@vizamodo/aws-sts-core 0.4.7 → 0.4.10

package/dist/sts/issue.d.ts

@@ -10,11 +10,8 @@ export interface IssueAwsCredentialsInput {
     forceRefresh?: boolean;
 }
 /**
- * Reset isolate-level signing material and cert serial caches.
- * ONLY for use in tests — forces re-import of signing key on next call.
- *
- * L1 cache is bypassed in tests via `forceRefresh: true` on each call —
- * there is no need to expose a cache-clear API from the core library.
+ * Reset isolate-level signing-material cache.
+ * ONLY for use in tests.
  */
 export declare function resetIsolateCache(): void;
 export declare function issueAwsCredentials(input: IssueAwsCredentialsInput): Promise<AwsCredentialResult>;

package/dist/sts/issue.js

@@ -1,18 +1,14 @@
+import { getCachedOrFetch, wrapResult } from "@vizamodo/edge-cache-core";
 import { canonicalizeHeaders } from "../sigv4/headers";
 import { buildCanonicalRequest } from "../sigv4/canonical";
 import { buildStringToSign } from "../sigv4/string-to-sign";
 import { signStringToSign } from "./signer";
 import { InternalError } from "./errors";
 import { sha256Hex } from "../crypto/sha256";
-import { getCachedOrFetch, wrapResult } from "@vizamodo/edge-cache-core";
 // ── Constants ──────────────────────────────────────────────────────────────
 const ALGORITHM = "AWS4-X509-ECDSA-SHA256";
 const SERVICE = "rolesanywhere";
 const PATH = "/sessions";
-/**
- * Per-profile AWS session duration (seconds).
- * Clamped to [MIN_SESSION_TTL, MAX_SESSION_TTL] at resolution time.
- */
 const PROFILE_TTL = {
     Runtime: 45 * 60,
     ConsoleReadOnly: 12 * 60 * 60,
@@ -21,46 +17,39 @@ const PROFILE_TTL = {
     BillingAdmin: 3 * 60 * 60,
     BillingAccountant: 3 * 60 * 60,
 };
-const DEFAULT_SESSION_TTL = 2 * 60 * 60;
-const MIN_SESSION_TTL = 45 * 60; // 45 min
-const MAX_SESSION_TTL = 12 * 60 * 60; // 12 h
+const DEFAULT_TTL = 2 * 60 * 60;
+const MIN_PROFILE_TTL = 45 * 60; // 45 min
+const MAX_PROFILE_TTL = 12 * 60 * 60; // 12 h
 // ── Isolate-level signing-material cache ───────────────────────────────────
-// Single Promise slot prevents concurrent cold-start import races.
+// Single Promise slot deduplicates concurrent cold-start imports.
+// Cache vars are updated inside .then() so all concurrent awaiters see
+// consistent state and hit the fast path on the next call.
 let signingKeyPromise = null;
 let cachedSigningKey = null;
 let cachedCertBase64 = null;
 let cachedPrivateKeyBase64 = null;
-// ── Isolate-level cert-serial cache ───────────────────────────────────────
-// DER walk is CPU-bound; the cert rarely rotates within an isolate lifetime.
-let cachedCertSerialDec = null;
-let cachedCertSerialSource = null;
 // ── Test utilities ─────────────────────────────────────────────────────────
 /**
- * Reset isolate-level signing material and cert serial caches.
- * ONLY for use in tests — forces re-import of signing key on next call.
- *
- * L1 cache is bypassed in tests via `forceRefresh: true` on each call —
- * there is no need to expose a cache-clear API from the core library.
+ * Reset isolate-level signing-material cache.
+ * ONLY for use in tests.
  */
 export function resetIsolateCache() {
     signingKeyPromise = null;
     cachedSigningKey = null;
     cachedCertBase64 = null;
     cachedPrivateKeyBase64 = null;
-    cachedCertSerialDec = null;
-    cachedCertSerialSource = null;
 }
 // ── Signing material ───────────────────────────────────────────────────────
 async function getSigningMaterial(certBase64, privateKeyPkcs8Base64) {
-    // Fast path: same material already imported in this isolate.
+    // Fast path: same material already imported.
     if (cachedSigningKey &&
         cachedCertBase64 === certBase64 &&
         cachedPrivateKeyBase64 === privateKeyPkcs8Base64) {
         return cachedSigningKey;
     }
     // Material changed or first call — reset and re-import.
-    // Cache vars are updated inside .then() so concurrent callers
-    // awaiting the same promise all see consistent state after resolve.
+    // Cache vars are updated inside .then() so concurrent callers awaiting
+    // the same promise all get the correct key and hit the fast path next call.
     signingKeyPromise = null;
     cachedSigningKey = null;
     cachedCertBase64 = null;
@@ -68,32 +57,30 @@ async function getSigningMaterial(certBase64, privateKeyPkcs8Base64) {
     signingKeyPromise = crypto.subtle
         .importKey("pkcs8", base64ToBytes(privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
         .then((key) => {
-        // Update cache atomically after successful import.
