cloudflare-next-intl 0.6.28 → 0.6.30

package/dist/src/config/middleware.js

@@ -141,7 +141,9 @@ export default async function intlMiddleware(request, options) {
             if (!updateSessionModule) {
                 updateSessionModule = await import('../firebase_auth/middleware/update_session');
             }
-            response = await updateSessionModule.default(request, response, effectiveLocaleForRequest);
+            response = await updateSessionModule.default(request, response, effectiveLocaleForRequest, (refreshedRequest) => rewriteUrl
+                ? NextResponse.rewrite(rewriteUrl, { request: refreshedRequest })
+                : NextResponse.next({ request: refreshedRequest }));
         }
         return response;
     }

package/dist/src/error_handling/create_server_error_action.d.ts

@@ -26,6 +26,12 @@ import { type ReportErrorConfig } from './report_error';
  * boundary (Next.js server actions serialize arguments; an `Error` instance
  * doesn't survive that intact) and `isClient: true` is set automatically.
  *
+ * Also attaches `requestContext: { path, userAgent, referer }` (best-effort,
+ * via `next/headers` — see `resolveRequestContext`) alongside your own
+ * `params`, so `onError`/the console report shows WHERE the error happened,
+ * not just what it was — useful when diagnosing a client error without a
+ * repro, since the page and browser are often the missing piece.
+ *
  * @param config Pass the relevant slices of your `RoutingConfig` directly —
  *   `{ errorHandling: config.errorHandling, generate: config.generate }`.
  */

package/dist/src/error_handling/create_server_error_action.js

@@ -1,5 +1,26 @@
 import reportError from './report_error';
 import stringifyUnknown from './stringify_unknown';
+/**
+ * Reads request context (page path, user agent, referer) via `next/headers`
+ * for a client-originated error report. `path` comes from `x-pathname`, set
+ * by `intlMiddleware` (this package's own middleware) — falls back to
+ * `undefined` when a header is missing (e.g. middleware didn't run for this
+ * request) rather than throwing.
+ */
+async function resolveRequestContext() {
+    try {
+        const { headers } = await import('next/headers');
+        const headerList = await headers();
+        return {
+            path: headerList.get('x-pathname') ?? undefined,
+            userAgent: headerList.get('user-agent') ?? undefined,
+            referer: headerList.get('referer') ?? undefined,
+        };
+    }
+    catch {
+        return {};
+    }
+}
 /**
  * Builds a function that reports a client-originated error via
  * `reportError`, meant to be re-exported directly from your OWN
@@ -26,15 +47,28 @@ import stringifyUnknown from './stringify_unknown';
  * boundary (Next.js server actions serialize arguments; an `Error` instance
  * doesn't survive that intact) and `isClient: true` is set automatically.
  *
+ * Also attaches `requestContext: { path, userAgent, referer }` (best-effort,
+ * via `next/headers` — see `resolveRequestContext`) alongside your own
+ * `params`, so `onError`/the console report shows WHERE the error happened,
+ * not just what it was — useful when diagnosing a client error without a
+ * repro, since the page and browser are often the missing piece.
+ *
  * @param config Pass the relevant slices of your `RoutingConfig` directly —
  *   `{ errorHandling: config.errorHandling, generate: config.generate }`.
  */
 export default function createServerErrorAction(config) {
     return async function reportClientError(error, classOrMethodName, params) {
+        const requestContext = await resolveRequestContext();
+        const isPlainParamsObject = typeof params === 'object' && params !== null && !Array.isArray(params);
+        const mergedParams = params === undefined
+            ? { requestContext }
+            : isPlainParamsObject
+                ? { ...params, requestContext }
+                : { params, requestContext };
         await reportError(config, {
             error: stringifyUnknown(error, true),
             classOrMethodName,
-            params,
+            params: mergedParams,
             isClient: true,
         });
     };

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -4,6 +4,23 @@ export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
 export declare const defaultEmailVerifiedHintCookieName = "__fa_email_verified_hint__";
 export declare const defaultAppCheckTokenCookieName = "__fa_app_check_token__";
 export declare const defaultResetPasswordPath = "/reset-password";
+export declare function isIdTokenExpired(token: string): boolean;
+export type RefreshResult = {
+    status: 'refreshed';
+    idToken: string;
+    refreshToken: string;
+} | {
+    status: 'invalid';
+} | {
+    status: 'transient-failure';
+};
+/**
+ * Mints a fresh ID token from a stored refresh token via Google's Secure
+ * Token API. No `firebase/auth` import: this runs in the Edge middleware
+ * runtime, and `firebase/auth` pulls in Node-only APIs that break Edge
+ * bundles even though this function never touches that module.
+ */
+export declare function refreshIdToken(apiKey: string, refreshToken: string): Promise<RefreshResult>;
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`
@@ -22,4 +39,4 @@ export declare const defaultResetPasswordPath = "/reset-password";
  *   state still survives the redirect.
  * @param locale The effective locale `intlMiddleware` resolved for this request.
  */
-export default function updateSession(request: NextRequest, baseResponse: NextResponse, locale: string): Promise<NextResponse>;
+export default function updateSession(request: NextRequest, baseResponse: NextResponse, locale: string, rebuildResponse?: (request: NextRequest) => NextResponse): Promise<NextResponse>;

