 1000);
-                    const ttlSec = Math.max(0, remainingSec - Math.floor(sessionTtl / 3));
+                    // Cache lifetime policy: only cache for 1/3 of requested session TTL
+                    const desiredTtl = Math.floor(sessionTtl / 3);
+                    // Ensure we never cache longer than the actual credential lifetime
+                    const ttlSec = Math.max(0, Math.min(desiredTtl, remainingSec));
                     setEdgeCache(cacheKey, result, ttlSec).catch(() => { });
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",
@@ -23,8 +23,8 @@
   "devDependencies": {
     "@aws-crypto/sha256-js": "^5.2.0",
     "@aws-sdk/signature-v4": "^3.374.0",
-    "@vitest/coverage-v8": "^4.0.18",
+    "@vitest/coverage-v8": "^4.1.0",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.0"
   }
 }