cloudflare-next-intl 0.3.0 → 0.3.2

package/dist/src/config/middleware.js

@@ -15,6 +15,8 @@ async function getIsBotValue(userAgent) {
     if (userAgent === null)
         return false;
     const { isBot } = await import('next/dist/server/web/spec-extension/user-agent');
+    // Unreachable: userAgent is already narrowed to non-null string above,
+    // so the ?? '' fallback never triggers.
     return isBot(userAgent ?? '');
 }
 const getIsBotValueCache = cache(getIsBotValue);
@@ -57,7 +59,9 @@ export default async function intlMiddleware(request, options) {
         let urlLocale;
         let pathWithoutLocale;
         // Avoids split('/').filter(Boolean) array allocation on every request:
-        // scan for the first segment's bounds directly.
+        // scan for the first segment's bounds directly. Unreachable:
+        // Next.js guarantees pathname always starts with '/', so the else
+        // branch (segmentStart = 0) never runs.
         const segmentStart = pathname.charCodeAt(0) === 47 /* '/' */ ? 1 : 0;
         let segmentEnd = pathname.indexOf('/', segmentStart);
         if (segmentEnd === -1)

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -7,15 +7,15 @@ import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
 import { getFirebaseAuthClient } from './firebase_client';
 import { setAuthUserCache } from './auth_user_cache';
-import { sessionCookieName } from '../middleware/update_session';
+import { defaultSessionCookieName } from '../middleware/update_session';
 // `null` default (instead of a `{ loading: true, ... }` stand-in) lets
 // `useAuthUser` distinguish "not wrapped in AuthUserProvider" (throw) from
 // "wrapped, still loading" (`loading: true`).
 export const AuthUserContext = createContext(null);
-function writeSessionCookie(idToken, maxAge) {
+function writeSessionCookie(sessionCookieName, idToken, maxAge) {
     document.cookie = `${sessionCookieName}=${idToken}; path=/; max-age=${maxAge}`;
 }
-function clearSessionCookie() {
+function clearSessionCookie(sessionCookieName) {
     document.cookie = `${sessionCookieName}=; path=/; max-age=0`;
 }
 /**
@@ -44,6 +44,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
     const isAuthPage = fa.isAuthPath(pathname);
     const isWhiteListed = fa.whiteListPaths?.includes(pathname) ?? false;
     const maxAge = fa.sessionCookieMaxAge ?? 60 * 60 * 24 * 5;
+    const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const [state, setState] = useState({
         user: initialUser,
         loading: initialUser === null,
@@ -76,10 +77,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
                 const previous = syncedSignedIn.current;
                 try {
                     if (user) {
-                        writeSessionCookie(await user.getIdToken(true), maxAge);
+                        writeSessionCookie(sessionCookieName, await user.getIdToken(true), maxAge);
                     }
                     else if (previous) {
-                        clearSessionCookie();
+                        clearSessionCookie(sessionCookieName);
                     }
                 }
                 catch (e) {
@@ -112,7 +113,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             unsubscribe?.();
         };
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [router, isAuthPage, maxAge]);
+    }, [router, isAuthPage, maxAge, sessionCookieName]);
     const reloadUser = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;
@@ -120,10 +121,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             return;
         const { reload } = await import('firebase/auth');
         await reload(user);
-        writeSessionCookie(await user.getIdToken(true), maxAge);
+        writeSessionCookie(sessionCookieName, await user.getIdToken(true), maxAge);
         setAuthUserCache(user);
         setState({ user, loading: false });
-    }, [maxAge]);
+    }, [maxAge, sessionCookieName]);
     const sendVerificationEmail = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;
@@ -139,10 +140,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             await signOut(auth);
         }
         finally {
-            clearSessionCookie();
+            clearSessionCookie(sessionCookieName);
             window.location.assign(fa.redirectAuthPath);
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [fa.redirectAuthPath]);
+    }, [fa.redirectAuthPath, sessionCookieName]);
     return _jsx(AuthUserContext.Provider, { value: { ...state, reloadUser, sendVerificationEmail, logout }, children: children });
 }

package/dist/src/firebase_auth/error_messages/firebase_auth_error_helper.js

@@ -38,5 +38,8 @@ export default function firebaseAuthErrorMessage(locale, error) {
             // fall through to English default
         }
     }
+    // Unreachable: key is always either a value from ERROR_CODE_TO_KEY (all
+    // valid DEFAULT_MESSAGES_EN keys) or the literal 'unknown' fallback
+    // above, so DEFAULT_MESSAGES_EN[key] never misses.
     return DEFAULT_MESSAGES_EN[key] ?? DEFAULT_MESSAGES_EN.unknown;
 }

