cloudflare-next-intl 0.3.1 → 0.3.2

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -7,15 +7,15 @@ import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
 import { getFirebaseAuthClient } from './firebase_client';
 import { setAuthUserCache } from './auth_user_cache';
-import { sessionCookieName } from '../middleware/update_session';
+import { defaultSessionCookieName } from '../middleware/update_session';
 // `null` default (instead of a `{ loading: true, ... }` stand-in) lets
 // `useAuthUser` distinguish "not wrapped in AuthUserProvider" (throw) from
 // "wrapped, still loading" (`loading: true`).
 export const AuthUserContext = createContext(null);
-function writeSessionCookie(idToken, maxAge) {
+function writeSessionCookie(sessionCookieName, idToken, maxAge) {
     document.cookie = `${sessionCookieName}=${idToken}; path=/; max-age=${maxAge}`;
 }
-function clearSessionCookie() {
+function clearSessionCookie(sessionCookieName) {
     document.cookie = `${sessionCookieName}=; path=/; max-age=0`;
 }
 /**
@@ -44,6 +44,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
     const isAuthPage = fa.isAuthPath(pathname);
     const isWhiteListed = fa.whiteListPaths?.includes(pathname) ?? false;
     const maxAge = fa.sessionCookieMaxAge ?? 60 * 60 * 24 * 5;
+    const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const [state, setState] = useState({
         user: initialUser,
         loading: initialUser === null,
@@ -76,10 +77,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
                 const previous = syncedSignedIn.current;
                 try {
                     if (user) {
-                        writeSessionCookie(await user.getIdToken(true), maxAge);
+                        writeSessionCookie(sessionCookieName, await user.getIdToken(true), maxAge);
                     }
                     else if (previous) {
-                        clearSessionCookie();
+                        clearSessionCookie(sessionCookieName);
                     }
                 }
                 catch (e) {
@@ -112,7 +113,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             unsubscribe?.();
         };
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [router, isAuthPage, maxAge]);
+    }, [router, isAuthPage, maxAge, sessionCookieName]);
     const reloadUser = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;
@@ -120,10 +121,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             return;
         const { reload } = await import('firebase/auth');
         await reload(user);
-        writeSessionCookie(await user.getIdToken(true), maxAge);
+        writeSessionCookie(sessionCookieName, await user.getIdToken(true), maxAge);
         setAuthUserCache(user);
         setState({ user, loading: false });
-    }, [maxAge]);
+    }, [maxAge, sessionCookieName]);
     const sendVerificationEmail = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;
@@ -139,10 +140,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             await signOut(auth);
         }
         finally {
-            clearSessionCookie();
+            clearSessionCookie(sessionCookieName);
             window.location.assign(fa.redirectAuthPath);
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [fa.redirectAuthPath]);
+    }, [fa.redirectAuthPath, sessionCookieName]);
     return _jsx(AuthUserContext.Provider, { value: { ...state, reloadUser, sendVerificationEmail, logout }, children: children });
 }

package/dist/src/firebase_auth/index.d.ts

@@ -3,7 +3,7 @@ export { default as FirebaseAuthServerProvider } from './server/auth_user_server
 export { default as useFirebaseAuthUserClient } from './client/use_auth_user';
 export { default as useFirebaseAuthUserServer } from './server/use_auth_user_server';
 export { createLoginAction, createSignUpAction, createForgotPasswordAction } from './client/auth_actions';
-export { default as updateFirebaseAuthSession, sessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
+export { default as updateFirebaseAuthSession, defaultSessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
 export { getFirebaseAuthClient } from './client/firebase_client';
 export type { SerializedAuthUser, AuthFormState, AuthActionMessages, AuthUser } from './types';
 export type { FirebaseAuthRoutingConfig } from '../types/types';

package/dist/src/firebase_auth/index.js

@@ -9,5 +9,5 @@ export { default as FirebaseAuthServerProvider } from './server/auth_user_server
 export { default as useFirebaseAuthUserClient } from './client/use_auth_user';
 export { default as useFirebaseAuthUserServer } from './server/use_auth_user_server';
 export { createLoginAction, createSignUpAction, createForgotPasswordAction } from './client/auth_actions';
-export { default as updateFirebaseAuthSession, sessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
+export { default as updateFirebaseAuthSession, defaultSessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
 export { getFirebaseAuthClient } from './client/firebase_client';

