cloudflare-next-intl 0.6.31 → 0.6.33

package/dist/src/error_handling/default_ignored_console_errors.js

@@ -24,8 +24,15 @@ export const defaultIgnoredConsoleErrors = [
     'auth/expired-action-code',
     'auth/invalid-action-code',
     'auth/user-token-expired',
+    // Logged by `initializeServerApp` itself (not thrown) when a session
+    // cookie's token is revoked/stale — `getAuthenticatedAppForUser` already
+    // handles it by refreshing and retrying, so it's noise, not a bug.
+    'auth/invalid-user-token',
+    'FirebaseServerApp could not login user with provided authIdToken',
     'The `punycode` module is deprecated. Please use a userland alternative instead.',
     'failed to pipe response',
+    "FirebaseServerApp authIdToken is invalid: the token has expired.",
+    "failed Error: Database is closing/hidden",
     'Failed to fetch RSC payload',
     ...(process.env.NODE_ENV === 'development'
         ? ['A DurableObjectNamespace in the config referenced the class "DOQueueHandler", but no such Durable Object class is exported from the worker. Please make sure the class name matches,']

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -1,9 +1,24 @@
 import { NextResponse, type NextRequest } from 'next/server';
+import config from '@intl-config';
 export declare const defaultSessionCookieName = "__fa_session__";
 export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
 export declare const defaultEmailVerifiedHintCookieName = "__fa_email_verified_hint__";
 export declare const defaultAppCheckTokenCookieName = "__fa_app_check_token__";
 export declare const defaultResetPasswordPath = "/reset-password";
+export declare const DEFAULT_SESSION_MAX_AGE: number;
+export declare const DEFAULT_REFRESH_MAX_AGE: number;
+/**
+ * The session/refresh cookie attributes, shared by every writer so the
+ * middleware and the RSC-side refresh can't drift into writing the same
+ * cookie pair with different flags or lifetimes.
+ *
+ * @param secure `false` only for a plain-http local dev origin — a `secure`
+ *   cookie is silently dropped there.
+ */
+export declare function sessionCookieOptions(fa: NonNullable<typeof config.firebaseAuth>, secure: boolean): {
+    session: Record<string, unknown>;
+    refresh: Record<string, unknown>;
+};
 export declare function isIdTokenExpired(token: string): boolean;
 export type RefreshResult = {
     status: 'refreshed';
@@ -20,7 +35,9 @@ export type RefreshResult = {
  * runtime, and `firebase/auth` pulls in Node-only APIs that break Edge
  * bundles even though this function never touches that module.
  */
-export declare function refreshIdToken(apiKey: string, refreshToken: string): Promise<RefreshResult>;
+export declare function refreshIdToken(apiKey: string, refreshToken: string, options?: {
+    skipCache?: boolean;
+}): Promise<RefreshResult>;
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`

