@gemeentenijmegen/webapp 1.0.1 → 1.1.1

package/assets/webapp/auth/auth.lambda/index.js

@@ -85,6 +85,16 @@ var require_Response = __commonJS({
           cookies
         };
       }
+      static csv(csv, csvFileName, code = 200) {
+        return {
+          statusCode: code,
+          body: csv,
+          headers: {
+            "Content-type": "text/csv",
+            "Content-Disposition": `attachment;filename=${csvFileName}`
+          }
+        };
+      }
       static ok(code = 200, message) {
         if (code < 200 || code >= 300) {
           throw new Error("Only 2xx statuscodes are allowed");
@@ -124,8 +134,7 @@ var require_lambda = __commonJS({
   "node_modules/@aws-lambda-powertools/commons/lib/utils/lambda/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -134,14 +143,11 @@ var require_lambda = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m)
-        if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p))
-          __createBinding(exports3, m, p);
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     __exportStar(require_LambdaInterface(), exports2);
@@ -298,8 +304,7 @@ var require_config = __commonJS({
   "node_modules/@aws-lambda-powertools/commons/lib/config/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -308,14 +313,11 @@ var require_config = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m)
-        if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p))
-          __createBinding(exports3, m, p);
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     __exportStar(require_ConfigService(), exports2);
@@ -352,8 +354,7 @@ var require_contexts = __commonJS({
   "node_modules/@aws-lambda-powertools/commons/lib/samples/resources/contexts/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -362,14 +363,11 @@ var require_contexts = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m)
-        if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p))
-          __createBinding(exports3, m, p);
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     __exportStar(require_hello_world(), exports2);
@@ -395,8 +393,7 @@ var require_events = __commonJS({
   "node_modules/@aws-lambda-powertools/commons/lib/samples/resources/events/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -405,8 +402,7 @@ var require_events = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? function(o, v) {
@@ -415,13 +411,10 @@ var require_events = __commonJS({
       o["default"] = v;
     });
     var __importStar = exports2 && exports2.__importStar || function(mod2) {
-      if (mod2 && mod2.__esModule)
-        return mod2;
+      if (mod2 && mod2.__esModule) return mod2;
       var result = {};
       if (mod2 != null) {
-        for (var k in mod2)
-          if (k !== "default" && Object.prototype.hasOwnProperty.call(mod2, k))
-            __createBinding(result, mod2, k);
+        for (var k in mod2) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod2, k)) __createBinding(result, mod2, k);
       }
       __setModuleDefault(result, mod2);
       return result;
@@ -483,7 +476,7 @@ var require_version = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.PT_VERSION = void 0;
-    exports2.PT_VERSION = "1.17.0";
+    exports2.PT_VERSION = "1.18.1";
   }
 });
 
@@ -570,8 +563,7 @@ var require_lib = __commonJS({
   "node_modules/@aws-lambda-powertools/commons/lib/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -580,8 +572,7 @@ var require_lib = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? function(o, v) {
@@ -590,18 +581,13 @@ var require_lib = __commonJS({
       o["default"] = v;
     });
     var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m)
-        if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p))
-          __createBinding(exports3, m, p);
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     var __importStar = exports2 && exports2.__importStar || function(mod2) {
-      if (mod2 && mod2.__esModule)
-        return mod2;
+      if (mod2 && mod2.__esModule) return mod2;
       var result = {};
       if (mod2 != null) {
-        for (var k in mod2)
-          if (k !== "default" && Object.prototype.hasOwnProperty.call(mod2, k))
-            __createBinding(result, mod2, k);
+        for (var k in mod2) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod2, k)) __createBinding(result, mod2, k);
       }
       __setModuleDefault(result, mod2);
       return result;
@@ -726,8 +712,7 @@ var require_formatter = __commonJS({
