cloudflare-next-intl 0.6.30 → 0.6.32

package/dist/src/config/middleware.js

@@ -128,6 +128,7 @@ export default async function intlMiddleware(request, options) {
         }
         response.headers.set('Content-Language', effectiveLocaleForRequest);
         response.headers.set('x-pathname', pathWithoutLocale);
+        response.headers.set('x-search', search);
         // Auto-wires the firebase_auth submodule's redirect/session-refresh
         // logic when `firebaseAuth` is configured — dynamic import so this
         // file never pulls in firebase_auth/** (and transitively firebase/*)

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -10,6 +10,7 @@ import { setAuthUserCache } from './auth_user_cache';
 import { defaultAppCheckTokenCookieName, defaultEmailVerifiedHintCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
 import decodeJwtPayload from '../decode_jwt_payload';
 import isWhitelisted from '../is_whitelisted';
+import withRedirectQuery from '../preserve_redirect_query';
 import setCookie from '../../client/functions/set_cookie';
 import getCookie from '../../client/functions/get_cookie';
 import clearSessionAction from '../server/clear_session_action';
@@ -155,14 +156,14 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             // Signed-out on an auth page is where they're supposed to be —
             // only bounce a signed-out user away from a NON-auth page.
             if (!isAuthPage && confirmedSignedOut)
-                router.replace(fa.redirectAuthPath);
+                router.replace(withRedirectQuery(fa.redirectAuthPath, window.location.search));
         }
         else if (fa.verifyEmailPath && !user.emailVerified && pathname !== fa.verifyEmailPath) {
             // Checked before the auth-page redirect below (mirrors
             // `update_session.ts`'s same ordering): an unverified signed-in
             // user must land on verifyEmailPath even if they navigated to
             // an auth page like /login — homePath isn't reachable yet either.
-            router.replace(fa.verifyEmailPath);
+            router.replace(withRedirectQuery(fa.verifyEmailPath, window.location.search));
         }
         else if (isAuthPage || (fa.verifyEmailPath && user.emailVerified && pathname === fa.verifyEmailPath)) {
             // Mirrors the middleware's own signed-in-on-auth-page redirect
@@ -173,7 +174,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             // there until a hard refresh. A verified user reaching
             // verifyEmailPath itself gets the same "go home" treatment —
             // they're done here, same as the auth-page case.
-            router.replace(fa.homePath);
+            router.replace(withRedirectQuery(fa.homePath, window.location.search));
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [state, pathname, isAuthPage, isWhiteListed, confirmedSignedOut]);

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -1,9 +1,24 @@
 import { NextResponse, type NextRequest } from 'next/server';
+import config from '@intl-config';
 export declare const defaultSessionCookieName = "__fa_session__";
 export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
 export declare const defaultEmailVerifiedHintCookieName = "__fa_email_verified_hint__";
 export declare const defaultAppCheckTokenCookieName = "__fa_app_check_token__";
 export declare const defaultResetPasswordPath = "/reset-password";
+export declare const DEFAULT_SESSION_MAX_AGE: number;
+export declare const DEFAULT_REFRESH_MAX_AGE: number;
+/**
+ * The session/refresh cookie attributes, shared by every writer so the
+ * middleware and the RSC-side refresh can't drift into writing the same
+ * cookie pair with different flags or lifetimes.
+ *
+ * @param secure `false` only for a plain-http local dev origin — a `secure`
+ *   cookie is silently dropped there.
+ */
+export declare function sessionCookieOptions(fa: NonNullable<typeof config.firebaseAuth>, secure: boolean): {
+    session: Record<string, unknown>;
+    refresh: Record<string, unknown>;
+};
 export declare function isIdTokenExpired(token: string): boolean;
 export type RefreshResult = {
     status: 'refreshed';
@@ -20,7 +35,9 @@ export type RefreshResult = {
  * runtime, and `firebase/auth` pulls in Node-only APIs that break Edge
  * bundles even though this function never touches that module.
  */
-export declare function refreshIdToken(apiKey: string, refreshToken: string): Promise<RefreshResult>;
+export declare function refreshIdToken(apiKey: string, refreshToken: string, options?: {
+    skipCache?: boolean;
+}): Promise<RefreshResult>;
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`