package/dist/src/firebase_auth/middleware/update_session.js

@@ -43,6 +43,9 @@ const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
 // time can hand a client a token that dies moments after this check, forcing
 // an extra round-trip on the very next request.
 const CLOCK_SKEW_MARGIN_MS = 60 * 1000;
+export function isIdTokenExpired(token) {
+    return isJwtExpired(token);
+}
 function isJwtExpired(token) {
     const decoded = decodeJwtPayload(token);
     return !decoded?.exp || decoded.exp * 1000 - CLOCK_SKEW_MARGIN_MS <= Date.now();
@@ -126,7 +129,7 @@ const INVALID_REFRESH_TOKEN_ERRORS = new Set([
  * runtime, and `firebase/auth` pulls in Node-only APIs that break Edge
  * bundles even though this function never touches that module.
  */
-async function refreshIdToken(apiKey, refreshToken) {
+export async function refreshIdToken(apiKey, refreshToken) {
     const cached = await getCachedRefresh(refreshToken);
     if (cached)
         return { status: 'refreshed', ...cached };
@@ -183,7 +186,7 @@ async function refreshIdToken(apiKey, refreshToken) {
  *   state still survives the redirect.
  * @param locale The effective locale `intlMiddleware` resolved for this request.
  */
-export default async function updateSession(request, baseResponse, locale) {
+export default async function updateSession(request, baseResponse, locale, rebuildResponse) {
     const fa = config.firebaseAuth;
     if (!fa || fa.middlewareEnabled === false)
         return baseResponse;
@@ -354,6 +357,20 @@ export default async function updateSession(request, baseResponse, locale) {
         response.cookies.delete(refreshTokenCookieName);
     }
     if (refreshedToken) {
+        // `response.cookies.set` only reaches the BROWSER — the current
+        // render still reads the old, expired token from `cookies()`, so
+        // `initializeServerApp` rejects it with `auth/invalid-user-token`.
+        // Writing to `request.cookies` and rebuilding the pass-through
+        // response from that request makes the fresh token visible to this
+        // render too.
+        request.cookies.set(sessionCookieName, refreshedToken.idToken);
+        request.cookies.set(refreshTokenCookieName, refreshedToken.refreshToken);
+        if (rebuildResponse && response === baseResponse) {
+            const rebuilt = rebuildResponse(request);
+            baseResponse.cookies.getAll().forEach((cookie) => rebuilt.cookies.set(cookie));
+            baseResponse.headers.forEach((value, key) => rebuilt.headers.set(key, value));
+            response = rebuilt;
+        }
         response.cookies.set(sessionCookieName, refreshedToken.idToken, {
             httpOnly: true,
             secure: request.nextUrl.protocol === 'https',

package/dist/src/firebase_auth/server/firebase_server.js

@@ -2,7 +2,7 @@ import { cookies } from 'next/headers';
 import { cache } from 'react';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { defaultAppCheckTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
+import { defaultAppCheckTokenCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName, isIdTokenExpired, refreshIdToken } from '../middleware/update_session';
 import reportError from '../../error_handling/report_error';
 import mintServerAppCheckToken from './mint_server_app_check_token';
 let baseApp;
@@ -22,8 +22,22 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
     requireFirebaseAuthConfig(fa);
     const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const appCheckTokenCookieName = fa.appCheckTokenCookieName ?? defaultAppCheckTokenCookieName;
+    const refreshTokenCookieName = fa.refreshTokenCookieName ?? defaultRefreshTokenCookieName;
     const cookieStore = await cookies();
-    const authIdToken = cookieStore.get(sessionCookieName)?.value;
+    let authIdToken = cookieStore.get(sessionCookieName)?.value;
+    // Safety net for the paths the middleware can't cover (prefetch requests,
+    // excluded matcher routes, server actions): an expired token would be
+    // rejected by `initializeServerApp` with `auth/invalid-user-token`, so
+    // mint a fresh one from the refresh-token cookie first. The refreshed
+    // token can't be written back to the cookie from here (RSC render), but
+    // the middleware persists it on the next request.
+    if (authIdToken && isIdTokenExpired(authIdToken)) {
+        const refreshToken = cookieStore.get(refreshTokenCookieName)?.value;
+        const result = refreshToken
+            ? await refreshIdToken(fa.apiKey, refreshToken)
+            : undefined;
+        authIdToken = result?.status === 'refreshed' ? result.idToken : undefined;
+    }
     if (!authIdToken) {
         return { firebaseServerApp: null, currentUser: null };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.28",
+  "version": "0.6.30",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",