package/dist/src/firebase_auth/index.d.ts

@@ -3,7 +3,7 @@ export { default as FirebaseAuthServerProvider } from './server/auth_user_server
 export { default as useFirebaseAuthUserClient } from './client/use_auth_user';
 export { default as useFirebaseAuthUserServer } from './server/use_auth_user_server';
 export { createLoginAction, createSignUpAction, createForgotPasswordAction } from './client/auth_actions';
-export { default as updateFirebaseAuthSession, sessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
+export { default as updateFirebaseAuthSession, defaultSessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
 export { getFirebaseAuthClient } from './client/firebase_client';
 export type { SerializedAuthUser, AuthFormState, AuthActionMessages, AuthUser } from './types';
 export type { FirebaseAuthRoutingConfig } from '../types/types';

package/dist/src/firebase_auth/index.js

@@ -9,5 +9,5 @@ export { default as FirebaseAuthServerProvider } from './server/auth_user_server
 export { default as useFirebaseAuthUserClient } from './client/use_auth_user';
 export { default as useFirebaseAuthUserServer } from './server/use_auth_user_server';
 export { createLoginAction, createSignUpAction, createForgotPasswordAction } from './client/auth_actions';
-export { default as updateFirebaseAuthSession, sessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
+export { default as updateFirebaseAuthSession, defaultSessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
 export { getFirebaseAuthClient } from './client/firebase_client';

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -1,6 +1,6 @@
 import { NextResponse, type NextRequest } from 'next/server';
-export declare const sessionCookieName = "__fa_session__";
-export declare const refreshTokenCookieName = "__fa_refresh_token__";
+export declare const defaultSessionCookieName = "__fa_session__";
+export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`