package/dist/src/firebase_auth/middleware/update_session.js

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server';
 import config from '@intl-config';
 import decodeJwtPayload from '../decode_jwt_payload';
 import isWhitelisted from '../is_whitelisted';
+import withRedirectQuery from '../preserve_redirect_query';
 export const defaultSessionCookieName = '__fa_session__';
 export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 // Non-httpOnly: written by AuthUserProvider (client) every time it observes
@@ -36,8 +37,23 @@ function resolveActionModePaths(fa) {
         paths.recoverEmail = fa.recoverEmailPath;
     return { ...paths, ...fa.actionModePaths };
 }
-const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
-const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
+export const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
+export const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
+/**
+ * The session/refresh cookie attributes, shared by every writer so the
+ * middleware and the RSC-side refresh can't drift into writing the same
+ * cookie pair with different flags or lifetimes.
+ *
+ * @param secure `false` only for a plain-http local dev origin — a `secure`
+ *   cookie is silently dropped there.
+ */
+export function sessionCookieOptions(fa, secure) {
+    const shared = { httpOnly: true, secure, sameSite: 'lax', path: '/' };
+    return {
+        session: { ...shared, maxAge: fa.sessionCookieMaxAge ?? DEFAULT_SESSION_MAX_AGE },
+        refresh: { ...shared, maxAge: fa.refreshTokenCookieMaxAge ?? DEFAULT_REFRESH_MAX_AGE },
+    };
+}
 // Refresh slightly before the real expiry — treating a token as expired
 // right up to its last second means normal clock skew or in-flight request
 // time can hand a client a token that dies moments after this check, forcing
@@ -67,7 +83,7 @@ function isJwtExpired(token) {
 // `.internal` is a non-resolvable TLD reserved by convention — no real
 // `fetch()` in this Worker could ever have populated (or could ever
 // collide with) an entry under it.
-const REFRESH_CACHE_TTL_SECONDS = 50 * 60;
+const REFRESH_CACHE_TTL_SECONDS = 30 * 60;
 const REFRESH_CACHE_KEY_ORIGIN = 'https://firebase-auth-refresh-cache.internal';
 function getEdgeCache() {
     const cachesApi = globalThis.caches;
@@ -129,9 +145,13 @@ const INVALID_REFRESH_TOKEN_ERRORS = new Set([
  * runtime, and `firebase/auth` pulls in Node-only APIs that break Edge
  * bundles even though this function never touches that module.
  */
-export async function refreshIdToken(apiKey, refreshToken) {
-    const cached = await getCachedRefresh(refreshToken);
-    if (cached)
+export async function refreshIdToken(apiKey, refreshToken, options) {
+    // `skipCache` exists for the caller that already HAS a token the Auth
+    // service rejected: the cache entry is what produced that token, so a
+    // normal cache hit would hand back the exact same rejected token and the
+    // retry could never recover.
+    const cached = options?.skipCache ? null : await getCachedRefresh(refreshToken);
+    if (cached && !isJwtExpired(cached.idToken))
         return { status: 'refreshed', ...cached };
     try {
         const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${apiKey}`, {
@@ -203,7 +223,7 @@ export default async function updateSession(request, baseResponse, locale, rebui
         return baseResponse;
     }
     const localePrefix = locale === config.defaultLocale ? '' : requestPrefix;
-    const localeUrl = (target) => new URL(`${localePrefix}${target === '/' ? '' : target}` || '/', request.url);
+    const localeUrl = (target) => new URL(withRedirectQuery(`${localePrefix}${target === '/' ? '' : target}` || '/', request.nextUrl.search), request.url);
     // Emailed Firebase action links all arrive on the single project-wide
     // action URL carrying `?mode=<action>&oobCode=...`. Forward them to the
     // page for that mode BEFORE any auth/whitelist check below: these links
@@ -371,20 +391,9 @@ export default async function updateSession(request, baseResponse, locale, rebui
             baseResponse.headers.forEach((value, key) => rebuilt.headers.set(key, value));
             response = rebuilt;
         }
-        response.cookies.set(sessionCookieName, refreshedToken.idToken, {
-            httpOnly: true,
-            secure: request.nextUrl.protocol === 'https',
-            sameSite: 'lax',
-            path: '/',
-            maxAge: fa.sessionCookieMaxAge ?? DEFAULT_SESSION_MAX_AGE,
-        });
-        response.cookies.set(refreshTokenCookieName, refreshedToken.refreshToken, {
-            httpOnly: true,
-            secure: request.nextUrl.protocol === 'https',
-            sameSite: 'lax',
-            path: '/',
-            maxAge: fa.refreshTokenCookieMaxAge ?? DEFAULT_REFRESH_MAX_AGE,
-        });
+        const cookieOptions = sessionCookieOptions(fa, request.nextUrl.protocol === 'https');
+        response.cookies.set(sessionCookieName, refreshedToken.idToken, cookieOptions.session);
+        response.cookies.set(refreshTokenCookieName, refreshedToken.refreshToken, cookieOptions.refresh);
     }
     return response;
 }

