cloudflare-next-intl 0.6.7 → 0.6.9

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -7,7 +7,7 @@ import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
 import { getFirebaseAuthClient, getFirebaseAuthModule } from './firebase_client';
 import { setAuthUserCache } from './auth_user_cache';
-import { defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
+import { defaultEmailVerifiedHintCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
 import setCookie from '../../client/functions/set_cookie';
 import clearSessionAction from '../server/clear_session_action';
 // `null` default (instead of a `{ loading: true, ... }` stand-in) lets
@@ -26,9 +26,20 @@ function writeRefreshTokenCookie(refreshTokenCookieName, user, maxAge) {
 function clearRefreshTokenCookie(refreshTokenCookieName) {
     setCookie({ name: refreshTokenCookieName, value: '', maxAge: 0 });
 }
-async function clearSession(sessionCookieName, refreshTokenCookieName) {
+// Mirrors the live SDK's `emailVerified` into a client-readable cookie so
+// the middleware can tell "the client already agrees with the session JWT's
+// claim" (skip the extra refresh) apart from "the client observed a change
+// this claim hasn't caught up to yet" (worth one refresh to confirm).
+function writeEmailVerifiedHintCookie(emailVerifiedHintCookieName, emailVerified, maxAge) {
+    setCookie({ name: emailVerifiedHintCookieName, value: String(emailVerified), maxAge });
+}
+function clearEmailVerifiedHintCookie(emailVerifiedHintCookieName) {
+    setCookie({ name: emailVerifiedHintCookieName, value: '', maxAge: 0 });
+}
+async function clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName) {
     clearSessionCookie(sessionCookieName);
     clearRefreshTokenCookie(refreshTokenCookieName);
+    clearEmailVerifiedHintCookie(emailVerifiedHintCookieName);
     try {
         await clearSessionAction();
     }
@@ -36,13 +47,14 @@ async function clearSession(sessionCookieName, refreshTokenCookieName) {
         console.error('AuthUserProvider: clearSessionAction failed', e);
     }
 }
-async function writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge) {
+async function writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName) {
     try {
         writeRefreshTokenCookie(refreshTokenCookieName, user, refreshTokenMaxAge);
     }
     catch (e) {
         console.error('AuthUserProvider: refresh-token cookie sync failed', e);
     }
+    writeEmailVerifiedHintCookie(emailVerifiedHintCookieName, user.emailVerified, refreshTokenMaxAge);
     writeSessionCookie(sessionCookieName, await user.getIdToken(true), maxAge);
 }
 /**
@@ -74,6 +86,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
     const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const refreshTokenMaxAge = fa.refreshTokenCookieMaxAge ?? 60 * 60 * 24 * 365;
     const refreshTokenCookieName = fa.refreshTokenCookieName ?? defaultRefreshTokenCookieName;
+    const emailVerifiedHintCookieName = fa.emailVerifiedHintCookieName ?? defaultEmailVerifiedHintCookieName;
     const [state, setState] = useState({
         user: initialUser,
         loading: initialUser === null,
@@ -114,10 +127,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
                 const previous = syncedSignedIn.current;
                 try {
                     if (user) {
-                        await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge);
+                        await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName);
                     }
                     else {
-                        await clearSession(sessionCookieName, refreshTokenCookieName);
+                        await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName);
                     }
                 }
                 catch (e) {
@@ -150,7 +163,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             unsubscribe?.();
         };
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [router, isAuthPage, maxAge, sessionCookieName, refreshTokenMaxAge, refreshTokenCookieName]);
+    }, [router, isAuthPage, maxAge, sessionCookieName, refreshTokenMaxAge, refreshTokenCookieName, emailVerifiedHintCookieName]);
     const reloadUser = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;
@@ -159,7 +172,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
         try {
             const { reload } = await getFirebaseAuthModule();
             await reload(user);
-            await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge);
+            await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName);
             setAuthUserCache(user);
             setState({ user, loading: false });
         }
@@ -182,10 +195,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             await signOut(auth);
         }
         finally {
-            await clearSession(sessionCookieName, refreshTokenCookieName);
+            await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName);
             router.push(fa.redirectAuthPath);
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [fa.redirectAuthPath, sessionCookieName, refreshTokenCookieName]);
+    }, [fa.redirectAuthPath, sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName]);
     return _jsx(AuthUserContext.Provider, { value: { ...state, reloadUser, sendVerificationEmail, logout }, children: children });
 }

