cloudflare-next-intl 0.6.27 → 0.6.28

package/dist/src/firebase_auth/server/mint_server_app_check_token.js

@@ -1,7 +1,22 @@
 import config from '@intl-config';
 import reportError from '../../error_handling/report_error';
-const APP_CHECK_CUSTOM_TOKEN_AUDIENCE = 'https://firebaseappcheck.googleapis.com/google.firebase.appcheck.v1.FirebaseAppCheck';
-const DEFAULT_CUSTOM_TOKEN_LIFETIME = '1h';
+// Matches `firebase-admin`'s own `AppCheckTokenGenerator.createCustomToken`
+// exactly (`token-generator.js`) — this specific audience (the App Check
+// TOKEN EXCHANGE service, not the App Check API resource name itself) is
+// REQUIRED. The wrong-but-plausible-looking
+// `.../google.firebase.appcheck.v1.FirebaseAppCheck` audience gets rejected
+// by `exchangeCustomToken` with an opaque `403 App attestation failed`, with
+// no indication the audience is the problem.
+const APP_CHECK_CUSTOM_TOKEN_AUDIENCE = 'https://firebaseappcheck.googleapis.com/google.firebase.appcheck.v1.TokenExchangeService';
+// `firebase-admin` hardcodes this custom token's own lifetime to 5 minutes
+// and does not expose it as configurable — it's a short-lived credential
+// whose only job is to be immediately exchanged for the actual App Check
+// token (whose own lifetime is controlled by Firebase, separately). Mirrored
+// here as a fixed value rather than the configurable
+// `customTokenLifetime` this used to be: Google's real backend rejects
+// longer lifetimes outright, so making it configurable only offered a
+// footgun with no working range above this default.
+const CUSTOM_TOKEN_LIFETIME = '5m';
 /**
  * Mints a fresh App Check token server-side via a service account, for use
  * when the client-written App Check cookie (see `appCheckTokenCookieName`)
@@ -34,7 +49,7 @@ export default async function mintServerAppCheckToken(projectId, apiKey, appChec
             .setSubject(appCheck.clientEmail)
             .setAudience(APP_CHECK_CUSTOM_TOKEN_AUDIENCE)
             .setIssuedAt()
-            .setExpirationTime(appCheck.customTokenLifetime ?? DEFAULT_CUSTOM_TOKEN_LIFETIME)
+            .setExpirationTime(CUSTOM_TOKEN_LIFETIME)
             .sign(privateKey);
         const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken?key=${apiKey}`;
         const res = await fetch(url, {

package/dist/src/types/types.d.ts

@@ -596,17 +596,6 @@ export interface FirebaseAppCheckConfig {
      * itself — App Check registers apps separately.
      */
     appId: string;
-    /**
-     * Lifetime of the custom JWT signed for the `exchangeCustomToken`
-     * server-side mint, as a `jose` `setExpirationTime` duration string
-     * (e.g. `'1h'`, `'30m'`, `'7d'`). Defaults to `'1h'`. This is the custom
-     * token's own lifetime, not the resulting App Check token's — Firebase
-     * controls that separately. Google's custom-token minting generally
-     * rejects lifetimes beyond 1 hour regardless of what's set here, so
-     * values longer than `'1h'` are unlikely to have any practical effect —
-     * kept configurable in case that constraint changes.
-     */
-    customTokenLifetime?: string;
 }
 export interface CookieAttributes {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.27",
+  "version": "0.6.28",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",