github.com/aws/aws-sdk-go-v2 v1.47.0: aws.NewCredentialsCache

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/aws/aws-sdk-go-v2/aws.NewCredentialsCache in pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0
Demonstrate these symbols/APIs:
  - github.com/aws/aws-sdk-go-v2/aws.NewCredentialsCache

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:502dced053fe8ffe3490aba7de89726e7d917386b41d9d42da27cf25d658ce4e","contract":["NewCredentialsCache wraps a CredentialsProvider and satisfies CredentialsProvider interface","NewCredentialsCache caches unexpired credentials across repeated Retrieve calls","NewCredentialsCache Invalidate clears cached credentials forcing subsequent Retrieve to re-query provider","NewCredentialsCache configures ExpiryWindow via CredentialsCacheOptions to trigger refresh before actual expiration","NewCredentialsCache propagates retrieval errors returned by the underlying provider","NewCredentialsCache IsCredentialsProvider checks wrapped provider against a target"],"goal":"verify github.com/aws/aws-sdk-go-v2/aws.NewCredentialsCache in pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0","kind":"HOW","packages":["pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0"],"schemaVersion":1,"symbols":["github.com/aws/aws-sdk-go-v2/aws.NewCredentialsCache"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","runtime":"go","runtimeVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0","symbols":["github.com/aws/aws-sdk-go-v2/aws.NewCredentialsCache"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require github.com/aws/aws-sdk-go-v2 v1.47.0

require github.com/aws/smithy-go v1.28.5 // indirect

github.com/aws/aws-sdk-go-v2 v1.47.0 h1:0jsHallhJCeaU0Ko48c/3FK1ctOQ7NpzggxriJOQ8MQ=
github.com/aws/aws-sdk-go-v2 v1.47.0/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU=
github.com/aws/aws-sdk-go-v2 v1.47.3 h1:HRoT/MkNi3bjO5xF4dCzLzvVmkvRGHj3/cLINDnJejk=
github.com/aws/aws-sdk-go-v2 v1.47.3/go.mod h1:xSl+OSI5ZUw6bSMupWc218zE5Pl+65MCCu3ySWFY99A=
github.com/aws/smithy-go v1.28.5 h1:OqbqKtzY9NUnr2yAe9+hiTdFb20tNaK/lI0PMOGXX9k=
github.com/aws/smithy-go v1.28.5/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=

package main

import (
	"context"
	"fmt"
	"time"

	"github.com/aws/aws-sdk-go-v2/aws"
)

type staticProvider struct {
	accessKey string
	secretKey string
}

func (p *staticProvider) Retrieve(ctx context.Context) (aws.Credentials, error) {
	return aws.Credentials{
		AccessKeyID:     p.accessKey,
		SecretAccessKey: p.secretKey,
		Source:          "StaticMockProvider",
		CanExpire:       true,
		Expires:         time.Now().Add(10 * time.Minute),
	}, nil
}

func main() {
	ctx := context.Background()

	underlying := &staticProvider{
		accessKey: "mock-access-key",
		secretKey: "mock-secret-key",
	}

	cache := aws.NewCredentialsCache(underlying, func(options *aws.CredentialsCacheOptions) {
		options.ExpiryWindow = 1 * time.Minute
	})

	creds1, err := cache.Retrieve(ctx)
	if err != nil {
		fmt.Printf("retrieve 1 failed: %v\n", err)
		return
	}
	fmt.Printf("retrieved credentials (first call): %s, expires: %v\n", creds1.AccessKeyID, creds1.Expires)

	creds2, err := cache.Retrieve(ctx)
	if err != nil {
		fmt.Printf("retrieve 2 failed: %v\n", err)
		return
	}
	fmt.Printf("retrieved credentials (cached call): %s, same: %t\n", creds2.AccessKeyID, creds1.AccessKeyID == creds2.AccessKeyID)

	cache.Invalidate()
	fmt.Println("cache invalidated successfully")
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/aws/aws-sdk-go-v2/aws.NewCredentialsCache in pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.0"
  ],
  "symbols": [
    "github.com/aws/aws-sdk-go-v2/aws.NewCredentialsCache"
  ]
}

package main

import (
	"context"
	"errors"
	"fmt"
	"os"
	"sync/atomic"
	"time"

