cloudflare-next-intl 0.3.2 → 0.3.3

package/dist/src/client/components/client_provider.d.ts

@@ -5,10 +5,12 @@ interface LocaleContextType {
     messages: TranslationObject;
 }
 export declare const LocaleContext: import("react").Context<LocaleContextType | undefined>;
-export default function LocationzationClientProvider({ language, messages, initialAuthUser, children }: {
+export default function LocationzationClientProvider({ language, messages, initialAuthUser, skipAuthProvider, children }: {
     language: string;
     messages: TranslationObject;
     initialAuthUser?: SerializedAuthUser | null;
+    /** Set when `firebaseAuth.autoWireClientProvider` is `false` — skips wrapping `children` in the client `AuthUserProvider` entirely. */
+    skipAuthProvider?: boolean;
     children: React.ReactNode;
 }): Component;
 export {};

package/dist/src/client/components/client_provider.js

@@ -5,7 +5,15 @@ import { createContext, useMemo } from "react";
 import dynamic from "next/dynamic";
 import config from "@intl-config";
 export const LocaleContext = createContext(undefined);
-export default function LocationzationClientProvider({ language, messages, initialAuthUser = null, children }) {
+// Hoisted to module scope — calling `dynamic()` inside the component body
+// creates a brand-new component identity every render, forcing React to
+// unmount/remount `AuthUserProvider` on every render instead of reusing the
+// existing instance. That remount re-subscribes `onIdTokenChanged`, which
+// Firebase immediately replays with the current user, triggering a state
+// update (and a `getIdToken(true)` refresh) that causes another render —
+// an infinite loop of session-cookie writes, one per render.
+const AuthUserProvider = dynamic(() => import("../../firebase_auth/client/auth_user_provider"));
+export default function LocationzationClientProvider({ language, messages, initialAuthUser = null, skipAuthProvider = false, children }) {
     setLocaleCache(language);
     setMessageForLocaleCache(language, messages);
     // `LocaleContext.Provider` stays the outermost element here — the
@@ -14,8 +22,7 @@ export default function LocationzationClientProvider({ language, messages, initi
     // sibling wrapping it, or those hooks would throw for running outside
     // the provider.
     let providedChildren = children;
-    if (config.firebaseAuth) {
-        const AuthUserProvider = dynamic(() => import("../../firebase_auth/client/auth_user_provider"));
+    if (config.firebaseAuth && !skipAuthProvider) {
         providedChildren = _jsx(AuthUserProvider, { initialUser: initialAuthUser, children: children });
     }
     const contextValue = useMemo(() => ({ language, messages }), [language, messages]);

package/dist/src/client/functions/get_cookie.js

@@ -10,8 +10,22 @@
  */
 export default function getCookie(name) {
     try {
-        const match = document.cookie.match(new RegExp(`(?:^|; )${name}=([^;]*)`));
-        return match ? decodeURIComponent(match[1]) : null;
+        const cookie = document.cookie;
+        const prefix = `${name}=`;
+        let start = -1;
+        if (cookie.startsWith(prefix)) {
+            start = prefix.length;
+        }
+        else {
+            const idx = cookie.indexOf(`; ${prefix}`);
+            if (idx !== -1)
+                start = idx + 2 + prefix.length;
+        }
+        if (start === -1)
+            return null;
+        const end = cookie.indexOf(';', start);
+        const value = end === -1 ? cookie.slice(start) : cookie.slice(start, end);
+        return decodeURIComponent(value);
     }
     catch (e) {
         console.error(`Get cookie on client side error: ${e}`);

package/dist/src/config/middleware.js

@@ -11,13 +11,16 @@ const defaultCookieOption = {
     secure: false, // Send cookie only over HTTPS in production
     sameSite: sameSite, // Protection against CSRF attacks. 'strict' or 'lax' are good choices.
 };
+let userAgentModule;
 async function getIsBotValue(userAgent) {
     if (userAgent === null)
         return false;
-    const { isBot } = await import('next/dist/server/web/spec-extension/user-agent');
+    if (!userAgentModule) {
+        userAgentModule = await import('next/dist/server/web/spec-extension/user-agent');
+    }
     // Unreachable: userAgent is already narrowed to non-null string above,
     // so the ?? '' fallback never triggers.
-    return isBot(userAgent ?? '');
+    return userAgentModule.isBot(userAgent ?? '');
 }
 const getIsBotValueCache = cache(getIsBotValue);
 export const localesSet = new Set(config.locales);

