cloudflare-next-intl 0.10.19 → 0.10.20

package/README.md

@@ -516,7 +516,7 @@ Features include:
 - `createForgotPasswordAction(locale, actionCodeSettings?)`: Accepts optional Firebase `AuthActionCodeSettings` (e.g. `url` redirect link).
 - `sendVerificationEmail(actionCodeSettings?)` on `useAuthUser()`: Custom action email settings when resending email verification.
 - `followSameOriginContinueUrl`: Automatically forwards emailed action links with `continueUrl` to the specified path (or external URL) directly from `intlMiddleware` (default `true`; set `false` on `firebaseAuth` config to disable). If `continueUrl` points to home root (`/`), it resolves to `actionLinkPath` (if set) or the mode target path (e.g. `/reset-password`).
-- `appCheck`: Firebase App Check integration supporting reCAPTCHA Enterprise (`recaptchaEnterpriseSiteKey`) and reCAPTCHA v3 (`recaptchaV3SiteKey`). For reCAPTCHA v3, defaults to a `CustomProvider` using an explicit `render=explicit` script tag to avoid iframe/webworker CDN integrity issues in private windows (`useExplicitRecaptchaScript: false` to opt out). Both the script and App Check's own initialization are always deferred to first actual need (the first `getAppCheckToken()`/token mint) rather than run as part of every `getFirebaseAuthClient()` call, so a page that never mints a token never pays reCAPTCHA's ~345KB cost. **Note:** because of that deferral, a request made through `getFirebaseAuthClient()`'s `auth` before anything has called `getAppCheckToken()` (e.g. a sign-in call) goes out without an `X-Firebase-AppCheck` header — only a concern if App Check enforcement is on for Auth/Firestore/Functions. Supports server-side token minting via service accounts.
+- `appCheck`: Firebase App Check integration supporting reCAPTCHA Enterprise (`recaptchaEnterpriseSiteKey`) and reCAPTCHA v3 (`recaptchaV3SiteKey`). For reCAPTCHA v3, defaults to a `CustomProvider` using an explicit `render=explicit` script tag to avoid iframe/webworker CDN integrity issues in private windows (`useExplicitRecaptchaScript: false` to opt out). When `appCheck` is configured, `getFirebaseAuthClient()` waits for App Check to initialize before returning, so every request made through its `auth` (sign-in included) carries an `X-Firebase-AppCheck` header and passes App Check enforcement. The trade-off: App Check (and, with token auto-refresh on, the reCAPTCHA script) now starts on the first `getFirebaseAuthClient()` call instead of the first token mint. If App Check initialization fails, the client is still returned, just without App Check. Supports server-side token minting via service accounts.
 - `resolveOptionalAuthUser()` (`cloudflare-next-intl/resolveOptionalAuthUser`): best-effort variant of `getAuthUser()` for callers that want to *attach* the current user when one happens to be known — error/telemetry reporting, analytics, logging — without failing or changing behavior when no request/session context is available. Swallows every failure and resolves `{ user: null }` instead of throwing. Use `getAuthUser()` (not this) whenever your own output actually depends on who's signed in — `checkDynamicPages` (below) treats `getAuthUser()`/`useAuthUser()`/`withUserDb()` as page-blocking dynamic-API signals but does not follow into this helper, so it's also the way to read "whoever's signed in, if anyone" from a page or a module it imports without forcing that page dynamic.
 - `resolveErrorReportingUser(useAuthUser?)` (same subpath): gated form of `resolveOptionalAuthUser()` for an `onError` sink — pass `ErrorHandlingParams.useAuthUser` straight through. Defaults to `false`: when not `true`, resolves `{ user: null }` immediately without calling `getAuthUser()` at all, so a page reached only through your `onError` sink's default path stays static-eligible. A specific `reportError({ ..., useAuthUser: true })` call site opts in per-call when it actually wants the user on that report.
 

package/dist/src/firebase_auth/client/firebase_client.js

@@ -128,7 +128,7 @@ async function ensureAppCheck() {
     const appCheckConfig = config.firebaseAuth?.appCheck;
     if (!appCheckConfig || typeof window === 'undefined')
         return;
-    const { app } = await getFirebaseAuthClient();
+    const { app } = await loadFirebaseAuthClient();
     if (appCheckInitPromise)
         return appCheckInitPromise;
     appCheckInitPromise = (async () => {
@@ -160,7 +160,7 @@ export async function getAppCheckToken() {
 }
 let cached;
 let cachedPromise;
-export async function getFirebaseAuthClient() {
+async function loadFirebaseAuthClient() {
     requireFirebaseAuthConfig(config.firebaseAuth);
     if (cached)
         return cached;
@@ -204,6 +204,11 @@ export async function getFirebaseAuthClient() {
     }
     return cachedPromise;
 }
+export async function getFirebaseAuthClient() {
+    const client = await loadFirebaseAuthClient();
+    await ensureAppCheck().catch(() => undefined);
+    return client;
+}
 export function getFirebaseAuthClientSync() {
     return cached;
 }

package/dist/src/firebase_auth/server/firebase_server.js

@@ -5,9 +5,7 @@ import requireFirebaseAuthConfig from '../require_config.js';
 import { defaultAppCheckTokenCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName, isIdTokenExpired, refreshIdToken, sessionCookieOptions } from '../middleware/update_session.js';
 import reportError from '../../error_handling/report_error.js';
 import mintServerAppCheckToken from './mint_server_app_check_token.js';
-let baseAppReady;
-let firebaseAppModuleReady;
-let firebaseAuthModuleReady;
+const baseAppName = 'firebase-auth-server-base';
 function persistRefreshedSession(cookieStore, sessionCookieName, refreshTokenCookieName, idToken, refreshToken) {
     const options = sessionCookieOptions(config.firebaseAuth, true);
     try {
@@ -38,10 +36,10 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
     const appCheckToken = cookieStore.get(appCheckTokenCookieName)?.value
         ?? await mintServerAppCheckToken(fa.projectId, fa.apiKey, fa.appCheck);
     const attempt = async (idToken) => {
-        firebaseAppModuleReady ?? (firebaseAppModuleReady = import('@firebase/app'));
-        firebaseAuthModuleReady ?? (firebaseAuthModuleReady = import('@firebase/auth'));
-        const { initializeApp, initializeServerApp } = await firebaseAppModuleReady;
-        const { getAuth } = await firebaseAuthModuleReady;
+        const [{ getApps, initializeApp, initializeServerApp }, { getAuth }] = await Promise.all([
+            import('@firebase/app'),
+            import('@firebase/auth'),
+        ]);
         const firebaseConfig = {
             apiKey: fa.apiKey,
             authDomain: fa.authDomain,
@@ -51,8 +49,8 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
             appId: fa.appId,
             measurementId: fa.measurementId,
         };
-        baseAppReady ?? (baseAppReady = (async () => initializeApp(firebaseConfig, 'firebase-auth-server-base'))());
-        const baseApp = await baseAppReady;
+        const baseApp = getApps().find(app => app.name === baseAppName)
+            ?? initializeApp(firebaseConfig, baseAppName);
         const firebaseServerApp = initializeServerApp(baseApp, { authIdToken: idToken, appCheckToken });
         const auth = getAuth(firebaseServerApp);
         await auth.authStateReady();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.10.19",
+  "version": "0.10.20",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",