@gemeentenijmegen/webapp 1.1.1 → 1.1.3

package/.jsii

@@ -7,22 +7,22 @@
   },
   "bundled": {
     "@aws-lambda-powertools/logger": "^1.17.0",
-    "@aws-sdk/client-dynamodb": "^3.687.0",
-    "@aws-sdk/client-secrets-manager": "^3.687.0",
+    "@aws-sdk/client-dynamodb": "^3.705.0",
+    "@aws-sdk/client-secrets-manager": "^3.699.0",
     "@aws-solutions-constructs/aws-lambda-dynamodb": "^2.74.0",
-    "@gemeentenijmegen/apiclient": "^0.0.19",
-    "@gemeentenijmegen/apigateway-http": "^0.0.16",
-    "@gemeentenijmegen/session": "^0.0.17",
-    "@gemeentenijmegen/utils": "^0.0.18",
-    "axios": "^1.7.7",
+    "@gemeentenijmegen/apiclient": "^0.0.21",
+    "@gemeentenijmegen/apigateway-http": "^0.0.18",
+    "@gemeentenijmegen/session": "^0.0.18",
+    "@gemeentenijmegen/utils": "^0.0.20",
+    "axios": "^1.7.9",
     "cdk-remote-stack": "^2.1.0",
     "cookie": "^0.7.2",
-    "dotenv": "^16.4.5",
+    "dotenv": "^16.4.7",
     "mustache": "^4.2.0",
-    "openid-client": "^5.7.0"
+    "openid-client": "^5.7.1"
   },
   "dependencies": {
-    "@gemeentenijmegen/aws-constructs": "^0.0.22",
+    "@gemeentenijmegen/aws-constructs": "^0.0.24",
     "aws-cdk-lib": "^2.122.0",
     "constructs": "^10.0.5"
   },
@@ -3685,7 +3685,7 @@
     "stability": "stable"
   },
   "homepage": "https://github.com/GemeenteNijmegen/modules-webapp.git",
-  "jsiiVersion": "5.5.9 (build 9ca058c)",
+  "jsiiVersion": "5.5.13 (build 464f9b8)",
   "keywords": [
     "cdk"
   ],
@@ -4698,6 +4698,6 @@
       "symbolId": "src/webapp/Webpage:WebpageProps"
     }
   },
-  "version": "1.1.1",
-  "fingerprint": "g9oPjuccrGSKSMlhZ8eMFK9QBKVuPG84jdTltoOgKPQ="
+  "version": "1.1.3",
+  "fingerprint": "Ek+Dqt+6nTDKYObANHFkcNSdlBfJKoH2zrS431iKQgA="
 }

package/assets/webapp/auth/auth.lambda/index.js

@@ -2589,75 +2589,99 @@ var require_lib2 = __commonJS({
   }
 });
 
