@vizamodo/aws-sts-core 0.3.50 → 0.4.1

package/dist/sts/issue.js

@@ -1,10 +1,10 @@
-import { getCachedOrFetch, wrapResult } from "@vizamodo/edge-cache-core";
 import { canonicalizeHeaders } from "../sigv4/headers";
 import { buildCanonicalRequest } from "../sigv4/canonical";
 import { buildStringToSign } from "../sigv4/string-to-sign";
 import { signStringToSign } from "./signer";
 import { InternalError } from "./errors";
 import { sha256Hex } from "../crypto/sha256";
+import { getCachedOrFetch, wrapResult } from "@vizamodo/edge-cache-core";
 // ── Constants ──────────────────────────────────────────────────────────────
 const ALGORITHM = "AWS4-X509-ECDSA-SHA256";
 const SERVICE = "rolesanywhere";
@@ -58,21 +58,29 @@ async function getSigningMaterial(certBase64, privateKeyPkcs8Base64) {
         cachedPrivateKeyBase64 === privateKeyPkcs8Base64) {
         return cachedSigningKey;
     }
-    // Material rotated — discard stale state and re-import.
+    // Material changed or first call — reset and re-import.
+    // Cache vars are updated inside .then() so concurrent callers
+    // awaiting the same promise all see consistent state after resolve.
     signingKeyPromise = null;
     cachedSigningKey = null;
-    if (!signingKeyPromise) {
-        signingKeyPromise = crypto.subtle
-            .importKey("pkcs8", base64ToBytes(privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
-            .catch(() => {
-            signingKeyPromise = null; // allow retry
-            throw new InternalError("invalid_signing_material");
-        });
-    }
-    cachedSigningKey = await signingKeyPromise;
-    cachedCertBase64 = certBase64;
-    cachedPrivateKeyBase64 = privateKeyPkcs8Base64;
-    return cachedSigningKey;
+    cachedCertBase64 = null;
+    cachedPrivateKeyBase64 = null;
+    signingKeyPromise = crypto.subtle
+        .importKey("pkcs8", base64ToBytes(privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
+        .then((key) => {
+        // Update cache atomically after successful import.
+        // All concurrent callers awaiting this promise will see
+        // consistent state and hit the fast path on next call.
+        cachedSigningKey = key;
+        cachedCertBase64 = certBase64;
+        cachedPrivateKeyBase64 = privateKeyPkcs8Base64;
+        return key;
+    })
+        .catch(() => {
+        signingKeyPromise = null; // allow retry on next call
+        throw new InternalError("invalid_signing_material");
+    });
+    return signingKeyPromise;
 }
 // ── Session TTL ────────────────────────────────────────────────────────────
 function resolveSessionTtl(profile) {
@@ -133,10 +141,6 @@ async function fetchCredentials(input) {
         "X-Amz-X509": normalizedCert,
         "Authorization": `${ALGORITHM} Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`,
     });
-    // 🔍 DEBUG signing output (temporary)
-    console.debug("[aws-debug] canonicalRequest", canonicalRequest);
-    console.debug("[aws-debug] stringToSign", stringToSign);
-    console.debug("[aws-debug] authorization", finalHeaders.get("Authorization"));
     let res;
     try {
         res = await fetch(`https://${host}${PATH}`, {
@@ -150,12 +154,7 @@ async function fetchCredentials(input) {
         throw new InternalError("aws_unreachable");
     }
     if (!res.ok) {
-        const text = await res.text().catch(() => "<no-body>");
-        console.error("[aws-rejected]", {
-            status: res.status,
-            body: text,
-            region,
-        });
+        console.warn("[aws-rejected]", { status: res.status, region });
         throw new InternalError("aws_rejected");
     }
     const json = await res.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.50",
+  "version": "0.4.1",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",