cloudflare-next-intl 0.6.19 → 0.6.21

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -9,6 +9,7 @@ import { getFirebaseAuthClient, getFirebaseAuthModule } from './firebase_client'
 import { setAuthUserCache } from './auth_user_cache';
 import { defaultEmailVerifiedHintCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
 import decodeJwtPayload from '../decode_jwt_payload';
+import isWhitelisted from '../is_whitelisted';
 import setCookie from '../../client/functions/set_cookie';
 import getCookie from '../../client/functions/get_cookie';
 import clearSessionAction from '../server/clear_session_action';
@@ -87,7 +88,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
     const router = useRouter();
     const pathname = usePathname();
     const isAuthPage = fa.isAuthPath(pathname);
-    const isWhiteListed = fa.whiteListPaths?.includes(pathname) ?? false;
+    const isWhiteListed = isWhitelisted(pathname, fa.whiteListPaths);
     const maxAge = fa.sessionCookieMaxAge ?? 60 * 60 * 24 * 5;
     const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const refreshTokenMaxAge = fa.refreshTokenCookieMaxAge ?? 60 * 60 * 24 * 365;

package/dist/src/firebase_auth/client/firebase_client.js

@@ -1,6 +1,19 @@
 'use client';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
+async function initializeFirebaseAppCheck(app, appCheckConfig) {
+    const { initializeAppCheck, ReCaptchaV3Provider, ReCaptchaEnterpriseProvider } = await import('firebase/app-check');
+    if (appCheckConfig.debugToken) {
+        globalThis.FIREBASE_APPCHECK_DEBUG_TOKEN = true;
+    }
+    const provider = appCheckConfig.recaptchaEnterpriseSiteKey
+        ? new ReCaptchaEnterpriseProvider(appCheckConfig.recaptchaEnterpriseSiteKey)
+        : new ReCaptchaV3Provider(appCheckConfig.recaptchaV3SiteKey);
+    initializeAppCheck(app, {
+        provider,
+        isTokenAutoRefreshEnabled: appCheckConfig.isTokenAutoRefreshEnabled ?? true,
+    });
+}
 let cached;
 let cachedPromise;
 /**
@@ -16,7 +29,7 @@ export async function getFirebaseAuthClient() {
         return cached;
     if (!cachedPromise) {
         const fa = config.firebaseAuth;
-        cachedPromise = Promise.all([import('firebase/app'), import('firebase/auth')]).then(([{ getApp, getApps, initializeApp }, { getAuth }]) => {
+        cachedPromise = Promise.all([import('firebase/app'), import('firebase/auth')]).then(async ([{ getApp, getApps, initializeApp }, { getAuth }]) => {
             const firebaseConfig = {
                 apiKey: fa.apiKey,
                 authDomain: fa.authDomain,
@@ -27,6 +40,9 @@ export async function getFirebaseAuthClient() {
                 measurementId: fa.measurementId,
             };
             const app = getApps().length ? getApp() : initializeApp(firebaseConfig);
+            if (fa.appCheck) {
+                await initializeFirebaseAppCheck(app, fa.appCheck);
+            }
             const auth = getAuth(app);
             cached = { app, auth };
             return cached;

package/dist/src/firebase_auth/is_whitelisted.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whether `path` is exempt from auth redirects under `whiteListPaths`.
+ * Matches an entry exactly, OR as a path-segment prefix (`/bonds` also
+ * covers `/bonds/some-slug`, but NOT `/bonds-extra`) — a plain
+ * `startsWith` would let a differently-named sibling route slip through
+ * whenever one route's name happens to prefix another's.
+ */
+export default function isWhitelisted(path: string, whiteListPaths: readonly string[] | undefined): boolean;

package/dist/src/firebase_auth/is_whitelisted.js

@@ -0,0 +1,12 @@
+/**
+ * Whether `path` is exempt from auth redirects under `whiteListPaths`.
+ * Matches an entry exactly, OR as a path-segment prefix (`/bonds` also
+ * covers `/bonds/some-slug`, but NOT `/bonds-extra`) — a plain
+ * `startsWith` would let a differently-named sibling route slip through
+ * whenever one route's name happens to prefix another's.
+ */
+export default function isWhitelisted(path, whiteListPaths) {
+    if (!whiteListPaths)
+        return false;
+    return whiteListPaths.some((entry) => path === entry || path.startsWith(`${entry}/`));
+}

package/dist/src/firebase_auth/middleware/update_session.js

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server';
 import config from '@intl-config';
 import decodeJwtPayload from '../decode_jwt_payload';
+import isWhitelisted from '../is_whitelisted';
 export const defaultSessionCookieName = '__fa_session__';
 export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 // Non-httpOnly: written by AuthUserProvider (client) every time it observes
@@ -219,7 +220,7 @@ export default async function updateSession(request, baseResponse, locale) {
             }
         }
     }
-    const isWhiteListed = fa.whiteListPaths?.includes(path) ?? false;
+    const isWhiteListed = isWhitelisted(path, fa.whiteListPaths);
     if (isWhiteListed)
         return baseResponse;
     const isAuthPage = fa.isAuthPath(path);

package/dist/src/types/types.d.ts

@@ -440,6 +440,13 @@ export interface FirebaseAuthRoutingConfig {
     appId: string;
     /** Firebase Analytics measurement ID. */
     measurementId?: string;
+    /**
+     * Enables Firebase App Check on the client. Omit to leave App Check
+     * uninitialized — required if App Check enforcement is turned on for
+     * Auth/Firestore/etc. in the Firebase console, or every request gets
+     * rejected with 401.
+     */
+    appCheck?: FirebaseAppCheckConfig;
     /** Path to redirect signed-out users to, e.g. "/login". Must start with "/" — `setIntlConfig` auto-corrects a missing leading slash with a warning. */
     redirectAuthPath: string;
     /** Path to redirect signed-in users away from auth pages to, e.g. "/". Must start with "/" — `setIntlConfig` auto-corrects a missing leading slash with a warning. */
@@ -531,6 +538,21 @@ export interface FirebaseAuthRoutingConfig {
      */
     onSignOut?: () => void | Promise<void>;
 }
+export interface FirebaseAppCheckConfig {
+    /** reCAPTCHA v3 site key. Mutually exclusive with `recaptchaEnterpriseSiteKey`. */
+    recaptchaV3SiteKey?: string;
+    /** reCAPTCHA Enterprise site key. Mutually exclusive with `recaptchaV3SiteKey`. */
+    recaptchaEnterpriseSiteKey?: string;
+    /**
+     * Enables App Check's debug token on this client (sets
+     * `self.FIREBASE_APPCHECK_DEBUG_TOKEN = true` before init, which logs a
+     * token to the console to register in the Firebase console). Use only
+     * for local development — never set `true` in production.
+     */
+    debugToken?: boolean;
+    /** Forwarded to `initializeAppCheck`'s `isTokenAutoRefreshEnabled`. Defaults to `true`. */
+    isTokenAutoRefreshEnabled?: boolean;
+}
 export interface CookieAttributes {
     /**
      * Specifies the value for the {@link https://tools.ietf.org/html/rfc6265#section-5.2.3|Domain Set-Cookie attribute}. By default, no

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.19",
+  "version": "0.6.21",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",