-// node_modules/@gemeentenijmegen/session/node_modules/cookie/index.js
+// node_modules/cookie/index.js
 var require_cookie = __commonJS({
-  "node_modules/@gemeentenijmegen/session/node_modules/cookie/index.js"(exports2) {
+  "node_modules/cookie/index.js"(exports2) {
     "use strict";
     exports2.parse = parse;
     exports2.serialize = serialize;
     var __toString = Object.prototype.toString;
-    var fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/;
-    function parse(str, options) {
+    var __hasOwnProperty = Object.prototype.hasOwnProperty;
+    var cookieNameRegExp = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+    var cookieValueRegExp = /^("?)[\u0021\u0023-\u002B\u002D-\u003A\u003C-\u005B\u005D-\u007E]*\1$/;
+    var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+    var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
+    function parse(str, opt) {
       if (typeof str !== "string") {
         throw new TypeError("argument str must be a string");
       }
       var obj = {};
-      var opt = options || {};
-      var dec = opt.decode || decode;
+      var len = str.length;
+      if (len < 2) return obj;
+      var dec = opt && opt.decode || decode;
       var index = 0;
-      while (index < str.length) {
-        var eqIdx = str.indexOf("=", index);
-        if (eqIdx === -1) {
-          break;
-        }
-        var endIdx = str.indexOf(";", index);
+      var eqIdx = 0;
+      var endIdx = 0;
+      do {
+        eqIdx = str.indexOf("=", index);
+        if (eqIdx === -1) break;
+        endIdx = str.indexOf(";", index);
         if (endIdx === -1) {
-          endIdx = str.length;
-        } else if (endIdx < eqIdx) {
+          endIdx = len;
+        } else if (eqIdx > endIdx) {
           index = str.lastIndexOf(";", eqIdx - 1) + 1;
           continue;
         }
-        var key = str.slice(index, eqIdx).trim();
-        if (void 0 === obj[key]) {
-          var val = str.slice(eqIdx + 1, endIdx).trim();
-          if (val.charCodeAt(0) === 34) {
-            val = val.slice(1, -1);
-          }
+        var keyStartIdx = startIndex(str, index, eqIdx);
+        var keyEndIdx = endIndex(str, eqIdx, keyStartIdx);
+        var key = str.slice(keyStartIdx, keyEndIdx);
+        if (!__hasOwnProperty.call(obj, key)) {
+          var valStartIdx = startIndex(str, eqIdx + 1, endIdx);
+          var valEndIdx = endIndex(str, endIdx, valStartIdx);
+          if (str.charCodeAt(valStartIdx) === 34 && str.charCodeAt(valEndIdx - 1) === 34) {
+            valStartIdx++;
+            valEndIdx--;
+          }
+          var val = str.slice(valStartIdx, valEndIdx);
           obj[key] = tryDecode(val, dec);
         }
         index = endIdx + 1;
-      }
+      } while (index < len);
       return obj;
     }
-    function serialize(name, val, options) {
-      var opt = options || {};
-      var enc = opt.encode || encode;
+    function startIndex(str, index, max) {
+      do {
+        var code = str.charCodeAt(index);
+        if (code !== 32 && code !== 9) return index;
+      } while (++index < max);
+      return max;
+    }
+    function endIndex(str, index, min) {
+      while (index > min) {
+        var code = str.charCodeAt(--index);
+        if (code !== 32 && code !== 9) return index + 1;
+      }
+      return min;
+    }
+    function serialize(name, val, opt) {
+      var enc = opt && opt.encode || encodeURIComponent;
       if (typeof enc !== "function") {
         throw new TypeError("option encode is invalid");
       }
-      if (!fieldContentRegExp.test(name)) {
+      if (!cookieNameRegExp.test(name)) {
         throw new TypeError("argument name is invalid");
       }
       var value = enc(val);
-      if (value && !fieldContentRegExp.test(value)) {
+      if (!cookieValueRegExp.test(value)) {
         throw new TypeError("argument val is invalid");
       }
       var str = name + "=" + value;
+      if (!opt) return str;
       if (null != opt.maxAge) {
-        var maxAge = opt.maxAge - 0;
-        if (isNaN(maxAge) || !isFinite(maxAge)) {
+        var maxAge = Math.floor(opt.maxAge);
+        if (!isFinite(maxAge)) {
           throw new TypeError("option maxAge is invalid");
         }
-        str += "; Max-Age=" + Math.floor(maxAge);
+        str += "; Max-Age=" + maxAge;
       }
       if (opt.domain) {
-        if (!fieldContentRegExp.test(opt.domain)) {
+        if (!domainValueRegExp.test(opt.domain)) {
           throw new TypeError("option domain is invalid");
         }
         str += "; Domain=" + opt.domain;
       }
       if (opt.path) {
-        if (!fieldContentRegExp.test(opt.path)) {
+        if (!pathValueRegExp.test(opt.path)) {
           throw new TypeError("option path is invalid");
         }
         str += "; Path=" + opt.path;
@@ -2718,11 +2742,8 @@ var require_cookie = __commonJS({
     function decode(str) {
       return str.indexOf("%") !== -1 ? decodeURIComponent(str) : str;
     }
-    function encode(val) {
-      return encodeURIComponent(val);
-    }
     function isDate(val) {
-      return __toString.call(val) === "[object Date]" || val instanceof Date;
+      return __toString.call(val) === "[object Date]";
     }
     function tryDecode(str, decode2) {
       try {
@@ -8742,7 +8763,7 @@ var require_package = __commonJS({
   "node_modules/openid-client/package.json"(exports2, module2) {
     module2.exports = {
       name: "openid-client",
-      version: "5.7.0",
+      version: "5.7.1",
       description: "OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs",
       keywords: [
         "auth",
@@ -8764,8 +8785,8 @@ var require_package = __commonJS({
         "relying party",
         "strategy"
       ],
-      homepage: "https://github.com/panva/node-openid-client",
-      repository: "panva/node-openid-client",
+      homepage: "https://github.com/panva/openid-client",
+      repository: "panva/openid-client",
       funding: {
         url: "https://github.com/sponsors/panva"
       },
@@ -9402,16 +9423,13 @@ var require_client = __commonJS({
         case "private_key_jwt":
         case "client_secret_jwt": {
           const timestamp = now();
-          const audience = [
-            ...new Set([this.issuer.issuer, this.issuer.token_endpoint].filter(Boolean))
-          ];
           const assertion = await clientAssertion.call(this, endpoint, {
             iat: timestamp,
             exp: timestamp + 60,
             jti: random(),
             iss: this.client_id,
             sub: this.client_id,
-            aud: audience,
+            aud: this.issuer.issuer,
             ...clientAssertionPayload
           });
           return {