package/dist/src/firebase_auth/client/auth_actions.bench.js

@@ -11,6 +11,7 @@ const fa = {
 vi.mock('@intl-config', () => ({ default: { firebaseAuth: fa } }));
 vi.mock('./firebase_client', () => ({
     getFirebaseAuthClient: vi.fn(async () => ({ auth: {} })),
+    getFirebaseAuthModule: () => import('firebase/auth'),
 }));
 vi.mock('../error_messages/firebase_auth_error_helper', () => ({
     default: vi.fn(() => 'translated error'),

package/dist/src/firebase_auth/client/auth_actions.js

@@ -1,7 +1,7 @@
 'use client';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { getFirebaseAuthClient } from './firebase_client';
+import { getFirebaseAuthClient, getFirebaseAuthModule } from './firebase_client';
 import firebaseAuthErrorMessage from '../error_messages/firebase_auth_error_helper';
 function readCredentials(formData) {
     return {
@@ -27,7 +27,7 @@ export function createLoginAction(locale, messages) {
     return async function loginAction(_prevState, formData) {
         requireFirebaseAuthConfig(config.firebaseAuth);
         const { auth } = await getFirebaseAuthClient();
-        const { signInWithEmailAndPassword } = await import('firebase/auth');
+        const { signInWithEmailAndPassword } = await getFirebaseAuthModule();
         const { email, password } = readCredentials(formData);
         try {
             await signInWithEmailAndPassword(auth, email, password);
@@ -57,7 +57,7 @@ export function createSignUpAction(locale, messages) {
     return async function signUpAction(_prevState, formData) {
         requireFirebaseAuthConfig(config.firebaseAuth);
         const { auth } = await getFirebaseAuthClient();
-        const { createUserWithEmailAndPassword } = await import('firebase/auth');
+        const { createUserWithEmailAndPassword } = await getFirebaseAuthModule();
         const { email, password } = readCredentials(formData);
         const confirmPassword = (formData.get('confirmPassword')?.toString() ?? '').trim();
         if (messages.mismatch && password !== confirmPassword) {
@@ -89,7 +89,7 @@ export function createForgotPasswordAction(locale, messages) {
     return async function forgotPasswordAction(_prevState, formData) {
         requireFirebaseAuthConfig(config.firebaseAuth);
         const { auth } = await getFirebaseAuthClient();
-        const { sendPasswordResetEmail } = await import('firebase/auth');
+        const { sendPasswordResetEmail } = await getFirebaseAuthModule();
         const email = (formData.get('email')?.toString() ?? '').trim();
         try {
             await sendPasswordResetEmail(auth, email);