package/dist/src/firebase_auth/middleware/update_session.js

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server';
 import config from '@intl-config';
-export const sessionCookieName = '__fa_session__';
-export const refreshTokenCookieName = '__fa_refresh_token__';
+export const defaultSessionCookieName = '__fa_session__';
+export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
 const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
 // Refresh slightly before the real expiry — treating a token as expired
@@ -77,6 +77,21 @@ async function setCachedRefresh(refreshToken, refreshed) {
         // refresh result already returned to the caller.
     }
 }
+// Google's Secure Token API returns 400 with one of these error codes when
+// the refresh token itself is the problem (expired/revoked/malformed/the
+// associated user no longer exists) — this is the ONLY case that should
+// sign the user out. Any other failure (5xx, network error, timeout,
+// unrecognized 400 body) is transient/unexpected and must NOT clear the
+// refresh-token cookie or redirect to login: doing so previously caused a
+// signed-in user with a perfectly valid refresh token to flash to /login
+// and bounce back home the moment their ID token merely expired and a
+// single refresh attempt happened to fail.
+const INVALID_REFRESH_TOKEN_ERRORS = new Set([
+    'INVALID_REFRESH_TOKEN',
+    'TOKEN_EXPIRED',
+    'USER_DISABLED',
+    'USER_NOT_FOUND',
+]);
 /**
  * Mints a fresh ID token from a stored refresh token via Google's Secure
  * Token API. No `firebase/auth` import: this runs in the Edge middleware
@@ -86,15 +101,28 @@ async function setCachedRefresh(refreshToken, refreshed) {
 async function refreshIdToken(apiKey, refreshToken) {
     const cached = await getCachedRefresh(refreshToken);
     if (cached)
-        return cached;
+        return { status: 'refreshed', ...cached };
     try {
         const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${apiKey}`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`,
         });
-        if (!res.ok)
-            return null;
+        if (!res.ok) {
+            if (res.status === 400) {
+                try {
+                    const errorBody = await res.json();
+                    if (errorBody.error?.message && INVALID_REFRESH_TOKEN_ERRORS.has(errorBody.error.message)) {
+                        return { status: 'invalid' };
+                    }
+                }
+                catch {
+                    // Unparseable body on a 400 — treat as transient rather
+                    // than assuming the token is invalid.
+                }
+            }
+            return { status: 'transient-failure' };
+        }
         const data = await res.json();
         const refreshed = { idToken: data.id_token, refreshToken: data.refresh_token };
         // Not awaited: the cache write is a pure optimization for FUTURE
@@ -103,10 +131,10 @@ async function refreshIdToken(apiKey, refreshToken) {
         // setCachedRefresh already swallows its own errors, so a rejected
         // write here would otherwise surface as an unhandled rejection.
         void setCachedRefresh(refreshToken, refreshed);
-        return refreshed;
+        return { status: 'refreshed', ...refreshed };
     }
     catch {
-        return null;
+        return { status: 'transient-failure' };
     }
 }
 /**
@@ -131,6 +159,8 @@ export default async function updateSession(request, baseResponse, locale) {
     const fa = config.firebaseAuth;
     if (!fa || fa.middlewareEnabled === false)
         return baseResponse;
+    const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
+    const refreshTokenCookieName = fa.refreshTokenCookieName ?? defaultRefreshTokenCookieName;
     const rawPath = request.nextUrl.pathname;
     const requestPrefix = `/${locale}`;
     const path = rawPath === requestPrefix || rawPath.startsWith(`${requestPrefix}/`)
@@ -149,19 +179,30 @@ export default async function updateSession(request, baseResponse, locale) {
     let token = request.cookies.get(sessionCookieName)?.value;
     let refreshedToken = null;
     let clearInvalidSession = false;
+    // A transient refresh failure (network blip, Google 5xx, timeout) means
+    // "couldn't confirm the session right now" — NOT "this user is signed
+    // out". Redirecting to login in that case is the bug this guards
+    // against: it signs a still-valid user out for a one-off hiccup, and
+    // the client SDK (which still has a live session independent of these
+    // cookies) then bounces them straight back, producing a login flash.
+    let refreshWasTransientFailure = false;
     if (token && isJwtExpired(token)) {
         token = undefined;
     }
     if (!token) {
         const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
         if (refreshToken) {
-            refreshedToken = await refreshIdToken(fa.apiKey, refreshToken);
-            if (refreshedToken) {
+            const result = await refreshIdToken(fa.apiKey, refreshToken);
+            if (result.status === 'refreshed') {
+                refreshedToken = { idToken: result.idToken, refreshToken: result.refreshToken };
                 token = refreshedToken.idToken;
             }
-            else {
+            else if (result.status === 'invalid') {
                 clearInvalidSession = true;
             }
+            else {
+                refreshWasTransientFailure = true;
+            }
         }
         else if (request.cookies.get(sessionCookieName)) {
             clearInvalidSession = true;
@@ -169,7 +210,14 @@ export default async function updateSession(request, baseResponse, locale) {
     }
     const hasSession = !!token;
     let response;
-    if (!hasSession) {
+    if (refreshWasTransientFailure) {
+        // Couldn't confirm the session either way — pass through without
+        // forcing a redirect in either direction. The next request (or the
+        // client SDK's own session, independent of these cookies) gets a
+        // chance to resolve this correctly instead of guessing wrong.
+        response = baseResponse;
+    }
+    else if (!hasSession) {
         response = isAuthPage ? baseResponse : buildRedirect(baseResponse, localeUrl(fa.redirectAuthPath));
     }
     else if (isAuthPage) {

package/dist/src/firebase_auth/server/firebase_server.js

@@ -2,7 +2,7 @@ import { cookies } from 'next/headers';
 import { cache } from 'react';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { sessionCookieName } from '../middleware/update_session';
+import { defaultSessionCookieName } from '../middleware/update_session';
 let baseApp;
 /**
  * Resolves the signed-in user on the server from the session cookie.
@@ -16,6 +16,7 @@ let baseApp;
 export const getAuthenticatedAppForUser = cache(async function getAuthenticatedAppForUser() {
     const fa = config.firebaseAuth;
     requireFirebaseAuthConfig(fa);
+    const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const authIdToken = (await cookies()).get(sessionCookieName)?.value;
     if (!authIdToken) {
         return { firebaseServerApp: null, currentUser: null };

