cloudflare-next-intl 0.6.24 → 0.6.26

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -5,9 +5,9 @@ import { useRouter } from 'next/navigation';
 import usePathname from '../../client/hooks/use_path_name';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { getFirebaseAuthClient, getFirebaseAuthModule } from './firebase_client';
+import { getAppCheckToken, getFirebaseAuthClient, getFirebaseAuthModule } from './firebase_client';
 import { setAuthUserCache } from './auth_user_cache';
-import { defaultEmailVerifiedHintCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
+import { defaultAppCheckTokenCookieName, defaultEmailVerifiedHintCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
 import decodeJwtPayload from '../decode_jwt_payload';
 import isWhitelisted from '../is_whitelisted';
 import setCookie from '../../client/functions/set_cookie';
@@ -39,9 +39,31 @@ function clearRefreshTokenCookie(refreshTokenCookieName) {
 function writeEmailVerifiedHintCookie(emailVerifiedHintCookieName, emailVerified, maxAge) {
     setCookie({ name: emailVerifiedHintCookieName, value: String(emailVerified), maxAge });
 }
-async function clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, refreshTokenMaxAge) {
+function clearAppCheckTokenCookie(appCheckTokenCookieName) {
+    setCookie({ name: appCheckTokenCookieName, value: '', maxAge: 0 });
+}
+// Mirrors the live App Check token into a client-readable cookie so
+// `getAuthenticatedAppForUser` can forward it to `initializeServerApp` —
+// required whenever App Check enforcement is on for Auth, or every
+// server-side `getAuthUser()` call is rejected with
+// `auth/firebase-app-check-token-is-invalid`. Best-effort: App Check may not
+// be configured, or a token fetch can transiently fail (e.g. reCAPTCHA not
+// yet ready) — either case just leaves the cookie unset rather than blocking
+// session sync on it.
+async function writeAppCheckTokenCookie(appCheckTokenCookieName, maxAge) {
+    try {
+        const token = await getAppCheckToken();
+        if (token)
+            setCookie({ name: appCheckTokenCookieName, value: token, maxAge });
+    }
+    catch (e) {
+        console.error('AuthUserProvider: App Check token cookie sync failed', e);
+    }
+}
+async function clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, appCheckTokenCookieName, refreshTokenMaxAge) {
     clearSessionCookie(sessionCookieName);
     clearRefreshTokenCookie(refreshTokenCookieName);
+    clearAppCheckTokenCookie(appCheckTokenCookieName);
     // Signed-out is not "unknown" — it's a confirmed non-verified state, so
     // write 'false' explicitly rather than clearing (an absent hint means
     // "no signal yet", which forces the middleware to refresh unnecessarily
@@ -54,7 +76,7 @@ async function clearSession(sessionCookieName, refreshTokenCookieName, emailVeri
         console.error('AuthUserProvider: clearSessionAction failed', e);
     }
 }
-async function writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName, idToken) {
+async function writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName, appCheckTokenCookieName, appCheckTokenMaxAge, idToken) {
     try {
         writeRefreshTokenCookie(refreshTokenCookieName, user, refreshTokenMaxAge);
     }
@@ -62,6 +84,7 @@ async function writeSession(user, sessionCookieName, maxAge, refreshTokenCookieN
         console.error('AuthUserProvider: refresh-token cookie sync failed', e);
     }
     writeEmailVerifiedHintCookie(emailVerifiedHintCookieName, user.emailVerified, refreshTokenMaxAge);
+    await writeAppCheckTokenCookie(appCheckTokenCookieName, appCheckTokenMaxAge);
     writeSessionCookie(sessionCookieName, idToken ?? await user.getIdToken(true), maxAge);
 }
 /**
@@ -94,6 +117,8 @@ export default function AuthUserProvider({ initialUser = null, children }) {
     const refreshTokenMaxAge = fa.refreshTokenCookieMaxAge ?? 60 * 60 * 24 * 365;
     const refreshTokenCookieName = fa.refreshTokenCookieName ?? defaultRefreshTokenCookieName;
     const emailVerifiedHintCookieName = fa.emailVerifiedHintCookieName ?? defaultEmailVerifiedHintCookieName;
+    const appCheckTokenCookieName = fa.appCheckTokenCookieName ?? defaultAppCheckTokenCookieName;
+    const appCheckTokenMaxAge = fa.appCheckTokenCookieMaxAge ?? 60 * 60;
     const [state, setState] = useState({
         user: initialUser,
         loading: initialUser === null,
@@ -164,10 +189,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
                 const previous = syncedSignedIn.current;
                 try {
                     if (user) {
-                        await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName);
+                        await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName, appCheckTokenCookieName, appCheckTokenMaxAge);
                     }
                     else {
-                        await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, refreshTokenMaxAge);
+                        await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, appCheckTokenCookieName, refreshTokenMaxAge);
                     }
                 }
                 catch (e) {
@@ -231,7 +256,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             unsubscribe?.();
         };
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [router, isAuthPage, maxAge, sessionCookieName, refreshTokenMaxAge, refreshTokenCookieName, emailVerifiedHintCookieName]);
+    }, [router, isAuthPage, maxAge, sessionCookieName, refreshTokenMaxAge, refreshTokenCookieName, emailVerifiedHintCookieName, appCheckTokenCookieName, appCheckTokenMaxAge]);
     const reloadUser = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;
@@ -265,7 +290,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
                         await sleep(500);
                 }
             }
-            await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName, confirmedToken);
+            await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName, appCheckTokenCookieName, appCheckTokenMaxAge, confirmedToken);
             if (!emailVerifiedRef.current && user.emailVerified) {
                 emailVerifiedRef.current = true;
                 try {
@@ -300,10 +325,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             await signOut(auth);
         }
         finally {
-            await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, refreshTokenMaxAge);
+            await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, appCheckTokenCookieName, refreshTokenMaxAge);
             router.push(fa.redirectAuthPath);
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [fa.redirectAuthPath, sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName]);
+    }, [fa.redirectAuthPath, sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, appCheckTokenCookieName]);
     return _jsx(AuthUserContext.Provider, { value: { ...state, reloadUser, sendVerificationEmail, logout }, children: children });
 }