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -5,18 +5,19 @@ import { useRouter } from 'next/navigation';
 import usePathname from '../../client/hooks/use_path_name';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { getFirebaseAuthClient } from './firebase_client';
+import { getFirebaseAuthClient, getFirebaseAuthModule } from './firebase_client';
 import { setAuthUserCache } from './auth_user_cache';
 import { defaultSessionCookieName } from '../middleware/update_session';
+import setCookie from '../../client/functions/set_cookie';
 // `null` default (instead of a `{ loading: true, ... }` stand-in) lets
 // `useAuthUser` distinguish "not wrapped in AuthUserProvider" (throw) from
 // "wrapped, still loading" (`loading: true`).
 export const AuthUserContext = createContext(null);
 function writeSessionCookie(sessionCookieName, idToken, maxAge) {
-    document.cookie = `${sessionCookieName}=${idToken}; path=/; max-age=${maxAge}`;
+    setCookie({ name: sessionCookieName, value: idToken, maxAge });
 }
 function clearSessionCookie(sessionCookieName) {
-    document.cookie = `${sessionCookieName}=; path=/; max-age=0`;
+    setCookie({ name: sessionCookieName, value: '', maxAge: 0 });
 }
 /**
  * Client-side auth-state provider for `firebase_auth`. Wrap your root layout
@@ -49,7 +50,15 @@ export default function AuthUserProvider({ initialUser = null, children }) {
         user: initialUser,
         loading: initialUser === null,
     });
+    // The signed-in state the last successful cookie write left behind, so a
+    // plain token refresh (same state) does not trigger a needless re-render.
     const syncedSignedIn = useRef(undefined);
+    // Consecutive `onIdTokenChanged(null)` callbacks since the last confirmed
+    // user. A single null here can be a transient client-SDK hiccup (e.g. its
+    // token-refresh scheduling misbehaving under local clock skew) rather
+    // than a real sign-out — the server already proved the session valid via
+    // `initialUser`, so redirecting on the very first null caused a
+    // login-then-bounce-home flash whenever the two disagreed.
     const consecutiveNulls = useRef(0);
     const [confirmedSignedOut, setConfirmedSignedOut] = useState(initialUser === null);
     useEffect(() => {
@@ -71,7 +80,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
         getFirebaseAuthClient().then(async ({ auth }) => {
             if (cancelled)
                 return;
-            const { onIdTokenChanged } = await import('firebase/auth');
+            const { onIdTokenChanged } = await getFirebaseAuthModule();
             unsubscribe = onIdTokenChanged(auth, async (user) => {
                 const isSignedIn = !!user;
                 const previous = syncedSignedIn.current;
@@ -119,24 +128,29 @@ export default function AuthUserProvider({ initialUser = null, children }) {
         const user = auth.currentUser;
         if (!user)
             return;
-        const { reload } = await import('firebase/auth');
-        await reload(user);
-        writeSessionCookie(sessionCookieName, await user.getIdToken(true), maxAge);
-        setAuthUserCache(user);
-        setState({ user, loading: false });
-    }, [maxAge, sessionCookieName]);
+        try {
+            const { reload } = await getFirebaseAuthModule();
+            await reload(user);
+            writeSessionCookie(sessionCookieName, await user.getIdToken(true), maxAge);
+            setAuthUserCache(user);
+            setState({ user, loading: false });
+        }
+        catch (e) {
+            console.error('AuthUserProvider: reloadUser failed', e);
+        }
+    }, []);
     const sendVerificationEmail = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;
         if (!user)
             return;
-        const { sendEmailVerification } = await import('firebase/auth');
+        const { sendEmailVerification } = await getFirebaseAuthModule();
         await sendEmailVerification(user);
     }, []);
     const logout = useCallback(async () => {
         try {
             const { auth } = await getFirebaseAuthClient();
-            const { signOut } = await import('firebase/auth');
+            const { signOut } = await getFirebaseAuthModule();
             await signOut(auth);
         }
         finally {

package/dist/src/firebase_auth/client/firebase_client.d.ts

@@ -16,3 +16,5 @@ export declare function getFirebaseAuthClientSync(): {
     app: FirebaseApp;
     auth: Auth;
 } | undefined;
+/** Memoized `import('firebase/auth')` — see {@link getFirebaseAuthClient} for why this is worth caching. */
+export declare function getFirebaseAuthModule(): Promise<typeof import('firebase/auth')>;

package/dist/src/firebase_auth/client/firebase_client.js

@@ -38,3 +38,11 @@ export async function getFirebaseAuthClient() {
 export function getFirebaseAuthClientSync() {
     return cached;
 }
+let cachedAuthModule;
+/** Memoized `import('firebase/auth')` — see {@link getFirebaseAuthClient} for why this is worth caching. */
+export function getFirebaseAuthModule() {
+    if (!cachedAuthModule) {
+        cachedAuthModule = import('firebase/auth');
+    }
+    return cachedAuthModule;
+}

package/dist/src/firebase_auth/error_messages/firebase_auth_error_helper.js

@@ -1,5 +1,5 @@
 import { getTranslationsImpl } from '../../general/general_functions';
-import { getMessageCache } from '../../general/cache_variables';
+import { getMessageCache, getTranslationCache } from '../../general/cache_variables';
 import { DEFAULT_MESSAGES_EN } from './default_messages.en';
 const ERROR_CODE_TO_KEY = {
     'auth/invalid-email': 'invalidEmail',
@@ -29,7 +29,8 @@ export default function firebaseAuthErrorMessage(locale, error) {
     const messages = getMessageCache(locale);
     if (messages) {
         try {
-            const t = getTranslationsImpl(locale, messages, 'firebaseAuth');
+            const cacheKey = `${locale}-firebaseAuth`;
+            const t = getTranslationCache(cacheKey) ?? getTranslationsImpl(locale, messages, 'firebaseAuth', cacheKey);
             const translated = t(key);
             if (typeof translated === 'string' && translated !== key)
                 return translated;

