@vizamodo/aws-sts-core 0.4.13 → 0.4.16

package/dist/sts/issue.d.ts

@@ -1,5 +1,6 @@
 import type { AwsCredentialResult } from "../types";
-export interface IssueAwsCredentialsInput {
+export declare function resetIsolateCache(): void;
+export declare function issueAwsCredentials(input: {
     roleArn: string;
     profileArn: string;
     trustAnchorArn: string;
@@ -8,6 +9,4 @@ export interface IssueAwsCredentialsInput {
     privateKeyPkcs8Base64: string;
     profile: string;
     forceRefresh?: boolean;
-}
-export declare function resetIsolateCache(): void;
-export declare function issueAwsCredentials(input: IssueAwsCredentialsInput): Promise<AwsCredentialResult>;
+}): Promise<AwsCredentialResult>;

package/dist/sts/issue.js

@@ -21,14 +21,16 @@ const DEFAULT_TTL = 2 * 60 * 60;
 const MIN_PROFILE_TTL = 45 * 60;
 const MAX_PROFILE_TTL = 12 * 60 * 60;
 // ── Isolate-level signing-material cache ───────────────────────────────────
+// FIX 2: cache vars updated inside .then() — no race condition.
 let signingKeyPromise = null;
 let cachedSigningKey = null;
 let cachedCertBase64 = null;
 let cachedPrivateKeyBase64 = null;
 // ── Cert serial cache ──────────────────────────────────────────────────────
-// BUG 5 KEPT: stale isolate cache — produced wrong serial in production.
+// BUG 5 KEPT: stale isolate cache can return wrong serial across deploys.
 let cachedCertSerialDec = null;
 let cachedCertSerialSource = null;
+// ── Test utilities ─────────────────────────────────────────────────────────
 export function resetIsolateCache() {
     signingKeyPromise = null;
     cachedSigningKey = null;
@@ -38,49 +40,45 @@ export function resetIsolateCache() {
     cachedCertSerialSource = null;
 }
 // ── Signing material ───────────────────────────────────────────────────────
-async function getSigningMaterial(certBase64, privateKeyPkcs8Base64) {
+async function getSigningMaterial(input) {
+    // Fast path: same material already imported.
     if (cachedSigningKey &&
-        cachedCertBase64 === certBase64 &&
-        cachedPrivateKeyBase64 === privateKeyPkcs8Base64) {
-        return cachedSigningKey;
+        cachedCertBase64 === input.certBase64 &&
+        cachedPrivateKeyBase64 === input.privateKeyPkcs8Base64) {
+        return { signingKey: cachedSigningKey, certBase64: cachedCertBase64 };
     }
-    // Material rotated — discard the stale resolved key so we re-import.
-    if (cachedSigningKey) {
-        signingKeyPromise = null;
-        cachedSigningKey = null;
-    }
-    if (!signingKeyPromise) {
-        try {
-            const keyBuffer = base64ToBytes(privateKeyPkcs8Base64);
-            signingKeyPromise = crypto.subtle.importKey("pkcs8", keyBuffer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
-        }
-        catch {
-            throw new InternalError("invalid_signing_material");
-        }
-    }
-    try {
-        cachedSigningKey = await signingKeyPromise;
-        cachedCertBase64 = certBase64;
-        cachedPrivateKeyBase64 = privateKeyPkcs8Base64;
-        return cachedSigningKey;
-    }
-    catch {
+    // FIX 2: reset + update cache vars inside .then() so concurrent callers
+    // awaiting the same promise all get the correct key.
+    signingKeyPromise = null;
+    cachedSigningKey = null;
+    cachedCertBase64 = null;
+    cachedPrivateKeyBase64 = null;
+    signingKeyPromise = crypto.subtle
+        .importKey("pkcs8", base64ToBytes(input.privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
+        .then((key) => {
+        cachedSigningKey = key;
+        cachedCertBase64 = input.certBase64;
+        cachedPrivateKeyBase64 = input.privateKeyPkcs8Base64;
+        return key;
+    })
+        .catch(() => {
         signingKeyPromise = null;
         throw new InternalError("invalid_signing_material");
-    }
+    });
+    const key = await signingKeyPromise;
+    return { signingKey: key, certBase64: input.certBase64 };
 }
-// ── Session TTL ────────────────────────────────────────────────────────────
-function resolveSessionTtl(profile) {
+// ── Profile TTL resolution ─────────────────────────────────────────────────
+function resolveSessionTtlByProfile(profile) {
     const ttl = PROFILE_TTL[profile] ?? DEFAULT_TTL;
     return Math.min(Math.max(ttl, MIN_PROFILE_TTL), MAX_PROFILE_TTL);
 }
 // ── Main export ────────────────────────────────────────────────────────────
 export async function issueAwsCredentials(input) {
     const { roleArn, profileArn, trustAnchorArn, region, certBase64, privateKeyPkcs8Base64, profile, forceRefresh, } = input;
-    const sessionTtl = resolveSessionTtl(profile);
+    const sessionTtl = resolveSessionTtlByProfile(profile);
     const normalizedCert = normalizeCert(certBase64);
-    // BUG 5 KEPT: isolate-level cert serial cache — can serve stale value
-    // from a previous (buggy) code version in the same long-lived isolate.
+    // BUG 5 KEPT: isolate-level cert serial cache.
     let certSerialDec;
