@vizamodo/aws-sts-core 0.4.31 → 0.4.32
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/sts/issue.js +39 -20
- package/package.json +1 -1
package/dist/sts/issue.js
CHANGED
|
@@ -26,6 +26,10 @@ let signingKeyPromise = null;
|
|
|
26
26
|
let cachedSigningKey = null;
|
|
27
27
|
let cachedCertBase64 = null;
|
|
28
28
|
let cachedPrivateKeyBase64 = null;
|
|
29
|
+
// ---- single-flight hard refresh guard + cooldown ----
|
|
30
|
+
let hardRefreshPromise = null;
|
|
31
|
+
let lastHardRefreshAt = 0;
|
|
32
|
+
const HARD_REFRESH_COOLDOWN_MS = 2000;
|
|
29
33
|
export function resetIsolateCache() {
|
|
30
34
|
signingKeyPromise = null;
|
|
31
35
|
cachedSigningKey = null;
|
|
@@ -161,29 +165,44 @@ export async function issueAwsCredentials(input) {
|
|
|
161
165
|
// Safe internal hard reset trigger:
|
|
162
166
|
// Only reset isolate cache on explicit forceRefresh AND first failure
|
|
163
167
|
if (forceRefresh && status === 403) {
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
method: "POST",
|
|
169
|
-
headers: retryHeaders,
|
|
170
|
-
body: retryBody,
|
|
171
|
-
});
|
|
172
|
-
if (!retryRes.ok) {
|
|
173
|
-
console.warn("[aws-rejected][after-hard-reset]", { status: retryRes.status, region });
|
|
168
|
+
const now = Date.now();
|
|
169
|
+
// Cooldown guard to avoid rapid consecutive hard resets
|
|
170
|
+
if (now - lastHardRefreshAt < HARD_REFRESH_COOLDOWN_MS) {
|
|
171
|
+
console.warn("[aws-rejected][cooldown-skip-hard-reset]", { status, region });
|
|
174
172
|
throw new InternalError("aws_rejected");
|
|
175
173
|
}
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
174
|
+
// Single-flight: only one request performs hard refresh
|
|
175
|
+
if (!hardRefreshPromise) {
|
|
176
|
+
hardRefreshPromise = (async () => {
|
|
177
|
+
console.warn("[aws-rejected][hard-reset-trigger]", { status, region });
|
|
178
|
+
lastHardRefreshAt = Date.now();
|
|
179
|
+
resetIsolateCache();
|
|
180
|
+
const { headers: retryHeaders, body: retryBody, host: retryHost } = await buildSignedHeaders();
|
|
181
|
+
const retryRes = await fetch(`https://${retryHost}${PATH}`, {
|
|
182
|
+
method: "POST",
|
|
183
|
+
headers: retryHeaders,
|
|
184
|
+
body: retryBody,
|
|
185
|
+
});
|
|
186
|
+
if (!retryRes.ok) {
|
|
187
|
+
console.warn("[aws-rejected][after-hard-reset]", { status: retryRes.status, region });
|
|
188
|
+
throw new InternalError("aws_rejected");
|
|
189
|
+
}
|
|
190
|
+
const retryJson = await retryRes.json();
|
|
191
|
+
const retryCreds = retryJson?.credentialSet?.[0]?.credentials;
|
|
192
|
+
if (!retryCreds?.accessKeyId || !retryCreds?.secretAccessKey || !retryCreds?.sessionToken) {
|
|
193
|
+
throw new InternalError("aws_malformed_credentials");
|
|
194
|
+
}
|
|
195
|
+
return {
|
|
196
|
+
accessKeyId: retryCreds.accessKeyId,
|
|
197
|
+
secretAccessKey: retryCreds.secretAccessKey,
|
|
198
|
+
sessionToken: retryCreds.sessionToken,
|
|
199
|
+
expiration: retryCreds.expiration,
|
|
200
|
+
};
|
|
201
|
+
})().finally(() => {
|
|
202
|
+
hardRefreshPromise = null;
|
|
203
|
+
});
|
|
180
204
|
}
|
|
181
|
-
return
|
|
182
|
-
accessKeyId: retryCreds.accessKeyId,
|
|
183
|
-
secretAccessKey: retryCreds.secretAccessKey,
|
|
184
|
-
sessionToken: retryCreds.sessionToken,
|
|
185
|
-
expiration: retryCreds.expiration,
|
|
186
|
-
};
|
|
205
|
+
return await hardRefreshPromise;
|
|
187
206
|
}
|
|
188
207
|
console.warn("[aws-rejected]", { status, region, profile });
|
|
189
208
|
throw new InternalError("aws_rejected");
|