package/dist/src/firebase_auth/middleware/update_session.js

@@ -232,11 +232,7 @@ export default async function updateSession(request, baseResponse, locale) {
     }
     if (refreshedToken) {
         response.cookies.set(sessionCookieName, refreshedToken.idToken, {
-            // Not httpOnly: the client provider also writes this cookie
-            // directly (via document.cookie) after `getIdToken(true)`, so it
-            // must stay client-writable — a JS cookie write can never carry
-            // httpOnly anyway, and two same-name cookies with conflicting
-            // flags is what actually caused ambiguity here.
+            httpOnly: true,
             secure: request.nextUrl.protocol === 'https',
             sameSite: 'lax',
             path: '/',

package/dist/src/firebase_auth/server/auth_user_server_provider.d.ts

@@ -3,11 +3,16 @@ import type { SerializedAuthUser } from '../types';
  * Resolves the signed-in user from the session cookie and performs the
  * authoritative pre-render redirect (guest→`redirectAuthPath`, signed-in→
  * `homePath` on auth pages) — middleware only checks cookie *presence*, not
- * validity. Plain async function, not a component: callers decide
- * where/how to use the resolved user relative to their own component tree
- * (see `AuthUserServerProvider` below for the simple case, and
- * `IntlProvider`'s auto-wiring for the case where ordering against
- * `LocaleContext` matters).
+ * validity; a forged, expired, or otherwise invalid-but-present cookie
+ * sails through it. Only this function's token validation
+ * (`getAuthenticatedAppForUser`) catches that, so this redirect must happen
+ * here, before any HTML is sent — relying solely on the client
+ * `AuthUserProvider` effect to redirect afterwards produces a visible
+ * flash (page renders signed-in, then bounces). Plain async function, not
+ * a component: callers decide where/how to use the resolved user relative
+ * to their own component tree (see `AuthUserServerProvider` below for the
+ * simple case, and `IntlProvider`'s auto-wiring for the case where ordering
+ * against `LocaleContext` matters).
  */
 export declare function resolveAuthUserAndRedirect(): Promise<SerializedAuthUser | null>;
 /**

package/dist/src/firebase_auth/server/auth_user_server_provider.js

@@ -10,11 +10,16 @@ const AuthUserProvider = dynamic(() => import('../client/auth_user_provider'));
  * Resolves the signed-in user from the session cookie and performs the
  * authoritative pre-render redirect (guest→`redirectAuthPath`, signed-in→
  * `homePath` on auth pages) — middleware only checks cookie *presence*, not
- * validity. Plain async function, not a component: callers decide
- * where/how to use the resolved user relative to their own component tree
- * (see `AuthUserServerProvider` below for the simple case, and
- * `IntlProvider`'s auto-wiring for the case where ordering against
- * `LocaleContext` matters).
+ * validity; a forged, expired, or otherwise invalid-but-present cookie
+ * sails through it. Only this function's token validation
+ * (`getAuthenticatedAppForUser`) catches that, so this redirect must happen
+ * here, before any HTML is sent — relying solely on the client
+ * `AuthUserProvider` effect to redirect afterwards produces a visible
+ * flash (page renders signed-in, then bounces). Plain async function, not
+ * a component: callers decide where/how to use the resolved user relative
+ * to their own component tree (see `AuthUserServerProvider` below for the
+ * simple case, and `IntlProvider`'s auto-wiring for the case where ordering
+ * against `LocaleContext` matters).
  */
 export async function resolveAuthUserAndRedirect() {
     const fa = config.firebaseAuth;

package/dist/src/firebase_auth/server/firebase_server.js

@@ -4,6 +4,8 @@ import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
 import { defaultSessionCookieName } from '../middleware/update_session';
 let baseApp;
+let firebaseAppModule;
+let firebaseAuthModule;
 /**
  * Resolves the signed-in user on the server from the session cookie.
  * `initializeServerApp` validates the token with the Auth service, so a
@@ -22,8 +24,12 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
         return { firebaseServerApp: null, currentUser: null };
     }
     try {
-        const { initializeApp, initializeServerApp } = await import('firebase/app');
-        const { getAuth } = await import('firebase/auth');
+        if (!firebaseAppModule)
+            firebaseAppModule = await import('firebase/app');
+        if (!firebaseAuthModule)
+            firebaseAuthModule = await import('firebase/auth');
+        const { initializeApp, initializeServerApp } = firebaseAppModule;
+        const { getAuth } = firebaseAuthModule;
         const firebaseConfig = {
             apiKey: fa.apiKey,
             authDomain: fa.authDomain,