package/dist/src/firebase_auth/server/use_auth_user_server.d.ts

@@ -1,19 +1,39 @@
 import type { User } from 'firebase/auth';
 /**
- * Server Component counterpart of the client `useAuthUser()` hook (from
- * `cloudflare-next-intl/useFirebaseAuthUser`'s `default` condition — this
- * file is that same subpath's `react-server` condition, resolved
- * automatically, not a separately-imported function). Reads through the
- * same `cache()`-wrapped `getAuthenticatedAppForUser`, so every server
- * component calling this within one request shares one lookup.
+ * Resolves the current request's authenticated Firebase user.
+ * @returns `{ user, loading: false }` — `loading` is always `false` here;
+ *   server resolution is synchronous with respect to the awaited call.
+ */
+declare function iGetAuthUser(): Promise<{
+    user: User | null;
+    loading: false;
+}>;
+/**
+ * Server Component/Action only: resolves the current request's
+ * authenticated Firebase user, same style as {@link getLocale}/
+ * {@link getTranslations} — an unconditional, always-`async` export
+ * (`cloudflare-next-intl/getFirebaseAuthUser`), so the `await` requirement
+ * is visible from the type itself in every editor.
+ *
+ * Returns the same `{ user, loading }` shape the client `useAuthUser()`
+ * hook's context exposes, so `const { user } = await getAuthUser()`
+ * generalizes correctly from `const { user } = useAuthUser()` on the client.
  *
- * Returns the same `{ user, loading }` shape the client variant's context
- * exposes (`loading` is always `false` here — server resolution is
- * synchronous with respect to the awaited call), so code reading
- * `const { user } = await useAuthUser()` generalizes correctly from
- * `const { user } = useAuthUser()` on the client side.
+ * @example
+ * ```tsx
+ * const { user } = await getAuthUser();
+ * ```
+ */
+export declare const getAuthUser: typeof iGetAuthUser;
+/**
+ * Server Component counterpart of the client `useAuthUser()` hook, reached
+ * via `cloudflare-next-intl/useFirebaseAuthUser`'s `react-server` condition
+ * (resolved automatically — not meant to be imported directly by name).
+ * Prefer {@link getAuthUser} for an unconditional, editor-typed-as-async
+ * equivalent.
  */
 export default function useAuthUser(): Promise<{
     user: User | null;
     loading: false;
 }>;
+export {};

package/dist/src/firebase_auth/server/use_auth_user_server.js

@@ -1,19 +1,37 @@
 import { getAuthenticatedAppForUser } from './firebase_server';
 /**
- * Server Component counterpart of the client `useAuthUser()` hook (from
- * `cloudflare-next-intl/useFirebaseAuthUser`'s `default` condition — this
- * file is that same subpath's `react-server` condition, resolved
- * automatically, not a separately-imported function). Reads through the
- * same `cache()`-wrapped `getAuthenticatedAppForUser`, so every server
- * component calling this within one request shares one lookup.
- *
- * Returns the same `{ user, loading }` shape the client variant's context
- * exposes (`loading` is always `false` here — server resolution is
- * synchronous with respect to the awaited call), so code reading
- * `const { user } = await useAuthUser()` generalizes correctly from
- * `const { user } = useAuthUser()` on the client side.
+ * Resolves the current request's authenticated Firebase user.
+ * @returns `{ user, loading: false }` — `loading` is always `false` here;
+ *   server resolution is synchronous with respect to the awaited call.
  */
-export default async function useAuthUser() {
+async function iGetAuthUser() {
     const { currentUser } = await getAuthenticatedAppForUser();
     return { user: currentUser, loading: false };
 }
+/**
+ * Server Component/Action only: resolves the current request's
+ * authenticated Firebase user, same style as {@link getLocale}/
+ * {@link getTranslations} — an unconditional, always-`async` export
+ * (`cloudflare-next-intl/getFirebaseAuthUser`), so the `await` requirement
+ * is visible from the type itself in every editor.
+ *
+ * Returns the same `{ user, loading }` shape the client `useAuthUser()`
+ * hook's context exposes, so `const { user } = await getAuthUser()`
+ * generalizes correctly from `const { user } = useAuthUser()` on the client.
+ *
+ * @example
+ * ```tsx
+ * const { user } = await getAuthUser();
+ * ```
+ */
+export const getAuthUser = iGetAuthUser;
+/**
+ * Server Component counterpart of the client `useAuthUser()` hook, reached
+ * via `cloudflare-next-intl/useFirebaseAuthUser`'s `react-server` condition
+ * (resolved automatically — not meant to be imported directly by name).
+ * Prefer {@link getAuthUser} for an unconditional, editor-typed-as-async
+ * equivalent.
+ */
+export default async function useAuthUser() {
+    return getAuthUser();
+}

