cloudflare-next-intl 0.6.30 → 0.6.31

package/dist/src/config/middleware.js

@@ -128,6 +128,7 @@ export default async function intlMiddleware(request, options) {
         }
         response.headers.set('Content-Language', effectiveLocaleForRequest);
         response.headers.set('x-pathname', pathWithoutLocale);
+        response.headers.set('x-search', search);
         // Auto-wires the firebase_auth submodule's redirect/session-refresh
         // logic when `firebaseAuth` is configured — dynamic import so this
         // file never pulls in firebase_auth/** (and transitively firebase/*)

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -10,6 +10,7 @@ import { setAuthUserCache } from './auth_user_cache';
 import { defaultAppCheckTokenCookieName, defaultEmailVerifiedHintCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
 import decodeJwtPayload from '../decode_jwt_payload';
 import isWhitelisted from '../is_whitelisted';
+import withRedirectQuery from '../preserve_redirect_query';
 import setCookie from '../../client/functions/set_cookie';
 import getCookie from '../../client/functions/get_cookie';
 import clearSessionAction from '../server/clear_session_action';
@@ -155,14 +156,14 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             // Signed-out on an auth page is where they're supposed to be —
             // only bounce a signed-out user away from a NON-auth page.
             if (!isAuthPage && confirmedSignedOut)
-                router.replace(fa.redirectAuthPath);
+                router.replace(withRedirectQuery(fa.redirectAuthPath, window.location.search));
         }
         else if (fa.verifyEmailPath && !user.emailVerified && pathname !== fa.verifyEmailPath) {
             // Checked before the auth-page redirect below (mirrors
             // `update_session.ts`'s same ordering): an unverified signed-in
             // user must land on verifyEmailPath even if they navigated to
             // an auth page like /login — homePath isn't reachable yet either.
-            router.replace(fa.verifyEmailPath);
+            router.replace(withRedirectQuery(fa.verifyEmailPath, window.location.search));
         }
         else if (isAuthPage || (fa.verifyEmailPath && user.emailVerified && pathname === fa.verifyEmailPath)) {
             // Mirrors the middleware's own signed-in-on-auth-page redirect
@@ -173,7 +174,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             // there until a hard refresh. A verified user reaching
             // verifyEmailPath itself gets the same "go home" treatment —
             // they're done here, same as the auth-page case.
-            router.replace(fa.homePath);
+            router.replace(withRedirectQuery(fa.homePath, window.location.search));
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [state, pathname, isAuthPage, isWhiteListed, confirmedSignedOut]);

package/dist/src/firebase_auth/middleware/update_session.js

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server';
 import config from '@intl-config';
 import decodeJwtPayload from '../decode_jwt_payload';
 import isWhitelisted from '../is_whitelisted';
+import withRedirectQuery from '../preserve_redirect_query';
 export const defaultSessionCookieName = '__fa_session__';
 export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 // Non-httpOnly: written by AuthUserProvider (client) every time it observes
@@ -203,7 +204,7 @@ export default async function updateSession(request, baseResponse, locale, rebui
         return baseResponse;
     }
     const localePrefix = locale === config.defaultLocale ? '' : requestPrefix;
-    const localeUrl = (target) => new URL(`${localePrefix}${target === '/' ? '' : target}` || '/', request.url);
+    const localeUrl = (target) => new URL(withRedirectQuery(`${localePrefix}${target === '/' ? '' : target}` || '/', request.nextUrl.search), request.url);
     // Emailed Firebase action links all arrive on the single project-wide
     // action URL carrying `?mode=<action>&oobCode=...`. Forward them to the
     // page for that mode BEFORE any auth/whitelist check below: these links

package/dist/src/firebase_auth/preserve_redirect_query.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Whether the firebase_auth redirects should carry the request's query
+ * string over to their target. Defaults to `true` — see
+ * `FirebaseAuthRoutingConfig.preserveRedirectQuery`.
+ */
+export declare function preserveRedirectQueryEnabled(): boolean;
+/**
+ * Appends `search` to a redirect target path, honoring the
+ * `preserveRedirectQuery` setting. Shared by all three places that redirect
+ * to `redirectAuthPath`/`homePath`/`verifyEmailPath` — the middleware
+ * (`update_session`), the RSC pre-render redirect
+ * (`resolveAuthUserAndRedirect`), and the client `AuthUserProvider` effect —
+ * so they can't drift apart on whether a query string survives.
+ *
+ * @param search Leading-`?` query string (`''` when there is none), from
+ *   `request.nextUrl.search`, the `x-search` header, or
+ *   `window.location.search` depending on the caller's runtime.
+ */
+export default function withRedirectQuery(target: string, search: string): string;