   "node_modules/@aws-lambda-powertools/logger/lib/formatter/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -736,14 +721,11 @@ var require_formatter = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m)
-        if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p))
-          __createBinding(exports3, m, p);
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     __exportStar(require_LogFormatter(), exports2);
@@ -1531,8 +1513,7 @@ var require_log = __commonJS({
   "node_modules/@aws-lambda-powertools/logger/lib/log/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -1541,14 +1522,11 @@ var require_log = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m)
-        if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p))
-          __createBinding(exports3, m, p);
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     __exportStar(require_LogItem(), exports2);
@@ -1683,8 +1661,7 @@ var require_config2 = __commonJS({
   "node_modules/@aws-lambda-powertools/logger/lib/config/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -1693,14 +1670,11 @@ var require_config2 = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m)
-        if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p))
-          __createBinding(exports3, m, p);
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     __exportStar(require_ConfigServiceInterface(), exports2);
@@ -2495,8 +2469,7 @@ var require_middleware = __commonJS({
   "node_modules/@aws-lambda-powertools/commons/lib/middleware/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -2505,14 +2478,11 @@ var require_middleware = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m)
-        if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p))
-          __createBinding(exports3, m, p);
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     __exportStar(require_cleanupMiddlewares(), exports2);
@@ -2571,8 +2541,7 @@ var require_middleware2 = __commonJS({
   "node_modules/@aws-lambda-powertools/logger/lib/middleware/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -2581,14 +2550,11 @@ var require_middleware2 = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m)
-        if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p))
-          __createBinding(exports3, m, p);
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     __exportStar(require_middy2(), exports2);
@@ -2600,8 +2566,7 @@ var require_lib2 = __commonJS({
   "node_modules/@aws-lambda-powertools/logger/lib/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
@@ -2610,14 +2575,11 @@ var require_lib2 = __commonJS({
       }
       Object.defineProperty(o, k2, desc);
     } : function(o, m, k, k2) {
-      if (k2 === void 0)
-        k2 = k;
+      if (k2 === void 0) k2 = k;
       o[k2] = m[k];
     });
     var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m)
-        if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p))
-          __createBinding(exports3, m, p);
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     __exportStar(require_helpers(), exports2);
@@ -2713,6 +2675,9 @@ var require_cookie = __commonJS({
       if (opt.secure) {
         str += "; Secure";
       }
+      if (opt.partitioned) {
+        str += "; Partitioned";
+      }
       if (opt.priority) {
         var priority = typeof opt.priority === "string" ? opt.priority.toLowerCase() : opt.priority;
         switch (priority) {
@@ -2839,7 +2804,7 @@ var require_lib3 = __commonJS({
         });
         try {
           const session = await this.dbClient.send(getItemCommand);
-          if (((_a = session.Item) === null || _a === void 0 ? void 0 : _a.data) !== void 0) {
+          if (((_a = session === null || session === void 0 ? void 0 : session.Item) === null || _a === void 0 ? void 0 : _a.data) !== void 0) {
             this.session = session;
             return session;
           } else {
@@ -2869,8 +2834,23 @@ var require_lib3 = __commonJS({
         var _a, _b, _c, _d;
         return (_d = (_c = (_b = (_a = this.session) === null || _a === void 0 ? void 0 : _a.Item) === null || _b === void 0 ? void 0 : _b.data) === null || _c === void 0 ? void 0 : _c.M[key]) === null || _d === void 0 ? void 0 : _d[type];
       }
+      /** Update the session with a single value
+       * The new data object will be written to the session
+       * immediately.
+       */
+      async setValue(key, value) {
+        var _a, _b, _c, _d;
+        if (!((_b = (_a = this.session) === null || _a === void 0 ? void 0 : _a.Item) === null || _b === void 0 ? void 0 : _b.data)) {