package/dist/src/general/general_functions.js

@@ -51,7 +51,10 @@ export function getTranslationsImpl(locale, messages, namespace, cacheKey) {
             }
         }
     }
-    // If after traversal, no base translations object was found.
+    // If after traversal, no base translations object was found. Unreachable:
+    // the loop above always either sets translationsBase or returns early on
+    // its final iteration, since namespaceParts always has length >= 1
+    // (''.split('.') yields ['']).
     if (!translationsBase) {
         return errorAndReturnFallback(`Translations for namespace "${namespace}" could not be found.`, cacheKeyValue, locale, namespace);
     }
@@ -66,6 +69,9 @@ export function getTranslationsImpl(locale, messages, namespace, cacheKey) {
         // Traverse the resolved translations base using the key parts.
         for (let i = 0; i < keyParts.length; i++) {
             const part = keyParts[i];
+            // Unreachable: currentTranslation only ever becomes a string via
+            // the reassignment below, which is guarded to only assign
+            // non-null objects.
             if (typeof currentTranslation === 'string') {
                 // Translation key path prematurely leads to a string.
                 console.warn(`Translation key "${key}" in namespace "${namespace}" leads to a string prematurely at "${part}" for locale "${locale}".`);
@@ -91,7 +97,10 @@ export function getTranslationsImpl(locale, messages, namespace, cacheKey) {
                 }
             }
         }
-        // If the loop completes and no string translation was found (e.g., key missing or not a string).
+        // If the loop completes and no string translation was found (e.g.,
+        // key missing or not a string). Unreachable: keyParts always has
+        // length >= 1 (''.split('.') yields ['']), and every branch above
+        // returns on the final iteration.
         console.warn(`Translation key "${key}" in namespace "${namespace}" is missing or not a string for locale "${locale}".`);
         return key; // Return the key as fallback
     };

package/dist/src/types/types.d.ts

@@ -120,6 +120,10 @@ export interface FirebaseAuthRoutingConfig {
     sessionCookieMaxAge?: number;
     /** Refresh-token cookie max-age in seconds. Defaults to 365 days (31536000). */
     refreshTokenCookieMaxAge?: number;
+    /** Session cookie name. Defaults to `'__fa_session__'`. Override this if your app already uses a different name for its Firebase ID-token cookie. */
+    sessionCookieName?: string;
+    /** Refresh-token cookie name. Defaults to `'__fa_refresh_token__'`. Override this if your app already uses a different name for its Firebase refresh-token cookie. */
+    refreshTokenCookieName?: string;
 }
 export interface CookieAttributes {
     /**

package/llms.txt

@@ -30,6 +30,7 @@ other subpath can be used.
 - `./firebaseAuthClientProvider` — `AuthUserProvider`: client auth-state provider (session cookie sync, auth-page redirects).
 - `./firebaseAuthServerProvider` — server-side equivalent provider (not used by the default auto-wiring path — see its doc comment).
 - `./useFirebaseAuthUser` — `useAuthUser()`; resolves to RSC or client implementation via the `react-server` condition. Client variant throws `"useAuthUser must be used within an AuthUserProvider"` if called outside one.
+- `./getFirebaseAuthUser` — `getAuthUser()`; unconditional server-only export of the same RSC implementation `useFirebaseAuthUser` resolves to via `react-server`. Use this when you want `await` to be visible from the type itself — TypeScript doesn't evaluate the `react-server` condition, so `useFirebaseAuthUser` always types as its client (sync) signature in editors regardless of call site.
 - `./firebaseAuthActions` — `createLoginAction`/`createSignUpAction`/`createForgotPasswordAction`: factories returning React `useActionState`-shaped form actions.
 - `./firebaseAuthMiddleware` — `updateSession`: session-cookie refresh, called automatically by `./middleware`'s default handler.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -104,6 +104,10 @@
         "import": "./dist/src/firebase_auth/client/use_auth_user.js"
       }
     },
+    "./getFirebaseAuthUser": {
+      "types": "./dist/src/firebase_auth/server/use_auth_user_server.d.ts",
+      "import": "./dist/src/firebase_auth/server/use_auth_user_server.js"
+    },
     "./firebaseAuthActions": {
       "types": "./dist/src/firebase_auth/client/auth_actions.d.ts",
       "import": "./dist/src/firebase_auth/client/auth_actions.js"
@@ -150,9 +154,9 @@
   "author": "Demian Ilnutskyi",
   "license": "MIT",
   "bugs": {
-    "url": "https://github.com/DemienIlnutskiy/cloudflare-next-intl/issues"
+    "url": "https://github.com/demian-ilnytskyi/cloudflare-next-intl/issues"
   },
-  "homepage": "https://github.com/DemienIlnutskiy/cloudflare-next-intl#readme",
+  "homepage": "https://github.com/demian-ilnytskyi/cloudflare-next-intl#readme",
   "peerDependencies": {
     "firebase": ">=10.0.0",
     "next": ">=12.0.0",