package/dist/src/firebase_auth/middleware/update_session.js

@@ -37,8 +37,23 @@ function resolveActionModePaths(fa) {
         paths.recoverEmail = fa.recoverEmailPath;
     return { ...paths, ...fa.actionModePaths };
 }
-const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
-const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
+export const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
+export const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
+/**
+ * The session/refresh cookie attributes, shared by every writer so the
+ * middleware and the RSC-side refresh can't drift into writing the same
+ * cookie pair with different flags or lifetimes.
+ *
+ * @param secure `false` only for a plain-http local dev origin — a `secure`
+ *   cookie is silently dropped there.
+ */
+export function sessionCookieOptions(fa, secure) {
+    const shared = { httpOnly: true, secure, sameSite: 'lax', path: '/' };
+    return {
+        session: { ...shared, maxAge: fa.sessionCookieMaxAge ?? DEFAULT_SESSION_MAX_AGE },
+        refresh: { ...shared, maxAge: fa.refreshTokenCookieMaxAge ?? DEFAULT_REFRESH_MAX_AGE },
+    };
+}
 // Refresh slightly before the real expiry — treating a token as expired
 // right up to its last second means normal clock skew or in-flight request
 // time can hand a client a token that dies moments after this check, forcing
@@ -68,7 +83,7 @@ function isJwtExpired(token) {
 // `.internal` is a non-resolvable TLD reserved by convention — no real
 // `fetch()` in this Worker could ever have populated (or could ever
 // collide with) an entry under it.
-const REFRESH_CACHE_TTL_SECONDS = 50 * 60;
+const REFRESH_CACHE_TTL_SECONDS = 30 * 60;
 const REFRESH_CACHE_KEY_ORIGIN = 'https://firebase-auth-refresh-cache.internal';
 function getEdgeCache() {
     const cachesApi = globalThis.caches;
@@ -130,9 +145,13 @@ const INVALID_REFRESH_TOKEN_ERRORS = new Set([
  * runtime, and `firebase/auth` pulls in Node-only APIs that break Edge
  * bundles even though this function never touches that module.
  */
-export async function refreshIdToken(apiKey, refreshToken) {
-    const cached = await getCachedRefresh(refreshToken);
-    if (cached)
+export async function refreshIdToken(apiKey, refreshToken, options) {
+    // `skipCache` exists for the caller that already HAS a token the Auth
+    // service rejected: the cache entry is what produced that token, so a
+    // normal cache hit would hand back the exact same rejected token and the
+    // retry could never recover.
+    const cached = options?.skipCache ? null : await getCachedRefresh(refreshToken);
+    if (cached && !isJwtExpired(cached.idToken))
         return { status: 'refreshed', ...cached };
     try {
         const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${apiKey}`, {
@@ -283,6 +302,26 @@ export default async function updateSession(request, baseResponse, locale, rebui
     // the claim is still accurate. Only when the hint AGREES with the claim
     // is a refresh skipped, so a genuinely unverified user with an
     // established, agreeing hint doesn't pay a refresh on every request.
+    // On verifyEmailPath itself the branch above deliberately never runs, so
+    // a token minted before the user verified keeps the page pinned even
+    // after the client has confirmed verification and mirrored it into the
+    // hint cookie. Refresh once when the hint claims `true` against a stale
+    // `false` claim, so the redirect-home branch below can observe it.
+    if (isVerifyEmailPage && hasSession && !refreshedToken
+        && decodeJwtPayload(token)?.email_verified === false
+        && request.cookies.get(emailVerifiedHintCookieName)?.value === 'true') {
+        const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
+        if (refreshToken) {
+            const result = await refreshIdToken(fa.apiKey, refreshToken);
+            if (result.status === 'refreshed') {
+                refreshedToken = { idToken: result.idToken, refreshToken: result.refreshToken };
+                token = refreshedToken.idToken;
+            }
+            else if (result.status === 'invalid') {
+                clearInvalidSession = true;
+            }
+        }
+    }
     let unverifiedEmail = false;
     if (fa.verifyEmailPath && !isVerifyEmailPage && hasSession && decodeJwtPayload(token)?.email_verified === false) {
         const hint = request.cookies.get(emailVerifiedHintCookieName)?.value;
@@ -372,20 +411,9 @@ export default async function updateSession(request, baseResponse, locale, rebui
             baseResponse.headers.forEach((value, key) => rebuilt.headers.set(key, value));
             response = rebuilt;
         }
-        response.cookies.set(sessionCookieName, refreshedToken.idToken, {
-            httpOnly: true,
-            secure: request.nextUrl.protocol === 'https',
-            sameSite: 'lax',
-            path: '/',
-            maxAge: fa.sessionCookieMaxAge ?? DEFAULT_SESSION_MAX_AGE,
-        });
-        response.cookies.set(refreshTokenCookieName, refreshedToken.refreshToken, {
-            httpOnly: true,
-            secure: request.nextUrl.protocol === 'https',
-            sameSite: 'lax',
-            path: '/',
-            maxAge: fa.refreshTokenCookieMaxAge ?? DEFAULT_REFRESH_MAX_AGE,
-        });
+        const cookieOptions = sessionCookieOptions(fa, request.nextUrl.protocol === 'https');
+        response.cookies.set(sessionCookieName, refreshedToken.idToken, cookieOptions.session);
+        response.cookies.set(refreshTokenCookieName, refreshedToken.refreshToken, cookieOptions.refresh);
     }
     return response;
 }

package/dist/src/firebase_auth/server/firebase_server.d.ts

@@ -3,9 +3,10 @@ import type { User } from 'firebase/auth';
 /**
  * Resolves the signed-in user on the server from the session cookie.
  * `initializeServerApp` validates the token with the Auth service, so a
- * missing, expired, or forged token yields `currentUser === null`.
- * Wrapped in React's `cache()` so multiple server components in one request
- * share a single Auth service lookup. Lazily imports `firebase/app`/
+ * missing, expired, or forged token yields `currentUser === null` — in which
+ * case one refresh from the refresh-token cookie is attempted before giving
+ * up. Wrapped in React's `cache()` so multiple server components in one
+ * request share a single Auth service lookup. Lazily imports `firebase/app`/
  * `firebase/auth` — never touched unless this is actually called, and
  * throws if `firebaseAuth` is missing from `RoutingConfig`.
  */