package/dist/src/firebase_auth/preserve_redirect_query.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Whether the firebase_auth redirects should carry the request's query
+ * string over to their target. Defaults to `true` — see
+ * `FirebaseAuthRoutingConfig.preserveRedirectQuery`.
+ */
+export declare function preserveRedirectQueryEnabled(): boolean;
+/**
+ * Appends `search` to a redirect target path, honoring the
+ * `preserveRedirectQuery` setting. Shared by all three places that redirect
+ * to `redirectAuthPath`/`homePath`/`verifyEmailPath` — the middleware
+ * (`update_session`), the RSC pre-render redirect
+ * (`resolveAuthUserAndRedirect`), and the client `AuthUserProvider` effect —
+ * so they can't drift apart on whether a query string survives.
+ *
+ * @param search Leading-`?` query string (`''` when there is none), from
+ *   `request.nextUrl.search`, the `x-search` header, or
+ *   `window.location.search` depending on the caller's runtime.
+ */
+export default function withRedirectQuery(target: string, search: string): string;

package/dist/src/firebase_auth/preserve_redirect_query.js

@@ -0,0 +1,26 @@
+import config from '@intl-config';
+/**
+ * Whether the firebase_auth redirects should carry the request's query
+ * string over to their target. Defaults to `true` — see
+ * `FirebaseAuthRoutingConfig.preserveRedirectQuery`.
+ */
+export function preserveRedirectQueryEnabled() {
+    return config.firebaseAuth?.preserveRedirectQuery !== false;
+}
+/**
+ * Appends `search` to a redirect target path, honoring the
+ * `preserveRedirectQuery` setting. Shared by all three places that redirect
+ * to `redirectAuthPath`/`homePath`/`verifyEmailPath` — the middleware
+ * (`update_session`), the RSC pre-render redirect
+ * (`resolveAuthUserAndRedirect`), and the client `AuthUserProvider` effect —
+ * so they can't drift apart on whether a query string survives.
+ *
+ * @param search Leading-`?` query string (`''` when there is none), from
+ *   `request.nextUrl.search`, the `x-search` header, or
+ *   `window.location.search` depending on the caller's runtime.
+ */
+export default function withRedirectQuery(target, search) {
+    if (!search || !preserveRedirectQueryEnabled())
+        return target;
+    return `${target}${search}`;
+}