-        // All concurrent callers awaiting this promise will see
-        // consistent state and hit the fast path on next call.
         cachedSigningKey = key;
         cachedCertBase64 = certBase64;
         cachedPrivateKeyBase64 = privateKeyPkcs8Base64;
         return key;
     })
         .catch(() => {
-        signingKeyPromise = null; // allow retry on next call
+        signingKeyPromise = null; // allow retry
         throw new InternalError("invalid_signing_material");
     });
     return signingKeyPromise;
 }
 // ── Session TTL ────────────────────────────────────────────────────────────
 function resolveSessionTtl(profile) {
-    const ttl = PROFILE_TTL[profile] ?? DEFAULT_SESSION_TTL;
-    return Math.min(Math.max(ttl, MIN_SESSION_TTL), MAX_SESSION_TTL);
+    const ttl = PROFILE_TTL[profile] ?? DEFAULT_TTL;
+    return Math.min(Math.max(ttl, MIN_PROFILE_TTL), MAX_PROFILE_TTL);
 }
 // ── Main export ────────────────────────────────────────────────────────────
 export async function issueAwsCredentials(input) {
     const { roleArn, profileArn, trustAnchorArn, region, certBase64, privateKeyPkcs8Base64, profile, forceRefresh, } = input;
     const sessionTtl = resolveSessionTtl(profile);
     const normalizedCert = normalizeCert(certBase64);
-    // Cert serial — use isolate cache to avoid redundant DER walks.
-    const certSerialDec = getCertSerialDec(normalizedCert);
+    // Parse serial fresh every call — no isolate cache.
+    // DER walk is ~5 µs; stale isolate-cached values caused wrong-serial bugs.
+    const certSerialDec = parseCertSerialDec(normalizedCert);
     const cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
     return getCachedOrFetch(cacheKey, () => fetchCredentials({
         roleArn, profileArn, trustAnchorArn,
@@ -103,7 +90,9 @@ export async function issueAwsCredentials(input) {
 }
 async function fetchCredentials(input) {
     const { roleArn, profileArn, trustAnchorArn, region, normalizedCert, privateKeyPkcs8Base64, sessionTtl, } = input;
+    // Signing happens INSIDE the fetcher so it only runs on a cache miss.
     const signingKey = await getSigningMaterial(normalizedCert, privateKeyPkcs8Base64);
+    const certSerialDec = parseCertSerialDec(normalizedCert);
     const host = `${SERVICE}.${region}.amazonaws.com`;
     const iso = new Date().toISOString();
     const amzDate = isoToAmzDate(iso);
@@ -119,51 +108,14 @@ async function fetchCredentials(input) {
     const { canonicalHeaders, signedHeaders } = canonicalizeHeaders(baseHeaders);
     const credentialScope = `${dateStamp}/${region}/${SERVICE}/aws4_request`;
     const canonicalRequest = buildCanonicalRequest({
-        method: "POST",
-        canonicalUri: PATH,
-        query: "",
-        canonicalHeaders,
-        signedHeaders,
-        payloadHash,
+        method: "POST", canonicalUri: PATH, query: "",
+        canonicalHeaders, signedHeaders, payloadHash,
     });
-    const canonicalRequestHash = await sha256Hex(canonicalRequest);
     const stringToSign = buildStringToSign({
-        algorithm: ALGORITHM,
-        amzDate,
-        credentialScope,
-        canonicalRequestHash,
+        algorithm: ALGORITHM, amzDate, credentialScope,
+        canonicalRequestHash: await sha256Hex(canonicalRequest),
     });
     const signatureHex = await signStringToSign(stringToSign, signingKey);
-    const certSerialDec = getCertSerialDec(normalizedCert);
-    // 🔍 Deep debug helper (compare with working version)
-    function debugAwsSigning() {
-        try {
-            console.debug("[aws-debug][input]", {
-                roleArn,
-                profileArn,
-                trustAnchorArn,
-                region,
-                sessionTtl,
-            });
-            console.debug("[aws-debug][cert]", {
-                length: normalizedCert.length,
-                preview: normalizedCert.slice(0, 30),
-            });
-            console.debug("[aws-debug][serial]", {
-                serialDec: certSerialDec,
-                serialHex: BigInt(certSerialDec).toString(16),
-            });
-            console.debug("[aws-debug][headers]", baseHeaders);
-            console.debug("[aws-debug][signedHeaders]", signedHeaders);
-            console.debug("[aws-debug][canonicalRequest]", canonicalRequest);
-            console.debug("[aws-debug][stringToSign]", stringToSign);
-            console.debug("[aws-debug][signatureHex]", signatureHex);
-        }
-        catch (e) {
-            console.warn("[aws-debug][error]", e);
-        }
-    }
-    debugAwsSigning();
     const finalHeaders = new Headers({
         "Content-Type": "application/json",
         "X-Amz-Date": amzDate,
@@ -183,12 +135,7 @@ async function fetchCredentials(input) {
         throw new InternalError("aws_unreachable");
     }
     if (!res.ok) {
-        const text = await res.text().catch(() => "<no-body>");
-        console.error("[aws-rejected]", {
-            status: res.status,
-            body: text,
-            region,
-        });
+        console.warn("[aws-rejected]", { status: res.status, region });
         throw new InternalError("aws_rejected");
     }
     const json = await res.json();
@@ -204,9 +151,9 @@ async function fetchCredentials(input) {
         expiration: creds.expiration,
     };
     // Cache for 1/3 of the credential lifetime so it's refreshed well before expiry.
