cloudflare-next-intl 0.6.26 → 0.6.27

package/dist/src/firebase_auth/server/firebase_server.js

@@ -45,7 +45,7 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
     // so apps that never configure server-side minting keep today's exact
     // behavior.
     const appCheckToken = cookieStore.get(appCheckTokenCookieName)?.value
-        ?? await mintServerAppCheckToken(fa.projectId, fa.appCheck);
+        ?? await mintServerAppCheckToken(fa.projectId, fa.apiKey, fa.appCheck);
     try {
         if (!firebaseAppModule)
             firebaseAppModule = await import('firebase/app');

package/dist/src/firebase_auth/server/mint_server_app_check_token.d.ts

@@ -10,9 +10,13 @@ import type { FirebaseAppCheckConfig } from '../../types/types';
  *
  * Signs a short-lived custom JWT with the service account's private key
  * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
- * it for an App Check token via `exchangeCustomToken`. Not cached beyond the
- * caller's own request-scoped `cache()` wrapper — a fresh mint costs one
- * signing operation plus one network round-trip, acceptable per-request but
- * not worth doing more than once per request.
+ * it for an App Check token via `exchangeCustomToken`, authenticated with
+ * the project's Web API key (`?key=`) — `exchangeCustomToken` otherwise
+ * rejects the call outright as an unregistered/unidentified caller
+ * (403 `PERMISSION_DENIED`), before the custom token itself is even
+ * evaluated. Not cached beyond the caller's own request-scoped `cache()`
+ * wrapper — a fresh mint costs one signing operation plus one network
+ * round-trip, acceptable per-request but not worth doing more than once per
+ * request.
  */
-export default function mintServerAppCheckToken(projectId: string, appCheck: FirebaseAppCheckConfig | undefined): Promise<string | undefined>;
+export default function mintServerAppCheckToken(projectId: string, apiKey: string, appCheck: FirebaseAppCheckConfig | undefined): Promise<string | undefined>;

package/dist/src/firebase_auth/server/mint_server_app_check_token.js

@@ -13,12 +13,16 @@ const DEFAULT_CUSTOM_TOKEN_LIFETIME = '1h';
  *
  * Signs a short-lived custom JWT with the service account's private key
  * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
- * it for an App Check token via `exchangeCustomToken`. Not cached beyond the
- * caller's own request-scoped `cache()` wrapper — a fresh mint costs one
- * signing operation plus one network round-trip, acceptable per-request but
- * not worth doing more than once per request.
+ * it for an App Check token via `exchangeCustomToken`, authenticated with
+ * the project's Web API key (`?key=`) — `exchangeCustomToken` otherwise
+ * rejects the call outright as an unregistered/unidentified caller
+ * (403 `PERMISSION_DENIED`), before the custom token itself is even
+ * evaluated. Not cached beyond the caller's own request-scoped `cache()`
+ * wrapper — a fresh mint costs one signing operation plus one network
+ * round-trip, acceptable per-request but not worth doing more than once per
+ * request.
  */
-export default async function mintServerAppCheckToken(projectId, appCheck) {
+export default async function mintServerAppCheckToken(projectId, apiKey, appCheck) {
     if (!appCheck?.clientEmail || !appCheck.privateKey || !appCheck.appId)
         return undefined;
     try {
@@ -32,7 +36,7 @@ export default async function mintServerAppCheckToken(projectId, appCheck) {
             .setIssuedAt()
             .setExpirationTime(appCheck.customTokenLifetime ?? DEFAULT_CUSTOM_TOKEN_LIFETIME)
             .sign(privateKey);
-        const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken`;
+        const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken?key=${apiKey}`;
         const res = await fetch(url, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.26",
+  "version": "0.6.27",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",