cloudflare-next-intl 0.6.17 → 0.6.19

package/dist/src/config/init_config.js

@@ -7,7 +7,14 @@
 // Auto-prepending `/` here fixes the common typo (`'login'` instead of
 // `'/login'`) at the source, for every consumer, instead of requiring each
 // one to notice and fix it themselves.
-const FIREBASE_AUTH_PATH_FIELDS = ['redirectAuthPath', 'homePath', 'verifyEmailPath'];
+const FIREBASE_AUTH_PATH_FIELDS = [
+    'redirectAuthPath',
+    'homePath',
+    'verifyEmailPath',
+    'resetPasswordPath',
+    'recoverEmailPath',
+    'actionLinkPath',
+];
 function normalizeFirebaseAuthPaths(config) {
     const fa = config.firebaseAuth;
     if (!fa)

package/dist/src/cookie_consent/client/components/cookie_consent_analytics.js

@@ -18,23 +18,24 @@ const ClarityScript = dynamic(() => import('./clarity_script'));
  * `false` — render manually instead if you set `autoWireAnalytics: false`.
  */
 export default function CookieConsentAnalytics({ config }) {
-    const { consent } = useCookieConsent();
+    const { consent, requiresConsent } = useCookieConsent();
+    const granted = consent === true || !requiresConsent;
     useEffect(() => {
-        if (consent === null)
+        if (consent === null && requiresConsent)
             return;
         const w = window;
         if (typeof w.gtag !== 'function')
             return;
-        const state = consent ? 'granted' : 'denied';
+        const state = granted ? 'granted' : 'denied';
         w.gtag('consent', 'update', {
             ad_storage: state,
             ad_user_data: state,
             ad_personalization: state,
             analytics_storage: state,
         });
-    }, [consent]);
+    }, [consent, requiresConsent, granted]);
     const hasGoogle = Boolean(config.googleAnalyticsId || config.googleAdsId || config.googleAdSenseId);
-    return (_jsxs(_Fragment, { children: [hasGoogle && (_jsx("script", { id: "cookie-consent-google-consent-mode", dangerouslySetInnerHTML: { __html: googleConsentModeBootstrapScript(config) } })), consent === true && config.cloudflareBeaconToken && (_jsx("script", { defer: true, src: "https://static.cloudflareinsights.com/beacon.min.js", "data-cf-beacon": config.cloudflareBeaconToken })), consent === true && config.clarityProjectId && _jsx(ClarityScript, { projectId: config.clarityProjectId })] }));
+    return (_jsxs(_Fragment, { children: [hasGoogle && (_jsx("script", { id: "cookie-consent-google-consent-mode", dangerouslySetInnerHTML: { __html: googleConsentModeBootstrapScript(config) } })), granted && config.cloudflareBeaconToken && (_jsx("script", { defer: true, src: "https://static.cloudflareinsights.com/beacon.min.js", "data-cf-beacon": config.cloudflareBeaconToken })), granted && config.clarityProjectId && _jsx(ClarityScript, { projectId: config.clarityProjectId })] }));
 }
 /**
  * Denies storage by default and loads the configured Google tags; the

package/dist/src/cookie_consent/client/components/cookie_consent_dialog.js

@@ -13,8 +13,8 @@ import { defaultCookieDialogClassNames } from './default_dialog_styles';
  * particular design system.
  */
 export default function CookieConsentDialog({ message, link, privacyPolicyLinkText, acceptText, declineText, hideDecline = false, id = 'cookie-consent-dialog', classNames, styles, render, }) {
-    const { consent, isMounted, setConsent, privacyPolicyPath } = useCookieConsent();
-    if (!isMounted || consent !== null)
+    const { consent, requiresConsent, isMounted, setConsent, privacyPolicyPath } = useCookieConsent();
+    if (!isMounted || !requiresConsent || consent !== null)
         return null;
     if (render)
         return _jsx(_Fragment, { children: render({ setConsent }) });

