cloudflare-next-intl 0.6.29 → 0.6.31

package/dist/src/config/middleware.js

@@ -128,6 +128,7 @@ export default async function intlMiddleware(request, options) {
         }
         response.headers.set('Content-Language', effectiveLocaleForRequest);
         response.headers.set('x-pathname', pathWithoutLocale);
+        response.headers.set('x-search', search);
         // Auto-wires the firebase_auth submodule's redirect/session-refresh
         // logic when `firebaseAuth` is configured — dynamic import so this
         // file never pulls in firebase_auth/** (and transitively firebase/*)
@@ -141,7 +142,9 @@ export default async function intlMiddleware(request, options) {
             if (!updateSessionModule) {
                 updateSessionModule = await import('../firebase_auth/middleware/update_session');
             }
-            response = await updateSessionModule.default(request, response, effectiveLocaleForRequest);
+            response = await updateSessionModule.default(request, response, effectiveLocaleForRequest, (refreshedRequest) => rewriteUrl
+                ? NextResponse.rewrite(rewriteUrl, { request: refreshedRequest })
+                : NextResponse.next({ request: refreshedRequest }));
         }
         return response;
     }

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -10,6 +10,7 @@ import { setAuthUserCache } from './auth_user_cache';
 import { defaultAppCheckTokenCookieName, defaultEmailVerifiedHintCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
 import decodeJwtPayload from '../decode_jwt_payload';
 import isWhitelisted from '../is_whitelisted';
+import withRedirectQuery from '../preserve_redirect_query';
 import setCookie from '../../client/functions/set_cookie';
 import getCookie from '../../client/functions/get_cookie';
 import clearSessionAction from '../server/clear_session_action';
@@ -155,14 +156,14 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             // Signed-out on an auth page is where they're supposed to be —
             // only bounce a signed-out user away from a NON-auth page.
             if (!isAuthPage && confirmedSignedOut)
-                router.replace(fa.redirectAuthPath);
+                router.replace(withRedirectQuery(fa.redirectAuthPath, window.location.search));
         }
         else if (fa.verifyEmailPath && !user.emailVerified && pathname !== fa.verifyEmailPath) {
             // Checked before the auth-page redirect below (mirrors
             // `update_session.ts`'s same ordering): an unverified signed-in
             // user must land on verifyEmailPath even if they navigated to
             // an auth page like /login — homePath isn't reachable yet either.
-            router.replace(fa.verifyEmailPath);
+            router.replace(withRedirectQuery(fa.verifyEmailPath, window.location.search));
         }
         else if (isAuthPage || (fa.verifyEmailPath && user.emailVerified && pathname === fa.verifyEmailPath)) {
             // Mirrors the middleware's own signed-in-on-auth-page redirect
@@ -173,7 +174,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             // there until a hard refresh. A verified user reaching
             // verifyEmailPath itself gets the same "go home" treatment —
             // they're done here, same as the auth-page case.
-            router.replace(fa.homePath);
+            router.replace(withRedirectQuery(fa.homePath, window.location.search));
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [state, pathname, isAuthPage, isWhiteListed, confirmedSignedOut]);

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -4,6 +4,23 @@ export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
 export declare const defaultEmailVerifiedHintCookieName = "__fa_email_verified_hint__";
 export declare const defaultAppCheckTokenCookieName = "__fa_app_check_token__";
 export declare const defaultResetPasswordPath = "/reset-password";
+export declare function isIdTokenExpired(token: string): boolean;
+export type RefreshResult = {
+    status: 'refreshed';
+    idToken: string;
+    refreshToken: string;
+} | {
+    status: 'invalid';
+} | {
+    status: 'transient-failure';
+};
+/**
+ * Mints a fresh ID token from a stored refresh token via Google's Secure
+ * Token API. No `firebase/auth` import: this runs in the Edge middleware
+ * runtime, and `firebase/auth` pulls in Node-only APIs that break Edge
+ * bundles even though this function never touches that module.
+ */
+export declare function refreshIdToken(apiKey: string, refreshToken: string): Promise<RefreshResult>;
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`
@@ -22,4 +39,4 @@ export declare const defaultResetPasswordPath = "/reset-password";
  *   state still survives the redirect.
  * @param locale The effective locale `intlMiddleware` resolved for this request.
  */
-export default function updateSession(request: NextRequest, baseResponse: NextResponse, locale: string): Promise<NextResponse>;
+export default function updateSession(request: NextRequest, baseResponse: NextResponse, locale: string, rebuildResponse?: (request: NextRequest) => NextResponse): Promise<NextResponse>;