package/assets/webapp/login/login.lambda/index.js

@@ -109,75 +109,99 @@ var require_Response = __commonJS({
   }
 });
 
-// node_modules/@gemeentenijmegen/session/node_modules/cookie/index.js
+// node_modules/cookie/index.js
 var require_cookie = __commonJS({
-  "node_modules/@gemeentenijmegen/session/node_modules/cookie/index.js"(exports2) {
+  "node_modules/cookie/index.js"(exports2) {
     "use strict";
     exports2.parse = parse;
     exports2.serialize = serialize;
     var __toString = Object.prototype.toString;
-    var fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/;
-    function parse(str, options) {
+    var __hasOwnProperty = Object.prototype.hasOwnProperty;
+    var cookieNameRegExp = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+    var cookieValueRegExp = /^("?)[\u0021\u0023-\u002B\u002D-\u003A\u003C-\u005B\u005D-\u007E]*\1$/;
+    var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+    var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
+    function parse(str, opt) {
       if (typeof str !== "string") {
         throw new TypeError("argument str must be a string");
       }
       var obj = {};
-      var opt = options || {};
-      var dec = opt.decode || decode;
+      var len = str.length;
+      if (len < 2) return obj;
+      var dec = opt && opt.decode || decode;
       var index = 0;
-      while (index < str.length) {
-        var eqIdx = str.indexOf("=", index);
-        if (eqIdx === -1) {
-          break;
-        }
-        var endIdx = str.indexOf(";", index);
+      var eqIdx = 0;
+      var endIdx = 0;
+      do {
+        eqIdx = str.indexOf("=", index);
+        if (eqIdx === -1) break;
+        endIdx = str.indexOf(";", index);
         if (endIdx === -1) {
-          endIdx = str.length;
-        } else if (endIdx < eqIdx) {
+          endIdx = len;
+        } else if (eqIdx > endIdx) {
           index = str.lastIndexOf(";", eqIdx - 1) + 1;
           continue;
         }
-        var key = str.slice(index, eqIdx).trim();
-        if (void 0 === obj[key]) {
-          var val = str.slice(eqIdx + 1, endIdx).trim();
-          if (val.charCodeAt(0) === 34) {
-            val = val.slice(1, -1);
-          }
+        var keyStartIdx = startIndex(str, index, eqIdx);
+        var keyEndIdx = endIndex(str, eqIdx, keyStartIdx);
+        var key = str.slice(keyStartIdx, keyEndIdx);
+        if (!__hasOwnProperty.call(obj, key)) {
+          var valStartIdx = startIndex(str, eqIdx + 1, endIdx);
+          var valEndIdx = endIndex(str, endIdx, valStartIdx);
+          if (str.charCodeAt(valStartIdx) === 34 && str.charCodeAt(valEndIdx - 1) === 34) {
+            valStartIdx++;
+            valEndIdx--;
+          }
+          var val = str.slice(valStartIdx, valEndIdx);
           obj[key] = tryDecode(val, dec);
         }
         index = endIdx + 1;
-      }
+      } while (index < len);
       return obj;
     }
-    function serialize(name, val, options) {
-      var opt = options || {};
-      var enc = opt.encode || encode;
+    function startIndex(str, index, max) {
+      do {
+        var code = str.charCodeAt(index);
+        if (code !== 32 && code !== 9) return index;
+      } while (++index < max);
+      return max;
+    }
+    function endIndex(str, index, min) {
+      while (index > min) {
+        var code = str.charCodeAt(--index);
+        if (code !== 32 && code !== 9) return index + 1;