package/dist/src/firebase_auth/server/firebase_server.js

@@ -2,18 +2,39 @@ import { cookies } from 'next/headers';
 import { cache } from 'react';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { defaultAppCheckTokenCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName, isIdTokenExpired, refreshIdToken } from '../middleware/update_session';
+import { defaultAppCheckTokenCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName, isIdTokenExpired, refreshIdToken, sessionCookieOptions } from '../middleware/update_session';
 import reportError from '../../error_handling/report_error';
 import mintServerAppCheckToken from './mint_server_app_check_token';
 let baseApp;
 let firebaseAppModule;
 let firebaseAuthModule;
+/**
+ * Writes a freshly-minted session/refresh pair back to the cookie jar so the
+ * NEXT request doesn't repeat the rejected-token round-trip. Next only allows
+ * cookie writes from Server Actions and Route Handlers — during an RSC render
+ * this throws, which is expected and harmless: the middleware persists the
+ * same pair on the following request, so this is a best-effort shortcut only.
+ */
+function persistRefreshedSession(cookieStore, sessionCookieName, refreshTokenCookieName, idToken, refreshToken) {
+    // No request URL here (unlike the middleware), so `secure` can't be
+    // derived from the protocol — always secure, which is correct for every
+    // origin a session cookie should be sent to anyway.
+    const options = sessionCookieOptions(config.firebaseAuth, true);
+    try {
+        cookieStore.set(sessionCookieName, idToken, options.session);
+        cookieStore.set(refreshTokenCookieName, refreshToken, options.refresh);
+    }
+    catch {
+        // Read-only cookie jar (RSC render) — middleware handles it next request.
+    }
+}
 /**
  * Resolves the signed-in user on the server from the session cookie.
  * `initializeServerApp` validates the token with the Auth service, so a
- * missing, expired, or forged token yields `currentUser === null`.
- * Wrapped in React's `cache()` so multiple server components in one request
- * share a single Auth service lookup. Lazily imports `firebase/app`/
+ * missing, expired, or forged token yields `currentUser === null` — in which
+ * case one refresh from the refresh-token cookie is attempted before giving
+ * up. Wrapped in React's `cache()` so multiple server components in one
+ * request share a single Auth service lookup. Lazily imports `firebase/app`/
  * `firebase/auth` — never touched unless this is actually called, and
  * throws if `firebaseAuth` is missing from `RoutingConfig`.
  */
@@ -60,7 +81,14 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
     // behavior.
     const appCheckToken = cookieStore.get(appCheckTokenCookieName)?.value
         ?? await mintServerAppCheckToken(fa.projectId, fa.apiKey, fa.appCheck);
-    try {
+    // A token that isn't merely expired-by-clock (revoked session, password
+    // change, a token minted for a different project) is rejected with
+    // `auth/invalid-user-token`. `initializeServerApp` does NOT surface that
+    // as a rejection though — it logs "FirebaseServerApp could not login user
+    // with provided authIdToken" itself and simply resolves `authStateReady()`
+    // with `currentUser === null`. So a null user (not a throw) is the signal
+    // to drop the bad token and mint a replacement from the refresh cookie.
+    const attempt = async (idToken) => {
         if (!firebaseAppModule)
             firebaseAppModule = await import('firebase/app');
         if (!firebaseAuthModule)
@@ -83,12 +111,46 @@ export const getAuthenticatedAppForUser = cache(async function getAuthenticatedA
         // registering a new named app in Firebase's global app registry.
         if (!baseApp)
             baseApp = initializeApp(firebaseConfig, 'firebase-auth-server-base');
-        const firebaseServerApp = initializeServerApp(baseApp, { authIdToken, appCheckToken });
+        const firebaseServerApp = initializeServerApp(baseApp, { authIdToken: idToken, appCheckToken });
         const auth = getAuth(firebaseServerApp);
         await auth.authStateReady();
         return { firebaseServerApp, currentUser: auth.currentUser };
+    };
+    const retryWithFreshToken = async (rejectedToken) => {
+        const refreshToken = cookieStore.get(refreshTokenCookieName)?.value;
+        if (!refreshToken)
+            return { firebaseServerApp: null, currentUser: null };
+        // The cached entry is what produced `rejectedToken` in the first
+        // place, so a plain refresh would hand back the same rejected token.
+        const result = await refreshIdToken(fa.apiKey, refreshToken, { skipCache: true });
+        if (result.status !== 'refreshed' || result.idToken === rejectedToken) {
+            return { firebaseServerApp: null, currentUser: null };
+        }
+        try {
+            const retried = await attempt(result.idToken);
+            if (retried.currentUser) {
+                persistRefreshedSession(cookieStore, sessionCookieName, refreshTokenCookieName, result.idToken, result.refreshToken);
+            }
+            return retried;
+        }
+        catch (retryError) {
+            await reportError(config, { error: retryError, classOrMethodName: 'getAuthenticatedAppForUser' });
+            return { firebaseServerApp: null, currentUser: null };
+        }
+    };
+    try {
+        const first = await attempt(authIdToken);
+        // `initializeServerApp` reports an invalid/revoked token by resolving
+        // with a null user rather than throwing — retry rather than render
+        // this request as signed-out.
+        if (!first.currentUser)
+            return await retryWithFreshToken(authIdToken);
+        return first;
     }
     catch (error) {
+        if (error?.code === 'auth/invalid-user-token') {
+            return await retryWithFreshToken(authIdToken);
+        }
         await reportError(config, { error, classOrMethodName: 'getAuthenticatedAppForUser' });
         return { firebaseServerApp: null, currentUser: null };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.31",
+  "version": "0.6.33",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",