	"github.com/aws/aws-sdk-go-v2/aws"
)

type countingProvider struct {
	count atomic.Int64
	creds aws.Credentials
	err   error
}

func (c *countingProvider) Retrieve(ctx context.Context) (aws.Credentials, error) {
	c.count.Add(1)
	if c.err != nil {
		return aws.Credentials{}, c.err
	}
	return c.creds, nil
}

type otherProvider struct{}

func (o *otherProvider) Retrieve(ctx context.Context) (aws.Credentials, error) {
	return aws.Credentials{}, nil
}

func main() {
	if err := runContract(); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("PASS: all contract assertions satisfied")
}

func runContract() error {
	ctx := context.Background()

	// 1. NewCredentialsCache wraps a CredentialsProvider and satisfies CredentialsProvider interface
	underlying := &countingProvider{
		creds: aws.Credentials{
			AccessKeyID:     "test-key-id",
			SecretAccessKey: "test-secret",
			Source:          "TestProvider",
			CanExpire:       true,
			Expires:         time.Now().Add(1 * time.Hour),
		},
	}
	cache := aws.NewCredentialsCache(underlying)
	if cache == nil {
		return fmt.Errorf("NewCredentialsCache returned nil")
	}
	var _ aws.CredentialsProvider = cache

	// 2. NewCredentialsCache caches unexpired credentials across repeated Retrieve calls
	c1, err := cache.Retrieve(ctx)
	if err != nil {
		return fmt.Errorf("first Retrieve failed: %w", err)
	}
	c2, err := cache.Retrieve(ctx)
	if err != nil {
		return fmt.Errorf("second Retrieve failed: %w", err)
	}
	if c1.AccessKeyID != c2.AccessKeyID {
		return fmt.Errorf("credentials changed between cached calls: %s != %s", c1.AccessKeyID, c2.AccessKeyID)
	}
	if calls := underlying.count.Load(); calls != 1 {
		return fmt.Errorf("expected 1 underlying call due to caching, got %d", calls)
	}

	// 3. NewCredentialsCache Invalidate clears cached credentials forcing subsequent Retrieve to re-query provider
	cache.Invalidate()
	c3, err := cache.Retrieve(ctx)
	if err != nil {
		return fmt.Errorf("Retrieve after Invalidate failed: %w", err)
	}
	if c3.AccessKeyID != c1.AccessKeyID {
		return fmt.Errorf("credentials mismatch after invalidate: %s != %s", c3.AccessKeyID, c1.AccessKeyID)
	}
	if calls := underlying.count.Load(); calls != 2 {
		return fmt.Errorf("expected 2 underlying calls after Invalidate, got %d", calls)
	}

	// 4. NewCredentialsCache configures ExpiryWindow via CredentialsCacheOptions to trigger refresh before actual expiration
	shortLivedProvider := &countingProvider{
		creds: aws.Credentials{
			AccessKeyID:     "short-key",
			SecretAccessKey: "short-secret",
			CanExpire:       true,
			Expires:         time.Now().Add(30 * time.Second),
		},
	}
	// ExpiryWindow of 1 minute means credentials expiring in 30 seconds are immediately treated as expired for refresh
	windowCache := aws.NewCredentialsCache(shortLivedProvider, func(options *aws.CredentialsCacheOptions) {
		options.ExpiryWindow = 1 * time.Minute
	})
	_, err = windowCache.Retrieve(ctx)
	if err != nil {
		return fmt.Errorf("windowCache first retrieve failed: %w", err)
	}
	_, err = windowCache.Retrieve(ctx)
	if err != nil {
		return fmt.Errorf("windowCache second retrieve failed: %w", err)
	}
	if calls := shortLivedProvider.count.Load(); calls != 2 {
		return fmt.Errorf("expected 2 calls due to ExpiryWindow triggering refresh, got %d", calls)
	}

	// 5. NewCredentialsCache propagates retrieval errors returned by the underlying provider
	expectedErr := errors.New("retrieval failed")
	errorProvider := &countingProvider{err: expectedErr}
	errCache := aws.NewCredentialsCache(errorProvider)
	_, err = errCache.Retrieve(ctx)
	if err == nil {
		return fmt.Errorf("expected error from provider, got nil")
	}
	if !errors.Is(err, expectedErr) {
		return fmt.Errorf("expected error %v, got %v", expectedErr, err)
	}

	// 6. NewCredentialsCache IsCredentialsProvider checks wrapped provider against a target
	if !cache.IsCredentialsProvider(&countingProvider{}) {
		return fmt.Errorf("expected IsCredentialsProvider to match countingProvider type")
	}
	if cache.IsCredentialsProvider(&otherProvider{}) {
		return fmt.Errorf("expected IsCredentialsProvider to return false for otherProvider type")
	}

	return nil
}