cloudflare-next-intl 0.6.13 → 0.6.14

package/dist/src/config/init_config.d.ts

@@ -2,9 +2,14 @@ import type { LocalePrefixMode, Locales, RoutingConfig } from '../types/types';
 /**
  * Defines and type-checks your app's i18n routing config.
  *
- * Identity function at runtime — it exists purely so TypeScript infers
- * `AppLocales`/`AppLocalePrefixMode` from the literal config object you pass
- * in, giving you autocomplete/type errors on `locale` params elsewhere.
+ * Mostly an identity function at runtime — it exists primarily so
+ * TypeScript infers `AppLocales`/`AppLocalePrefixMode` from the literal
+ * config object you pass in, giving you autocomplete/type errors on
+ * `locale` params elsewhere. The one runtime behavior: if `firebaseAuth` is
+ * set, `redirectAuthPath`/`homePath`/`verifyEmailPath` are auto-corrected to
+ * start with `/` (with a console warning) if you forgot it — see
+ * `normalizeFirebaseAuthPaths` above for why that specific typo is worth
+ * guarding against.
  *
  * Export the result from the file referenced by `@intl-config` (see your
  * `next.config`), e.g.:

package/dist/src/config/init_config.js

@@ -1,9 +1,45 @@
+// Every path this package compares against `request.nextUrl.pathname`
+// (always `/`-prefixed) must itself start with `/` — a missing leading
+// slash means `path === fa.verifyEmailPath` (and the same check for
+// `redirectAuthPath`/`homePath`) never matches, silently disabling that
+// redirect/exemption entirely (e.g. an infinite redirect loop on
+// `verifyEmailPath` because the page is never recognized as itself).
+// Auto-prepending `/` here fixes the common typo (`'login'` instead of
+// `'/login'`) at the source, for every consumer, instead of requiring each
+// one to notice and fix it themselves.
+const FIREBASE_AUTH_PATH_FIELDS = ['redirectAuthPath', 'homePath', 'verifyEmailPath'];
+function normalizeFirebaseAuthPaths(config) {
+    const fa = config.firebaseAuth;
+    if (!fa)
+        return config;
+    let changed = false;
+    const normalizedFa = { ...fa };
+    for (const field of FIREBASE_AUTH_PATH_FIELDS) {
+        const value = normalizedFa[field];
+        if (typeof value === 'string' && value !== '' && !value.startsWith('/')) {
+            console.warn(`[cloudflare-next-intl] firebaseAuth.${field} ("${value}") is missing its leading "/" — ` +
+                `auto-corrected to "/${value}". Paths are compared against the URL pathname (always ` +
+                `"/"-prefixed), so without this fix the check would never match and silently disable the ` +
+                `redirect/exemption for this path. Fix your config to avoid this warning.`);
+            normalizedFa[field] = `/${value}`;
+            changed = true;
+        }
+    }
+    if (!changed)
+        return config;
+    return { ...config, firebaseAuth: normalizedFa };
+}
 /**
  * Defines and type-checks your app's i18n routing config.
  *
- * Identity function at runtime — it exists purely so TypeScript infers
- * `AppLocales`/`AppLocalePrefixMode` from the literal config object you pass
- * in, giving you autocomplete/type errors on `locale` params elsewhere.
+ * Mostly an identity function at runtime — it exists primarily so
+ * TypeScript infers `AppLocales`/`AppLocalePrefixMode` from the literal
+ * config object you pass in, giving you autocomplete/type errors on
+ * `locale` params elsewhere. The one runtime behavior: if `firebaseAuth` is
+ * set, `redirectAuthPath`/`homePath`/`verifyEmailPath` are auto-corrected to
+ * start with `/` (with a console warning) if you forgot it — see
+ * `normalizeFirebaseAuthPaths` above for why that specific typo is worth
+ * guarding against.
  *
  * Export the result from the file referenced by `@intl-config` (see your
  * `next.config`), e.g.:
@@ -15,5 +51,5 @@
  * ```
  */
 export function setIntlConfig(config) {
-    return config;
+    return normalizeFirebaseAuthPaths(config);
 }

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -108,6 +108,19 @@ export default function AuthUserProvider({ initialUser = null, children }) {
     // login-then-bounce-home flash whenever the two disagreed.
     const consecutiveNulls = useRef(0);
     const [confirmedSignedOut, setConfirmedSignedOut] = useState(initialUser === null);
+    // Whether `onSignIn`/`onSignOut` have already fired for the CURRENT
+    // signed-in/signed-out state — both seeded from `initialUser` so a
+    // callback observing the SAME state `initialUser` already established
+    // (server-resolved, not a fresh client-side transition) does not refire
+    // it. Reset on the opposite transition so the next real occurrence of
+    // this state fires again.
+    const signInCallbackFired = useRef(initialUser !== null);
+    const signOutCallbackFired = useRef(initialUser === null);
+    // Tracks the last-observed `emailVerified` value so `onEmailVerified`
+    // fires exactly once on the false→true edge, not on every later
+    // observation of an already-verified user (both `onIdTokenChanged` and
+    // `reloadUser` can be the first to observe the transition).
+    const emailVerifiedRef = useRef(initialUser?.emailVerified ?? false);
     useEffect(() => {
         const { user, loading } = state;
         if (loading || isWhiteListed)
@@ -168,11 +181,42 @@ export default function AuthUserProvider({ initialUser = null, children }) {
                 if (user) {
                     consecutiveNulls.current = 0;
                     setConfirmedSignedOut(false);
+                    signOutCallbackFired.current = false;
+                    if (!signInCallbackFired.current) {
+                        signInCallbackFired.current = true;
+                        try {
+                            await fa.onSignIn?.(user);
+                        }
+                        catch (e) {
+                            console.error('AuthUserProvider: onSignIn callback failed', e);
+                        }
+                    }
