fix(credential-provider-node): update cache on forceRefresh in memoizeChain

Previously, calling the memoized provider with forceRefresh: true would
fetch fresh credentials but not update the internal cache. Subsequent
calls without forceRefresh would still return the stale cached value.

This caused issues for consumers like RDS Signer that force-refresh
near-expiry credentials — the refreshed credentials were used once but
lost on the next invocation.

Author: kuhe

packages-internal/credential-provider-node/src/runtime/memoize-chain.spec.ts

@@ -158,6 +158,23 @@ describe("memoize runtime config aware AWS credential chain", () => {
     expect(expiringCredentials).toHaveBeenCalledTimes(5);
   });
 
+  it("should update cache on forceRefresh so subsequent calls return refreshed credentials", async () => {
+    const provider = memoizeChain([staticCredentials], credentialsWillNeedRefresh);
+
+    // Initial call populates cache.
+    await provider();
+    expect(staticCredentials).toHaveBeenCalledTimes(1);
+
+    // Force refresh updates cache.
+    const refreshed = await provider({ forceRefresh: true });
+    expect(staticCredentials).toHaveBeenCalledTimes(2);
+
+    // Subsequent call without forceRefresh returns cached (refreshed) value.
+    const cached = await provider();
+    expect(staticCredentials).toHaveBeenCalledTimes(2);
+    expect(cached).toBe(refreshed);
+  });
+
   it("should release locks on credential resolution failure at the end of the chain", async () => {
     const neverAvailableCredentialProvider: () => RuntimeConfigAwsCredentialIdentityProvider = () => async () => {
       throw new CredentialsProviderError("never available", { tryNextLink: true });

packages-internal/credential-provider-node/src/runtime/memoize-chain.ts

@@ -32,7 +32,8 @@ export function memoizeChain(
 
   const provider = async (options?: AwsIdentityProperties & { forceRefresh?: boolean }) => {
     if (options?.forceRefresh) {
-      return await chain(options);
+      credentials = await chain(options);
+      return credentials;
     }
     if (credentials?.expiration) {
       if (credentials?.expiration?.getTime() < Date.now()) {

packages-internal/credential-provider-node/tests/credential-provider-node.integ.spec.ts

@@ -1327,6 +1327,30 @@ describe("credential-provider-node integration test", () => {
     });
   });
 
+  describe("forceRefresh should update credentials returned by the cache", () => {
+    it("subsequent calls without forceRefresh return the refreshed credentials", async () => {
+      process.env.AWS_ACCESS_KEY_ID = "ORIGINAL_KEY";
+      process.env.AWS_SECRET_ACCESS_KEY = "ORIGINAL_SECRET";
+
+      const provider = defaultProvider();
+
+      const credentials1 = await provider();
+      expect(credentials1.accessKeyId).toBe("ORIGINAL_KEY");
+
+      process.env.AWS_ACCESS_KEY_ID = "REFRESHED_KEY";
+      process.env.AWS_SECRET_ACCESS_KEY = "REFRESHED_SECRET";
+
+      const credentials2 = await provider();
+      expect(credentials2.accessKeyId).toBe("ORIGINAL_KEY");
+
+      const credentials3 = await provider({ forceRefresh: true });
+      expect(credentials3.accessKeyId).toBe("REFRESHED_KEY");
+
+      const credentials4 = await provider();
+      expect(credentials4.accessKeyId).toBe("REFRESHED_KEY");
+    });
+  });
+
   describe("No credentials available", () => {
     it("should throw CredentialsProviderError", async () => {
       process.env.AWS_EC2_METADATA_DISABLED = "true";