cloudflare-next-intl 0.6.25 → 0.6.27

package/dist/src/firebase_auth/server/firebase_server.js

@@ -45,7 +45,7 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
     // so apps that never configure server-side minting keep today's exact
     // behavior.
     const appCheckToken = cookieStore.get(appCheckTokenCookieName)?.value
-        ?? await mintServerAppCheckToken(fa.projectId, fa.appCheck);
+        ?? await mintServerAppCheckToken(fa.projectId, fa.apiKey, fa.appCheck);
     try {
         if (!firebaseAppModule)
             firebaseAppModule = await import('firebase/app');

package/dist/src/firebase_auth/server/mint_server_app_check_token.d.ts

@@ -4,15 +4,19 @@ import type { FirebaseAppCheckConfig } from '../../types/types';
  * when the client-written App Check cookie (see `appCheckTokenCookieName`)
  * is absent — e.g. a cold navigation before `AuthUserProvider` has run and
  * had a chance to write it. Requires `clientEmail`/`privateKey`/`appId` on
- * `firebaseAuth.appCheck`; returns `undefined` (never throws) if any of
- * those are missing or the exchange fails, so a caller can always fall back
- * to "no App Check token" exactly as before this existed.
+ * `firebaseAuth.appCheck`; returns `undefined` (never throws) if the
+ * exchange fails, so a caller can always fall back to "no App Check token"
+ * exactly as before this existed.
  *
  * Signs a short-lived custom JWT with the service account's private key
  * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
- * it for an App Check token via `exchangeCustomToken`. Not cached beyond the
- * caller's own request-scoped `cache()` wrapper — a fresh mint costs one
- * signing operation plus one network round-trip, acceptable per-request but
- * not worth doing more than once per request.
+ * it for an App Check token via `exchangeCustomToken`, authenticated with
+ * the project's Web API key (`?key=`) — `exchangeCustomToken` otherwise
+ * rejects the call outright as an unregistered/unidentified caller
+ * (403 `PERMISSION_DENIED`), before the custom token itself is even
+ * evaluated. Not cached beyond the caller's own request-scoped `cache()`
+ * wrapper — a fresh mint costs one signing operation plus one network
+ * round-trip, acceptable per-request but not worth doing more than once per
+ * request.
  */
-export default function mintServerAppCheckToken(projectId: string, appCheck: FirebaseAppCheckConfig | undefined): Promise<string | undefined>;
+export default function mintServerAppCheckToken(projectId: string, apiKey: string, appCheck: FirebaseAppCheckConfig | undefined): Promise<string | undefined>;

package/dist/src/firebase_auth/server/mint_server_app_check_token.js

@@ -7,18 +7,22 @@ const DEFAULT_CUSTOM_TOKEN_LIFETIME = '1h';
  * when the client-written App Check cookie (see `appCheckTokenCookieName`)
  * is absent — e.g. a cold navigation before `AuthUserProvider` has run and
  * had a chance to write it. Requires `clientEmail`/`privateKey`/`appId` on
- * `firebaseAuth.appCheck`; returns `undefined` (never throws) if any of
- * those are missing or the exchange fails, so a caller can always fall back
- * to "no App Check token" exactly as before this existed.
+ * `firebaseAuth.appCheck`; returns `undefined` (never throws) if the
+ * exchange fails, so a caller can always fall back to "no App Check token"
+ * exactly as before this existed.
  *
  * Signs a short-lived custom JWT with the service account's private key
  * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
- * it for an App Check token via `exchangeCustomToken`. Not cached beyond the
- * caller's own request-scoped `cache()` wrapper — a fresh mint costs one
- * signing operation plus one network round-trip, acceptable per-request but
- * not worth doing more than once per request.
+ * it for an App Check token via `exchangeCustomToken`, authenticated with
+ * the project's Web API key (`?key=`) — `exchangeCustomToken` otherwise
+ * rejects the call outright as an unregistered/unidentified caller
+ * (403 `PERMISSION_DENIED`), before the custom token itself is even
+ * evaluated. Not cached beyond the caller's own request-scoped `cache()`
+ * wrapper — a fresh mint costs one signing operation plus one network
+ * round-trip, acceptable per-request but not worth doing more than once per
+ * request.
  */
-export default async function mintServerAppCheckToken(projectId, appCheck) {
+export default async function mintServerAppCheckToken(projectId, apiKey, appCheck) {
     if (!appCheck?.clientEmail || !appCheck.privateKey || !appCheck.appId)
         return undefined;
     try {
@@ -32,7 +36,7 @@ export default async function mintServerAppCheckToken(projectId, appCheck) {
             .setIssuedAt()
             .setExpirationTime(appCheck.customTokenLifetime ?? DEFAULT_CUSTOM_TOKEN_LIFETIME)
             .sign(privateKey);
-        const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken`;
+        const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken?key=${apiKey}`;
         const res = await fetch(url, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },

package/dist/src/types/types.d.ts

@@ -575,13 +575,11 @@ export interface FirebaseAppCheckConfig {
      * Service account client email, used ONLY server-side to mint an App
      * Check token when the client-written App Check cookie is absent (e.g.
      * a cold navigation before `AuthUserProvider` has run — see
-     * `appCheckTokenCookieName`). Omit to skip server-side minting entirely;
-     * `getAuthenticatedAppForUser` then behaves exactly as it did before this
-     * option existed (falls back to no App Check token). Never sent to the
-     * client — read only by `firebase_server.ts`. Required alongside
-     * `privateKey` and `appId` for minting to activate.
+     * `appCheckTokenCookieName`). Required alongside `privateKey` and
+     * `appId` for server-side minting. Never sent to the client — read only
+     * by `firebase_server.ts`.
      */
-    clientEmail?: string;
+    clientEmail: string;
     /**
      * Service account private key (PEM), paired with `clientEmail` for
      * server-side App Check token minting. Same server-only, secret-bearing
@@ -590,14 +588,14 @@ export interface FirebaseAppCheckConfig {
      * browser. Escaped `\n` sequences (common when stored in a single-line
      * env var) are unescaped automatically before use.
      */
-    privateKey?: string;
+    privateKey: string;
     /**
      * Firebase App Check app ID (e.g. `"1:1234567890:web:abcdef123456"`),
      * required alongside `clientEmail`/`privateKey` for server-side minting.
      * Distinct from the Firebase Auth `appId` on `FirebaseAuthRoutingConfig`
      * itself — App Check registers apps separately.
      */
-    appId?: string;
+    appId: string;
     /**
      * Lifetime of the custom JWT signed for the `exchangeCustomToken`
      * server-side mint, as a `jose` `setExpirationTime` duration string

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.25",
+  "version": "0.6.27",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",