+                    if (!emailVerifiedRef.current && user.emailVerified) {
+                        emailVerifiedRef.current = true;
+                        try {
+                            await fa.onEmailVerified?.(user);
+                        }
+                        catch (e) {
+                            console.error('AuthUserProvider: onEmailVerified callback failed', e);
+                        }
+                    }
+                    else {
+                        emailVerifiedRef.current = user.emailVerified;
+                    }
                 }
                 else {
                     consecutiveNulls.current += 1;
-                    if (consecutiveNulls.current >= 2)
+                    signInCallbackFired.current = false;
+                    if (consecutiveNulls.current >= 2 && !signOutCallbackFired.current) {
                         setConfirmedSignedOut(true);
+                        signOutCallbackFired.current = true;
+                        try {
+                            await fa.onSignOut?.();
+                        }
+                        catch (e) {
+                            console.error('AuthUserProvider: onSignOut callback failed', e);
+                        }
+                    }
                 }
                 const flipped = previous !== undefined && previous !== isSignedIn;
                 const contradictsPage = previous === undefined && isSignedIn === isAuthPage;
@@ -221,6 +265,18 @@ export default function AuthUserProvider({ initialUser = null, children }) {
                 }
             }
             await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName, confirmedToken);
+            if (!emailVerifiedRef.current && user.emailVerified) {
+                emailVerifiedRef.current = true;
+                try {
+                    await fa.onEmailVerified?.(user);
+                }
+                catch (e) {
+                    console.error('AuthUserProvider: onEmailVerified callback failed', e);
+                }
+            }
+            else {
+                emailVerifiedRef.current = user.emailVerified;
+            }
             setAuthUserCache(user);
             setState({ user, loading: false });
         }

package/dist/src/types/types.d.ts

@@ -4,6 +4,7 @@ import type { Videos } from 'next/dist/lib/metadata/types/metadata-types';
 import type { CookieConsentDialogProps } from '../cookie_consent/client/components/cookie_consent_dialog';
 import type { PrivacyPolicyUpdateDialogProps } from '../cookie_consent/client/components/privacy_policy_update_dialog';
 import type { ConsentValue } from '../cookie_consent/types';
+import type { User } from 'firebase/auth';
 /**
  * Custom middleware hook, run by `intlMiddleware` for your own logic
  * (e.g. auth, feature flags, A/B tests) — on top of the library's own
@@ -439,11 +440,11 @@ export interface FirebaseAuthRoutingConfig {
     appId: string;
     /** Firebase Analytics measurement ID. */
     measurementId?: string;
-    /** Path to redirect signed-out users to, e.g. "/login". */
+    /** Path to redirect signed-out users to, e.g. "/login". Must start with "/" — `setIntlConfig` auto-corrects a missing leading slash with a warning. */
     redirectAuthPath: string;
-    /** Path to redirect signed-in users away from auth pages to, e.g. "/". */
+    /** Path to redirect signed-in users away from auth pages to, e.g. "/". Must start with "/" — `setIntlConfig` auto-corrects a missing leading slash with a warning. */
     homePath: string;
-    /** Path to redirect unverified-email users to. Omit to skip email-verification redirects. */
+    /** Path to redirect unverified-email users to. Omit to skip email-verification redirects. Must start with "/" — `setIntlConfig` auto-corrects a missing leading slash with a warning. */
     verifyEmailPath?: string;
     /** Returns true if the given (locale-stripped) path is an auth page (login/signup/etc). */
     isAuthPath: (path: string) => boolean;
@@ -459,6 +460,34 @@ export interface FirebaseAuthRoutingConfig {
     refreshTokenCookieName?: string;
     /** Email-verified hint cookie name. Defaults to `'__fa_email_verified_hint__'`. Client-written, non-httpOnly; lets the middleware avoid an unnecessary token refresh when its view already matches the client's. */
     emailVerifiedHintCookieName?: string;
+    /**
+     * Called once, the moment `AuthUserProvider` observes a real sign-in
+     * (a `null → user` transition) — never on a plain token refresh of an
+     * already-signed-in user. Runs after the session/refresh-token/
+     * email-verified-hint cookies have already been written for this
+     * user, so cookie state is in sync when this fires. A throw/rejection
+     * is caught and logged via `console.error`; it never blocks cookie
+     * sync or navigation.
+     */
+    onSignIn?: (user: User) => void | Promise<void>;
+    /**
+     * Called once, on the `false → true` transition of `user.emailVerified`
+     * — never on a later observation of an already-verified user. Checked
+     * from both `AuthUserProvider`'s `onIdTokenChanged` listener and its
+     * `reloadUser()`, since either can be the first to observe the
+     * transition. A throw/rejection is caught and logged via
+     * `console.error`.
+     */
+    onEmailVerified?: (user: User) => void | Promise<void>;
+    /**
+     * Called once, when sign-out is confirmed — after `AuthUserProvider`'s
+     * existing debounce for transient SDK null-callbacks (two consecutive
+     * `onIdTokenChanged(null)` calls), not on the first, possibly
+     * transient, null. Runs after the session/refresh-token cookies have
+     * already been cleared. A throw/rejection is caught and logged via
+     * `console.error`.
+     */
+    onSignOut?: () => void | Promise<void>;
 }
 export interface CookieAttributes {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.13",
+  "version": "0.6.14",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",