@vizamodo/aws-sts-core 0.4.1 → 0.4.3

package/dist/sts/issue.js

@@ -135,6 +135,35 @@ async function fetchCredentials(input) {
     });
     const signatureHex = await signStringToSign(stringToSign, signingKey);
     const certSerialDec = getCertSerialDec(normalizedCert);
+    // 🔍 Deep debug helper (compare with working version)
+    function debugAwsSigning() {
+        try {
+            console.debug("[aws-debug][input]", {
+                roleArn,
+                profileArn,
+                trustAnchorArn,
+                region,
+                sessionTtl,
+            });
+            console.debug("[aws-debug][cert]", {
+                length: normalizedCert.length,
+                preview: normalizedCert.slice(0, 30),
+            });
+            console.debug("[aws-debug][serial]", {
+                serialDec: certSerialDec,
+                serialHex: BigInt(certSerialDec).toString(16),
+            });
+            console.debug("[aws-debug][headers]", baseHeaders);
+            console.debug("[aws-debug][signedHeaders]", signedHeaders);
+            console.debug("[aws-debug][canonicalRequest]", canonicalRequest);
+            console.debug("[aws-debug][stringToSign]", stringToSign);
+            console.debug("[aws-debug][signatureHex]", signatureHex);
+        }
+        catch (e) {
+            console.warn("[aws-debug][error]", e);
+        }
+    }
+    debugAwsSigning();
     const finalHeaders = new Headers({
         "Content-Type": "application/json",
         "X-Amz-Date": amzDate,
@@ -154,7 +183,12 @@ async function fetchCredentials(input) {
         throw new InternalError("aws_unreachable");
     }
     if (!res.ok) {
-        console.warn("[aws-rejected]", { status: res.status, region });
+        const text = await res.text().catch(() => "<no-body>");
+        console.error("[aws-rejected]", {
+            status: res.status,
+            body: text,
+            region,
+        });
         throw new InternalError("aws_rejected");
     }
     const json = await res.json();
@@ -221,32 +255,42 @@ function parseCertSerialDec(normalizedCertBase64) {
                 len = (len << 8) | der[offset++];
             return len;
         }
+        // Certificate ::= SEQUENCE
         if (der[offset++] !== 0x30)
             throw new Error("bad cert");
         readLen();
+        // tbsCertificate ::= SEQUENCE
         if (der[offset++] !== 0x30)
             throw new Error("bad tbs");
         readLen();
-        // Skip optional [0] EXPLICIT version field.
+        // Optional version [0] EXPLICIT
         if (der[offset] === 0xa0) {
-            offset++;
-            offset += readLen();
-        }
-        if (der[offset++] !== 0x02)
-            throw new Error("bad serial tag");
-        const serialLen = readLen();
-        if (offset + serialLen > der.length)
-            throw new Error("DER overflow");
-        let serial = der.slice(offset, offset + serialLen);
-        // Strip ASN.1 sign-extension padding byte.
-        if (serial.length > 1 && serial[0] === 0x00) {
-            serial = serial.slice(1);
+            offset++; // tag
+            offset += readLen(); // skip content
         }
-        let serialBig = 0n;
-        for (let i = 0; i < serial.length; i++) {
-            serialBig = (serialBig << 8n) | BigInt(serial[i]);
+        // Now scan for first INTEGER with "real" length (>2 bytes)
+        while (offset < der.length) {
+            if (der[offset++] !== 0x02)
+                continue;
+            const len = readLen();
+            if (len <= 2) {
+                offset += len; // skip small integers (likely version)
+                continue;
+            }
+            if (offset + len > der.length)
+                throw new Error("DER overflow");
+            let serial = der.slice(offset, offset + len);
+            // Strip leading 0x00 ONLY if it's padding
+            if (serial.length > 1 && serial[0] === 0x00 && (serial[1] & 0x80) === 0) {
+                serial = serial.slice(1);
+            }
+            let serialBig = 0n;
+            for (let i = 0; i < serial.length; i++) {
+                serialBig = (serialBig << 8n) | BigInt(serial[i]);
+            }
+            return serialBig.toString();
         }
-        return serialBig.toString();
+        throw new Error("serial not found");
     }
     catch (e) {
         console.error("[parseCertSerialDec] failed", e);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",