package/dist/src/firebase_auth/server/auth_user_server_provider.js

@@ -5,6 +5,7 @@ import { redirect } from 'next/navigation';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
 import { getAuthenticatedAppForUser } from './firebase_server';
+import withRedirectQuery from '../preserve_redirect_query';
 const AuthUserProvider = dynamic(() => import('../client/auth_user_provider'));
 /**
  * Resolves the signed-in user from the session cookie and performs the
@@ -25,14 +26,19 @@ export async function resolveAuthUserAndRedirect() {
     const fa = config.firebaseAuth;
     requireFirebaseAuthConfig(fa);
     const { currentUser } = await getAuthenticatedAppForUser();
-    const path = (await headers()).get('x-pathname') ?? '/';
+    const requestHeaders = await headers();
+    const path = requestHeaders.get('x-pathname') ?? '/';
     const isAuthPage = fa.isAuthPath(path);
     const isWhiteListed = fa.whiteListPaths?.includes(path) ?? false;
+    // `x-pathname` is path-only, so the query string comes from `x-search`
+    // (set alongside it by `intlMiddleware`) — `redirect()` takes a plain
+    // string, not a URL.
+    const search = requestHeaders.get('x-search') ?? '';
     if (!isWhiteListed) {
         if (!currentUser && !isAuthPage)
-            redirect(fa.redirectAuthPath);
+            redirect(withRedirectQuery(fa.redirectAuthPath, search));
         if (currentUser && isAuthPage)
-            redirect(fa.homePath);
+            redirect(withRedirectQuery(fa.homePath, search));
     }
     return currentUser && {
         uid: currentUser.uid,

package/dist/src/firebase_auth/server/firebase_server.d.ts

@@ -3,9 +3,10 @@ import type { User } from 'firebase/auth';
 /**
  * Resolves the signed-in user on the server from the session cookie.
  * `initializeServerApp` validates the token with the Auth service, so a
- * missing, expired, or forged token yields `currentUser === null`.
- * Wrapped in React's `cache()` so multiple server components in one request
- * share a single Auth service lookup. Lazily imports `firebase/app`/
+ * missing, expired, or forged token yields `currentUser === null` — in which
+ * case one refresh from the refresh-token cookie is attempted before giving
+ * up. Wrapped in React's `cache()` so multiple server components in one
+ * request share a single Auth service lookup. Lazily imports `firebase/app`/
  * `firebase/auth` — never touched unless this is actually called, and
  * throws if `firebaseAuth` is missing from `RoutingConfig`.
  */

