cloudflare-next-intl 0.2.2 → 0.3.0

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -0,0 +1,148 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useCallback, useEffect, useRef, useState } from 'react';
+import { useRouter } from 'next/navigation';
+import usePathname from '../../client/hooks/use_path_name';
+import config from '@intl-config';
+import requireFirebaseAuthConfig from '../require_config';
+import { getFirebaseAuthClient } from './firebase_client';
+import { setAuthUserCache } from './auth_user_cache';
+import { sessionCookieName } from '../middleware/update_session';
+// `null` default (instead of a `{ loading: true, ... }` stand-in) lets
+// `useAuthUser` distinguish "not wrapped in AuthUserProvider" (throw) from
+// "wrapped, still loading" (`loading: true`).
+export const AuthUserContext = createContext(null);
+function writeSessionCookie(idToken, maxAge) {
+    document.cookie = `${sessionCookieName}=${idToken}; path=/; max-age=${maxAge}`;
+}
+function clearSessionCookie() {
+    document.cookie = `${sessionCookieName}=; path=/; max-age=0`;
+}
+/**
+ * Client-side auth-state provider for `firebase_auth`. Wrap your root layout
+ * (or a client boundary below it) with this to make `useAuthUser()`
+ * (`cloudflare-next-intl/useFirebaseAuthUser`, client variant) resolve
+ * `{ user, loading }` from the live Firebase `onIdTokenChanged` listener,
+ * and to get automatic session-cookie sync + redirect-on-sign-out/verify
+ * behavior driven by `firebaseAuth.isAuthPath` / `whiteListPaths` /
+ * `redirectAuthPath` / `verifyEmailPath` on your `RoutingConfig`.
+ *
+ * Requires `firebaseAuth` to be set on the config passed to `setIntlConfig`
+ * — throws via {@link requireFirebaseAuthConfig} otherwise.
+ *
+ * @param initialUser Server-resolved user (e.g. from
+ *   `useFirebaseAuthUser`'s `react-server` variant) to avoid a
+ *   loading flash on first paint; pass `null`/omit if unavailable.
+ * @example
+ * <AuthUserProvider initialUser={initialUser}>{children}</AuthUserProvider>
+ */
+export default function AuthUserProvider({ initialUser = null, children }) {
+    const fa = config.firebaseAuth;
+    requireFirebaseAuthConfig(fa);
+    const router = useRouter();
+    const pathname = usePathname();
+    const isAuthPage = fa.isAuthPath(pathname);
+    const isWhiteListed = fa.whiteListPaths?.includes(pathname) ?? false;
+    const maxAge = fa.sessionCookieMaxAge ?? 60 * 60 * 24 * 5;
+    const [state, setState] = useState({
+        user: initialUser,
+        loading: initialUser === null,
+    });
+    const syncedSignedIn = useRef(undefined);
+    const consecutiveNulls = useRef(0);
+    const [confirmedSignedOut, setConfirmedSignedOut] = useState(initialUser === null);
+    useEffect(() => {
+        const { user, loading } = state;
+        if (loading || isAuthPage || isWhiteListed)
+            return;
+        if (!user) {
+            if (confirmedSignedOut)
+                router.replace(fa.redirectAuthPath);
+        }
+        else if (fa.verifyEmailPath && !user.emailVerified && pathname !== fa.verifyEmailPath) {
+            router.replace(fa.verifyEmailPath);
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [state, pathname, isAuthPage, isWhiteListed, confirmedSignedOut]);
+    useEffect(() => {
+        let unsubscribe;
+        let cancelled = false;
+        getFirebaseAuthClient().then(async ({ auth }) => {
+            if (cancelled)
+                return;
+            const { onIdTokenChanged } = await import('firebase/auth');
+            unsubscribe = onIdTokenChanged(auth, async (user) => {
+                const isSignedIn = !!user;
+                const previous = syncedSignedIn.current;
+                try {
+                    if (user) {
+                        writeSessionCookie(await user.getIdToken(true), maxAge);
+                    }
+                    else if (previous) {
+                        clearSessionCookie();
+                    }
+                }
+                catch (e) {
+                    console.error('AuthUserProvider: session sync failed', e);
+                    setAuthUserCache(user);
+                    setState({ user, loading: false });
+                    return;
+                }
+                syncedSignedIn.current = isSignedIn;
+                setAuthUserCache(user);
+                setState({ user, loading: false });
+                if (user) {
+                    consecutiveNulls.current = 0;
+                    setConfirmedSignedOut(false);
+                }
+                else {
+                    consecutiveNulls.current += 1;
+                    if (consecutiveNulls.current >= 2)
+                        setConfirmedSignedOut(true);
+                }
+                const flipped = previous !== undefined && previous !== isSignedIn;
+                const contradictsPage = previous === undefined && isSignedIn === isAuthPage;
+                if (flipped || contradictsPage) {
+                    router.refresh();
+                }
+            });
+        });
+        return () => {
+            cancelled = true;
+            unsubscribe?.();
+        };
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [router, isAuthPage, maxAge]);
+    const reloadUser = useCallback(async () => {
+        const { auth } = await getFirebaseAuthClient();
+        const user = auth.currentUser;
+        if (!user)
+            return;
+        const { reload } = await import('firebase/auth');
+        await reload(user);
+        writeSessionCookie(await user.getIdToken(true), maxAge);
+        setAuthUserCache(user);
+        setState({ user, loading: false });
+    }, [maxAge]);
+    const sendVerificationEmail = useCallback(async () => {
+        const { auth } = await getFirebaseAuthClient();
+        const user = auth.currentUser;
+        if (!user)
+            return;
+        const { sendEmailVerification } = await import('firebase/auth');
+        await sendEmailVerification(user);
+    }, []);
+    const logout = useCallback(async () => {
+        try {
+            const { auth } = await getFirebaseAuthClient();
+            const { signOut } = await import('firebase/auth');
+            await signOut(auth);
+        }
+        finally {
+            clearSessionCookie();
+            window.location.assign(fa.redirectAuthPath);
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [fa.redirectAuthPath]);
+    return _jsx(AuthUserContext.Provider, { value: { ...state, reloadUser, sendVerificationEmail, logout }, children: children });
+}