package/dist/src/firebase_auth/client/firebase_client.d.ts

@@ -1,5 +1,13 @@
 import type { FirebaseApp } from 'firebase/app';
 import type { Auth } from 'firebase/auth';
+/**
+ * Current App Check token, or `undefined` if `appCheck` isn't configured or
+ * hasn't initialized yet. Forces a refresh only when the cached token is
+ * expired/near-expiry — mirrors `getToken`'s own semantics, just exposed
+ * here so callers (e.g. `AuthUserProvider`'s session-cookie sync) don't need
+ * to import `firebase/app-check` themselves.
+ */
+export declare function getAppCheckToken(): Promise<string | undefined>;
 /**
  * Lazily loads and initializes `firebase/app`/`firebase/auth` — a dynamic
  * import, not a static one, so consumers who never call a firebase_auth

package/dist/src/firebase_auth/client/firebase_client.js

@@ -1,6 +1,7 @@
 'use client';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
+let cachedAppCheck;
 async function initializeFirebaseAppCheck(app, appCheckConfig) {
     const { initializeAppCheck, ReCaptchaV3Provider, ReCaptchaEnterpriseProvider } = await import('firebase/app-check');
     if (appCheckConfig.debugToken) {
@@ -10,11 +11,25 @@ async function initializeFirebaseAppCheck(app, appCheckConfig) {
     const provider = appCheckConfig.recaptchaEnterpriseSiteKey
         ? new ReCaptchaEnterpriseProvider(appCheckConfig.recaptchaEnterpriseSiteKey)
         : new ReCaptchaV3Provider(appCheckConfig.recaptchaV3SiteKey);
-    initializeAppCheck(app, {
+    return initializeAppCheck(app, {
         provider,
         isTokenAutoRefreshEnabled: appCheckConfig.isTokenAutoRefreshEnabled ?? true,
     });
 }
+/**
+ * Current App Check token, or `undefined` if `appCheck` isn't configured or
+ * hasn't initialized yet. Forces a refresh only when the cached token is
+ * expired/near-expiry — mirrors `getToken`'s own semantics, just exposed
+ * here so callers (e.g. `AuthUserProvider`'s session-cookie sync) don't need
+ * to import `firebase/app-check` themselves.
+ */
+export async function getAppCheckToken() {
+    if (!cachedAppCheck)
+        return undefined;
+    const { getToken } = await import('firebase/app-check');
+    const result = await getToken(cachedAppCheck);
+    return result.token;
+}
 let cached;
 let cachedPromise;
 /**
@@ -42,7 +57,7 @@ export async function getFirebaseAuthClient() {
             };
             const app = getApps().length ? getApp() : initializeApp(firebaseConfig);
             if (fa.appCheck) {
-                await initializeFirebaseAppCheck(app, fa.appCheck);
+                cachedAppCheck = await initializeFirebaseAppCheck(app, fa.appCheck);
             }
             const auth = getAuth(app);
             cached = { app, auth };