+      }
+      return min;
+    }
+    function serialize(name, val, opt) {
+      var enc = opt && opt.encode || encodeURIComponent;
       if (typeof enc !== "function") {
         throw new TypeError("option encode is invalid");
       }
-      if (!fieldContentRegExp.test(name)) {
+      if (!cookieNameRegExp.test(name)) {
         throw new TypeError("argument name is invalid");
       }
       var value = enc(val);
-      if (value && !fieldContentRegExp.test(value)) {
+      if (!cookieValueRegExp.test(value)) {
         throw new TypeError("argument val is invalid");
       }
       var str = name + "=" + value;
+      if (!opt) return str;
       if (null != opt.maxAge) {
-        var maxAge = opt.maxAge - 0;
-        if (isNaN(maxAge) || !isFinite(maxAge)) {
+        var maxAge = Math.floor(opt.maxAge);
+        if (!isFinite(maxAge)) {
           throw new TypeError("option maxAge is invalid");
         }
-        str += "; Max-Age=" + Math.floor(maxAge);
+        str += "; Max-Age=" + maxAge;
       }
       if (opt.domain) {
-        if (!fieldContentRegExp.test(opt.domain)) {
+        if (!domainValueRegExp.test(opt.domain)) {
           throw new TypeError("option domain is invalid");
         }
         str += "; Domain=" + opt.domain;
       }
       if (opt.path) {
-        if (!fieldContentRegExp.test(opt.path)) {
+        if (!pathValueRegExp.test(opt.path)) {
           throw new TypeError("option path is invalid");
         }
         str += "; Path=" + opt.path;
@@ -238,11 +262,8 @@ var require_cookie = __commonJS({
     function decode(str) {
       return str.indexOf("%") !== -1 ? decodeURIComponent(str) : str;
     }
-    function encode(val) {
-      return encodeURIComponent(val);
-    }
     function isDate(val) {
-      return __toString.call(val) === "[object Date]" || val instanceof Date;
+      return __toString.call(val) === "[object Date]";
     }
     function tryDecode(str, decode2) {
       try {
@@ -6262,7 +6283,7 @@ var require_package = __commonJS({
   "node_modules/openid-client/package.json"(exports2, module2) {
     module2.exports = {
       name: "openid-client",
-      version: "5.7.0",
+      version: "5.7.1",
       description: "OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs",
       keywords: [
         "auth",
@@ -6284,8 +6305,8 @@ var require_package = __commonJS({
         "relying party",
         "strategy"
       ],
-      homepage: "https://github.com/panva/node-openid-client",
-      repository: "panva/node-openid-client",
+      homepage: "https://github.com/panva/openid-client",
+      repository: "panva/openid-client",
       funding: {
         url: "https://github.com/sponsors/panva"
       },
@@ -6922,16 +6943,13 @@ var require_client = __commonJS({
         case "private_key_jwt":
         case "client_secret_jwt": {
           const timestamp = now();
-          const audience = [
-            ...new Set([this.issuer.issuer, this.issuer.token_endpoint].filter(Boolean))
-          ];
           const assertion = await clientAssertion.call(this, endpoint, {
             iat: timestamp,
             exp: timestamp + 60,
             jti: random(),
             iss: this.client_id,
             sub: this.client_id,
-            aud: audience,
+            aud: this.issuer.issuer,
             ...clientAssertionPayload
           });
           return {