@vizamodo/aws-sts-core 0.4.23 → 0.4.24

package/dist/sts/issue.d.ts

@@ -1,5 +1,4 @@
 import type { AwsCredentialResult } from "../types";
-export declare function resetIsolateCache(): void;
 export declare function issueAwsCredentials(input: {
     roleArn: string;
     profileArn: string;

package/dist/sts/issue.js

@@ -5,7 +5,7 @@ import { buildStringToSign } from "../sigv4/string-to-sign";
 import { signStringToSign } from "./signer";
 import { InternalError } from "./errors";
 import { sha256Hex } from "../crypto/sha256";
-// ── Constants ──────────────────────────────────────────────────────────────
+// ---- constants ----
 const ALGORITHM = "AWS4-X509-ECDSA-SHA256";
 const SERVICE = "rolesanywhere";
 const PATH = "/sessions";
@@ -18,22 +18,20 @@ const PROFILE_TTL = {
     BillingAccountant: 3 * 60 * 60,
 };
 const DEFAULT_TTL = 2 * 60 * 60;
-const MIN_PROFILE_TTL = 45 * 60;
-const MAX_PROFILE_TTL = 12 * 60 * 60;
-// ── Isolate-level signing-material cache ───────────────────────────────────
-// FIX 2: cache vars updated inside .then() — no race condition.
+const MIN_PROFILE_TTL = 45 * 60; // 45 min — lower guard
+const MAX_PROFILE_TTL = 12 * 60 * 60; // 12 h  — upper guard
+// ---- isolate-level signing material cache ----
+// Single Promise-based slot avoids concurrent cold-start races.
 let signingKeyPromise = null;
 let cachedSigningKey = null;
 let cachedCertBase64 = null;
 let cachedPrivateKeyBase64 = null;
-// ── Test utilities ─────────────────────────────────────────────────────────
-export function resetIsolateCache() {
-    signingKeyPromise = null;
-    cachedSigningKey = null;
-    cachedCertBase64 = null;
-    cachedPrivateKeyBase64 = null;
-}
-// ── Signing material ───────────────────────────────────────────────────────
+// ---- certificate serial cache (DER walk is CPU-bound, cert rarely rotates) ----
+let cachedCertSerialDec = null;
+let cachedCertSerialSource = null;
+// ---------------------------------------------------------------------------
+// Signing material
+// ---------------------------------------------------------------------------
 async function getSigningMaterial(input) {
     // Fast path: same material already imported.
     if (cachedSigningKey &&
@@ -41,42 +39,57 @@ async function getSigningMaterial(input) {
         cachedPrivateKeyBase64 === input.privateKeyPkcs8Base64) {
         return { signingKey: cachedSigningKey, certBase64: cachedCertBase64 };
     }
-    // FIX 2: reset + update cache vars inside .then() so concurrent callers
-    // awaiting the same promise all get the correct key.
-    signingKeyPromise = null;
-    cachedSigningKey = null;
-    cachedCertBase64 = null;
-    cachedPrivateKeyBase64 = null;
-    signingKeyPromise = crypto.subtle
-        .importKey("pkcs8", base64ToBytes(input.privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
-        .then((key) => {
-        cachedSigningKey = key;
+    // Material rotated — discard the stale resolved key so we re-import.
+    if (cachedSigningKey) {
+        signingKeyPromise = null;
+        cachedSigningKey = null;
+    }
+    if (!signingKeyPromise) {
+        try {
+            const keyBuffer = base64ToBytes(input.privateKeyPkcs8Base64);
+            signingKeyPromise = crypto.subtle.importKey("pkcs8", keyBuffer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+        }
+        catch {
+            throw new InternalError("invalid_signing_material");
+        }
+    }
+    try {
+        cachedSigningKey = await signingKeyPromise;
         cachedCertBase64 = input.certBase64;
         cachedPrivateKeyBase64 = input.privateKeyPkcs8Base64;
-        return key;
-    })
-        .catch(() => {
-        signingKeyPromise = null;
+        return { signingKey: cachedSigningKey, certBase64: cachedCertBase64 };
+    }
+    catch {
+        signingKeyPromise = null; // allow retry on next call
         throw new InternalError("invalid_signing_material");
-    });
-    const key = await signingKeyPromise;
-    return { signingKey: key, certBase64: input.certBase64 };
+    }
 }
-// ── Profile TTL resolution ─────────────────────────────────────────────────
+// ---------------------------------------------------------------------------
+// Profile TTL resolution
+// ---------------------------------------------------------------------------
 function resolveSessionTtlByProfile(profile) {
     const ttl = PROFILE_TTL[profile] ?? DEFAULT_TTL;
     return Math.min(Math.max(ttl, MIN_PROFILE_TTL), MAX_PROFILE_TTL);
 }
-// ── Main export ────────────────────────────────────────────────────────────
+// ---------------------------------------------------------------------------
+// Main export
+// ---------------------------------------------------------------------------
 export async function issueAwsCredentials(input) {
     const { roleArn, profileArn, trustAnchorArn, region, certBase64, privateKeyPkcs8Base64, profile, forceRefresh, } = input;
     const sessionTtl = resolveSessionTtlByProfile(profile);
     const normalizedCert = normalizeCert(certBase64);
-    // No isolate cache — stale cached values caused wrong-serial bugs.
