@djangocfg/nextjs 2.1.626 → 2.1.628

package/src/app-icon/next.ts

@@ -0,0 +1,47 @@
+/**
+ * Route handlers for Next's icon file conventions, from one glyph and one hue.
+ *
+ *   // app/icon.tsx
+ *   import * as workflow from 'lucide-react/icons/workflow';
+ *   import { createAppIcon } from '@djangocfg/nextjs/app-icon/next';
+ *   const icon = createAppIcon({ glyph: workflow, hue: 55 });
+ *   export const generateImageMetadata = icon.generateImageMetadata;
+ *   export default icon.icon;
+ *
+ *   // app/apple-icon.tsx
+ *   export const size = { width: 180, height: 180 };
+ *   export const contentType = 'image/png';
+ *   export default icon.appleIcon;   // same createAppIcon call, or call it again
+ *
+ * Served at `/icon/tab` (64, rounded), `/icon/192`, `/icon/384`, `/icon/512` (square) and `/apple-icon` (180, square).
+ */
+
+import { ImageResponse } from 'next/og';
+
+import { appIconElement, type AppIconGlyph } from './element';
+
+export const appIconSizes = { tab: 64, '192': 192, '384': 384, '512': 512 } as const;
+export const appleIconSize = { width: 180, height: 180 } as const;
+
+export function createAppIcon({ glyph, hue }: { glyph: AppIconGlyph; hue: number }) {
+  return {
+    generateImageMetadata() {
+      return Object.entries(appIconSizes).map(([id, side]) => ({
+        id,
+        size: { width: side, height: side },
+        contentType: 'image/png',
+      }));
+    },
+    async icon({ id }: { id: Promise<string | number> }) {
+      const key = String(await id) as keyof typeof appIconSizes;
+      const side = appIconSizes[key] ?? appIconSizes.tab;
+      return new ImageResponse(appIconElement({ glyph, hue, size: side, shape: key === 'tab' ? 'rounded' : 'square' }), {
+        width: side,
+        height: side,
+      });
+    },
+    appleIcon() {
+      return new ImageResponse(appIconElement({ glyph, hue, size: appleIconSize.width, shape: 'square' }), appleIconSize);
+    },
+  };
+}

package/src/app-icon/paths.ts

@@ -0,0 +1,6 @@
+/** The manifest's `icons` for an app that serves `createAppIcon` at `app/icon.tsx`. Pass it to `createManifest({ icons })`. */
+export const appIconPaths = {
+  logo192: '/icon/192',
+  logo384: '/icon/384',
+  logo512: '/icon/512',
+} as const;

package/src/i18n/client.ts

@@ -28,6 +28,7 @@ import {
 import { usePathname } from './navigation';
 import { I18nProvider, NextIntlProvider, useDeclaredLocales } from './provider';
 import { routing } from './routing';
+import { expireHostOnlyLocaleCookie, localeCookieHeader, sharedCookieDomain } from './shared-locale';
 
 // Re-export providers
 export { I18nProvider, NextIntlProvider };
@@ -198,10 +199,12 @@ export function useChangeLocale() {
   const pathname = usePathname();
 
   return (locale: LocaleCode) => {
-    // Set NEXT_LOCALE cookie so middleware remembers the choice
-    const date = new Date();
-    date.setFullYear(date.getFullYear() + 1);
-    document.cookie = `NEXT_LOCALE=${locale}; expires=${date.toUTCString()}; path=/`;
+    // Set NEXT_LOCALE so middleware remembers the choice, on the registrable domain so every host of the family
+    // reads it (see ./shared-locale); the host-only twin is expired so it cannot shadow the shared one.
+    const secure = window.location.protocol === 'https:';
+    const domain = sharedCookieDomain(window.location.hostname, process.env.NEXT_PUBLIC_COOKIE_DOMAIN);
+    document.cookie = localeCookieHeader(locale, domain, secure);
+    if (domain) document.cookie = expireHostOnlyLocaleCookie(secure);
 