-    // deriveEdgeTtlSec in cache.ts will further subtract EDGE_BUFFER_SEC (5 min).
-    const expiresAtMs = Date.parse(creds.expiration);
+    // getCachedOrFetch will further subtract EDGE_BUFFER_SEC (5 min).
     const receivedAt = Date.now();
+    const expiresAtMs = Date.parse(creds.expiration);
     const credLifetimeSec = Math.floor((expiresAtMs - receivedAt) / 1000);
     if (Number.isFinite(expiresAtMs) && credLifetimeSec > 0) {
         const cacheTtlSec = Math.floor(credLifetimeSec / 3);
@@ -216,25 +163,14 @@ async function fetchCredentials(input) {
     return value;
 }
 // ── Helpers ────────────────────────────────────────────────────────────────
-/** Strip whitespace; reject PEM-wrapped input. */
 function normalizeCert(raw) {
-    if (raw.includes("BEGIN CERTIFICATE")) {
+    if (raw.includes("BEGIN CERTIFICATE"))
         throw new InternalError("pem_not_allowed");
-    }
     return raw.replace(/\s+/g, "");
 }
-/** Return cert serial as decimal string, using isolate-level cache. */
-function getCertSerialDec(normalizedCert) {
-    if (cachedCertSerialDec && cachedCertSerialSource === normalizedCert) {
-        return cachedCertSerialDec;
-    }
-    const serial = parseCertSerialDec(normalizedCert);
-    cachedCertSerialDec = serial;
-    cachedCertSerialSource = normalizedCert;
-    return serial;
-}
 /**
  * Minimal DER walk to extract the certificate serial number as a decimal string.
+ * No isolate-level cache — stale cached values caused wrong-serial bugs in production.
  * Throws InternalError("invalid_cert_der") on any parse failure.
  */
 function parseCertSerialDec(normalizedCertBase64) {
@@ -255,34 +191,28 @@ function parseCertSerialDec(normalizedCertBase64) {
                 len = (len << 8) | der[offset++];
             return len;
         }
-        // Certificate ::= SEQUENCE
         if (der[offset++] !== 0x30)
             throw new Error("bad cert");
         readLen();
-        // tbsCertificate ::= SEQUENCE
         if (der[offset++] !== 0x30)
             throw new Error("bad tbs");
         readLen();
-        // Optional version [0] EXPLICIT
+        // Skip optional [0] EXPLICIT version field.
         if (der[offset] === 0xa0) {
-            offset++; // tag
-            offset += readLen(); // skip content
+            offset++;
+            offset += readLen();
         }
-        // 👉 SERIAL MUST be the next INTEGER after optional version
         if (der[offset++] !== 0x02)
             throw new Error("bad serial tag");
-        const len = readLen();
-        if (offset + len > der.length)
+        const serialLen = readLen();
+        if (offset + serialLen > der.length)
             throw new Error("DER overflow");
-        let serial = der.slice(offset, offset + len);
-        // Strip leading 0x00 only if it's padding for signed INTEGER
-        if (serial.length > 1 && serial[0] === 0x00) {
+        let serial = der.slice(offset, offset + serialLen);
+        if (serial.length > 1 && serial[0] === 0x00)
             serial = serial.slice(1);
-        }
         let serialBig = 0n;
-        for (let i = 0; i < serial.length; i++) {
+        for (let i = 0; i < serial.length; i++)
             serialBig = (serialBig << 8n) | BigInt(serial[i]);
-        }
         return serialBig.toString();
     }
     catch (e) {
@@ -290,26 +220,16 @@ function parseCertSerialDec(normalizedCertBase64) {
         throw new InternalError("invalid_cert_der");
     }
 }
-/**
- * Convert ISO-8601 to compact AMZ date-time format.
- * e.g. "2026-03-07T12:00:00.000Z" → "20260307T120000Z"
- */
 function isoToAmzDate(iso) {
-    return (iso.slice(0, 4) +
-        iso.slice(5, 7) +
-        iso.slice(8, 10) +
+    return (iso.slice(0, 4) + iso.slice(5, 7) + iso.slice(8, 10) +
         "T" +
-        iso.slice(11, 13) +
-        iso.slice(14, 16) +
-        iso.slice(17, 19) +
+        iso.slice(11, 13) + iso.slice(14, 16) + iso.slice(17, 19) +
         "Z");
 }
-/** base64 → Uint8Array via V8's vectorized atob path. */
 function base64ToBytes(base64) {
     const binary = atob(base64);
     const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
+    for (let i = 0; i < binary.length; i++)
         bytes[i] = binary.charCodeAt(i);
-    }
     return bytes;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.4.7",
+  "version": "0.4.10",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",