cloudflare-next-intl 0.6.11 → 0.6.13

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -110,15 +110,32 @@ export default function AuthUserProvider({ initialUser = null, children }) {
     const [confirmedSignedOut, setConfirmedSignedOut] = useState(initialUser === null);
     useEffect(() => {
         const { user, loading } = state;
-        if (loading || isAuthPage || isWhiteListed)
+        if (loading || isWhiteListed)
             return;
         if (!user) {
-            if (confirmedSignedOut)
+            // Signed-out on an auth page is where they're supposed to be —
+            // only bounce a signed-out user away from a NON-auth page.
+            if (!isAuthPage && confirmedSignedOut)
                 router.replace(fa.redirectAuthPath);
         }
         else if (fa.verifyEmailPath && !user.emailVerified && pathname !== fa.verifyEmailPath) {
+            // Checked before the auth-page redirect below (mirrors
+            // `update_session.ts`'s same ordering): an unverified signed-in
+            // user must land on verifyEmailPath even if they navigated to
+            // an auth page like /login — homePath isn't reachable yet either.
             router.replace(fa.verifyEmailPath);
         }
+        else if (isAuthPage || (fa.verifyEmailPath && user.emailVerified && pathname === fa.verifyEmailPath)) {
+            // Mirrors the middleware's own signed-in-on-auth-page redirect
+            // (`update_session.ts`'s `isAuthPage` branch) — needed here too
+            // because a client-side navigation (e.g. a `<Link>`) to an auth
+            // page never re-runs the middleware, so without this the user
+            // would land on e.g. `/login` while already signed in and stay
+            // there until a hard refresh. A verified user reaching
+            // verifyEmailPath itself gets the same "go home" treatment —
+            // they're done here, same as the auth-page case.
+            router.replace(fa.homePath);
+        }
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [state, pathname, isAuthPage, isWhiteListed, confirmedSignedOut]);
     useEffect(() => {

package/dist/src/firebase_auth/middleware/update_session.js

@@ -270,12 +270,30 @@ export default async function updateSession(request, baseResponse, locale) {
     else if (!hasSession || clearInvalidSession) {
         response = isAuthPage ? baseResponse : buildRedirect(baseResponse, localeUrl(fa.redirectAuthPath));
     }
-    else if (isAuthPage) {
-        response = buildRedirect(baseResponse, localeUrl(fa.homePath));
-    }
     else if (unverifiedEmail) {
+        // Checked before the auth-page redirect: an unverified signed-in
+        // user must land on verifyEmailPath even if they navigated to an
+        // auth page like /login — homePath is not a state they're allowed
+        // to reach yet either.
         response = buildRedirect(baseResponse, localeUrl(fa.verifyEmailPath));
     }
+    else if (isAuthPage || (isVerifyEmailPage && decodeJwtPayload(token)?.email_verified === true)) {
+        // A verified user has no reason to be on verifyEmailPath either —
+        // same "you're done here, go home" treatment as an auth page.
+        // `unverifiedEmail` can't be reused here: its own computation
+        // deliberately skips verifyEmailPath (so it never redirects AWAY
+        // from that page for an unverified user), so it's always `false`
+        // while already on it regardless of actual verification status —
+        // checking the claim again directly is what tells verified and
+        // unverified apart on this specific page. Requires an EXPLICIT
+        // `true` (not just "not false") — a missing/undefined claim must
+        // NOT redirect home here, since `AuthUserProvider`'s client-side
+        // effect treats that same user as unverified via the live SDK's
+        // boolean `user.emailVerified`. The two disagreeing caused an
+        // infinite client<->server redirect loop on this exact page when a
+        // token's claim was merely absent rather than `false`.
+        response = buildRedirect(baseResponse, localeUrl(fa.homePath));
+    }
     else {
         response = baseResponse;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.11",
+  "version": "0.6.13",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",