@vizamodo/aws-sts-core 0.3.32 → 0.3.34

package/dist/federation/login.js

@@ -10,6 +10,14 @@ export async function buildFederationLoginUrl(input) {
     if (!Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now()) {
         throw new Error("[federation] invalid or expired credentials");
     }
+    const tokenHash = await sha256Hex(input.sessionToken);
+    console.debug("[signin] key input", {
+        accessKeyId: input.accessKeyId,
+        tokenHash,
+        intent: input.intent,
+        region: input.region,
+        forceRefresh: input.forceRefresh
+    });
     const cacheKey = `aws-signin:${await sha256Hex(input.accessKeyId)}`;
     const sessionJson = JSON.stringify(session);
     const encoded = encodeURIComponent(sessionJson);

package/dist/sts/issue.js

@@ -89,6 +89,7 @@ export async function issueAwsCredentials(input) {
         cachedCertSerialSource = normalizedCert;
     }
     const cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
+    console.debug("[issueAwsCredentials] cacheKey", { cacheKey, forceRefresh });
     // ---- Build SigV4 request ----
     const { signingKey } = await getSigningMaterial({
         certBase64: normalizedCert,
@@ -131,6 +132,7 @@ export async function issueAwsCredentials(input) {
         "Authorization": `${ALGORITHM} Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`,
     });
     const issuedAt = Date.now(); // snapshot before the network round-trip
+    console.debug("[issueAwsCredentials] invoking cache layer", { cacheKey });
     return getCachedOrFetch(cacheKey, async () => {
         const res = await fetch(`https://${host}${PATH}`, {
             method: "POST",
@@ -147,6 +149,10 @@ export async function issueAwsCredentials(input) {
             console.warn("[issueAwsCredentials] malformed AWS credential response");
             throw new InternalError("aws_malformed_credentials");
         }
+        console.debug("[issueAwsCredentials] fetched new credentials", {
+            accessKeyId: creds.accessKeyId,
+            expiration: creds.expiration
+        });
         const value = {
             accessKeyId: creds.accessKeyId,
             secretAccessKey: creds.secretAccessKey,
@@ -159,8 +165,15 @@ export async function issueAwsCredentials(input) {
         if (Number.isFinite(expiresAtMs) && credLifetimeSec > 0) {
             const edgeCacheTtlSec = Math.floor(credLifetimeSec / 3);
             const edgeCacheExpiry = new Date(issuedAt + edgeCacheTtlSec * 1000).toISOString();
+            console.debug("[issueAwsCredentials] computed TTL", {
+                credLifetimeSec,
+                edgeCacheTtlSec
+            });
             return wrapResult(value, edgeCacheExpiry);
         }
+        console.debug("[issueAwsCredentials] fallback return (no TTL)", {
+            accessKeyId: value.accessKeyId
+        });
         return value;
     }, {
         ttlSec: 60,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.32",
+  "version": "0.3.34",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",