cloudflare-next-intl 0.6.18 → 0.6.20

package/dist/src/config/init_config.js

@@ -7,7 +7,14 @@
 // Auto-prepending `/` here fixes the common typo (`'login'` instead of
 // `'/login'`) at the source, for every consumer, instead of requiring each
 // one to notice and fix it themselves.
-const FIREBASE_AUTH_PATH_FIELDS = ['redirectAuthPath', 'homePath', 'verifyEmailPath'];
+const FIREBASE_AUTH_PATH_FIELDS = [
+    'redirectAuthPath',
+    'homePath',
+    'verifyEmailPath',
+    'resetPasswordPath',
+    'recoverEmailPath',
+    'actionLinkPath',
+];
 function normalizeFirebaseAuthPaths(config) {
     const fa = config.firebaseAuth;
     if (!fa)

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -9,6 +9,7 @@ import { getFirebaseAuthClient, getFirebaseAuthModule } from './firebase_client'
 import { setAuthUserCache } from './auth_user_cache';
 import { defaultEmailVerifiedHintCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
 import decodeJwtPayload from '../decode_jwt_payload';
+import isWhitelisted from '../is_whitelisted';
 import setCookie from '../../client/functions/set_cookie';
 import getCookie from '../../client/functions/get_cookie';
 import clearSessionAction from '../server/clear_session_action';
@@ -87,7 +88,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
     const router = useRouter();
     const pathname = usePathname();
     const isAuthPage = fa.isAuthPath(pathname);
-    const isWhiteListed = fa.whiteListPaths?.includes(pathname) ?? false;
+    const isWhiteListed = isWhitelisted(pathname, fa.whiteListPaths);
     const maxAge = fa.sessionCookieMaxAge ?? 60 * 60 * 24 * 5;
     const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const refreshTokenMaxAge = fa.refreshTokenCookieMaxAge ?? 60 * 60 * 24 * 365;

package/dist/src/firebase_auth/is_whitelisted.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whether `path` is exempt from auth redirects under `whiteListPaths`.
+ * Matches an entry exactly, OR as a path-segment prefix (`/bonds` also
+ * covers `/bonds/some-slug`, but NOT `/bonds-extra`) — a plain
+ * `startsWith` would let a differently-named sibling route slip through
+ * whenever one route's name happens to prefix another's.
+ */
+export default function isWhitelisted(path: string, whiteListPaths: readonly string[] | undefined): boolean;

package/dist/src/firebase_auth/is_whitelisted.js

@@ -0,0 +1,12 @@
+/**
+ * Whether `path` is exempt from auth redirects under `whiteListPaths`.
+ * Matches an entry exactly, OR as a path-segment prefix (`/bonds` also
+ * covers `/bonds/some-slug`, but NOT `/bonds-extra`) — a plain
+ * `startsWith` would let a differently-named sibling route slip through
+ * whenever one route's name happens to prefix another's.
+ */
+export default function isWhitelisted(path, whiteListPaths) {
+    if (!whiteListPaths)
+        return false;
+    return whiteListPaths.some((entry) => path === entry || path.startsWith(`${entry}/`));
+}

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -2,6 +2,7 @@ import { NextResponse, type NextRequest } from 'next/server';
 export declare const defaultSessionCookieName = "__fa_session__";
 export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
 export declare const defaultEmailVerifiedHintCookieName = "__fa_email_verified_hint__";
+export declare const defaultResetPasswordPath = "/reset-password";
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`