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -2,6 +2,7 @@ import { NextResponse, type NextRequest } from 'next/server';
 export declare const defaultSessionCookieName = "__fa_session__";
 export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
 export declare const defaultEmailVerifiedHintCookieName = "__fa_email_verified_hint__";
+export declare const defaultAppCheckTokenCookieName = "__fa_app_check_token__";
 export declare const defaultResetPasswordPath = "/reset-password";
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto

package/dist/src/firebase_auth/middleware/update_session.js

@@ -11,6 +11,13 @@ export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 // — force one refresh). Readable client-side is fine: it carries no secret,
 // only a boolean mirror of a claim already inside the session JWT.
 export const defaultEmailVerifiedHintCookieName = '__fa_email_verified_hint__';
+// Non-httpOnly: written by AuthUserProvider (client) whenever it mints a
+// fresh App Check token, so the server can forward it to
+// `initializeServerApp` — required whenever App Check enforcement is on for
+// Auth, or every server-side `getAuthUser()` call is rejected with
+// `auth/firebase-app-check-token-is-invalid`. Carries no secret beyond what
+// the client already attaches to every Firebase SDK request itself.
+export const defaultAppCheckTokenCookieName = '__fa_app_check_token__';
 export const defaultResetPasswordPath = '/reset-password';
 /**
  * Firebase's console exposes ONE project-wide action URL, so every email

package/dist/src/firebase_auth/server/firebase_server.js

@@ -2,8 +2,9 @@ import { cookies } from 'next/headers';
 import { cache } from 'react';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { defaultSessionCookieName } from '../middleware/update_session';
+import { defaultAppCheckTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
 import reportError from '../../error_handling/report_error';
+import mintServerAppCheckToken from './mint_server_app_check_token';
 let baseApp;
 let firebaseAppModule;
 let firebaseAuthModule;
@@ -20,10 +21,31 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
     const fa = config.firebaseAuth;
     requireFirebaseAuthConfig(fa);
     const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
-    const authIdToken = (await cookies()).get(sessionCookieName)?.value;
+    const appCheckTokenCookieName = fa.appCheckTokenCookieName ?? defaultAppCheckTokenCookieName;
+    const cookieStore = await cookies();
+    const authIdToken = cookieStore.get(sessionCookieName)?.value;
     if (!authIdToken) {
         return { firebaseServerApp: null, currentUser: null };
     }
+    // Only meaningful when `appCheck` is configured — if App Check
+    // enforcement is on for Auth in the Firebase console, `initializeServerApp`
+    // rejects with `auth/firebase-app-check-token-is-invalid` unless this is
+    // supplied. Absent when App Check isn't configured, which is fine:
+    // `initializeServerApp` simply skips App Check validation in that case.
+    //
+    // The client-written cookie is the fast path (no round-trip) but can be
+    // missing on a cold navigation — a fresh tab/hard-refresh renders on the
+    // server BEFORE `AuthUserProvider` has had a chance to run and write it,
+    // even though `authIdToken` above proves this is a genuinely signed-in
+    // user. Falling straight through to `initializeServerApp` with no App
+    // Check token in that case would reject the whole lookup and render the
+    // page as signed-out. Minting one server-side (service-account-backed,
+    // see `mintServerAppCheckToken`) closes that gap; it's a no-op returning
+    // `undefined` if `appCheck.clientEmail`/`privateKey`/`appId` aren't set,
+    // so apps that never configure server-side minting keep today's exact
+    // behavior.
+    const appCheckToken = cookieStore.get(appCheckTokenCookieName)?.value
+        ?? await mintServerAppCheckToken(fa.projectId, fa.appCheck);
     try {
         if (!firebaseAppModule)
             firebaseAppModule = await import('firebase/app');
@@ -47,7 +69,7 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
         // registering a new named app in Firebase's global app registry.
         if (!baseApp)
             baseApp = initializeApp(firebaseConfig, 'firebase-auth-server-base');
-        const firebaseServerApp = initializeServerApp(baseApp, { authIdToken });
+        const firebaseServerApp = initializeServerApp(baseApp, { authIdToken, appCheckToken });
         const auth = getAuth(firebaseServerApp);
         await auth.authStateReady();
         return { firebaseServerApp, currentUser: auth.currentUser };