-    const certSerialDec = parseCertSerialDec(normalizedCert);
+    // ---- DER serial extraction (with isolate-level cache) ----
+    let certSerialDec;
+    if (cachedCertSerialDec && cachedCertSerialSource === normalizedCert) {
+        certSerialDec = cachedCertSerialDec;
+    }
+    else {
+        certSerialDec = parseCertSerialDec(normalizedCert); // throws InternalError on bad DER
+        cachedCertSerialDec = certSerialDec;
+        cachedCertSerialSource = normalizedCert;
+    }
     const cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
-    // BUG 1 KEPT: signing happens before getCachedOrFetch — runs on every
-    // request even when L1/L2 cache would have returned a hit.
+    // ---- Build SigV4 request ----
     const { signingKey } = await getSigningMaterial({
         certBase64: normalizedCert,
         privateKeyPkcs8Base64,
@@ -96,12 +109,19 @@ export async function issueAwsCredentials(input) {
     const { canonicalHeaders, signedHeaders } = canonicalizeHeaders(baseHeaders);
     const credentialScope = `${dateStamp}/${region}/${SERVICE}/aws4_request`;
     const canonicalRequest = buildCanonicalRequest({
-        method: "POST", canonicalUri: PATH, query: "",
-        canonicalHeaders, signedHeaders, payloadHash,
+        method: "POST",
+        canonicalUri: PATH,
+        query: "",
+        canonicalHeaders,
+        signedHeaders,
+        payloadHash,
     });
+    const canonicalRequestHash = await sha256Hex(canonicalRequest);
     const stringToSign = buildStringToSign({
-        algorithm: ALGORITHM, amzDate, credentialScope,
-        canonicalRequestHash: await sha256Hex(canonicalRequest),
+        algorithm: ALGORITHM,
+        amzDate,
+        credentialScope,
+        canonicalRequestHash,
     });
     const signatureHex = await signStringToSign(stringToSign, signingKey);
     const finalHeaders = new Headers({
@@ -110,31 +130,15 @@ export async function issueAwsCredentials(input) {
         "X-Amz-X509": normalizedCert,
         "Authorization": `${ALGORITHM} Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`,
     });
+    const issuedAt = Date.now(); // snapshot before the network round-trip
     return getCachedOrFetch(cacheKey, async () => {
-        // FIX 4: catch network errors as aws_unreachable.
-        let res;
-        try {
-            res = await fetch(`https://${host}${PATH}`, {
-                method: "POST",
-                headers: finalHeaders,
-                body,
-            });
-        }
-        catch (err) {
-            console.warn("[aws-unreachable]", { region, err });
-            throw new InternalError("aws_unreachable");
-        }
+        const res = await fetch(`https://${host}${PATH}`, {
+            method: "POST",
+            headers: finalHeaders,
+            body,
+        });
         if (!res.ok) {
-            const errorBody = await res.text().catch(() => "<no-body>");
-            console.error("[aws-rejected]", {
-                status: res.status,
-                region,
-                profile,
-                errorBody,
-                certSerial: certSerialDec,
-                amzDate,
-                credentialScope,
-            });
+            console.warn("[aws-rejected]", { status: res.status, region, profile });
             throw new InternalError("aws_rejected");
         }
         const json = await res.json();
@@ -149,70 +153,79 @@ export async function issueAwsCredentials(input) {
             sessionToken: creds.sessionToken,
             expiration: creds.expiration,
         };
-        // FIX 3: no unsafe cast, receivedAt captured after response.
-        const receivedAt = Date.now();
+        // derive TTL = 1/3 lifetime
         const expiresAtMs = Date.parse(creds.expiration);
-        const credLifetimeSec = Math.floor((expiresAtMs - receivedAt) / 1000);
+        const credLifetimeSec = Math.floor((expiresAtMs - issuedAt) / 1000);
         if (Number.isFinite(expiresAtMs) && credLifetimeSec > 0) {
-            const cacheTtlSec = Math.floor(credLifetimeSec / 3);
-            const cacheExpiry = new Date(receivedAt + cacheTtlSec * 1000).toISOString();
-            return wrapResult(value, cacheExpiry);
+            const edgeCacheTtlSec = Math.floor(credLifetimeSec / 3);
+            const edgeCacheExpiry = new Date(issuedAt + edgeCacheTtlSec * 1000).toISOString();
+            return wrapResult(value, edgeCacheExpiry);
         }
         return value;
-    }, { ttlSec: 60, forceRefresh });
+    }, {
+        ttlSec: 60,
+        ...(forceRefresh !== undefined ? { forceRefresh } : {})
+    });
 }
-// ── Helpers ────────────────────────────────────────────────────────────────
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Strip whitespace and reject PEM-wrapped input. */
 function normalizeCert(raw) {
-    if (raw.includes("BEGIN CERTIFICATE"))
+    if (raw.includes("BEGIN CERTIFICATE")) {
         throw new InternalError("pem_not_allowed");
+    }
     return raw.replace(/\s+/g, "");
 }
+/**
+ * Minimal DER walk to extract the certificate serial number as a decimal string.