     if (cachedCertSerialDec && cachedCertSerialSource === normalizedCert) {
         certSerialDec = cachedCertSerialDec;
@@ -91,17 +89,12 @@ export async function issueAwsCredentials(input) {
         cachedCertSerialSource = normalizedCert;
     }
     const cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
-    return getCachedOrFetch(cacheKey, () => fetchCredentials({
-        roleArn, profileArn, trustAnchorArn,
-        region, normalizedCert, privateKeyPkcs8Base64,
-        sessionTtl,
-    }), { ttlSec: 60, forceRefresh });
-}
-async function fetchCredentials(input) {
-    const { roleArn, profileArn, trustAnchorArn, region, normalizedCert, privateKeyPkcs8Base64, sessionTtl, } = input;
-    // FIX 1: signing happens inside fetcher — only runs on cache miss.
-    const signingKey = await getSigningMaterial(normalizedCert, privateKeyPkcs8Base64);
-    const certSerialDec = parseCertSerialDec(normalizedCert);
+    // BUG 1 KEPT: signing happens before getCachedOrFetch — runs on every
+    // request even when L1/L2 cache would have returned a hit.
+    const { signingKey } = await getSigningMaterial({
+        certBase64: normalizedCert,
+        privateKeyPkcs8Base64,
+    });
     const host = `${SERVICE}.${region}.amazonaws.com`;
     const iso = new Date().toISOString();
     const amzDate = isoToAmzDate(iso);
@@ -131,37 +124,47 @@ async function fetchCredentials(input) {
         "X-Amz-X509": normalizedCert,
         "Authorization": `${ALGORITHM} Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`,
     });
-    const res = await fetch(`https://${host}${PATH}`, {
-        method: "POST",
-        headers: finalHeaders,
-        body,
-    });
-    if (!res.ok) {
-        console.warn("[aws-rejected]", { status: res.status, region });
-        throw new InternalError("aws_rejected");
-    }
-    const json = await res.json();
-    const creds = json?.credentialSet?.[0]?.credentials;
-    if (!creds?.accessKeyId || !creds?.secretAccessKey || !creds?.sessionToken) {
-        console.warn("[issueAwsCredentials] malformed AWS credential response");
-        throw new InternalError("aws_malformed_credentials");
-    }
-    const value = {
-        accessKeyId: creds.accessKeyId,
-        secretAccessKey: creds.secretAccessKey,
-        sessionToken: creds.sessionToken,
-        expiration: creds.expiration,
-    };
-    // FIX 3: no unsafe cast — fetcher typed correctly.
-    const receivedAt = Date.now();
-    const expiresAtMs = Date.parse(creds.expiration);
-    const credLifetimeSec = Math.floor((expiresAtMs - receivedAt) / 1000);
-    if (Number.isFinite(expiresAtMs) && credLifetimeSec > 0) {
-        const cacheTtlSec = Math.floor(credLifetimeSec / 3);
-        const cacheExpiry = new Date(receivedAt + cacheTtlSec * 1000).toISOString();
-        return wrapResult(value, cacheExpiry);
-    }
-    return value;
+    return getCachedOrFetch(cacheKey, async () => {
+        // FIX 4: catch network errors as aws_unreachable.
+        let res;
+        try {
+            res = await fetch(`https://${host}${PATH}`, {
+                method: "POST",
+                headers: finalHeaders,
+                body,
+            });
+        }
+        catch (err) {
+            console.warn("[aws-unreachable]", { region, err });
+            throw new InternalError("aws_unreachable");
+        }
+        if (!res.ok) {
+            console.warn("[aws-rejected]", { status: res.status, region, profile });
+            throw new InternalError("aws_rejected");
+        }
+        const json = await res.json();
+        const creds = json?.credentialSet?.[0]?.credentials;
+        if (!creds?.accessKeyId || !creds?.secretAccessKey || !creds?.sessionToken) {
+            console.warn("[issueAwsCredentials] malformed AWS credential response");
+            throw new InternalError("aws_malformed_credentials");
+        }
+        const value = {
+            accessKeyId: creds.accessKeyId,
+            secretAccessKey: creds.secretAccessKey,
+            sessionToken: creds.sessionToken,
+            expiration: creds.expiration,
+        };
+        // FIX 3: no unsafe cast, receivedAt captured after response.
+        const receivedAt = Date.now();
+        const expiresAtMs = Date.parse(creds.expiration);
+        const credLifetimeSec = Math.floor((expiresAtMs - receivedAt) / 1000);
+        if (Number.isFinite(expiresAtMs) && credLifetimeSec > 0) {
+            const cacheTtlSec = Math.floor(credLifetimeSec / 3);
+            const cacheExpiry = new Date(receivedAt + cacheTtlSec * 1000).toISOString();
+            return wrapResult(value, cacheExpiry);
+        }
+        return value;
+    }, { ttlSec: 60, forceRefresh });
 }
 // ── Helpers ────────────────────────────────────────────────────────────────
 function normalizeCert(raw) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.4.13",
+  "version": "0.4.16",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",