package/dist/src/firebase_auth/middleware/update_session.js

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server';
 import config from '@intl-config';
 import decodeJwtPayload from '../decode_jwt_payload';
 import isWhitelisted from '../is_whitelisted';
+import withRedirectQuery from '../preserve_redirect_query';
 export const defaultSessionCookieName = '__fa_session__';
 export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 // Non-httpOnly: written by AuthUserProvider (client) every time it observes
@@ -43,6 +44,9 @@ const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
 // time can hand a client a token that dies moments after this check, forcing
 // an extra round-trip on the very next request.
 const CLOCK_SKEW_MARGIN_MS = 60 * 1000;
+export function isIdTokenExpired(token) {
+    return isJwtExpired(token);
+}
 function isJwtExpired(token) {
     const decoded = decodeJwtPayload(token);
     return !decoded?.exp || decoded.exp * 1000 - CLOCK_SKEW_MARGIN_MS <= Date.now();
@@ -126,7 +130,7 @@ const INVALID_REFRESH_TOKEN_ERRORS = new Set([
  * runtime, and `firebase/auth` pulls in Node-only APIs that break Edge
  * bundles even though this function never touches that module.
  */
-async function refreshIdToken(apiKey, refreshToken) {
+export async function refreshIdToken(apiKey, refreshToken) {
     const cached = await getCachedRefresh(refreshToken);
     if (cached)
         return { status: 'refreshed', ...cached };
@@ -183,7 +187,7 @@ async function refreshIdToken(apiKey, refreshToken) {
  *   state still survives the redirect.
  * @param locale The effective locale `intlMiddleware` resolved for this request.
  */
-export default async function updateSession(request, baseResponse, locale) {
+export default async function updateSession(request, baseResponse, locale, rebuildResponse) {
     const fa = config.firebaseAuth;
     if (!fa || fa.middlewareEnabled === false)
         return baseResponse;
@@ -200,7 +204,7 @@ export default async function updateSession(request, baseResponse, locale) {
         return baseResponse;
     }
     const localePrefix = locale === config.defaultLocale ? '' : requestPrefix;
-    const localeUrl = (target) => new URL(`${localePrefix}${target === '/' ? '' : target}` || '/', request.url);
+    const localeUrl = (target) => new URL(withRedirectQuery(`${localePrefix}${target === '/' ? '' : target}` || '/', request.nextUrl.search), request.url);
     // Emailed Firebase action links all arrive on the single project-wide
     // action URL carrying `?mode=<action>&oobCode=...`. Forward them to the
     // page for that mode BEFORE any auth/whitelist check below: these links
@@ -354,6 +358,20 @@ export default async function updateSession(request, baseResponse, locale) {
         response.cookies.delete(refreshTokenCookieName);
     }
     if (refreshedToken) {
+        // `response.cookies.set` only reaches the BROWSER — the current
+        // render still reads the old, expired token from `cookies()`, so
+        // `initializeServerApp` rejects it with `auth/invalid-user-token`.
+        // Writing to `request.cookies` and rebuilding the pass-through
+        // response from that request makes the fresh token visible to this
+        // render too.
+        request.cookies.set(sessionCookieName, refreshedToken.idToken);
+        request.cookies.set(refreshTokenCookieName, refreshedToken.refreshToken);
+        if (rebuildResponse && response === baseResponse) {
+            const rebuilt = rebuildResponse(request);
+            baseResponse.cookies.getAll().forEach((cookie) => rebuilt.cookies.set(cookie));
+            baseResponse.headers.forEach((value, key) => rebuilt.headers.set(key, value));
+            response = rebuilt;
+        }
         response.cookies.set(sessionCookieName, refreshedToken.idToken, {
             httpOnly: true,
             secure: request.nextUrl.protocol === 'https',

package/dist/src/firebase_auth/preserve_redirect_query.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Whether the firebase_auth redirects should carry the request's query
+ * string over to their target. Defaults to `true` — see
+ * `FirebaseAuthRoutingConfig.preserveRedirectQuery`.
+ */
+export declare function preserveRedirectQueryEnabled(): boolean;
+/**
+ * Appends `search` to a redirect target path, honoring the
+ * `preserveRedirectQuery` setting. Shared by all three places that redirect
+ * to `redirectAuthPath`/`homePath`/`verifyEmailPath` — the middleware
+ * (`update_session`), the RSC pre-render redirect
+ * (`resolveAuthUserAndRedirect`), and the client `AuthUserProvider` effect —
+ * so they can't drift apart on whether a query string survives.
+ *
+ * @param search Leading-`?` query string (`''` when there is none), from
+ *   `request.nextUrl.search`, the `x-search` header, or
+ *   `window.location.search` depending on the caller's runtime.
+ */
+export default function withRedirectQuery(target: string, search: string): string;

package/dist/src/firebase_auth/preserve_redirect_query.js

@@ -0,0 +1,26 @@
+import config from '@intl-config';
+/**
+ * Whether the firebase_auth redirects should carry the request's query
+ * string over to their target. Defaults to `true` — see
+ * `FirebaseAuthRoutingConfig.preserveRedirectQuery`.
+ */
+export function preserveRedirectQueryEnabled() {
+    return config.firebaseAuth?.preserveRedirectQuery !== false;
+}
+/**
+ * Appends `search` to a redirect target path, honoring the
+ * `preserveRedirectQuery` setting. Shared by all three places that redirect
+ * to `redirectAuthPath`/`homePath`/`verifyEmailPath` — the middleware
+ * (`update_session`), the RSC pre-render redirect
+ * (`resolveAuthUserAndRedirect`), and the client `AuthUserProvider` effect —
+ * so they can't drift apart on whether a query string survives.
+ *
+ * @param search Leading-`?` query string (`''` when there is none), from
+ *   `request.nextUrl.search`, the `x-search` header, or
+ *   `window.location.search` depending on the caller's runtime.
+ */
+export default function withRedirectQuery(target, search) {
+    if (!search || !preserveRedirectQueryEnabled())
+        return target;
+    return `${target}${search}`;
+}