     // Hard navigation to force full page reload with new locale
     // (ensures server components re-render with updated translations)

package/src/i18n/index.ts

@@ -48,3 +48,5 @@ export type {
 export type { LinkProps } from './navigation';
 export type { RequestConfigOptions } from './request';
 export type { LocaleSwitcherProps } from './components';
+
+export { sharedCookieDomain, localeCookieHeader, expireHostOnlyLocaleCookie, LOCALE_COOKIE } from './shared-locale';

package/src/i18n/proxy.test.ts

@@ -0,0 +1,22 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { NextRequest, NextResponse } from 'next/server';
+import { shareLocaleCookie } from './proxy';
+
+test('rewrites the cookie onto the registrable domain', () => {
+  const request = new NextRequest('https://hub.example.com/ru', { headers: { 'x-forwarded-proto': 'https' } });
+  const response = NextResponse.next();
+  response.cookies.set('NEXT_LOCALE', 'ru', { path: '/' });
+  const out = shareLocaleCookie(request, response);
+  const lines = out.headers.getSetCookie();
+  assert.ok(lines.some((l) => l.startsWith('NEXT_LOCALE=ru') && l.includes('Domain=example.com')));
+  assert.ok(lines.some((l) => l.startsWith('NEXT_LOCALE=;') && l.includes('Max-Age=0') && !l.includes('Domain')));
+});
+
+test('localhost is left alone', () => {
+  const request = new NextRequest('http://localhost:3211/ru');
+  const response = NextResponse.next();
+  response.cookies.set('NEXT_LOCALE', 'ru', { path: '/' });
+  const out = shareLocaleCookie(request, response);
+  assert.equal(out.headers.getSetCookie().length, 1);
+});

package/src/i18n/proxy.ts

@@ -20,8 +20,9 @@
 import createIntlMiddleware from 'next-intl/middleware';
 
 import { createRouting, routing } from './routing';
+import { expireHostOnlyLocaleCookie, LOCALE_COOKIE, LOCALE_COOKIE_MAX_AGE, sharedCookieDomain } from './shared-locale';
 
-import type { NextRequest } from 'next/server';
+import type { NextRequest, NextResponse } from 'next/server';
 
 import type { I18nConfig } from './types';
 
@@ -29,20 +30,37 @@ import type { I18nConfig } from './types';
 // Proxy Factory
 // ─────────────────────────────────────────────────────────────────────────────
 
+/**
+ * next-intl writes `NEXT_LOCALE` host-only. Rewrite it onto the registrable domain, so the locale a reader chose on one host
+ * of the family is the locale on all of them, and expire the host-only twin that would shadow it. A host that cannot share
+ * (localhost, an IP) is left as next-intl wrote it. `NEXT_PUBLIC_COOKIE_DOMAIN` overrides the guess.
+ */
+export function shareLocaleCookie(request: NextRequest, response: NextResponse): NextResponse {
+  const written = response.cookies.get(LOCALE_COOKIE);
+  if (!written) return response;
+  const host = request.headers.get('x-forwarded-host') ?? request.headers.get('host') ?? request.nextUrl.hostname;
+  const domain = sharedCookieDomain(host, process.env.NEXT_PUBLIC_COOKIE_DOMAIN);
+  if (!domain) return response;
+  const secure = (request.headers.get('x-forwarded-proto') ?? request.nextUrl.protocol.replace(':', '')) === 'https';
+  response.cookies.set({ name: LOCALE_COOKIE, value: written.value, domain, path: '/', maxAge: LOCALE_COOKIE_MAX_AGE, sameSite: 'lax', secure });
+  response.headers.append('set-cookie', expireHostOnlyLocaleCookie(secure));
+  return response;
+}
+
 /**
  * Create i18n proxy handler with custom routing configuration
  */
 export function createProxy(routingConfig?: ReturnType<typeof createRouting>) {
   const config = routingConfig ?? routing;
-  return createIntlMiddleware(config);
+  const intl = createIntlMiddleware(config);
+  return (request: NextRequest) => shareLocaleCookie(request, intl(request) as NextResponse);
 }
 
 /**
  * Create i18n proxy from config options
  */
 export function createProxyFromConfig(config: Partial<I18nConfig>) {
-  const routingConfig = createRouting(config);
-  return createIntlMiddleware(routingConfig);
+  return createProxy(createRouting(config));
 }
 
