@vizamodo/aws-sts-core 0.4.30 → 0.4.32

package/dist/sts/issue.d.ts

@@ -1,4 +1,5 @@
 import type { AwsCredentialResult } from "../types";
+export declare function resetIsolateCache(): void;
 export declare function issueAwsCredentials(input: {
     roleArn: string;
     profileArn: string;

package/dist/sts/issue.js

@@ -26,6 +26,16 @@ let signingKeyPromise = null;
 let cachedSigningKey = null;
 let cachedCertBase64 = null;
 let cachedPrivateKeyBase64 = null;
+// ---- single-flight hard refresh guard + cooldown ----
+let hardRefreshPromise = null;
+let lastHardRefreshAt = 0;
+const HARD_REFRESH_COOLDOWN_MS = 2000;
+export function resetIsolateCache() {
+    signingKeyPromise = null;
+    cachedSigningKey = null;
+    cachedCertBase64 = null;
+    cachedPrivateKeyBase64 = null;
+}
 // ---- certificate serial cache (DER walk is CPU-bound, cert rarely rotates) ----
 let cachedCertSerialDec = null;
 let cachedCertSerialSource = null;
@@ -89,47 +99,54 @@ export async function issueAwsCredentials(input) {
     const certSerialDec = parseCertSerialDec(normalizedCert);
     const cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
     return getCachedOrFetch(cacheKey, async () => {
-        // ---- Build SigV4 request (moved inside fetcher) ----
-        const { signingKey } = await getSigningMaterial({
-            certBase64: normalizedCert,
-            privateKeyPkcs8Base64,
-        });
-        const host = `${SERVICE}.${region}.amazonaws.com`;
-        const iso = new Date().toISOString();
-        const amzDate = isoToAmzDate(iso);
-        const dateStamp = iso.slice(0, 4) + iso.slice(5, 7) + iso.slice(8, 10);
-        const body = JSON.stringify({ trustAnchorArn, profileArn, roleArn, durationSeconds: sessionTtl });
-        const payloadHash = await sha256Hex(body);
-        const baseHeaders = {
-            "content-type": "application/json",
-            "host": host,
-            "x-amz-date": amzDate,
-            "x-amz-x509": normalizedCert,
-        };
-        const { canonicalHeaders, signedHeaders } = canonicalizeHeaders(baseHeaders);
-        const credentialScope = `${dateStamp}/${region}/${SERVICE}/aws4_request`;
-        const canonicalRequest = buildCanonicalRequest({
-            method: "POST",
-            canonicalUri: PATH,
-            query: "",
-            canonicalHeaders,
-            signedHeaders,
-            payloadHash,
-        });
-        const canonicalRequestHash = await sha256Hex(canonicalRequest);
-        const stringToSign = buildStringToSign({
-            algorithm: ALGORITHM,
-            amzDate,
-            credentialScope,
-            canonicalRequestHash,
-        });
-        const signatureHex = await signStringToSign(stringToSign, signingKey);
-        const finalHeaders = new Headers({
-            "Content-Type": "application/json",
-            "X-Amz-Date": amzDate,
-            "X-Amz-X509": normalizedCert,
-            "Authorization": `${ALGORITHM} Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`,
-        });
+        async function buildSignedHeaders() {
+            const { signingKey } = await getSigningMaterial({
+                certBase64: normalizedCert,
+                privateKeyPkcs8Base64,
+            });
+            const host = `${SERVICE}.${region}.amazonaws.com`;
+            const iso = new Date().toISOString();
+            const amzDate = isoToAmzDate(iso);
+            const dateStamp = iso.slice(0, 4) + iso.slice(5, 7) + iso.slice(8, 10);
+            const body = JSON.stringify({ trustAnchorArn, profileArn, roleArn, durationSeconds: sessionTtl });
+            const payloadHash = await sha256Hex(body);
+            const baseHeaders = {
+                "content-type": "application/json",
+                "host": host,
+                "x-amz-date": amzDate,
+                "x-amz-x509": normalizedCert,
+            };
+            const { canonicalHeaders, signedHeaders } = canonicalizeHeaders(baseHeaders);
+            const credentialScope = `${dateStamp}/${region}/${SERVICE}/aws4_request`;
+            const canonicalRequest = buildCanonicalRequest({
+                method: "POST",
+                canonicalUri: PATH,
+                query: "",
+                canonicalHeaders,
+                signedHeaders,
+                payloadHash,