package/dist/src/firebase_auth/client/firebase_client.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/firebase_auth/client/firebase_client.bench.js

@@ -0,0 +1,28 @@
+import { bench, describe, vi } from 'vitest';
+vi.mock('@intl-config', () => ({
+    default: {
+        firebaseAuth: {
+            apiKey: 'bench-key',
+            authDomain: 'domain',
+            projectId: 'proj',
+            appId: 'app',
+            redirectAuthPath: '/login',
+            homePath: '/',
+            isAuthPath: () => false,
+        },
+    },
+}));
+vi.mock('firebase/app', () => ({
+    initializeApp: vi.fn(() => ({ name: 'bench-app' })),
+    getApps: vi.fn(() => []),
+    getApp: vi.fn(() => ({ name: 'bench-app' })),
+}));
+vi.mock('firebase/auth', () => ({
+    getAuth: vi.fn(() => ({ currentUser: null })),
+}));
+describe('getFirebaseAuthClient', () => {
+    bench('warm: cached client, no dynamic import', async () => {
+        const { getFirebaseAuthClient } = await import('./firebase_client');
+        await getFirebaseAuthClient();
+    });
+});

package/dist/src/firebase_auth/client/firebase_client.d.ts

@@ -0,0 +1,18 @@
+import type { FirebaseApp } from 'firebase/app';
+import type { Auth } from 'firebase/auth';
+/**
+ * Lazily loads and initializes `firebase/app`/`firebase/auth` — a dynamic
+ * import, not a static one, so consumers who never call a firebase_auth
+ * export never pull these packages into their bundle or runtime at all.
+ * Throws if `firebaseAuth` is missing from `RoutingConfig` (see
+ * `require_config.ts`) instead of silently no-op'ing.
+ */
+export declare function getFirebaseAuthClient(): Promise<{
+    app: FirebaseApp;
+    auth: Auth;
+}>;
+/** Synchronous read of the cached client, or `undefined` before the first `getFirebaseAuthClient()` resolves. */
+export declare function getFirebaseAuthClientSync(): {
+    app: FirebaseApp;
+    auth: Auth;
+} | undefined;