package/dist/src/firebase_auth/middleware/update_session.bench.js

@@ -10,13 +10,14 @@ const baseFa = {
     redirectAuthPath: '/login',
     homePath: '/',
     isAuthPath: (path) => path === '/login',
+    verifyEmailPath: '/verify-email',
 };
 vi.mock('@intl-config', () => ({
     default: { locales: ['en'], defaultLocale: 'en', firebaseAuth: baseFa },
 }));
-function makeJwt(exp) {
+function makeJwt(exp, claims = {}) {
     const header = Buffer.from(JSON.stringify({ alg: 'none' })).toString('base64url');
-    const payload = Buffer.from(JSON.stringify({ exp })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({ exp, ...claims })).toString('base64url');
     return `${header}.${payload}.sig`;
 }
 describe('updateSession', () => {
@@ -34,4 +35,11 @@ describe('updateSession', () => {
         });
         await updateSession(req, NextResponse.next(), 'en');
     });
+    bench('valid session, unverified email: decodeJwtPayload + verifyEmailPath redirect', async () => {
+        const { default: updateSession } = await import('./update_session');
+        const req = makeTestRequest('https://example.com/en/dashboard', {
+            cookies: { __fa_session__: makeJwt(Date.now() / 1000 + 3600, { email_verified: false }) },
+        });
+        await updateSession(req, NextResponse.next(), 'en');
+    });
 });

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -1,6 +1,7 @@
 import { NextResponse, type NextRequest } from 'next/server';
 export declare const defaultSessionCookieName = "__fa_session__";
 export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
+export declare const defaultEmailVerifiedHintCookieName = "__fa_email_verified_hint__";
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`

