@vizamodo/aws-sts-core 0.3.49 → 0.4.1

package/dist/sts/issue.js

@@ -1,10 +1,10 @@
-import { getCachedOrFetch, wrapResult } from "@vizamodo/edge-cache-core";
 import { canonicalizeHeaders } from "../sigv4/headers";
 import { buildCanonicalRequest } from "../sigv4/canonical";
 import { buildStringToSign } from "../sigv4/string-to-sign";
 import { signStringToSign } from "./signer";
 import { InternalError } from "./errors";
 import { sha256Hex } from "../crypto/sha256";
+import { getCachedOrFetch, wrapResult } from "@vizamodo/edge-cache-core";
 // ── Constants ──────────────────────────────────────────────────────────────
 const ALGORITHM = "AWS4-X509-ECDSA-SHA256";
 const SERVICE = "rolesanywhere";
@@ -58,21 +58,29 @@ async function getSigningMaterial(certBase64, privateKeyPkcs8Base64) {
         cachedPrivateKeyBase64 === privateKeyPkcs8Base64) {
         return cachedSigningKey;
     }
-    // Material rotated — discard stale state and re-import.
+    // Material changed or first call — reset and re-import.
+    // Cache vars are updated inside .then() so concurrent callers
+    // awaiting the same promise all see consistent state after resolve.
     signingKeyPromise = null;
     cachedSigningKey = null;
-    if (!signingKeyPromise) {
-        signingKeyPromise = crypto.subtle
-            .importKey("pkcs8", base64ToBytes(privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
-            .catch(() => {
-            signingKeyPromise = null; // allow retry
-            throw new InternalError("invalid_signing_material");
-        });
-    }
-    cachedSigningKey = await signingKeyPromise;
-    cachedCertBase64 = certBase64;
-    cachedPrivateKeyBase64 = privateKeyPkcs8Base64;
-    return cachedSigningKey;
+    cachedCertBase64 = null;
+    cachedPrivateKeyBase64 = null;
+    signingKeyPromise = crypto.subtle
+        .importKey("pkcs8", base64ToBytes(privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
+        .then((key) => {
+        // Update cache atomically after successful import.
+        // All concurrent callers awaiting this promise will see
+        // consistent state and hit the fast path on next call.
+        cachedSigningKey = key;
+        cachedCertBase64 = certBase64;
+        cachedPrivateKeyBase64 = privateKeyPkcs8Base64;
+        return key;
+    })
+        .catch(() => {
+        signingKeyPromise = null; // allow retry on next call
+        throw new InternalError("invalid_signing_material");
+    });
+    return signingKeyPromise;
 }
 // ── Session TTL ────────────────────────────────────────────────────────────
 function resolveSessionTtl(profile) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.49",
+  "version": "0.4.1",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",