package/dist/src/firebase_auth/server/mint_server_app_check_token.d.ts

@@ -0,0 +1,18 @@
+import type { FirebaseAppCheckConfig } from '../../types/types';
+/**
+ * Mints a fresh App Check token server-side via a service account, for use
+ * when the client-written App Check cookie (see `appCheckTokenCookieName`)
+ * is absent — e.g. a cold navigation before `AuthUserProvider` has run and
+ * had a chance to write it. Requires `clientEmail`/`privateKey`/`appId` on
+ * `firebaseAuth.appCheck`; returns `undefined` (never throws) if the
+ * exchange fails, so a caller can always fall back to "no App Check token"
+ * exactly as before this existed.
+ *
+ * Signs a short-lived custom JWT with the service account's private key
+ * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
+ * it for an App Check token via `exchangeCustomToken`. Not cached beyond the
+ * caller's own request-scoped `cache()` wrapper — a fresh mint costs one
+ * signing operation plus one network round-trip, acceptable per-request but
+ * not worth doing more than once per request.
+ */
+export default function mintServerAppCheckToken(projectId: string, appCheck: FirebaseAppCheckConfig | undefined): Promise<string | undefined>;

package/dist/src/firebase_auth/server/mint_server_app_check_token.js

@@ -0,0 +1,55 @@
+import config from '@intl-config';
+import reportError from '../../error_handling/report_error';
+const APP_CHECK_CUSTOM_TOKEN_AUDIENCE = 'https://firebaseappcheck.googleapis.com/google.firebase.appcheck.v1.FirebaseAppCheck';
+const DEFAULT_CUSTOM_TOKEN_LIFETIME = '1h';
+/**
+ * Mints a fresh App Check token server-side via a service account, for use
+ * when the client-written App Check cookie (see `appCheckTokenCookieName`)
+ * is absent — e.g. a cold navigation before `AuthUserProvider` has run and
+ * had a chance to write it. Requires `clientEmail`/`privateKey`/`appId` on
+ * `firebaseAuth.appCheck`; returns `undefined` (never throws) if the
+ * exchange fails, so a caller can always fall back to "no App Check token"
+ * exactly as before this existed.
+ *
+ * Signs a short-lived custom JWT with the service account's private key
+ * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
+ * it for an App Check token via `exchangeCustomToken`. Not cached beyond the
+ * caller's own request-scoped `cache()` wrapper — a fresh mint costs one
+ * signing operation plus one network round-trip, acceptable per-request but
+ * not worth doing more than once per request.
+ */
+export default async function mintServerAppCheckToken(projectId, appCheck) {
+    if (!appCheck?.clientEmail || !appCheck.privateKey || !appCheck.appId)
+        return undefined;
+    try {
+        const { SignJWT, importPKCS8 } = await import('jose');
+        const privateKey = await importPKCS8(appCheck.privateKey.replace(/\\n/g, '\n'), 'RS256');
+        const customToken = await new SignJWT({ app_id: appCheck.appId })
+            .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
+            .setIssuer(appCheck.clientEmail)
+            .setSubject(appCheck.clientEmail)
+            .setAudience(APP_CHECK_CUSTOM_TOKEN_AUDIENCE)
+            .setIssuedAt()
+            .setExpirationTime(appCheck.customTokenLifetime ?? DEFAULT_CUSTOM_TOKEN_LIFETIME)
+            .sign(privateKey);
+        const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken`;
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ customToken }),
+        });
+        if (!res.ok) {
+            await reportError(config, {
+                error: new Error(`exchangeCustomToken failed: ${res.status} ${await res.text()}`),
+                classOrMethodName: 'mintServerAppCheckToken',
+            });
+            return undefined;
+        }
+        const data = await res.json();
+        return data.token;
+    }
+    catch (error) {
+        await reportError(config, { error, classOrMethodName: 'mintServerAppCheckToken' });
+        return undefined;
+    }
+}

