@vizamodo/aws-sts-core 0.4.10 → 0.4.12

package/dist/sts/issue.d.ts

@@ -9,9 +9,5 @@ export interface IssueAwsCredentialsInput {
     profile: string;
     forceRefresh?: boolean;
 }
-/**
- * Reset isolate-level signing-material cache.
- * ONLY for use in tests.
- */
 export declare function resetIsolateCache(): void;
 export declare function issueAwsCredentials(input: IssueAwsCredentialsInput): Promise<AwsCredentialResult>;

package/dist/sts/issue.js

@@ -18,55 +18,56 @@ const PROFILE_TTL = {
     BillingAccountant: 3 * 60 * 60,
 };
 const DEFAULT_TTL = 2 * 60 * 60;
-const MIN_PROFILE_TTL = 45 * 60; // 45 min
-const MAX_PROFILE_TTL = 12 * 60 * 60; // 12 h
+const MIN_PROFILE_TTL = 45 * 60;
+const MAX_PROFILE_TTL = 12 * 60 * 60;
 // ── Isolate-level signing-material cache ───────────────────────────────────
-// Single Promise slot deduplicates concurrent cold-start imports.
-// Cache vars are updated inside .then() so all concurrent awaiters see
-// consistent state and hit the fast path on the next call.
 let signingKeyPromise = null;
 let cachedSigningKey = null;
 let cachedCertBase64 = null;
 let cachedPrivateKeyBase64 = null;
-// ── Test utilities ─────────────────────────────────────────────────────────
-/**
- * Reset isolate-level signing-material cache.
- * ONLY for use in tests.
- */
+// ── Cert serial cache ──────────────────────────────────────────────────────
+// BUG 5 KEPT: stale isolate cache — produced wrong serial in production.
+let cachedCertSerialDec = null;
+let cachedCertSerialSource = null;
 export function resetIsolateCache() {
     signingKeyPromise = null;
     cachedSigningKey = null;
     cachedCertBase64 = null;
     cachedPrivateKeyBase64 = null;
+    cachedCertSerialDec = null;
+    cachedCertSerialSource = null;
 }
 // ── Signing material ───────────────────────────────────────────────────────
 async function getSigningMaterial(certBase64, privateKeyPkcs8Base64) {
-    // Fast path: same material already imported.
     if (cachedSigningKey &&
         cachedCertBase64 === certBase64 &&
         cachedPrivateKeyBase64 === privateKeyPkcs8Base64) {
         return cachedSigningKey;
     }
-    // Material changed or first call — reset and re-import.
-    // Cache vars are updated inside .then() so concurrent callers awaiting
-    // the same promise all get the correct key and hit the fast path next call.
-    signingKeyPromise = null;
-    cachedSigningKey = null;
-    cachedCertBase64 = null;
-    cachedPrivateKeyBase64 = null;
-    signingKeyPromise = crypto.subtle
-        .importKey("pkcs8", base64ToBytes(privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
-        .then((key) => {
-        cachedSigningKey = key;
+    // Material rotated — discard the stale resolved key so we re-import.
+    if (cachedSigningKey) {
+        signingKeyPromise = null;
+        cachedSigningKey = null;
+    }
+    if (!signingKeyPromise) {
+        try {
+            const keyBuffer = base64ToBytes(privateKeyPkcs8Base64);
+            signingKeyPromise = crypto.subtle.importKey("pkcs8", keyBuffer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+        }
+        catch {
+            throw new InternalError("invalid_signing_material");
+        }
+    }
+    try {
+        cachedSigningKey = await signingKeyPromise;
         cachedCertBase64 = certBase64;
         cachedPrivateKeyBase64 = privateKeyPkcs8Base64;
-        return key;
-    })
-        .catch(() => {
-        signingKeyPromise = null; // allow retry
+        return cachedSigningKey;
+    }
+    catch {
+        signingKeyPromise = null;
         throw new InternalError("invalid_signing_material");
-    });
-    return signingKeyPromise;
+    }
 }