+            });
+            const canonicalRequestHash = await sha256Hex(canonicalRequest);
+            const stringToSign = buildStringToSign({
+                algorithm: ALGORITHM,
+                amzDate,
+                credentialScope,
+                canonicalRequestHash,
+            });
+            const signatureHex = await signStringToSign(stringToSign, signingKey);
+            const headers = new Headers({
+                "Content-Type": "application/json",
+                "X-Amz-Date": amzDate,
+                "X-Amz-X509": normalizedCert,
+                "Authorization": `${ALGORITHM} Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`,
+            });
+            return {
+                headers,
+                body,
+                host,
+            };
+        }
+        const { headers: finalHeaders, body, host } = await buildSignedHeaders();
         const issuedAt = Date.now();
         let res;
         try {
@@ -144,7 +161,50 @@ export async function issueAwsCredentials(input) {
             throw new InternalError("aws_unreachable");
         }
         if (!res.ok) {
-            console.warn("[aws-rejected]", { status: res.status, region, profile });
+            const status = res.status;
+            // Safe internal hard reset trigger:
+            // Only reset isolate cache on explicit forceRefresh AND first failure
+            if (forceRefresh && status === 403) {
+                const now = Date.now();
+                // Cooldown guard to avoid rapid consecutive hard resets
+                if (now - lastHardRefreshAt < HARD_REFRESH_COOLDOWN_MS) {
+                    console.warn("[aws-rejected][cooldown-skip-hard-reset]", { status, region });
+                    throw new InternalError("aws_rejected");
+                }
+                // Single-flight: only one request performs hard refresh
+                if (!hardRefreshPromise) {
+                    hardRefreshPromise = (async () => {
+                        console.warn("[aws-rejected][hard-reset-trigger]", { status, region });
+                        lastHardRefreshAt = Date.now();
+                        resetIsolateCache();
+                        const { headers: retryHeaders, body: retryBody, host: retryHost } = await buildSignedHeaders();
+                        const retryRes = await fetch(`https://${retryHost}${PATH}`, {
+                            method: "POST",
+                            headers: retryHeaders,
+                            body: retryBody,
+                        });
+                        if (!retryRes.ok) {
+                            console.warn("[aws-rejected][after-hard-reset]", { status: retryRes.status, region });
+                            throw new InternalError("aws_rejected");
+                        }
+                        const retryJson = await retryRes.json();
+                        const retryCreds = retryJson?.credentialSet?.[0]?.credentials;
+                        if (!retryCreds?.accessKeyId || !retryCreds?.secretAccessKey || !retryCreds?.sessionToken) {
+                            throw new InternalError("aws_malformed_credentials");
+                        }
+                        return {
+                            accessKeyId: retryCreds.accessKeyId,
+                            secretAccessKey: retryCreds.secretAccessKey,
+                            sessionToken: retryCreds.sessionToken,
+                            expiration: retryCreds.expiration,
+                        };
+                    })().finally(() => {
+                        hardRefreshPromise = null;
+                    });
+                }
+                return await hardRefreshPromise;
+            }
+            console.warn("[aws-rejected]", { status, region, profile });
             throw new InternalError("aws_rejected");
         }
         const json = await res.json();
@@ -170,7 +230,7 @@ export async function issueAwsCredentials(input) {
         return value;
     }, {
         ttlSec: 60,
-        ...(forceRefresh !== undefined ? { forceRefresh } : {})
+        forceRefresh: !!forceRefresh
     });
 }
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.4.30",
+  "version": "0.4.32",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",