package/dist/src/server/components/server_provider.js

@@ -5,6 +5,7 @@ import dynamic from "next/dynamic";
 import { localesSet } from "../../config/middleware";
 import config from "../../config/intl_config";
 const LocationzationClientProvider = dynamic(() => import("../../client/components/client_provider"));
+let authUserServerProviderModule;
 /**
  * Server component that provides locale/messages context to the rest of the
  * tree. Exported publicly as `IntlProvider` from `cloudflare-next-intl/serverProvider`.
@@ -47,9 +48,12 @@ export default async function LocationzationProvider({ language, messages, child
     }
     const messagesValue = messages ?? await getMessage(language);
     let initialAuthUser = null;
-    if (config.firebaseAuth) {
-        const { resolveAuthUserAndRedirect } = await import("../../firebase_auth/server/auth_user_server_provider");
-        initialAuthUser = await resolveAuthUserAndRedirect();
+    const autoWireClientProvider = config.firebaseAuth?.autoWireClientProvider !== false;
+    if (config.firebaseAuth && autoWireClientProvider) {
+        if (!authUserServerProviderModule) {
+            authUserServerProviderModule = await import("../../firebase_auth/server/auth_user_server_provider");
+        }
+        initialAuthUser = await authUserServerProviderModule.resolveAuthUserAndRedirect();
     }
-    return _jsx(LocationzationClientProvider, { language: language, messages: messagesValue, initialAuthUser: initialAuthUser, children: children });
+    return _jsx(LocationzationClientProvider, { language: language, messages: messagesValue, initialAuthUser: initialAuthUser, skipAuthProvider: !autoWireClientProvider, children: children });
 }

package/dist/src/server/functions/server.js

@@ -5,6 +5,7 @@ import { getLocaleCache, getMessageCache, getTranslationCache, setLocaleCache, s
 import { cache } from "react";
 import { localesSet } from "../../config/middleware";
 const isDev = process.env.NODE_ENV === 'development';
+let nextHeadersModule;
 /**
  * Loads and caches messages for a specific locale using dynamic import.
  * Prevents redundant file loads and handles import errors gracefully.
@@ -104,8 +105,10 @@ async function iGetLocale() {
         // Dynamically import "next/headers" only when needed.
         // This ensures it's loaded only on the server where cookies are accessible,
         // preventing client-side import errors and reducing bundle size.
-        const { cookies } = await import("next/headers");
-        const cookieStore = await cookies();
+        if (!nextHeadersModule) {
+            nextHeadersModule = await import("next/headers");
+        }
+        const cookieStore = await nextHeadersModule.cookies();
         const localeCookie = cookieStore.get(localeCookieName);
         // Use the cookie value or fall back to the default locale.
         const localeValue = localeCookie?.value ?? config.defaultLocale;

package/dist/src/types/types.d.ts

@@ -92,6 +92,17 @@ export interface FirebaseAuthRoutingConfig {
      * middleware redirect logic yourself instead.
      */
     middlewareEnabled?: boolean;
+    /**
+     * Whether `IntlProvider` should automatically wrap your app in the
+     * client `AuthUserProvider` and call `resolveAuthUser` server-side.
+     * Defaults to `true`. Set `false` if you drive auth entirely from your
+     * own middleware (like `middlewareEnabled: false`'s manual-override
+     * case, but for the client/RSC layer) and don't want this package
+     * rendering any auth-related React tree on top of it — e.g. if you
+     * only use `intlMiddleware`'s built-in session-refresh/redirect logic
+     * and have no use for `useAuthUser()`/`AuthUserProvider` at all.
+     */
+    autoWireClientProvider?: boolean;
     /** Firebase project's Web API key (`NEXT_PUBLIC_FIREBASE_API_KEY` equivalent). */
     apiKey: string;
     /** Firebase project's auth domain, e.g. "my-app.firebaseapp.com". */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",