package/dist/src/firebase_auth/client/firebase_client.js

@@ -0,0 +1,40 @@
+'use client';
+import config from '@intl-config';
+import requireFirebaseAuthConfig from '../require_config';
+let cached;
+let cachedPromise;
+/**
+ * Lazily loads and initializes `firebase/app`/`firebase/auth` — a dynamic
+ * import, not a static one, so consumers who never call a firebase_auth
+ * export never pull these packages into their bundle or runtime at all.
+ * Throws if `firebaseAuth` is missing from `RoutingConfig` (see
+ * `require_config.ts`) instead of silently no-op'ing.
+ */
+export async function getFirebaseAuthClient() {
+    requireFirebaseAuthConfig(config.firebaseAuth);
+    if (cached)
+        return cached;
+    if (!cachedPromise) {
+        const fa = config.firebaseAuth;
+        cachedPromise = Promise.all([import('firebase/app'), import('firebase/auth')]).then(([{ getApp, getApps, initializeApp }, { getAuth }]) => {
+            const firebaseConfig = {
+                apiKey: fa.apiKey,
+                authDomain: fa.authDomain,
+                projectId: fa.projectId,
+                storageBucket: fa.storageBucket,
+                messagingSenderId: fa.messagingSenderId,
+                appId: fa.appId,
+                measurementId: fa.measurementId,
+            };
+            const app = getApps().length ? getApp() : initializeApp(firebaseConfig);
+            const auth = getAuth(app);
+            cached = { app, auth };
+            return cached;
+        });
+    }
+    return cachedPromise;
+}
+/** Synchronous read of the cached client, or `undefined` before the first `getFirebaseAuthClient()` resolves. */
+export function getFirebaseAuthClientSync() {
+    return cached;
+}

package/dist/src/firebase_auth/client/use_auth_user.d.ts

@@ -0,0 +1,12 @@
+import { type AuthUserContextType } from './auth_user_provider';
+/**
+ * Reads the current Firebase auth user and its actions from
+ * `AuthUserProvider`'s context.
+ *
+ * @throws If called without an `AuthUserProvider` above it in the tree.
+ * @example
+ * const { user, loading, logout } = useAuthUser();
+ * if (loading) return null;
+ * return user ? <button onClick={logout}>Log out</button> : null;
+ */
+export default function useAuthUser(): AuthUserContextType;

package/dist/src/firebase_auth/client/use_auth_user.js

@@ -0,0 +1,20 @@
+'use client';
+import { useContext } from 'react';
+import { AuthUserContext } from './auth_user_provider';
+/**
+ * Reads the current Firebase auth user and its actions from
+ * `AuthUserProvider`'s context.
+ *
+ * @throws If called without an `AuthUserProvider` above it in the tree.
+ * @example
+ * const { user, loading, logout } = useAuthUser();
+ * if (loading) return null;
+ * return user ? <button onClick={logout}>Log out</button> : null;
+ */
+export default function useAuthUser() {
+    const context = useContext(AuthUserContext);
+    if (context === null) {
+        throw new Error('useAuthUser must be used within an AuthUserProvider');
+    }
+    return context;
+}

package/dist/src/firebase_auth/error_messages/default_messages.en.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/firebase_auth/error_messages/default_messages.en.bench.js

@@ -0,0 +1,10 @@
+import { bench, describe } from 'vitest';
+import { DEFAULT_MESSAGES_EN } from './default_messages.en';
+describe('DEFAULT_MESSAGES_EN', () => {
+    bench('reads a known key from the message map', () => {
+        void DEFAULT_MESSAGES_EN.invalidEmail;
+    });
+    bench('reads the unknown fallback key', () => {
+        void DEFAULT_MESSAGES_EN.unknown;
+    });
+});

package/dist/src/firebase_auth/error_messages/default_messages.en.d.ts

@@ -0,0 +1 @@
+export declare const DEFAULT_MESSAGES_EN: Record<string, string>;

package/dist/src/firebase_auth/error_messages/default_messages.en.js

@@ -0,0 +1,14 @@
+export const DEFAULT_MESSAGES_EN = {
+    invalidEmail: 'Please enter a valid email address.',
+    userDisabled: 'This account has been disabled.',
+    invalidCredential: 'Invalid email or password.',
+    emailAlreadyInUse: 'An account with this email already exists.',
+    weakPassword: 'Password is too weak.',
+    tooManyRequests: 'Too many attempts. Please try again later.',
+    networkRequestFailed: 'Network error. Please check your connection.',
+    requiresRecentLogin: 'Please log in again to continue.',
+    expiredActionCode: 'This link has expired. Please request a new one.',
+    invalidActionCode: 'This link is invalid or has already been used.',
+    userTokenExpired: 'Your session has expired. Please log in again.',
+    unknown: 'Something went wrong. Please try again.',
+};

package/dist/src/firebase_auth/error_messages/firebase_auth_error_helper.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/firebase_auth/error_messages/firebase_auth_error_helper.bench.js