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -1,6 +1,6 @@
 import { NextResponse, type NextRequest } from 'next/server';
-export declare const sessionCookieName = "__fa_session__";
-export declare const refreshTokenCookieName = "__fa_refresh_token__";
+export declare const defaultSessionCookieName = "__fa_session__";
+export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`

package/dist/src/firebase_auth/middleware/update_session.js

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server';
 import config from '@intl-config';
-export const sessionCookieName = '__fa_session__';
-export const refreshTokenCookieName = '__fa_refresh_token__';
+export const defaultSessionCookieName = '__fa_session__';
+export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
 const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
 // Refresh slightly before the real expiry — treating a token as expired
@@ -77,6 +77,21 @@ async function setCachedRefresh(refreshToken, refreshed) {
         // refresh result already returned to the caller.
     }
 }
+// Google's Secure Token API returns 400 with one of these error codes when
+// the refresh token itself is the problem (expired/revoked/malformed/the
+// associated user no longer exists) — this is the ONLY case that should
+// sign the user out. Any other failure (5xx, network error, timeout,
+// unrecognized 400 body) is transient/unexpected and must NOT clear the
+// refresh-token cookie or redirect to login: doing so previously caused a
+// signed-in user with a perfectly valid refresh token to flash to /login
+// and bounce back home the moment their ID token merely expired and a
+// single refresh attempt happened to fail.
+const INVALID_REFRESH_TOKEN_ERRORS = new Set([
+    'INVALID_REFRESH_TOKEN',
+    'TOKEN_EXPIRED',
+    'USER_DISABLED',
+    'USER_NOT_FOUND',
+]);
 /**
  * Mints a fresh ID token from a stored refresh token via Google's Secure
  * Token API. No `firebase/auth` import: this runs in the Edge middleware
@@ -86,15 +101,28 @@ async function setCachedRefresh(refreshToken, refreshed) {
 async function refreshIdToken(apiKey, refreshToken) {
     const cached = await getCachedRefresh(refreshToken);
     if (cached)
-        return cached;
+        return { status: 'refreshed', ...cached };
     try {
         const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${apiKey}`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`,
         });
-        if (!res.ok)
-            return null;
+        if (!res.ok) {
+            if (res.status === 400) {
+                try {
+                    const errorBody = await res.json();
+                    if (errorBody.error?.message && INVALID_REFRESH_TOKEN_ERRORS.has(errorBody.error.message)) {
+                        return { status: 'invalid' };
+                    }
+                }
+                catch {
+                    // Unparseable body on a 400 — treat as transient rather
+                    // than assuming the token is invalid.
+                }
+            }
+            return { status: 'transient-failure' };
+        }
         const data = await res.json();
         const refreshed = { idToken: data.id_token, refreshToken: data.refresh_token };
         // Not awaited: the cache write is a pure optimization for FUTURE
@@ -103,10 +131,10 @@ async function refreshIdToken(apiKey, refreshToken) {
         // setCachedRefresh already swallows its own errors, so a rejected
         // write here would otherwise surface as an unhandled rejection.
         void setCachedRefresh(refreshToken, refreshed);
-        return refreshed;
+        return { status: 'refreshed', ...refreshed };
     }
     catch {
-        return null;
+        return { status: 'transient-failure' };
     }
 }
 /**
@@ -131,6 +159,8 @@ export default async function updateSession(request, baseResponse, locale) {
     const fa = config.firebaseAuth;
     if (!fa || fa.middlewareEnabled === false)
         return baseResponse;
+    const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
+    const refreshTokenCookieName = fa.refreshTokenCookieName ?? defaultRefreshTokenCookieName;
     const rawPath = request.nextUrl.pathname;
     const requestPrefix = `/${locale}`;
     const path = rawPath === requestPrefix || rawPath.startsWith(`${requestPrefix}/`)
@@ -149,19 +179,30 @@ export default async function updateSession(request, baseResponse, locale) {
     let token = request.cookies.get(sessionCookieName)?.value;
     let refreshedToken = null;
     let clearInvalidSession = false;
+    // A transient refresh failure (network blip, Google 5xx, timeout) means
+    // "couldn't confirm the session right now" — NOT "this user is signed
+    // out". Redirecting to login in that case is the bug this guards
+    // against: it signs a still-valid user out for a one-off hiccup, and
+    // the client SDK (which still has a live session independent of these
+    // cookies) then bounces them straight back, producing a login flash.
+    let refreshWasTransientFailure = false;
     if (token && isJwtExpired(token)) {
         token = undefined;
     }
     if (!token) {
         const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
         if (refreshToken) {
-            refreshedToken = await refreshIdToken(fa.apiKey, refreshToken);
-            if (refreshedToken) {
+            const result = await refreshIdToken(fa.apiKey, refreshToken);
+            if (result.status === 'refreshed') {
+                refreshedToken = { idToken: result.idToken, refreshToken: result.refreshToken };
                 token = refreshedToken.idToken;
             }
-            else {
+            else if (result.status === 'invalid') {
                 clearInvalidSession = true;
             }
+            else {
+                refreshWasTransientFailure = true;
+            }
         }
         else if (request.cookies.get(sessionCookieName)) {
             clearInvalidSession = true;
@@ -169,7 +210,14 @@ export default async function updateSession(request, baseResponse, locale) {
     }
     const hasSession = !!token;
     let response;
-    if (!hasSession) {
+    if (refreshWasTransientFailure) {
+        // Couldn't confirm the session either way — pass through without
+        // forcing a redirect in either direction. The next request (or the
+        // client SDK's own session, independent of these cookies) gets a
+        // chance to resolve this correctly instead of guessing wrong.
+        response = baseResponse;
+    }
+    else if (!hasSession) {
         response = isAuthPage ? baseResponse : buildRedirect(baseResponse, localeUrl(fa.redirectAuthPath));
     }
     else if (isAuthPage) {