+          await this.init();
+        }
+        const data = (_d = (_c = this.session) === null || _c === void 0 ? void 0 : _c.Item) === null || _d === void 0 ? void 0 : _d.data;
+        data.M[key] = {
+          S: value
+        };
+        return this.updateSession(data.M);
+      }
       /**
-         * Update the session with login state and / or BSN
+         * Update the session with session data
          *
          * @param {any} sessionData set the session data
          */
@@ -3113,7 +3093,7 @@ var require_errors2 = __commonJS({
   "node_modules/jose/dist/node/cjs/util/errors.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.JWSSignatureVerificationFailed = exports2.JWKSTimeout = exports2.JWKSMultipleMatchingKeys = exports2.JWKSNoMatchingKey = exports2.JWKSInvalid = exports2.JWKInvalid = exports2.JWTInvalid = exports2.JWSInvalid = exports2.JWEInvalid = exports2.JWEDecryptionFailed = exports2.JOSENotSupported = exports2.JOSEAlgNotAllowed = exports2.JWTExpired = exports2.JWTClaimValidationFailed = exports2.JOSEError = void 0;
+    exports2.JWSSignatureVerificationFailed = exports2.JWKSTimeout = exports2.JWKSMultipleMatchingKeys = exports2.JWKSNoMatchingKey = exports2.JWKSInvalid = exports2.JWKInvalid = exports2.JWTInvalid = exports2.JWSInvalid = exports2.JWEInvalid = exports2.JWEDecompressionFailed = exports2.JWEDecryptionFailed = exports2.JOSENotSupported = exports2.JOSEAlgNotAllowed = exports2.JWTExpired = exports2.JWTClaimValidationFailed = exports2.JOSEError = void 0;
     var JOSEError = class extends Error {
       static get code() {
         return "ERR_JOSE_GENERIC";
@@ -3182,6 +3162,17 @@ var require_errors2 = __commonJS({
       }
     };
     exports2.JWEDecryptionFailed = JWEDecryptionFailed;
+    var JWEDecompressionFailed = class extends JOSEError {
+      constructor() {
+        super(...arguments);
+        this.code = "ERR_JWE_DECOMPRESSION_FAILED";
+        this.message = "decompression operation failed";
+      }
+      static get code() {
+        return "ERR_JWE_DECOMPRESSION_FAILED";
+      }
+    };
+    exports2.JWEDecompressionFailed = JWEDecompressionFailed;
     var JWEInvalid = class extends JOSEError {
       constructor() {
         super(...arguments);
@@ -3768,9 +3759,12 @@ var require_zlib = __commonJS({
     exports2.deflate = exports2.inflate = void 0;
     var util_1 = require("util");
     var zlib_1 = require("zlib");
+    var errors_js_1 = require_errors2();
     var inflateRaw = (0, util_1.promisify)(zlib_1.inflateRaw);
     var deflateRaw = (0, util_1.promisify)(zlib_1.deflateRaw);
-    var inflate = (input) => inflateRaw(input);
+    var inflate = (input) => inflateRaw(input, { maxOutputLength: 25e4 }).catch(() => {
+      throw new errors_js_1.JWEDecompressionFailed();
+    });
     exports2.inflate = inflate;
     var deflate = (input) => deflateRaw(input);
     exports2.deflate = deflate;
@@ -7926,8 +7920,7 @@ var require_assert = __commonJS({
   "node_modules/openid-client/lib/helpers/assert.js"(exports2, module2) {
     "use strict";
     function assertSigningAlgValuesSupport(endpoint, issuer, properties) {
-      if (!issuer[`${endpoint}_endpoint`])
-        return;
+      if (!issuer[`${endpoint}_endpoint`]) return;
       const eam = `${endpoint}_endpoint_auth_method`;
       const easa = `${endpoint}_endpoint_auth_signing_alg`;
       const easavs = `${endpoint}_endpoint_auth_signing_alg_values_supported`;
@@ -7989,8 +7982,7 @@ var require_process_response = __commonJS({
           jsonbody = response.body;
         }
         result = typeof jsonbody.error === "string" && jsonbody.error.length;
-        if (result)
-          Object.defineProperty(response, "body", { value: jsonbody, configurable: true });
+        if (result) Object.defineProperty(response, "body", { value: jsonbody, configurable: true });
       } catch (err) {
       }
       return result;
@@ -8639,8 +8631,7 @@ var require_lru_cache = __commonJS({
         return true;
       }
       has(key) {
-        if (!this[CACHE].has(key))
-          return false;
+        if (!this[CACHE].has(key)) return false;
         const hit = this[CACHE].get(key).value;
         return !isStale(this, hit);
       }
@@ -8751,7 +8742,7 @@ var require_package = __commonJS({
   "node_modules/openid-client/package.json"(exports2, module2) {
     module2.exports = {
       name: "openid-client",
-      version: "5.6.4",
+      version: "5.7.0",