@@ -0,0 +1,15 @@
+import { bench, describe } from 'vitest';
+import firebaseAuthErrorMessage from './firebase_auth_error_helper';
+import { setMessageForLocaleCache } from '../../general/cache_variables';
+describe('firebaseAuthErrorMessage', () => {
+    bench('no message cache for locale: falls back to English default', () => {
+        firebaseAuthErrorMessage('de', { code: 'auth/invalid-email' });
+    });
+    bench('unrecognized error code: maps to unknown key', () => {
+        firebaseAuthErrorMessage('en', { code: 'auth/something-else' });
+    });
+    setMessageForLocaleCache('fr', { firebaseAuth: { invalidEmail: 'E-mail invalide.' } });
+    bench('locale translation present: uses the cached message', () => {
+        firebaseAuthErrorMessage('fr', { code: 'auth/invalid-email' });
+    });
+});

package/dist/src/firebase_auth/error_messages/firebase_auth_error_helper.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Resolves a Firebase auth error to a user-facing message. If the consumer's
+ * locale messages have a `firebaseAuth` namespace with a matching key, that
+ * translation is used; otherwise falls back to the bundled English default.
+ */
+export default function firebaseAuthErrorMessage(locale: string, error: unknown): string;

package/dist/src/firebase_auth/error_messages/firebase_auth_error_helper.js

@@ -0,0 +1,42 @@
+import { getTranslationsImpl } from '../../general/general_functions';
+import { getMessageCache } from '../../general/cache_variables';
+import { DEFAULT_MESSAGES_EN } from './default_messages.en';
+const ERROR_CODE_TO_KEY = {
+    'auth/invalid-email': 'invalidEmail',
+    'auth/user-disabled': 'userDisabled',
+    'auth/user-not-found': 'invalidCredential',
+    'auth/wrong-password': 'invalidCredential',
+    'auth/invalid-credential': 'invalidCredential',
+    'auth/email-already-in-use': 'emailAlreadyInUse',
+    'auth/weak-password': 'weakPassword',
+    'auth/too-many-requests': 'tooManyRequests',
+    'auth/network-request-failed': 'networkRequestFailed',
+    'auth/requires-recent-login': 'requiresRecentLogin',
+    'auth/expired-action-code': 'expiredActionCode',
+    'auth/invalid-action-code': 'invalidActionCode',
+    'auth/user-token-expired': 'userTokenExpired',
+};
+/**
+ * Resolves a Firebase auth error to a user-facing message. If the consumer's
+ * locale messages have a `firebaseAuth` namespace with a matching key, that
+ * translation is used; otherwise falls back to the bundled English default.
+ */
+export default function firebaseAuthErrorMessage(locale, error) {
+    const code = typeof error === 'object' && error !== null && 'code' in error
+        ? String(error.code)
+        : '';
+    const key = ERROR_CODE_TO_KEY[code] ?? 'unknown';
+    const messages = getMessageCache(locale);
+    if (messages) {
+        try {
+            const t = getTranslationsImpl(locale, messages, 'firebaseAuth');
+            const translated = t(key);
+            if (typeof translated === 'string' && translated !== key)
+                return translated;
+        }
+        catch {
+            // fall through to English default
+        }
+    }
+    return DEFAULT_MESSAGES_EN[key] ?? DEFAULT_MESSAGES_EN.unknown;
+}

package/dist/src/firebase_auth/index.d.ts

@@ -0,0 +1,9 @@
+export { default as FirebaseAuthClientProvider } from './client/auth_user_provider';
+export { default as FirebaseAuthServerProvider } from './server/auth_user_server_provider';
+export { default as useFirebaseAuthUserClient } from './client/use_auth_user';
+export { default as useFirebaseAuthUserServer } from './server/use_auth_user_server';
+export { createLoginAction, createSignUpAction, createForgotPasswordAction } from './client/auth_actions';
+export { default as updateFirebaseAuthSession, sessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
+export { getFirebaseAuthClient } from './client/firebase_client';
+export type { SerializedAuthUser, AuthFormState, AuthActionMessages, AuthUser } from './types';
+export type { FirebaseAuthRoutingConfig } from '../types/types';