package/dist/src/cookie_consent/client/cookie_consent_provider.js

@@ -65,19 +65,18 @@ export default function CookieConsentProvider({ requiresConsent = true, children
     const [isMounted, setIsMounted] = useState(false);
     const pathname = usePathname();
     useEffect(() => {
-        // `undefined` (no cookie at all) means a genuine first visit — auto-
-        // accept applies. `'null'` (explicitly stored by `setConsent(null)`,
-        // e.g. a "cookie settings" button) means the visitor already decided
-        // once and is being asked to re-decide, so it must NOT auto-accept
-        // again — otherwise it'd immediately flip back to `true` whenever
-        // `requiresConsent` is `false` (e.g. always in dev, see
-        // `resolveRequiresConsent`), reopening then instantly re-closing the
-        // dialog on the next navigation/refresh.
+        // `consent` reflects only what the visitor actually decided — never
+        // auto-set to `true` just because `requiresConsent` is `false`.
+        // Whether the banner shows / analytics unlock for a not-required
+        // visitor is `requiresConsent`'s job (see `CookieConsentDialog`/
+        // `CookieConsentAnalytics`), not something baked into `consent`
+        // itself; otherwise there's no way to tell "not required" apart
+        // from "explicitly accepted" (e.g. the settings button in the nav
+        // bar, which only renders once consent has been decided).
         const rawConsent = getCookie(consentCookieName);
         const storedConsent = parseConsent(rawConsent);
         const isFirstVisit = rawConsent === null;
-        const autoAccepted = isFirstVisit && !requiresConsent;
-        setConsentState(autoAccepted ? true : storedConsent);
+        setConsentState(storedConsent);
         setIsMounted(true);
         if (isFirstVisit || !policyDate)
             return;
@@ -121,6 +120,6 @@ export default function CookieConsentProvider({ requiresConsent = true, children
             acknowledgePrivacyPolicyUpdate();
         }
     }, [pathname, privacyPolicyUpdated, privacyPolicyPath, acknowledgePrivacyPolicyUpdate]);
-    const contextValue = useMemo(() => ({ consent, privacyPolicyUpdated, isMounted, setConsent, acknowledgePrivacyPolicyUpdate, privacyPolicyPath }), [consent, privacyPolicyUpdated, isMounted, setConsent, acknowledgePrivacyPolicyUpdate, privacyPolicyPath]);
+    const contextValue = useMemo(() => ({ consent, requiresConsent, privacyPolicyUpdated, isMounted, setConsent, acknowledgePrivacyPolicyUpdate, privacyPolicyPath }), [consent, requiresConsent, privacyPolicyUpdated, isMounted, setConsent, acknowledgePrivacyPolicyUpdate, privacyPolicyPath]);
     return (_jsx(CookieConsentContext.Provider, { value: contextValue, children: children }));
 }

package/dist/src/cookie_consent/types.d.ts

@@ -4,6 +4,15 @@ export type ConsentValue = boolean | null;
 export interface CookieConsentContextType {
     /** Current consent value; `null` until the visitor decides. */
     consent: ConsentValue;
+    /**
+     * Resolved server-side from `cookieConsent.getCountryCode`/
+     * `gdprCountries` (see `resolveRequiresConsent`). `false` means the
+     * visitor's country doesn't require consent at all — the default
+     * `CookieConsentDialog` stays hidden and `CookieConsentAnalytics`
+     * unlocks immediately, even while `consent` itself is still `null`
+     * (never decided, since there was nothing to decide).
+     */
+    requiresConsent: boolean;
     /**
      * `false` until the client has read the stored consent/date cookies once
      * (always `false` during SSR and the first client render, to avoid a

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -2,6 +2,7 @@ import { NextResponse, type NextRequest } from 'next/server';
 export declare const defaultSessionCookieName = "__fa_session__";
 export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
 export declare const defaultEmailVerifiedHintCookieName = "__fa_email_verified_hint__";
+export declare const defaultResetPasswordPath = "/reset-password";
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`