       description: "OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs",
       keywords: [
         "auth",
@@ -8796,18 +8787,18 @@ var require_package = __commonJS({
         test: "mocha test/**/*.test.js"
       },
       dependencies: {
-        jose: "^4.15.4",
+        jose: "^4.15.9",
         "lru-cache": "^6.0.0",
         "object-hash": "^2.2.0",
         "oidc-token-hash": "^5.0.3"
       },
       devDependencies: {
-        "@types/node": "^16.18.59",
-        "@types/passport": "^1.0.14",
+        "@types/node": "^16.18.106",
+        "@types/passport": "^1.0.16",
         base64url: "^3.0.1",
-        chai: "^4.3.10",
-        mocha: "^10.2.0",
-        nock: "^13.3.6",
+        chai: "^4.5.0",
+        mocha: "^10.7.3",
+        nock: "^13.5.5",
         prettier: "^2.8.8",
         "readable-mock-req": "^0.2.2",
         sinon: "^9.2.4",
@@ -8945,7 +8936,7 @@ var require_request = __commonJS({
         opts.headers.DPoP = await this.dpopProof(
           {
             htu: `${url.origin}${url.pathname}`,
-            htm: options.method,
+            htm: options.method || "GET",
             nonce: nonces.get(nonceKey)
           },
           DPoP,
@@ -9038,8 +9029,7 @@ var require_request = __commonJS({
         }
         return response;
       })().catch((err) => {
-        if (response)
-          Object.defineProperty(err, "response", { value: response });
+        if (response) Object.defineProperty(err, "response", { value: response });
         throw err;
       }).finally(() => {
         const dpopNonce = response && response.headers["dpop-nonce"];
@@ -9113,7 +9103,7 @@ var require_keystore = __commonJS({
             switch (crv) {
               case "P-256":
               case "P-384":
-                algs = algs.concat([`ES${crv.slice(-3)}`.replace("21", "12")]);
+                algs = algs.concat([`ES${crv.slice(-3)}`]);
                 break;
               case "P-521":
                 algs = algs.concat(["ES512"]);
@@ -9150,8 +9140,7 @@ var require_keystore = __commonJS({
     module2.exports = class KeyStore {
       #keys;
       constructor(i, keys) {
-        if (i !== internal)
-          throw new Error("invalid constructor call");
+        if (i !== internal) throw new Error("invalid constructor call");
         this.#keys = keys;
       }
       toJWKS() {
@@ -9946,7 +9935,8 @@ var require_issuer = __commonJS({
         algorithm: "sha256",
         ignoreUnknown: true,
         unorderedArrays: true,
-        unorderedSets: true
+        unorderedSets: true,
+        respectType: false
       });
       const freshJwksUri = cache.get(defHash) || cache.get("throttle");
       const keystore = await getKeyStore.call(this, !freshJwksUri);
@@ -10161,8 +10151,7 @@ var require_client2 = __commonJS({
     }
     function getSearchParams(input) {
       const parsed = url.parse(input);
-      if (!parsed.search)
-        return {};
+      if (!parsed.search) return {};
       return querystring.parse(parsed.search.substring(1));
     }
     function verifyPresence(payload, jwt, prop) {
@@ -10231,8 +10220,7 @@ var require_client2 = __commonJS({
       }
     }
     function getDefaultsForEndpoint(endpoint, issuer, properties) {
-      if (!issuer[`${endpoint}_endpoint`])
-        return;
+      if (!issuer[`${endpoint}_endpoint`]) return;
       const tokenEndpointAuthMethod = properties.token_endpoint_auth_method;
       const tokenEndpointAuthSigningAlg = properties.token_endpoint_auth_signing_alg;
       const eam = `${endpoint}_endpoint_auth_method`;
@@ -10264,7 +10252,7 @@ var require_client2 = __commonJS({
           authorization_signed_response_alg: "RS256",
           response_types: ["code"],
           token_endpoint_auth_method: "client_secret_basic",
-          ...this.fapi() ? {
+          ...this.fapi1() ? {
             grant_types: ["authorization_code", "implicit"],
             id_token_signed_response_alg: "PS256",
             authorization_signed_response_alg: "PS256",
@@ -10272,6 +10260,11 @@ var require_client2 = __commonJS({
             tls_client_certificate_bound_access_tokens: true,
             token_endpoint_auth_method: void 0
           } : void 0,
+          ...this.fapi2() ? {
+            id_token_signed_response_alg: "PS256",
+            authorization_signed_response_alg: "PS256",
+            token_endpoint_auth_method: void 0
+          } : void 0,
           ...metadata
         };
         if (this.fapi()) {