package/dist/src/firebase_auth/preserve_redirect_query.js

@@ -0,0 +1,26 @@
+import config from '@intl-config';
+/**
+ * Whether the firebase_auth redirects should carry the request's query
+ * string over to their target. Defaults to `true` — see
+ * `FirebaseAuthRoutingConfig.preserveRedirectQuery`.
+ */
+export function preserveRedirectQueryEnabled() {
+    return config.firebaseAuth?.preserveRedirectQuery !== false;
+}
+/**
+ * Appends `search` to a redirect target path, honoring the
+ * `preserveRedirectQuery` setting. Shared by all three places that redirect
+ * to `redirectAuthPath`/`homePath`/`verifyEmailPath` — the middleware
+ * (`update_session`), the RSC pre-render redirect
+ * (`resolveAuthUserAndRedirect`), and the client `AuthUserProvider` effect —
+ * so they can't drift apart on whether a query string survives.
+ *
+ * @param search Leading-`?` query string (`''` when there is none), from
+ *   `request.nextUrl.search`, the `x-search` header, or
+ *   `window.location.search` depending on the caller's runtime.
+ */
+export default function withRedirectQuery(target, search) {
+    if (!search || !preserveRedirectQueryEnabled())
+        return target;
+    return `${target}${search}`;
+}

package/dist/src/firebase_auth/server/auth_user_server_provider.js

@@ -5,6 +5,7 @@ import { redirect } from 'next/navigation';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
 import { getAuthenticatedAppForUser } from './firebase_server';
+import withRedirectQuery from '../preserve_redirect_query';
 const AuthUserProvider = dynamic(() => import('../client/auth_user_provider'));
 /**
  * Resolves the signed-in user from the session cookie and performs the
@@ -25,14 +26,19 @@ export async function resolveAuthUserAndRedirect() {
     const fa = config.firebaseAuth;
     requireFirebaseAuthConfig(fa);
     const { currentUser } = await getAuthenticatedAppForUser();
-    const path = (await headers()).get('x-pathname') ?? '/';
+    const requestHeaders = await headers();
+    const path = requestHeaders.get('x-pathname') ?? '/';
     const isAuthPage = fa.isAuthPath(path);
     const isWhiteListed = fa.whiteListPaths?.includes(path) ?? false;
+    // `x-pathname` is path-only, so the query string comes from `x-search`
+    // (set alongside it by `intlMiddleware`) — `redirect()` takes a plain
+    // string, not a URL.
+    const search = requestHeaders.get('x-search') ?? '';
     if (!isWhiteListed) {
         if (!currentUser && !isAuthPage)
-            redirect(fa.redirectAuthPath);
+            redirect(withRedirectQuery(fa.redirectAuthPath, search));
         if (currentUser && isAuthPage)
-            redirect(fa.homePath);
+            redirect(withRedirectQuery(fa.homePath, search));
     }
     return currentUser && {
         uid: currentUser.uid,

package/dist/src/types/types.d.ts

@@ -495,6 +495,16 @@ export interface FirebaseAuthRoutingConfig {
      * auto-corrects a missing leading slash with a warning.
      */
     actionLinkPath?: string;
+    /**
+     * Whether the middleware's own redirects (`redirectAuthPath`, `homePath`,
+     * `verifyEmailPath`) carry over the original request's query string —
+     * e.g. `/login?ref=abc` stays `/login?ref=abc` after redirecting to
+     * `homePath` for a signed-in user, instead of dropping to `/`. Defaults
+     * to `true`. The emailed-action-link forward (see
+     * {@link resetPasswordPath}) always preserves its query string
+     * regardless of this setting, since `oobCode` must survive that hop.
+     */
+    preserveRedirectQuery?: boolean;
     /** Returns true if the given (locale-stripped) path is an auth page (login/signup/etc). */
     isAuthPath: (path: string) => boolean;
     /** Locale-stripped paths exempt from all auth redirects (e.g. public marketing pages). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.30",
+  "version": "0.6.31",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",