package/dist/src/firebase_auth/middleware/update_session.js

@@ -10,6 +10,24 @@ export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 // — force one refresh). Readable client-side is fine: it carries no secret,
 // only a boolean mirror of a claim already inside the session JWT.
 export const defaultEmailVerifiedHintCookieName = '__fa_email_verified_hint__';
+export const defaultResetPasswordPath = '/reset-password';
+/**
+ * Firebase's console exposes ONE project-wide action URL, so every email
+ * template (password reset, email verification, email recovery) lands on that
+ * same URL and distinguishes itself only by `?mode=`. This maps those raw
+ * `mode` values onto the app's own pages so each link reaches the page that
+ * knows how to consume its `oobCode`.
+ */
+function resolveActionModePaths(fa) {
+    const paths = {
+        resetPassword: fa.resetPasswordPath ?? defaultResetPasswordPath,
+    };
+    if (fa.verifyEmailPath)
+        paths.verifyEmail = fa.verifyEmailPath;
+    if (fa.recoverEmailPath)
+        paths.recoverEmail = fa.recoverEmailPath;
+    return { ...paths, ...fa.actionModePaths };
+}
 const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
 const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
 // Refresh slightly before the real expiry — treating a token as expired
@@ -175,6 +193,32 @@ export default async function updateSession(request, baseResponse, locale) {
     }
     const localePrefix = locale === config.defaultLocale ? '' : requestPrefix;
     const localeUrl = (target) => new URL(`${localePrefix}${target === '/' ? '' : target}` || '/', request.url);
+    // Emailed Firebase action links all arrive on the single project-wide
+    // action URL carrying `?mode=<action>&oobCode=...`. Forward them to the
+    // page for that mode BEFORE any auth/whitelist check below: these links
+    // are followed by users who are typically signed OUT (a password reset,
+    // or verification opened in another browser), so letting the guest
+    // redirect run first would bounce them to `redirectAuthPath` and discard
+    // the `oobCode` they came to spend. The whole query string is preserved
+    // so the destination page still receives `oobCode`/`continueUrl`/`lang`.
+    // When `actionLinkPath` is set, only requests to that exact (locale-
+    // stripped) path are eligible — matches a Firebase Console action URL
+    // pinned to one static path (e.g. "https://example.com/auth/action")
+    // rather than the bare domain root.
+    const isEligibleActionPath = !fa.actionLinkPath || path === fa.actionLinkPath;
+    if (fa.actionLinkRedirectEnabled !== false && isEligibleActionPath) {
+        const mode = request.nextUrl.searchParams.get('mode');
+        if (mode) {
+            const target = resolveActionModePaths(fa)[mode];
+            // Skip when already on the destination — the forward sets the same
+            // `?mode=` it matched on, so redirecting again would loop forever.
+            if (target && target !== path) {
+                const url = localeUrl(target);
+                url.search = request.nextUrl.search;
+                return buildRedirect(baseResponse, url);
+            }
+        }
+    }
     const isWhiteListed = fa.whiteListPaths?.includes(path) ?? false;
     if (isWhiteListed)
         return baseResponse;

package/dist/src/server/components/helper_script.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/server/components/helper_script.bench.js

@@ -0,0 +1,73 @@
+import { bench, describe } from 'vitest';
+import { isDarkCookieKey } from '../../config/cookie_key';
+const getCookieRegex = (name) => {
+    const match = document.cookie.match(new RegExp(`(?:^|; )${name}=([^;]*)`));
+    return match ? decodeURIComponent(match[1]) : null;
+};
+const cache = new Map();
+const getCookieCachedRegex = (name) => {
+    let re = cache.get(name);
+    if (!re) {
+        re = new RegExp(`(?:^|; )${name}=([^;]*)`);
+        cache.set(name, re);
+    }
+    const match = document.cookie.match(re);
+    return match ? decodeURIComponent(match[1]) : null;
+};
+const getCookieIndexOf = (name) => {
+    const raw = document.cookie;
+    const key = name + '=';
+    let i = raw.indexOf(key);
+    while (i !== -1) {
+        if (i === 0 || (raw[i - 1] === ' ' && raw[i - 2] === ';')) {
+            const end = raw.indexOf(';', i);
+            return raw.slice(i + key.length, end === -1 ? undefined : end);
+        }
+        i = raw.indexOf(key, i + 1);
+    }
+    return null;
+};
+document.cookie = `${isDarkCookieKey}=true`;
+document.cookie = 'NEXT_LOCALE=uk';
+document.cookie = 'session=abcdefghijklmnop';
+describe('cookie read strategies', () => {
+    bench('regex constructed per call (current)', () => {
+        getCookieRegex(isDarkCookieKey);
+    });
+    bench('regex cached', () => {
+        getCookieCachedRegex(isDarkCookieKey);
+    });
+    bench('indexOf scan, no decode', () => {
+        getCookieIndexOf(isDarkCookieKey);
+    });
+});
+describe('theme apply', () => {
+    bench('guarded toggle (current)', () => {
+        const classList = document.documentElement.classList;
+        const isDark = true;
+        if (classList.contains('dark') !== isDark) {
+            classList.toggle('dark', isDark);
+        }
+    });
+    bench('unguarded toggle', () => {
+        document.documentElement.classList.toggle('dark', true);
+    });
+});
+describe('full inline script path', () => {
+    bench('current: read cookie + guarded toggle', () => {
+        const isDark = getCookieRegex(isDarkCookieKey);
+        const classList = document.documentElement.classList;
+        const want = isDark === 'true';
+        if (classList.contains('dark') !== want) {
+            classList.toggle('dark', want);
+        }
+    });
+    bench('optimized: indexOf + guarded toggle', () => {
+        const isDark = getCookieIndexOf(isDarkCookieKey);
+        const classList = document.documentElement.classList;
+        const want = isDark === 'true';
+        if (classList.contains('dark') !== want) {
+            classList.toggle('dark', want);
+        }
+    });
+});