package/dist/src/firebase_auth/server/auth_user_server_provider.js

@@ -5,6 +5,7 @@ import { redirect } from 'next/navigation';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
 import { getAuthenticatedAppForUser } from './firebase_server';
+import withRedirectQuery from '../preserve_redirect_query';
 const AuthUserProvider = dynamic(() => import('../client/auth_user_provider'));
 /**
  * Resolves the signed-in user from the session cookie and performs the
@@ -25,14 +26,19 @@ export async function resolveAuthUserAndRedirect() {
     const fa = config.firebaseAuth;
     requireFirebaseAuthConfig(fa);
     const { currentUser } = await getAuthenticatedAppForUser();
-    const path = (await headers()).get('x-pathname') ?? '/';
+    const requestHeaders = await headers();
+    const path = requestHeaders.get('x-pathname') ?? '/';
     const isAuthPage = fa.isAuthPath(path);
     const isWhiteListed = fa.whiteListPaths?.includes(path) ?? false;
+    // `x-pathname` is path-only, so the query string comes from `x-search`
+    // (set alongside it by `intlMiddleware`) — `redirect()` takes a plain
+    // string, not a URL.
+    const search = requestHeaders.get('x-search') ?? '';
     if (!isWhiteListed) {
         if (!currentUser && !isAuthPage)
-            redirect(fa.redirectAuthPath);
+            redirect(withRedirectQuery(fa.redirectAuthPath, search));
         if (currentUser && isAuthPage)
-            redirect(fa.homePath);
+            redirect(withRedirectQuery(fa.homePath, search));
     }
     return currentUser && {
         uid: currentUser.uid,

package/dist/src/firebase_auth/server/firebase_server.js

@@ -2,7 +2,7 @@ import { cookies } from 'next/headers';
 import { cache } from 'react';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { defaultAppCheckTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
+import { defaultAppCheckTokenCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName, isIdTokenExpired, refreshIdToken } from '../middleware/update_session';
 import reportError from '../../error_handling/report_error';
 import mintServerAppCheckToken from './mint_server_app_check_token';
 let baseApp;
@@ -22,8 +22,22 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
     requireFirebaseAuthConfig(fa);
     const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const appCheckTokenCookieName = fa.appCheckTokenCookieName ?? defaultAppCheckTokenCookieName;
+    const refreshTokenCookieName = fa.refreshTokenCookieName ?? defaultRefreshTokenCookieName;
     const cookieStore = await cookies();
-    const authIdToken = cookieStore.get(sessionCookieName)?.value;
+    let authIdToken = cookieStore.get(sessionCookieName)?.value;
+    // Safety net for the paths the middleware can't cover (prefetch requests,
+    // excluded matcher routes, server actions): an expired token would be
+    // rejected by `initializeServerApp` with `auth/invalid-user-token`, so
+    // mint a fresh one from the refresh-token cookie first. The refreshed
+    // token can't be written back to the cookie from here (RSC render), but
+    // the middleware persists it on the next request.
+    if (authIdToken && isIdTokenExpired(authIdToken)) {
+        const refreshToken = cookieStore.get(refreshTokenCookieName)?.value;
+        const result = refreshToken
+            ? await refreshIdToken(fa.apiKey, refreshToken)
+            : undefined;
+        authIdToken = result?.status === 'refreshed' ? result.idToken : undefined;
+    }
     if (!authIdToken) {
         return { firebaseServerApp: null, currentUser: null };
     }

package/dist/src/types/types.d.ts

@@ -495,6 +495,16 @@ export interface FirebaseAuthRoutingConfig {
      * auto-corrects a missing leading slash with a warning.
      */
     actionLinkPath?: string;
+    /**
+     * Whether the middleware's own redirects (`redirectAuthPath`, `homePath`,
+     * `verifyEmailPath`) carry over the original request's query string —
+     * e.g. `/login?ref=abc` stays `/login?ref=abc` after redirecting to
+     * `homePath` for a signed-in user, instead of dropping to `/`. Defaults
+     * to `true`. The emailed-action-link forward (see
+     * {@link resetPasswordPath}) always preserves its query string
+     * regardless of this setting, since `oobCode` must survive that hop.
+     */
+    preserveRedirectQuery?: boolean;
     /** Returns true if the given (locale-stripped) path is an auth page (login/signup/etc). */
     isAuthPath: (path: string) => boolean;
     /** Locale-stripped paths exempt from all auth redirects (e.g. public marketing pages). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.29",
+  "version": "0.6.31",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",