package/dist/src/types/types.d.ts

@@ -509,6 +509,22 @@ export interface FirebaseAuthRoutingConfig {
     refreshTokenCookieName?: string;
     /** Email-verified hint cookie name. Defaults to `'__fa_email_verified_hint__'`. Client-written, non-httpOnly; lets the middleware avoid an unnecessary token refresh when its view already matches the client's. */
     emailVerifiedHintCookieName?: string;
+    /**
+     * App Check token cookie name. Defaults to `'__fa_app_check_token__'`.
+     * Client-written, non-httpOnly; carries the client's live App Check
+     * token to the server so `getAuthUser()`/`getAuthenticatedAppForUser`
+     * can pass it to `initializeServerApp`. Only relevant when `appCheck`
+     * is configured AND App Check enforcement is turned on for Auth in the
+     * Firebase console — otherwise `initializeServerApp` rejects every
+     * request with `auth/firebase-app-check-token-is-invalid`.
+     */
+    appCheckTokenCookieName?: string;
+    /**
+     * App Check token cookie max-age in seconds. Defaults to 1 hour (3600) —
+     * matches the App Check token's own default lifetime, so the cookie
+     * doesn't outlive the token it holds.
+     */
+    appCheckTokenCookieMaxAge?: number;
     /**
      * Called once, the moment `AuthUserProvider` observes a real sign-in
      * (a `null → user` transition) — never on a plain token refresh of an
@@ -555,6 +571,42 @@ export interface FirebaseAppCheckConfig {
     debugToken?: boolean | string;
     /** Forwarded to `initializeAppCheck`'s `isTokenAutoRefreshEnabled`. Defaults to `true`. */
     isTokenAutoRefreshEnabled?: boolean;
+    /**
+     * Service account client email, used ONLY server-side to mint an App
+     * Check token when the client-written App Check cookie is absent (e.g.
+     * a cold navigation before `AuthUserProvider` has run — see
+     * `appCheckTokenCookieName`). Required alongside `privateKey` and
+     * `appId` for server-side minting. Never sent to the client — read only
+     * by `firebase_server.ts`.
+     */
+    clientEmail: string;
+    /**
+     * Service account private key (PEM), paired with `clientEmail` for
+     * server-side App Check token minting. Same server-only, secret-bearing
+     * field as `clientEmail` — set from an untrusted-by-the-client env var
+     * (e.g. `process.env.FIREBASE_PRIVATE_KEY`), never exposed to the
+     * browser. Escaped `\n` sequences (common when stored in a single-line
+     * env var) are unescaped automatically before use.
+     */
+    privateKey: string;
+    /**
+     * Firebase App Check app ID (e.g. `"1:1234567890:web:abcdef123456"`),
+     * required alongside `clientEmail`/`privateKey` for server-side minting.
+     * Distinct from the Firebase Auth `appId` on `FirebaseAuthRoutingConfig`
+     * itself — App Check registers apps separately.
+     */
+    appId: string;
+    /**
+     * Lifetime of the custom JWT signed for the `exchangeCustomToken`
+     * server-side mint, as a `jose` `setExpirationTime` duration string
+     * (e.g. `'1h'`, `'30m'`, `'7d'`). Defaults to `'1h'`. This is the custom
+     * token's own lifetime, not the resulting App Check token's — Firebase
+     * controls that separately. Google's custom-token minting generally
+     * rejects lifetimes beyond 1 hour regardless of what's set here, so
+     * values longer than `'1h'` are unlikely to have any practical effect —
+     * kept configurable in case that constraint changes.
+     */
+    customTokenLifetime?: string;
 }
 export interface CookieAttributes {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.24",
+  "version": "0.6.26",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -211,7 +211,8 @@
   "homepage": "https://github.com/demian-ilnytskyi/cloudflare-next-intl#readme",
   "dependencies": {
     "@microsoft/clarity": "^1.0.2",
-    "firebase": "^12.17.0"
+    "firebase": "^12.17.0",
+    "jose": "^6.2.8"
   },
   "peerDependencies": {
     "next": ">=12.0.0",