@vizamodo/aws-sts-core 0.3.50 → 0.4.2

package/dist/sts/issue.js

@@ -1,10 +1,10 @@
-import { getCachedOrFetch, wrapResult } from "@vizamodo/edge-cache-core";
 import { canonicalizeHeaders } from "../sigv4/headers";
 import { buildCanonicalRequest } from "../sigv4/canonical";
 import { buildStringToSign } from "../sigv4/string-to-sign";
 import { signStringToSign } from "./signer";
 import { InternalError } from "./errors";
 import { sha256Hex } from "../crypto/sha256";
+import { getCachedOrFetch, wrapResult } from "@vizamodo/edge-cache-core";
 // ── Constants ──────────────────────────────────────────────────────────────
 const ALGORITHM = "AWS4-X509-ECDSA-SHA256";
 const SERVICE = "rolesanywhere";
@@ -58,21 +58,29 @@ async function getSigningMaterial(certBase64, privateKeyPkcs8Base64) {
         cachedPrivateKeyBase64 === privateKeyPkcs8Base64) {
         return cachedSigningKey;
     }
-    // Material rotated — discard stale state and re-import.
+    // Material changed or first call — reset and re-import.
+    // Cache vars are updated inside .then() so concurrent callers
+    // awaiting the same promise all see consistent state after resolve.
     signingKeyPromise = null;
     cachedSigningKey = null;
-    if (!signingKeyPromise) {
-        signingKeyPromise = crypto.subtle
-            .importKey("pkcs8", base64ToBytes(privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
-            .catch(() => {
-            signingKeyPromise = null; // allow retry
-            throw new InternalError("invalid_signing_material");
-        });
-    }
-    cachedSigningKey = await signingKeyPromise;
-    cachedCertBase64 = certBase64;
-    cachedPrivateKeyBase64 = privateKeyPkcs8Base64;
-    return cachedSigningKey;
+    cachedCertBase64 = null;
+    cachedPrivateKeyBase64 = null;
+    signingKeyPromise = crypto.subtle
+        .importKey("pkcs8", base64ToBytes(privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
+        .then((key) => {
+        // Update cache atomically after successful import.
+        // All concurrent callers awaiting this promise will see
+        // consistent state and hit the fast path on next call.
+        cachedSigningKey = key;
+        cachedCertBase64 = certBase64;
+        cachedPrivateKeyBase64 = privateKeyPkcs8Base64;
+        return key;
+    })
+        .catch(() => {
+        signingKeyPromise = null; // allow retry on next call
+        throw new InternalError("invalid_signing_material");
+    });
+    return signingKeyPromise;
 }
 // ── Session TTL ────────────────────────────────────────────────────────────
 function resolveSessionTtl(profile) {
@@ -127,16 +135,41 @@ async function fetchCredentials(input) {
     });
     const signatureHex = await signStringToSign(stringToSign, signingKey);
     const certSerialDec = getCertSerialDec(normalizedCert);
+    // 🔍 Deep debug helper (compare with working version)
+    function debugAwsSigning() {
+        try {
+            console.debug("[aws-debug][input]", {
+                roleArn,
+                profileArn,
+                trustAnchorArn,
+                region,
+                sessionTtl,
+            });
+            console.debug("[aws-debug][cert]", {
+                length: normalizedCert.length,
+                preview: normalizedCert.slice(0, 30),
+            });
+            console.debug("[aws-debug][serial]", {
+                serialDec: certSerialDec,
+                serialHex: BigInt(certSerialDec).toString(16),
+            });
+            console.debug("[aws-debug][headers]", baseHeaders);
+            console.debug("[aws-debug][signedHeaders]", signedHeaders);
+            console.debug("[aws-debug][canonicalRequest]", canonicalRequest);
+            console.debug("[aws-debug][stringToSign]", stringToSign);
+            console.debug("[aws-debug][signatureHex]", signatureHex);
+        }
+        catch (e) {
+            console.warn("[aws-debug][error]", e);
+        }
+    }
+    debugAwsSigning();
     const finalHeaders = new Headers({
         "Content-Type": "application/json",
         "X-Amz-Date": amzDate,
         "X-Amz-X509": normalizedCert,
         "Authorization": `${ALGORITHM} Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`,
     });
-    // 🔍 DEBUG signing output (temporary)
-    console.debug("[aws-debug] canonicalRequest", canonicalRequest);
-    console.debug("[aws-debug] stringToSign", stringToSign);
-    console.debug("[aws-debug] authorization", finalHeaders.get("Authorization"));
     let res;
     try {
         res = await fetch(`https://${host}${PATH}`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.3.50",
+  "version": "0.4.2",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",