package/dist/src/firebase_auth/middleware/update_session.js

@@ -2,6 +2,13 @@ import { NextResponse } from 'next/server';
 import config from '@intl-config';
 export const defaultSessionCookieName = '__fa_session__';
 export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
+// Non-httpOnly: written by AuthUserProvider (client) every time it observes
+// the live Firebase user's emailVerified state, so the middleware can tell
+// "the client already agrees with this claim" (no refresh needed) apart
+// from "the client last observed something different" (claim may be stale
+// — force one refresh). Readable client-side is fine: it carries no secret,
+// only a boolean mirror of a claim already inside the session JWT.
+export const defaultEmailVerifiedHintCookieName = '__fa_email_verified_hint__';
 const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
 const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
 // Refresh slightly before the real expiry — treating a token as expired
@@ -9,16 +16,19 @@ const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
 // time can hand a client a token that dies moments after this check, forcing
 // an extra round-trip on the very next request.
 const CLOCK_SKEW_MARGIN_MS = 60 * 1000;
-function isJwtExpired(token) {
+function decodeJwtPayload(token) {
     try {
         const payload = token.split('.')[1];
-        const { exp } = JSON.parse(atob(payload.replace(/[-_]/g, (c) => c === '-' ? '+' : '/')));
-        return !exp || exp * 1000 - CLOCK_SKEW_MARGIN_MS <= Date.now();
+        return JSON.parse(atob(payload.replace(/[-_]/g, (c) => c === '-' ? '+' : '/')));
     }
     catch {
-        return true;
+        return null;
     }
 }
+function isJwtExpired(token) {
+    const decoded = decodeJwtPayload(token);
+    return !decoded?.exp || decoded.exp * 1000 - CLOCK_SKEW_MARGIN_MS <= Date.now();
+}
 // Refreshing an ID token is a real network round-trip to Google on the
 // Edge middleware's critical path, on every request where the session
 // cookie has expired — which, for any session older than the ~1hr ID-token
@@ -161,6 +171,7 @@ export default async function updateSession(request, baseResponse, locale) {
         return baseResponse;
     const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const refreshTokenCookieName = fa.refreshTokenCookieName ?? defaultRefreshTokenCookieName;
+    const emailVerifiedHintCookieName = fa.emailVerifiedHintCookieName ?? defaultEmailVerifiedHintCookieName;
     const rawPath = request.nextUrl.pathname;
     const requestPrefix = `/${locale}`;
     const path = rawPath === requestPrefix || rawPath.startsWith(`${requestPrefix}/`)
@@ -170,7 +181,7 @@ export default async function updateSession(request, baseResponse, locale) {
     if (rawPath.startsWith('/_next') || /\.[a-zA-Z0-9]+$/.test(lastSegment)) {
         return baseResponse;
     }
-    const localePrefix = locale === config.locales[0] ? '' : requestPrefix;
+    const localePrefix = locale === config.defaultLocale ? '' : requestPrefix;
     const localeUrl = (target) => new URL(`${localePrefix}${target === '/' ? '' : target}` || '/', request.url);
     const isWhiteListed = fa.whiteListPaths?.includes(path) ?? false;
     if (isWhiteListed)
@@ -210,6 +221,53 @@ export default async function updateSession(request, baseResponse, locale) {
     }
     const hasSession = !!token;
     let response;
+    const isVerifyEmailPage = !!fa.verifyEmailPath && path === fa.verifyEmailPath;
+    // The session cookie's `email_verified` claim is only as fresh as the
+    // last ID-token mint — it does NOT update the moment a user clicks an
+    // emailed verification link, only once the token naturally refreshes
+    // (up to ~1hr later). AuthUserProvider (client) mirrors the live SDK
+    // state into `emailVerifiedHintCookieName` on every auth-state change,
+    // so it reflects verification status sooner than the session JWT does.
+    // If that hint disagrees with the stale claim, something changed since
+    // this claim was minted — force one refresh to confirm before
+    // redirecting, so this claim is no staler than a single refresh
+    // round-trip instead of up to an hour. If the hint AGREES with the
+    // claim (or is absent, e.g. first request before the client has run),
+    // trust the claim as-is — no extra network call, so a genuinely
+    // unverified user doesn't pay a refresh on every single request.
+    let unverifiedEmail = false;
+    if (fa.verifyEmailPath && !isVerifyEmailPage && hasSession && decodeJwtPayload(token)?.email_verified === false) {
+        const hint = request.cookies.get(emailVerifiedHintCookieName)?.value;
+        const hintDisagrees = hint === 'true';
+        if (hintDisagrees && !refreshedToken) {
+            const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
+            if (refreshToken) {
+                const result = await refreshIdToken(fa.apiKey, refreshToken);
+                if (result.status === 'refreshed') {
+                    refreshedToken = { idToken: result.idToken, refreshToken: result.refreshToken };
+                    token = refreshedToken.idToken;
+                    unverifiedEmail = decodeJwtPayload(token)?.email_verified === false;
+                }
+                else if (result.status === 'invalid') {
+                    clearInvalidSession = true;
+                }
+                else {
+                    // Transient failure — can't confirm the live claim, fall
+                    // back to trusting the (possibly stale) existing claim
+                    // rather than blocking the request.
+                    unverifiedEmail = true;
+                }
+            }
+            else {
+                // No refresh token to re-check with — trust the existing claim.
+                unverifiedEmail = true;
+            }
+        }
+        else {
+            // Hint agrees (or is absent) — no reason to distrust the claim.
+            unverifiedEmail = true;
+        }
+    }
     if (refreshWasTransientFailure) {
         // Couldn't confirm the session either way — pass through without
         // forcing a redirect in either direction. The next request (or the
@@ -217,12 +275,15 @@ export default async function updateSession(request, baseResponse, locale) {
         // chance to resolve this correctly instead of guessing wrong.
         response = baseResponse;
     }
-    else if (!hasSession) {
+    else if (!hasSession || clearInvalidSession) {
         response = isAuthPage ? baseResponse : buildRedirect(baseResponse, localeUrl(fa.redirectAuthPath));
     }
     else if (isAuthPage) {
         response = buildRedirect(baseResponse, localeUrl(fa.homePath));
     }
+    else if (unverifiedEmail) {
+        response = buildRedirect(baseResponse, localeUrl(fa.verifyEmailPath));
+    }
     else {
         response = baseResponse;
     }

package/dist/src/types/types.d.ts

@@ -457,6 +457,8 @@ export interface FirebaseAuthRoutingConfig {
     sessionCookieName?: string;
     /** Refresh-token cookie name. Defaults to `'__fa_refresh_token__'`. Override this if your app already uses a different name for its Firebase refresh-token cookie. */
     refreshTokenCookieName?: string;
+    /** Email-verified hint cookie name. Defaults to `'__fa_email_verified_hint__'`. Client-written, non-httpOnly; lets the middleware avoid an unnecessary token refresh when its view already matches the client's. */
+    emailVerifiedHintCookieName?: string;
 }
 export interface CookieAttributes {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.7",
+  "version": "0.6.9",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",