package/dist/src/firebase_auth/server/firebase_server.js

@@ -2,7 +2,7 @@ import { cookies } from 'next/headers';
 import { cache } from 'react';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { sessionCookieName } from '../middleware/update_session';
+import { defaultSessionCookieName } from '../middleware/update_session';
 let baseApp;
 /**
  * Resolves the signed-in user on the server from the session cookie.
@@ -16,6 +16,7 @@ let baseApp;
 export const getAuthenticatedAppForUser = cache(async function getAuthenticatedAppForUser() {
     const fa = config.firebaseAuth;
     requireFirebaseAuthConfig(fa);
+    const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const authIdToken = (await cookies()).get(sessionCookieName)?.value;
     if (!authIdToken) {
         return { firebaseServerApp: null, currentUser: null };

package/dist/src/types/types.d.ts

@@ -120,6 +120,10 @@ export interface FirebaseAuthRoutingConfig {
     sessionCookieMaxAge?: number;
     /** Refresh-token cookie max-age in seconds. Defaults to 365 days (31536000). */
     refreshTokenCookieMaxAge?: number;
+    /** Session cookie name. Defaults to `'__fa_session__'`. Override this if your app already uses a different name for its Firebase ID-token cookie. */
+    sessionCookieName?: string;
+    /** Refresh-token cookie name. Defaults to `'__fa_refresh_token__'`. Override this if your app already uses a different name for its Firebase refresh-token cookie. */
+    refreshTokenCookieName?: string;
 }
 export interface CookieAttributes {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",