cloudflare-next-intl 0.6.27 → 0.6.29

package/dist/src/error_handling/create_server_error_action.d.ts

@@ -26,6 +26,12 @@ import { type ReportErrorConfig } from './report_error';
  * boundary (Next.js server actions serialize arguments; an `Error` instance
  * doesn't survive that intact) and `isClient: true` is set automatically.
  *
+ * Also attaches `requestContext: { path, userAgent, referer }` (best-effort,
+ * via `next/headers` — see `resolveRequestContext`) alongside your own
+ * `params`, so `onError`/the console report shows WHERE the error happened,
+ * not just what it was — useful when diagnosing a client error without a
+ * repro, since the page and browser are often the missing piece.
+ *
  * @param config Pass the relevant slices of your `RoutingConfig` directly —
  *   `{ errorHandling: config.errorHandling, generate: config.generate }`.
  */

package/dist/src/error_handling/create_server_error_action.js

@@ -1,5 +1,26 @@
 import reportError from './report_error';
 import stringifyUnknown from './stringify_unknown';
+/**
+ * Reads request context (page path, user agent, referer) via `next/headers`
+ * for a client-originated error report. `path` comes from `x-pathname`, set
+ * by `intlMiddleware` (this package's own middleware) — falls back to
+ * `undefined` when a header is missing (e.g. middleware didn't run for this
+ * request) rather than throwing.
+ */
+async function resolveRequestContext() {
+    try {
+        const { headers } = await import('next/headers');
+        const headerList = await headers();
+        return {
+            path: headerList.get('x-pathname') ?? undefined,
+            userAgent: headerList.get('user-agent') ?? undefined,
+            referer: headerList.get('referer') ?? undefined,
+        };
+    }
+    catch {
+        return {};
+    }
+}
 /**
  * Builds a function that reports a client-originated error via
  * `reportError`, meant to be re-exported directly from your OWN
@@ -26,15 +47,28 @@ import stringifyUnknown from './stringify_unknown';
  * boundary (Next.js server actions serialize arguments; an `Error` instance
  * doesn't survive that intact) and `isClient: true` is set automatically.
  *
+ * Also attaches `requestContext: { path, userAgent, referer }` (best-effort,
+ * via `next/headers` — see `resolveRequestContext`) alongside your own
+ * `params`, so `onError`/the console report shows WHERE the error happened,
+ * not just what it was — useful when diagnosing a client error without a
+ * repro, since the page and browser are often the missing piece.
+ *
  * @param config Pass the relevant slices of your `RoutingConfig` directly —
  *   `{ errorHandling: config.errorHandling, generate: config.generate }`.
  */
 export default function createServerErrorAction(config) {
     return async function reportClientError(error, classOrMethodName, params) {
+        const requestContext = await resolveRequestContext();
+        const isPlainParamsObject = typeof params === 'object' && params !== null && !Array.isArray(params);
+        const mergedParams = params === undefined
+            ? { requestContext }
+            : isPlainParamsObject
+                ? { ...params, requestContext }
+                : { params, requestContext };
         await reportError(config, {
             error: stringifyUnknown(error, true),
             classOrMethodName,
-            params,
+            params: mergedParams,
             isClient: true,
         });
     };

package/dist/src/firebase_auth/server/mint_server_app_check_token.js

@@ -1,7 +1,22 @@
 import config from '@intl-config';
 import reportError from '../../error_handling/report_error';
-const APP_CHECK_CUSTOM_TOKEN_AUDIENCE = 'https://firebaseappcheck.googleapis.com/google.firebase.appcheck.v1.FirebaseAppCheck';
-const DEFAULT_CUSTOM_TOKEN_LIFETIME = '1h';
+// Matches `firebase-admin`'s own `AppCheckTokenGenerator.createCustomToken`
+// exactly (`token-generator.js`) — this specific audience (the App Check
+// TOKEN EXCHANGE service, not the App Check API resource name itself) is
+// REQUIRED. The wrong-but-plausible-looking
+// `.../google.firebase.appcheck.v1.FirebaseAppCheck` audience gets rejected
+// by `exchangeCustomToken` with an opaque `403 App attestation failed`, with
+// no indication the audience is the problem.
+const APP_CHECK_CUSTOM_TOKEN_AUDIENCE = 'https://firebaseappcheck.googleapis.com/google.firebase.appcheck.v1.TokenExchangeService';
+// `firebase-admin` hardcodes this custom token's own lifetime to 5 minutes
+// and does not expose it as configurable — it's a short-lived credential
+// whose only job is to be immediately exchanged for the actual App Check
+// token (whose own lifetime is controlled by Firebase, separately). Mirrored
+// here as a fixed value rather than the configurable
+// `customTokenLifetime` this used to be: Google's real backend rejects
+// longer lifetimes outright, so making it configurable only offered a
+// footgun with no working range above this default.
+const CUSTOM_TOKEN_LIFETIME = '5m';
 /**
  * Mints a fresh App Check token server-side via a service account, for use
  * when the client-written App Check cookie (see `appCheckTokenCookieName`)
@@ -34,7 +49,7 @@ export default async function mintServerAppCheckToken(projectId, apiKey, appChec
             .setSubject(appCheck.clientEmail)
             .setAudience(APP_CHECK_CUSTOM_TOKEN_AUDIENCE)
             .setIssuedAt()
-            .setExpirationTime(appCheck.customTokenLifetime ?? DEFAULT_CUSTOM_TOKEN_LIFETIME)
+            .setExpirationTime(CUSTOM_TOKEN_LIFETIME)
             .sign(privateKey);
         const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken?key=${apiKey}`;
         const res = await fetch(url, {

package/dist/src/types/types.d.ts

@@ -596,17 +596,6 @@ export interface FirebaseAppCheckConfig {
      * itself — App Check registers apps separately.
      */
     appId: string;
-    /**
-     * Lifetime of the custom JWT signed for the `exchangeCustomToken`
-     * server-side mint, as a `jose` `setExpirationTime` duration string
-     * (e.g. `'1h'`, `'30m'`, `'7d'`). Defaults to `'1h'`. This is the custom
-     * token's own lifetime, not the resulting App Check token's — Firebase
-     * controls that separately. Google's custom-token minting generally
-     * rejects lifetimes beyond 1 hour regardless of what's set here, so
-     * values longer than `'1h'` are unlikely to have any practical effect —
-     * kept configurable in case that constraint changes.
-     */
-    customTokenLifetime?: string;
 }
 export interface CookieAttributes {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.27",
+  "version": "0.6.29",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",