@@ -10290,6 +10283,18 @@ var require_client2 = __commonJS({
               throw new TypeError("invalid or unsupported token_endpoint_auth_method");
           }
         }
+        if (this.fapi2()) {
+          if (properties.tls_client_certificate_bound_access_tokens && properties.dpop_bound_access_tokens) {
+            throw new TypeError(
+              "either tls_client_certificate_bound_access_tokens or dpop_bound_access_tokens must be set to true"
+            );
+          }
+          if (!properties.tls_client_certificate_bound_access_tokens && !properties.dpop_bound_access_tokens) {
+            throw new TypeError(
+              "either tls_client_certificate_bound_access_tokens or dpop_bound_access_tokens must be set to true"
+            );
+          }
+        }
         handleCommonMistakes(this, metadata, properties);
         assertSigningAlgValuesSupport("token", this.issuer, properties);
         ["introspection", "revocation"].forEach((endpoint) => {
@@ -10699,8 +10704,7 @@ var require_client2 = __commonJS({
           })) {
             plaintext = await jose.compactDecrypt(jwe, await key.keyObject(protectedHeader.alg)).then(getPlaintext, () => {
             });
-            if (plaintext)
-              break;
+            if (plaintext) break;
           }
         } else {
           plaintext = await jose.compactDecrypt(jwe, this.secretForAlg(expectedAlg === "dir" ? expectedEnc : expectedAlg)).then(getPlaintext, () => {
@@ -10774,7 +10778,7 @@ var require_client2 = __commonJS({
               jwt: idToken
             });
           }
-          if (this.fapi()) {
+          if (this.fapi1()) {
             if (!payload.s_hash && (tokenSet.state || state)) {
               throw new RPError({
                 message: "missing required property s_hash",
@@ -11450,8 +11454,14 @@ var require_client2 = __commonJS({
         })}`;
       }
       fapi() {
+        return this.fapi1() || this.fapi2();
+      }
+      fapi1() {
         return this.constructor.name === "FAPI1Client";
       }
+      fapi2() {
+        return this.constructor.name === "FAPI2Client";
+      }
       async validateJARM(response) {
         const expectedAlg = this.authorization_signed_response_alg;
         const { payload } = await this.validateJWT(response, expectedAlg, ["iss", "exp", "aud"]);
@@ -11638,8 +11648,7 @@ var require_webfinger_normalize = __commonJS({
     "use strict";
     var PORT = /^\d+$/;
     function hasScheme(input) {
-      if (input.includes("://"))
-        return true;
+      if (input.includes("://")) return true;
       const authority = input.replace(/(\/|\?)/g, "#").split("#")[0];
       if (authority.includes(":")) {
         const index = authority.indexOf(":");
@@ -11651,8 +11660,7 @@ var require_webfinger_normalize = __commonJS({
       return false;
     }
     function acctSchemeAssumed(input) {
-      if (!input.includes("@"))
-        return false;
+      if (!input.includes("@")) return false;
       const parts = input.split("@");
       const host = parts[parts.length - 1];
       return !(host.includes(":") || host.includes("/") || host.includes("?"));
@@ -11738,6 +11746,8 @@ var require_issuer2 = __commonJS({
         Object.defineProperties(this, {
           Client: { value: Client, enumerable: true },
           FAPI1Client: { value: class FAPI1Client extends Client {
+          }, enumerable: true },
+          FAPI2Client: { value: class FAPI2Client extends Client {
           }, enumerable: true }
         });
       }
@@ -11879,12 +11889,9 @@ var require_passport_strategy = __commonJS({
       delete this._params.state;
       delete this._params.nonce;
       this._extras = cloneDeep(extras);
-      if (!this._params.response_type)
-        this._params.response_type = resolveResponseType.call(client);
-      if (!this._params.redirect_uri)
-        this._params.redirect_uri = resolveRedirectUri.call(client);
-      if (!this._params.scope)
-        this._params.scope = "openid";
+      if (!this._params.response_type) this._params.response_type = resolveResponseType.call(client);
+      if (!this._params.redirect_uri) this._params.redirect_uri = resolveRedirectUri.call(client);
+      if (!this._params.scope) this._params.scope = "openid";
       if (this._usePKCE === true) {
         const supportedMethods = Array.isArray(this._issuer.code_challenge_methods_supported) ? this._issuer.code_challenge_methods_supported : false;
         if (supportedMethods && supportedMethods.includes("S256")) {