cloudflare-next-intl 0.6.26 → 0.6.28

package/dist/src/firebase_auth/server/firebase_server.js

@@ -45,7 +45,7 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
     // so apps that never configure server-side minting keep today's exact
     // behavior.
     const appCheckToken = cookieStore.get(appCheckTokenCookieName)?.value
-        ?? await mintServerAppCheckToken(fa.projectId, fa.appCheck);
+        ?? await mintServerAppCheckToken(fa.projectId, fa.apiKey, fa.appCheck);
     try {
         if (!firebaseAppModule)
             firebaseAppModule = await import('firebase/app');

package/dist/src/firebase_auth/server/mint_server_app_check_token.d.ts

@@ -10,9 +10,13 @@ import type { FirebaseAppCheckConfig } from '../../types/types';
  *
  * Signs a short-lived custom JWT with the service account's private key
  * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
- * it for an App Check token via `exchangeCustomToken`. Not cached beyond the
- * caller's own request-scoped `cache()` wrapper — a fresh mint costs one
- * signing operation plus one network round-trip, acceptable per-request but
- * not worth doing more than once per request.
+ * it for an App Check token via `exchangeCustomToken`, authenticated with
+ * the project's Web API key (`?key=`) — `exchangeCustomToken` otherwise
+ * rejects the call outright as an unregistered/unidentified caller
+ * (403 `PERMISSION_DENIED`), before the custom token itself is even
+ * evaluated. Not cached beyond the caller's own request-scoped `cache()`
+ * wrapper — a fresh mint costs one signing operation plus one network
+ * round-trip, acceptable per-request but not worth doing more than once per
+ * request.
  */
-export default function mintServerAppCheckToken(projectId: string, appCheck: FirebaseAppCheckConfig | undefined): Promise<string | undefined>;
+export default function mintServerAppCheckToken(projectId: string, apiKey: string, appCheck: FirebaseAppCheckConfig | undefined): Promise<string | undefined>;

package/dist/src/firebase_auth/server/mint_server_app_check_token.js

@@ -1,7 +1,22 @@
 import config from '@intl-config';
 import reportError from '../../error_handling/report_error';
-const APP_CHECK_CUSTOM_TOKEN_AUDIENCE = 'https://firebaseappcheck.googleapis.com/google.firebase.appcheck.v1.FirebaseAppCheck';
-const DEFAULT_CUSTOM_TOKEN_LIFETIME = '1h';
+// Matches `firebase-admin`'s own `AppCheckTokenGenerator.createCustomToken`
+// exactly (`token-generator.js`) — this specific audience (the App Check
+// TOKEN EXCHANGE service, not the App Check API resource name itself) is
+// REQUIRED. The wrong-but-plausible-looking
+// `.../google.firebase.appcheck.v1.FirebaseAppCheck` audience gets rejected
+// by `exchangeCustomToken` with an opaque `403 App attestation failed`, with
+// no indication the audience is the problem.
+const APP_CHECK_CUSTOM_TOKEN_AUDIENCE = 'https://firebaseappcheck.googleapis.com/google.firebase.appcheck.v1.TokenExchangeService';
+// `firebase-admin` hardcodes this custom token's own lifetime to 5 minutes
+// and does not expose it as configurable — it's a short-lived credential
+// whose only job is to be immediately exchanged for the actual App Check
+// token (whose own lifetime is controlled by Firebase, separately). Mirrored
+// here as a fixed value rather than the configurable
+// `customTokenLifetime` this used to be: Google's real backend rejects
+// longer lifetimes outright, so making it configurable only offered a
+// footgun with no working range above this default.
+const CUSTOM_TOKEN_LIFETIME = '5m';
 /**
  * Mints a fresh App Check token server-side via a service account, for use
  * when the client-written App Check cookie (see `appCheckTokenCookieName`)
@@ -13,12 +28,16 @@ const DEFAULT_CUSTOM_TOKEN_LIFETIME = '1h';
  *
  * Signs a short-lived custom JWT with the service account's private key
  * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
- * it for an App Check token via `exchangeCustomToken`. Not cached beyond the
- * caller's own request-scoped `cache()` wrapper — a fresh mint costs one
- * signing operation plus one network round-trip, acceptable per-request but
- * not worth doing more than once per request.
+ * it for an App Check token via `exchangeCustomToken`, authenticated with
+ * the project's Web API key (`?key=`) — `exchangeCustomToken` otherwise
+ * rejects the call outright as an unregistered/unidentified caller
+ * (403 `PERMISSION_DENIED`), before the custom token itself is even
+ * evaluated. Not cached beyond the caller's own request-scoped `cache()`
+ * wrapper — a fresh mint costs one signing operation plus one network
+ * round-trip, acceptable per-request but not worth doing more than once per
+ * request.
  */
-export default async function mintServerAppCheckToken(projectId, appCheck) {
+export default async function mintServerAppCheckToken(projectId, apiKey, appCheck) {
     if (!appCheck?.clientEmail || !appCheck.privateKey || !appCheck.appId)
         return undefined;
     try {
@@ -30,9 +49,9 @@ export default async function mintServerAppCheckToken(projectId, appCheck) {
             .setSubject(appCheck.clientEmail)
             .setAudience(APP_CHECK_CUSTOM_TOKEN_AUDIENCE)
             .setIssuedAt()
-            .setExpirationTime(appCheck.customTokenLifetime ?? DEFAULT_CUSTOM_TOKEN_LIFETIME)
+            .setExpirationTime(CUSTOM_TOKEN_LIFETIME)
             .sign(privateKey);
-        const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken`;
+        const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken?key=${apiKey}`;
         const res = await fetch(url, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },

package/dist/src/types/types.d.ts

@@ -596,17 +596,6 @@ export interface FirebaseAppCheckConfig {
      * itself — App Check registers apps separately.
      */
     appId: string;
-    /**
-     * Lifetime of the custom JWT signed for the `exchangeCustomToken`
-     * server-side mint, as a `jose` `setExpirationTime` duration string
-     * (e.g. `'1h'`, `'30m'`, `'7d'`). Defaults to `'1h'`. This is the custom
-     * token's own lifetime, not the resulting App Check token's — Firebase
-     * controls that separately. Google's custom-token minting generally
-     * rejects lifetimes beyond 1 hour regardless of what's set here, so
-     * values longer than `'1h'` are unlikely to have any practical effect —
-     * kept configurable in case that constraint changes.
-     */
-    customTokenLifetime?: string;
 }
 export interface CookieAttributes {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.26",
+  "version": "0.6.28",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",