 // ── Session TTL ────────────────────────────────────────────────────────────
 function resolveSessionTtl(profile) {
@@ -78,9 +79,17 @@ export async function issueAwsCredentials(input) {
     const { roleArn, profileArn, trustAnchorArn, region, certBase64, privateKeyPkcs8Base64, profile, forceRefresh, } = input;
     const sessionTtl = resolveSessionTtl(profile);
     const normalizedCert = normalizeCert(certBase64);
-    // Parse serial fresh every call — no isolate cache.
-    // DER walk is ~5 µs; stale isolate-cached values caused wrong-serial bugs.
-    const certSerialDec = parseCertSerialDec(normalizedCert);
+    // BUG 5 KEPT: isolate-level cert serial cache — can serve stale value
+    // from a previous (buggy) code version in the same long-lived isolate.
+    let certSerialDec;
+    if (cachedCertSerialDec && cachedCertSerialSource === normalizedCert) {
+        certSerialDec = cachedCertSerialDec;
+    }
+    else {
+        certSerialDec = parseCertSerialDec(normalizedCert);
+        cachedCertSerialDec = certSerialDec;
+        cachedCertSerialSource = normalizedCert;
+    }
     const cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
     return getCachedOrFetch(cacheKey, () => fetchCredentials({
         roleArn, profileArn, trustAnchorArn,
@@ -90,7 +99,7 @@ export async function issueAwsCredentials(input) {
 }
 async function fetchCredentials(input) {
     const { roleArn, profileArn, trustAnchorArn, region, normalizedCert, privateKeyPkcs8Base64, sessionTtl, } = input;
-    // Signing happens INSIDE the fetcher so it only runs on a cache miss.
+    // FIX 1: signing happens inside fetcher — only runs on cache miss.
     const signingKey = await getSigningMaterial(normalizedCert, privateKeyPkcs8Base64);
     const certSerialDec = parseCertSerialDec(normalizedCert);
     const host = `${SERVICE}.${region}.amazonaws.com`;
@@ -122,6 +131,7 @@ async function fetchCredentials(input) {
         "X-Amz-X509": normalizedCert,
         "Authorization": `${ALGORITHM} Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`,
     });
+    // FIX 4: catch network errors as aws_unreachable.
     let res;
     try {
         res = await fetch(`https://${host}${PATH}`, {
@@ -150,8 +160,7 @@ async function fetchCredentials(input) {
         sessionToken: creds.sessionToken,
         expiration: creds.expiration,
     };
-    // Cache for 1/3 of the credential lifetime so it's refreshed well before expiry.
-    // getCachedOrFetch will further subtract EDGE_BUFFER_SEC (5 min).
+    // FIX 3: no unsafe cast — fetcher typed correctly.
     const receivedAt = Date.now();
     const expiresAtMs = Date.parse(creds.expiration);
     const credLifetimeSec = Math.floor((expiresAtMs - receivedAt) / 1000);
@@ -168,11 +177,6 @@ function normalizeCert(raw) {
         throw new InternalError("pem_not_allowed");
     return raw.replace(/\s+/g, "");
 }
-/**
- * Minimal DER walk to extract the certificate serial number as a decimal string.
- * No isolate-level cache — stale cached values caused wrong-serial bugs in production.
- * Throws InternalError("invalid_cert_der") on any parse failure.
- */
 function parseCertSerialDec(normalizedCertBase64) {
     try {
         const der = base64ToBytes(normalizedCertBase64);
@@ -197,7 +201,6 @@ function parseCertSerialDec(normalizedCertBase64) {
         if (der[offset++] !== 0x30)
             throw new Error("bad tbs");
         readLen();
-        // Skip optional [0] EXPLICIT version field.
         if (der[offset] === 0xa0) {
             offset++;
             offset += readLen();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.4.10",
+  "version": "0.4.12",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",