package/dist/src/firebase_auth/middleware/update_session.js

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server';
 import config from '@intl-config';
 import decodeJwtPayload from '../decode_jwt_payload';
+import isWhitelisted from '../is_whitelisted';
 export const defaultSessionCookieName = '__fa_session__';
 export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 // Non-httpOnly: written by AuthUserProvider (client) every time it observes
@@ -10,6 +11,24 @@ export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 // — force one refresh). Readable client-side is fine: it carries no secret,
 // only a boolean mirror of a claim already inside the session JWT.
 export const defaultEmailVerifiedHintCookieName = '__fa_email_verified_hint__';
+export const defaultResetPasswordPath = '/reset-password';
+/**
+ * Firebase's console exposes ONE project-wide action URL, so every email
+ * template (password reset, email verification, email recovery) lands on that
+ * same URL and distinguishes itself only by `?mode=`. This maps those raw
+ * `mode` values onto the app's own pages so each link reaches the page that
+ * knows how to consume its `oobCode`.
+ */
+function resolveActionModePaths(fa) {
+    const paths = {
+        resetPassword: fa.resetPasswordPath ?? defaultResetPasswordPath,
+    };
+    if (fa.verifyEmailPath)
+        paths.verifyEmail = fa.verifyEmailPath;
+    if (fa.recoverEmailPath)
+        paths.recoverEmail = fa.recoverEmailPath;
+    return { ...paths, ...fa.actionModePaths };
+}
 const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
 const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
 // Refresh slightly before the real expiry — treating a token as expired
@@ -175,7 +194,33 @@ export default async function updateSession(request, baseResponse, locale) {
     }
     const localePrefix = locale === config.defaultLocale ? '' : requestPrefix;
     const localeUrl = (target) => new URL(`${localePrefix}${target === '/' ? '' : target}` || '/', request.url);
-    const isWhiteListed = fa.whiteListPaths?.includes(path) ?? false;
+    // Emailed Firebase action links all arrive on the single project-wide
+    // action URL carrying `?mode=<action>&oobCode=...`. Forward them to the
+    // page for that mode BEFORE any auth/whitelist check below: these links
+    // are followed by users who are typically signed OUT (a password reset,
+    // or verification opened in another browser), so letting the guest
+    // redirect run first would bounce them to `redirectAuthPath` and discard
+    // the `oobCode` they came to spend. The whole query string is preserved
+    // so the destination page still receives `oobCode`/`continueUrl`/`lang`.
+    // When `actionLinkPath` is set, only requests to that exact (locale-
+    // stripped) path are eligible — matches a Firebase Console action URL
+    // pinned to one static path (e.g. "https://example.com/auth/action")
+    // rather than the bare domain root.
+    const isEligibleActionPath = !fa.actionLinkPath || path === fa.actionLinkPath;
+    if (fa.actionLinkRedirectEnabled !== false && isEligibleActionPath) {
+        const mode = request.nextUrl.searchParams.get('mode');
+        if (mode) {
+            const target = resolveActionModePaths(fa)[mode];
+            // Skip when already on the destination — the forward sets the same
+            // `?mode=` it matched on, so redirecting again would loop forever.
+            if (target && target !== path) {
+                const url = localeUrl(target);
+                url.search = request.nextUrl.search;
+                return buildRedirect(baseResponse, url);
+            }
+        }
+    }
+    const isWhiteListed = isWhitelisted(path, fa.whiteListPaths);
     if (isWhiteListed)
         return baseResponse;
     const isAuthPage = fa.isAuthPath(path);

package/dist/src/server/components/helper_script.bench.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/server/components/helper_script.bench.js

@@ -0,0 +1,73 @@
+import { bench, describe } from 'vitest';
+import { isDarkCookieKey } from '../../config/cookie_key';
+const getCookieRegex = (name) => {
+    const match = document.cookie.match(new RegExp(`(?:^|; )${name}=([^;]*)`));
+    return match ? decodeURIComponent(match[1]) : null;
+};
+const cache = new Map();
+const getCookieCachedRegex = (name) => {
+    let re = cache.get(name);
+    if (!re) {
+        re = new RegExp(`(?:^|; )${name}=([^;]*)`);
+        cache.set(name, re);
+    }
+    const match = document.cookie.match(re);
+    return match ? decodeURIComponent(match[1]) : null;
+};
+const getCookieIndexOf = (name) => {
+    const raw = document.cookie;
+    const key = name + '=';
+    let i = raw.indexOf(key);
+    while (i !== -1) {
+        if (i === 0 || (raw[i - 1] === ' ' && raw[i - 2] === ';')) {
+            const end = raw.indexOf(';', i);
+            return raw.slice(i + key.length, end === -1 ? undefined : end);
+        }
+        i = raw.indexOf(key, i + 1);
+    }
+    return null;
+};
+document.cookie = `${isDarkCookieKey}=true`;
+document.cookie = 'NEXT_LOCALE=uk';
+document.cookie = 'session=abcdefghijklmnop';
+describe('cookie read strategies', () => {
+    bench('regex constructed per call (current)', () => {
+        getCookieRegex(isDarkCookieKey);
+    });
+    bench('regex cached', () => {
+        getCookieCachedRegex(isDarkCookieKey);
+    });
+    bench('indexOf scan, no decode', () => {
+        getCookieIndexOf(isDarkCookieKey);
+    });
+});
+describe('theme apply', () => {
+    bench('guarded toggle (current)', () => {
+        const classList = document.documentElement.classList;
+        const isDark = true;
+        if (classList.contains('dark') !== isDark) {
+            classList.toggle('dark', isDark);
+        }
+    });
+    bench('unguarded toggle', () => {
+        document.documentElement.classList.toggle('dark', true);
+    });
+});
+describe('full inline script path', () => {
+    bench('current: read cookie + guarded toggle', () => {
+        const isDark = getCookieRegex(isDarkCookieKey);
+        const classList = document.documentElement.classList;
+        const want = isDark === 'true';
+        if (classList.contains('dark') !== want) {
+            classList.toggle('dark', want);
+        }
+    });
+    bench('optimized: indexOf + guarded toggle', () => {
+        const isDark = getCookieIndexOf(isDarkCookieKey);
+        const classList = document.documentElement.classList;
+        const want = isDark === 'true';
+        if (classList.contains('dark') !== want) {
+            classList.toggle('dark', want);
+        }
+    });
+});