package/dist/src/types/types.d.ts

@@ -446,6 +446,48 @@ export interface FirebaseAuthRoutingConfig {
     homePath: string;
     /** Path to redirect unverified-email users to. Omit to skip email-verification redirects. Must start with "/" — `setIntlConfig` auto-corrects a missing leading slash with a warning. */
     verifyEmailPath?: string;
+    /**
+     * Path handling an emailed password-reset link. Firebase allows only ONE
+     * project-wide action URL, so every template lands on the same URL with
+     * a `?mode=` query param; the middleware reads that param and forwards
+     * the request (query string intact, `oobCode` included) to the path for
+     * that mode. Defaults to `'/reset-password'`. Must start with "/" —
+     * `setIntlConfig` auto-corrects a missing leading slash with a warning.
+     */
+    resetPasswordPath?: string;
+    /**
+     * Path handling an emailed `recoverEmail` action link (undo an email
+     * change). Omit to leave that mode unhandled — the request then falls
+     * through to normal routing instead of being forwarded. Must start with
+     * "/" — `setIntlConfig` auto-corrects a missing leading slash with a
+     * warning.
+     */
+    recoverEmailPath?: string;
+    /**
+     * Extra/overriding `?mode=` → path entries for the emailed-action-link
+     * forward described on {@link resetPasswordPath}. Merged over the
+     * defaults derived from `resetPasswordPath`/`verifyEmailPath`/
+     * `recoverEmailPath`, so this is how you handle a mode this config has
+     * no dedicated field for (e.g. `verifyAndChangeEmail`) or point one of
+     * the known modes somewhere else. Keys are raw Firebase `mode` values.
+     */
+    actionModePaths?: Readonly<Record<string, string>>;
+    /**
+     * Set `false` to disable the emailed-action-link forward entirely (see
+     * {@link resetPasswordPath}) and let `?mode=` URLs route normally.
+     * Defaults to `true`.
+     */
+    actionLinkRedirectEnabled?: boolean;
+    /**
+     * Restricts the emailed-action-link forward (see {@link resetPasswordPath})
+     * to this exact static path — set this to whatever path your Firebase
+     * Console "action URL" is pinned to (e.g. `'/auth/action'`) so a `?mode=`
+     * on any other page is left alone instead of being treated as an action
+     * link. Omit to match Firebase's bare-domain-root default: any path
+     * carrying `?mode=` is eligible. Must start with "/" — `setIntlConfig`
+     * auto-corrects a missing leading slash with a warning.
+     */
+    actionLinkPath?: string;
     /** Returns true if the given (locale-stripped) path is an auth page (login/signup/etc). */
     isAuthPath: (path: string) => boolean;
     /** Locale-stripped paths exempt from all auth redirects (e.g. public marketing pages). */

package/dist/vitest.bench.config.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("vite").UserConfig;
+export default _default;

package/dist/vitest.bench.config.js

@@ -0,0 +1,18 @@
+import { defineConfig } from 'vitest/config';
+import path from 'node:path';
+export default defineConfig({
+    test: {
+        environment: 'jsdom',
+        setupFiles: ['./vitest.setup.ts'],
+        benchmark: {
+            include: ['src/server/components/helper_script.bench.ts'],
+            outputJson: '/private/tmp/claude-501/-Volumes-External-own-projects-cloudflare-next-intl/5816d729-594e-4dc8-b38e-1378f1a159bd/scratchpad/bres.json',
+        },
+    },
+    resolve: {
+        alias: {
+            '@intl-config': path.resolve(__dirname, './src/test_utils/mock_intl_config.ts'),
+            '@locale-file': path.resolve(__dirname, './src/test_utils/mock_locale_file'),
+        },
+    },
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.17",
+  "version": "0.6.19",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",