@vizamodo/aws-sts-core 0.3.3 → 0.3.5

package/dist/sts/issue.js

@@ -8,7 +8,7 @@ const ALGORITHM = "AWS4-X509-ECDSA-SHA256";
 const SERVICE = "rolesanywhere";
 const PATH = "/sessions";
 const PROFILE_TTL = {
-    Runtime: 90 * 60,
+    Runtime: 30 * 60,
     ConsoleReadOnly: 12 * 60 * 60,
     ConsoleViewOnlyProd: 12 * 60 * 60,
     BillingReadOnly: 2 * 60 * 60,
@@ -91,11 +91,15 @@ export async function issueAwsCredentials(input) {
             const der = base64ToBytes(normalizedCert);
             let offset = 0;
             function readLen() {
+                if (offset >= der.length)
+                    throw new Error("DER overflow");
                 const b = der[offset++];
                 if ((b & 0x80) === 0)
                     return b;
                 const n = b & 0x7f;
                 let len = 0;
+                if (offset + n > der.length)
+                    throw new Error("DER overflow");
                 for (let i = 0; i < n; i++) {
                     len = (len << 8) | der[offset++];
                 }
@@ -115,6 +119,8 @@ export async function issueAwsCredentials(input) {
             if (der[offset++] !== 0x02)
                 throw new Error("bad serial tag");
             const serialLen = readLen();
+            if (offset + serialLen > der.length)
+                throw new Error("DER overflow");
             let serial = der.slice(offset, offset + serialLen);
             if (serial.length > 1 && serial[0] === 0x00) {
                 serial = serial.slice(1);
@@ -134,17 +140,17 @@ export async function issueAwsCredentials(input) {
         }
     }
     // ---- STS credential cache lookup (using certificate serial) ----
-    cacheKey = `${region}|${roleArn}|${profileArn}|${certSerialDec}`;
+    cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
     const cachedEntry = stsCredentialCache.get(cacheKey);
-    // Only reuse cached credentials if they still have >1h1m remaining
-    const MIN_REMAINING_MS = 61 * 60 * 1000;
+    // Only reuse cached credentials if they still have >10p remaining
+    const MIN_REMAINING_MS = 5 * 60 * 1000;
     if (cachedEntry) {
-        // If credentials already resolved and still valid → reuse
-        if (cachedEntry.expiresAt > Date.now() + MIN_REMAINING_MS) {
+        // If refresh already in-flight → await the same promise
+        if (cachedEntry.expiresAt === 0) {
             return cachedEntry.promise;
         }
-        // If a refresh is already in-flight → await same promise
-        if (cachedEntry.expiresAt === 0) {
+        // If credentials still valid with safe remaining window → reuse
+        if (cachedEntry.expiresAt > Date.now() + MIN_REMAINING_MS) {
             return cachedEntry.promise;
         }
     }
@@ -155,9 +161,9 @@ export async function issueAwsCredentials(input) {
     // 2. Setup constants
     const host = `${SERVICE}.${region}.amazonaws.com`;
     const path = PATH;
-    const now = new Date();
-    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
-    const dateStamp = amzDate.slice(0, 8);
+    const iso = new Date().toISOString(); // e.g. 2026-03-07T12:00:00.000Z
+    const amzDate = `${iso.slice(0, 4)}${iso.slice(5, 7)}${iso.slice(8, 10)}T${iso.slice(11, 13)}${iso.slice(14, 16)}${iso.slice(17, 19)}Z`;
+    const dateStamp = iso.slice(0, 4) + iso.slice(5, 7) + iso.slice(8, 10);
     const service = SERVICE;
     // 3. Chuẩn bị Body & Cert
     const body = JSON.stringify({ trustAnchorArn, profileArn, roleArn, durationSeconds: sessionTtl });
@@ -204,20 +210,17 @@ export async function issueAwsCredentials(input) {
                 body,
             });
             if (!res.ok) {
-                const errorBody = await res.text();
-                console.error("[aws-rejected] Request details", {
+                console.warn("[aws-rejected]", {
                     status: res.status,
-                    response: errorBody,
                     region,
-                    profile,
-                    amzDate
+                    profile
                 });
                 throw new InternalError("aws_rejected");
             }
             const json = await res.json();
             const creds = json?.credentialSet?.[0]?.credentials;
             if (!creds?.accessKeyId || !creds?.secretAccessKey || !creds?.sessionToken) {
-                console.error("[issueAwsCredentials] malformed AWS credential response", { json });
+                console.warn("[issueAwsCredentials] malformed AWS credential response");
                 throw new InternalError("aws_malformed_credentials");
             }
             const result = {
@@ -226,7 +229,8 @@ export async function issueAwsCredentials(input) {
                 sessionToken: creds.sessionToken,
                 expiration: creds.expiration,
             };
-            const exp = new Date(creds.expiration).getTime();
+            // subtract small clock‑skew safety window (5s)
+            const exp = new Date(creds.expiration).getTime() - 5000;
             // update cache expiration after success
             const entry = stsCredentialCache.get(cacheKey);
             if (entry) {
@@ -254,7 +258,8 @@ function normalizeCert(raw) {
     if (raw.includes("BEGIN CERTIFICATE")) {
         throw new InternalError("pem_not_allowed");
     }
-    return raw.trim();
+    // remove whitespace and newlines to ensure stable cache keys
+    return raw.replace(/\s+/g, "");
 }
 async function sha256Hex(input) {
     // Tận dụng textEncoder có sẵn
@@ -274,7 +279,7 @@ async function getPayloadHash(body) {
     // so caching adds complexity without measurable benefit.
     return sha256Hex(body);
 }
-// Faster base64 decode → Uint8Array (avoids extra ArrayBuffer wrapping)
+// Faster base64 decode → Uint8Array (V8 optimized path using built‑in vectorized conversion)
 function base64ToBytes(base64) {
     const binary = atob(base64);
     const len = binary.length;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",