package/dist/src/types/types.d.ts

@@ -446,6 +446,48 @@ export interface FirebaseAuthRoutingConfig {
     homePath: string;
     /** Path to redirect unverified-email users to. Omit to skip email-verification redirects. Must start with "/" — `setIntlConfig` auto-corrects a missing leading slash with a warning. */
     verifyEmailPath?: string;
+    /**
+     * Path handling an emailed password-reset link. Firebase allows only ONE
+     * project-wide action URL, so every template lands on the same URL with
+     * a `?mode=` query param; the middleware reads that param and forwards
+     * the request (query string intact, `oobCode` included) to the path for
+     * that mode. Defaults to `'/reset-password'`. Must start with "/" —
+     * `setIntlConfig` auto-corrects a missing leading slash with a warning.
+     */
+    resetPasswordPath?: string;
+    /**
+     * Path handling an emailed `recoverEmail` action link (undo an email
+     * change). Omit to leave that mode unhandled — the request then falls
+     * through to normal routing instead of being forwarded. Must start with
+     * "/" — `setIntlConfig` auto-corrects a missing leading slash with a
+     * warning.
+     */
+    recoverEmailPath?: string;
+    /**
+     * Extra/overriding `?mode=` → path entries for the emailed-action-link
+     * forward described on {@link resetPasswordPath}. Merged over the
+     * defaults derived from `resetPasswordPath`/`verifyEmailPath`/
+     * `recoverEmailPath`, so this is how you handle a mode this config has
+     * no dedicated field for (e.g. `verifyAndChangeEmail`) or point one of
+     * the known modes somewhere else. Keys are raw Firebase `mode` values.
+     */
+    actionModePaths?: Readonly<Record<string, string>>;
+    /**
+     * Set `false` to disable the emailed-action-link forward entirely (see
+     * {@link resetPasswordPath}) and let `?mode=` URLs route normally.
+     * Defaults to `true`.
+     */
+    actionLinkRedirectEnabled?: boolean;
+    /**
+     * Restricts the emailed-action-link forward (see {@link resetPasswordPath})
+     * to this exact static path — set this to whatever path your Firebase
+     * Console "action URL" is pinned to (e.g. `'/auth/action'`) so a `?mode=`
+     * on any other page is left alone instead of being treated as an action
+     * link. Omit to match Firebase's bare-domain-root default: any path
+     * carrying `?mode=` is eligible. Must start with "/" — `setIntlConfig`
+     * auto-corrects a missing leading slash with a warning.
+     */
+    actionLinkPath?: string;
     /** Returns true if the given (locale-stripped) path is an auth page (login/signup/etc). */
     isAuthPath: (path: string) => boolean;
     /** Locale-stripped paths exempt from all auth redirects (e.g. public marketing pages). */

package/dist/vitest.bench.config.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("vite").UserConfig;
+export default _default;

package/dist/vitest.bench.config.js

@@ -0,0 +1,18 @@
+import { defineConfig } from 'vitest/config';
+import path from 'node:path';
+export default defineConfig({
+    test: {
+        environment: 'jsdom',
+        setupFiles: ['./vitest.setup.ts'],
+        benchmark: {
+            include: ['src/server/components/helper_script.bench.ts'],
+            outputJson: '/private/tmp/claude-501/-Volumes-External-own-projects-cloudflare-next-intl/5816d729-594e-4dc8-b38e-1378f1a159bd/scratchpad/bres.json',
+        },
+    },
+    resolve: {
+        alias: {
+            '@intl-config': path.resolve(__dirname, './src/test_utils/mock_intl_config.ts'),
+            '@locale-file': path.resolve(__dirname, './src/test_utils/mock_locale_file'),
+        },
+    },
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.18",
+  "version": "0.6.20",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",