+ * Throws InternalError("invalid_cert_der") on any parse failure.
+ */
 function parseCertSerialDec(normalizedCertBase64) {
     try {
         const der = base64ToBytes(normalizedCertBase64);
-        // Use array pointer instead of closure-captured variable to avoid
-        // bundler (esbuild/wrangler) variable-rename bugs.
-        const p = [0];
-        function readLen(p) {
-            if (p[0] >= der.length)
+        let offset = 0;
+        function readLen() {
+            if (offset >= der.length)
                 throw new Error("DER overflow");
-            const b = der[p[0]++];
+            const b = der[offset++];
             if ((b & 0x80) === 0)
                 return b;
             const n = b & 0x7f;
             let len = 0;
-            if (p[0] + n > der.length)
+            if (offset + n > der.length)
                 throw new Error("DER overflow");
             for (let i = 0; i < n; i++)
-                len = (len << 8) | der[p[0]++];
+                len = (len << 8) | der[offset++];
             return len;
         }
-        if (der[p[0]++] !== 0x30)
+        if (der[offset++] !== 0x30)
             throw new Error("bad cert");
-        readLen(p);
-        if (der[p[0]++] !== 0x30)
+        readLen();
+        if (der[offset++] !== 0x30)
             throw new Error("bad tbs");
-        readLen(p);
+        readLen();
         // Skip optional [0] EXPLICIT version field.
-        const p0_before = p[0];
-        if (der[p[0]] === 0xa0) {
-            p[0]++;
-            p[0] += readLen(p);
+        if (der[offset] === 0xa0) {
+            offset++;
+            const vLen = readLen();
+            offset += vLen;
         }
-        const p0_after = p[0];
-        console.debug("[parser-v2]", { p0_before, p0_after, nextTag: der[p[0]]?.toString(16) });
-        if (der[p[0]++] !== 0x02)
+        if (der[offset++] !== 0x02)
             throw new Error("bad serial tag");
-        const serialLen = readLen(p);
-        console.debug("[parser-v2-serial]", { serialLen, firstByte: der[p[0]]?.toString(16) });
-        if (p[0] + serialLen > der.length)
+        const serialLen = readLen();
+        if (offset + serialLen > der.length)
             throw new Error("DER overflow");
-        let serial = der.slice(p[0], p[0] + serialLen);
-        if (serial.length > 1 && serial[0] === 0x00)
+        let serial = der.slice(offset, offset + serialLen);
+        // Strip ASN.1 sign-extension padding byte.
+        if (serial.length > 1 && serial[0] === 0x00) {
             serial = serial.slice(1);
+        }
+        // Accumulate directly to BigInt — avoids intermediate hex string allocation.
         let serialBig = 0n;
-        for (let i = 0; i < serial.length; i++)
+        for (let i = 0; i < serial.length; i++) {
             serialBig = (serialBig << 8n) | BigInt(serial[i]);
+        }
         return serialBig.toString();
     }
     catch (e) {
@@ -220,16 +233,26 @@ function parseCertSerialDec(normalizedCertBase64) {
         throw new InternalError("invalid_cert_der");
     }
 }
+/**
+ * Convert an ISO-8601 timestamp to the compact AMZ date-time format.
+ * e.g. "2026-03-07T12:00:00.000Z" → "20260307T120000Z"
+ */
 function isoToAmzDate(iso) {
-    return (iso.slice(0, 4) + iso.slice(5, 7) + iso.slice(8, 10) +
+    return (iso.slice(0, 4) +
+        iso.slice(5, 7) +
+        iso.slice(8, 10) +
         "T" +
-        iso.slice(11, 13) + iso.slice(14, 16) + iso.slice(17, 19) +
+        iso.slice(11, 13) +
+        iso.slice(14, 16) +
+        iso.slice(17, 19) +
         "Z");
 }
+/** Faster base64 → Uint8Array using V8's vectorized atob path. */
 function base64ToBytes(base64) {
     const binary = atob(base64);
     const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++)
+    for (let i = 0; i < binary.length; i++) {
         bytes[i] = binary.charCodeAt(i);
+    }
     return bytes;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.4.23",
+  "version": "0.4.24",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",