 // ─────────────────────────────────────────────────────────────────────────────

package/src/i18n/shared-locale.test.ts

@@ -0,0 +1,34 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+
+import { expireHostOnlyLocaleCookie, localeCookieHeader, sharedCookieDomain } from './shared-locale';
+
+test('the registrable domain of a subdomain host', () => {
+  assert.equal(sharedCookieDomain('hub.example.com'), 'example.com');
+  assert.equal(sharedCookieDomain('team.hub.example.com:3000'), 'example.com');
+  assert.equal(sharedCookieDomain('example.com'), 'example.com');
+});
+
+test('two-label public suffixes keep three labels', () => {
+  assert.equal(sharedCookieDomain('hub.example.co.uk'), 'example.co.uk');
+});
+
+test('hosts that cannot share get no domain', () => {
+  assert.equal(sharedCookieDomain('localhost:3211'), null);
+  assert.equal(sharedCookieDomain('127.0.0.1'), null);
+  assert.equal(sharedCookieDomain('[::1]'), null);
+});
+
+test('the override wins', () => {
+  assert.equal(sharedCookieDomain('hub.example.org', '.corp.example.org'), 'corp.example.org');
+  assert.equal(sharedCookieDomain('localhost', 'dev.test'), 'dev.test');
+});
+
+test('cookie headers', () => {
+  assert.equal(
+    localeCookieHeader('ru', 'example.com', true),
+    'NEXT_LOCALE=ru; Path=/; Max-Age=31536000; SameSite=Lax; Domain=example.com; Secure',
+  );
+  assert.equal(localeCookieHeader('ru', null, false), 'NEXT_LOCALE=ru; Path=/; Max-Age=31536000; SameSite=Lax');
+  assert.equal(expireHostOnlyLocaleCookie(false), 'NEXT_LOCALE=; Path=/; Max-Age=0; SameSite=Lax');
+});

package/src/i18n/shared-locale.ts

@@ -0,0 +1,46 @@
+/**
+ * One locale across every host of one product family.
+ *
+ * `NEXT_LOCALE` is written host-only by default, so a reader who picked Russian on `hub.example.com` meets English on
+ * `team.example.com`. The session tokens already live on the registrable domain (`@djangocfg/api` `createStorage`,
+ * `cookieDomain: 'auto'`); the locale follows the same rule: the cookie gets `Domain=` the registrable domain, and the
+ * host-only twin is expired so it cannot shadow the shared one.
+ *
+ * Pure and framework-free, so the proxy (server) and `useChangeLocale` (browser) agree on the domain.
+ */
+
+export const LOCALE_COOKIE = 'NEXT_LOCALE';
+export const LOCALE_COOKIE_MAX_AGE = 60 * 60 * 24 * 365;
+
+// Second-level public suffixes whose registrable domain has three labels. Not the whole Public Suffix List: the common
+// ones; anything else sets NEXT_PUBLIC_COOKIE_DOMAIN.
+const TWO_LABEL_SUFFIXES = new Set([
+  'co.uk', 'org.uk', 'ac.uk', 'com.au', 'net.au', 'co.nz', 'co.jp', 'co.kr', 'or.kr', 'com.br', 'com.tr', 'com.cn', 'com.mx',
+  'co.in', 'co.za', 'com.sg', 'com.hk', 'com.tw', 'com.ar', 'com.ua', 'co.il',
+]);
+
+/**
+ * The domain a cookie must carry to be sent to every subdomain, or `null` for a host that cannot share (an IP, a bare
+ * label such as `localhost`, or an apex with no subdomain in use: a host-only cookie already covers it).
+ * `override` (`NEXT_PUBLIC_COOKIE_DOMAIN`) wins when set.
+ */
+export function sharedCookieDomain(hostname: string, override?: string | null): string | null {
+  const forced = override?.trim().replace(/^\./, '');
+  if (forced) return forced;
+  const host = hostname.split(':')[0]!.toLowerCase();
+  if (!host || /^\d+(\.\d+){3}$/.test(host) || host.includes(':')) return null;
+  const labels = host.split('.');
+  if (labels.length < 2) return null;
+  const keep = TWO_LABEL_SUFFIXES.has(labels.slice(-2).join('.')) ? 3 : 2;
+  return labels.slice(-keep).join('.');
+}
+
+/** The `Set-Cookie` value that writes the shared locale cookie. */
+export function localeCookieHeader(locale: string, domain: string | null, secure: boolean): string {
+  return `${LOCALE_COOKIE}=${encodeURIComponent(locale)}; Path=/; Max-Age=${LOCALE_COOKIE_MAX_AGE}; SameSite=Lax${domain ? `; Domain=${domain}` : ''}${secure ? '; Secure' : ''}`;
+}
+
+/** Expires the host-only twin of the cookie (a cookie is identified by name and Domain). */
+export function expireHostOnlyLocaleCookie(secure: boolean): string {
+  return `${LOCALE_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax${secure ? '; Secure' : ''}`;
+}