package/dist/src/firebase_auth/server/firebase_server.js

@@ -2,18 +2,39 @@ import { cookies } from 'next/headers';
 import { cache } from 'react';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { defaultAppCheckTokenCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName, isIdTokenExpired, refreshIdToken } from '../middleware/update_session';
+import { defaultAppCheckTokenCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName, isIdTokenExpired, refreshIdToken, sessionCookieOptions } from '../middleware/update_session';
 import reportError from '../../error_handling/report_error';
 import mintServerAppCheckToken from './mint_server_app_check_token';
 let baseApp;
 let firebaseAppModule;
 let firebaseAuthModule;
+/**
+ * Writes a freshly-minted session/refresh pair back to the cookie jar so the
+ * NEXT request doesn't repeat the rejected-token round-trip. Next only allows
+ * cookie writes from Server Actions and Route Handlers — during an RSC render
+ * this throws, which is expected and harmless: the middleware persists the
+ * same pair on the following request, so this is a best-effort shortcut only.
+ */
+function persistRefreshedSession(cookieStore, sessionCookieName, refreshTokenCookieName, idToken, refreshToken) {
+    // No request URL here (unlike the middleware), so `secure` can't be
+    // derived from the protocol — always secure, which is correct for every
+    // origin a session cookie should be sent to anyway.
+    const options = sessionCookieOptions(config.firebaseAuth, true);
+    try {
+        cookieStore.set(sessionCookieName, idToken, options.session);
+        cookieStore.set(refreshTokenCookieName, refreshToken, options.refresh);
+    }
+    catch {
+        // Read-only cookie jar (RSC render) — middleware handles it next request.
+    }
+}
 /**
  * Resolves the signed-in user on the server from the session cookie.
  * `initializeServerApp` validates the token with the Auth service, so a
- * missing, expired, or forged token yields `currentUser === null`.
- * Wrapped in React's `cache()` so multiple server components in one request
- * share a single Auth service lookup. Lazily imports `firebase/app`/
+ * missing, expired, or forged token yields `currentUser === null` — in which
+ * case one refresh from the refresh-token cookie is attempted before giving
+ * up. Wrapped in React's `cache()` so multiple server components in one
+ * request share a single Auth service lookup. Lazily imports `firebase/app`/
  * `firebase/auth` — never touched unless this is actually called, and
  * throws if `firebaseAuth` is missing from `RoutingConfig`.
  */
@@ -60,7 +81,14 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
     // behavior.
     const appCheckToken = cookieStore.get(appCheckTokenCookieName)?.value
         ?? await mintServerAppCheckToken(fa.projectId, fa.apiKey, fa.appCheck);
-    try {
+    // A token that isn't merely expired-by-clock (revoked session, password
+    // change, a token minted for a different project) is rejected with
+    // `auth/invalid-user-token`. `initializeServerApp` does NOT surface that
+    // as a rejection though — it logs "FirebaseServerApp could not login user
+    // with provided authIdToken" itself and simply resolves `authStateReady()`
+    // with `currentUser === null`. So a null user (not a throw) is the signal
+    // to drop the bad token and mint a replacement from the refresh cookie.
+    const attempt = async (idToken) => {
         if (!firebaseAppModule)
             firebaseAppModule = await import('firebase/app');
         if (!firebaseAuthModule)
@@ -83,12 +111,46 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
         // registering a new named app in Firebase's global app registry.
         if (!baseApp)
             baseApp = initializeApp(firebaseConfig, 'firebase-auth-server-base');
-        const firebaseServerApp = initializeServerApp(baseApp, { authIdToken, appCheckToken });
+        const firebaseServerApp = initializeServerApp(baseApp, { authIdToken: idToken, appCheckToken });
         const auth = getAuth(firebaseServerApp);
         await auth.authStateReady();
         return { firebaseServerApp, currentUser: auth.currentUser };
+    };
+    const retryWithFreshToken = async (rejectedToken) => {
+        const refreshToken = cookieStore.get(refreshTokenCookieName)?.value;
+        if (!refreshToken)
+            return { firebaseServerApp: null, currentUser: null };
+        // The cached entry is what produced `rejectedToken` in the first
+        // place, so a plain refresh would hand back the same rejected token.
+        const result = await refreshIdToken(fa.apiKey, refreshToken, { skipCache: true });
+        if (result.status !== 'refreshed' || result.idToken === rejectedToken) {
+            return { firebaseServerApp: null, currentUser: null };
+        }
+        try {
+            const retried = await attempt(result.idToken);
+            if (retried.currentUser) {
+                persistRefreshedSession(cookieStore, sessionCookieName, refreshTokenCookieName, result.idToken, result.refreshToken);
+            }
+            return retried;
+        }
+        catch (retryError) {
+            await reportError(config, { error: retryError, classOrMethodName: 'getAuthenticatedAppForUser' });
+            return { firebaseServerApp: null, currentUser: null };
+        }
+    };
+    try {
+        const first = await attempt(authIdToken);
+        // `initializeServerApp` reports an invalid/revoked token by resolving
+        // with a null user rather than throwing — retry rather than render
+        // this request as signed-out.
+        if (!first.currentUser)
+            return await retryWithFreshToken(authIdToken);
+        return first;
     }
     catch (error) {
+        if (error?.code === 'auth/invalid-user-token') {
+            return await retryWithFreshToken(authIdToken);
+        }
         await reportError(config, { error, classOrMethodName: 'getAuthenticatedAppForUser' });
         return { firebaseServerApp: null, currentUser: null };
     }

package/dist/src/types/types.d.ts

@@ -495,6 +495,16 @@ export interface FirebaseAuthRoutingConfig {
      * auto-corrects a missing leading slash with a warning.
      */
     actionLinkPath?: string;
+    /**
+     * Whether the middleware's own redirects (`redirectAuthPath`, `homePath`,
+     * `verifyEmailPath`) carry over the original request's query string —
+     * e.g. `/login?ref=abc` stays `/login?ref=abc` after redirecting to
+     * `homePath` for a signed-in user, instead of dropping to `/`. Defaults
+     * to `true`. The emailed-action-link forward (see
+     * {@link resetPasswordPath}) always preserves its query string
+     * regardless of this setting, since `oobCode` must survive that hop.
+     */
+    preserveRedirectQuery?: boolean;
     /** Returns true if the given (locale-stripped) path is an auth page (login/signup/etc). */
     isAuthPath: (path: string) => boolean;
     /** Locale-stripped paths exempt from all auth redirects (e.g. public marketing pages). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.30",
+  "version": "0.6.32",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",