package/dist/src/firebase_auth/index.js

@@ -0,0 +1,13 @@
+export { default as FirebaseAuthClientProvider } from './client/auth_user_provider';
+export { default as FirebaseAuthServerProvider } from './server/auth_user_server_provider';
+// NOTE: no single `useFirebaseAuthUser` re-export here — the barrel is a
+// plain module graph with no bundler-conditional resolution, so it cannot
+// replicate the react-server/default split package.json's exports map
+// provides for the ./useFirebaseAuthUser subpath. A consumer wanting the
+// hook imports `cloudflare-next-intl/useFirebaseAuthUser` directly (which
+// DOES resolve correctly per-environment) rather than through this barrel.
+export { default as useFirebaseAuthUserClient } from './client/use_auth_user';
+export { default as useFirebaseAuthUserServer } from './server/use_auth_user_server';
+export { createLoginAction, createSignUpAction, createForgotPasswordAction } from './client/auth_actions';
+export { default as updateFirebaseAuthSession, sessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
+export { getFirebaseAuthClient } from './client/firebase_client';

package/dist/src/firebase_auth/middleware/update_session.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/firebase_auth/middleware/update_session.bench.js

@@ -0,0 +1,37 @@
+// @vitest-environment node
+import { bench, describe, vi } from 'vitest';
+import { NextResponse } from 'next/server';
+import { makeTestRequest } from '../../test_utils/mock_next_server';
+const baseFa = {
+    apiKey: 'bench-api-key',
+    authDomain: 'domain',
+    projectId: 'proj',
+    appId: 'app',
+    redirectAuthPath: '/login',
+    homePath: '/',
+    isAuthPath: (path) => path === '/login',
+};
+vi.mock('@intl-config', () => ({
+    default: { locales: ['en'], defaultLocale: 'en', firebaseAuth: baseFa },
+}));
+function makeJwt(exp) {
+    const header = Buffer.from(JSON.stringify({ alg: 'none' })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({ exp })).toString('base64url');
+    return `${header}.${payload}.sig`;
+}
+describe('updateSession', () => {
+    bench('valid, unexpired session cookie: isJwtExpired parse + pass-through', async () => {
+        const { default: updateSession } = await import('./update_session');
+        const req = makeTestRequest('https://example.com/en/dashboard', {
+            cookies: { __fa_session__: makeJwt(Date.now() / 1000 + 3600) },
+        });
+        await updateSession(req, NextResponse.next(), 'en');
+    });
+    bench('malformed session cookie: isJwtExpired parse failure path', async () => {
+        const { default: updateSession } = await import('./update_session');
+        const req = makeTestRequest('https://example.com/en/dashboard', {
+            cookies: { __fa_session__: 'not.valid.jwt' },
+        });
+        await updateSession(req, NextResponse.next(), 'en');
+    });
+});

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -0,0 +1,22 @@
+import { NextResponse, type NextRequest } from 'next/server';
+export declare const sessionCookieName = "__fa_session__";
+export declare const refreshTokenCookieName = "__fa_refresh_token__";
+/**
+ * Layers Firebase session-cookie validation/refresh and auth redirects onto
+ * an already-built middleware response. Called internally by `intlMiddleware`
+ * (via dynamic import) when `config.firebaseAuth` is set and
+ * `middlewareEnabled !== false` — not intended to be called directly unless
+ * that auto-wiring is opted out of.
+ *
+ * @param baseResponse The response `intlMiddleware` already produced for
+ *   locale routing (its own next()/rewrite()/redirect(), with the locale
+ *   cookie / bot cookie / `Content-Language` header already set). On the
+ *   pass-through path this function returns `baseResponse` itself (with
+ *   Firebase cookies layered on) so none of that is dropped; on the
+ *   guest/auth-page redirect paths it returns a NEW response instead, since
+ *   a redirect response can't also carry forward a rewrite/next decision —
+ *   its cookies/headers are copied across from `baseResponse` so locale
+ *   state still survives the redirect.
+ * @param locale The effective locale `intlMiddleware` resolved for this request.
+ */
+export default function updateSession(request: NextRequest, baseResponse: NextResponse, locale: string): Promise<NextResponse>;