cloudflare-next-intl 0.6.8 → 0.6.10

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -7,7 +7,7 @@ import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
 import { getFirebaseAuthClient, getFirebaseAuthModule } from './firebase_client';
 import { setAuthUserCache } from './auth_user_cache';
-import { defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
+import { defaultEmailVerifiedHintCookieName, defaultRefreshTokenCookieName, defaultSessionCookieName } from '../middleware/update_session';
 import setCookie from '../../client/functions/set_cookie';
 import clearSessionAction from '../server/clear_session_action';
 // `null` default (instead of a `{ loading: true, ... }` stand-in) lets
@@ -26,9 +26,21 @@ function writeRefreshTokenCookie(refreshTokenCookieName, user, maxAge) {
 function clearRefreshTokenCookie(refreshTokenCookieName) {
     setCookie({ name: refreshTokenCookieName, value: '', maxAge: 0 });
 }
-async function clearSession(sessionCookieName, refreshTokenCookieName) {
+// Mirrors the live SDK's `emailVerified` into a client-readable cookie so
+// the middleware can tell "the client already agrees with the session JWT's
+// claim" (skip the extra refresh) apart from "the client observed a change
+// this claim hasn't caught up to yet" (worth one refresh to confirm).
+function writeEmailVerifiedHintCookie(emailVerifiedHintCookieName, emailVerified, maxAge) {
+    setCookie({ name: emailVerifiedHintCookieName, value: String(emailVerified), maxAge });
+}
+async function clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, refreshTokenMaxAge) {
     clearSessionCookie(sessionCookieName);
     clearRefreshTokenCookie(refreshTokenCookieName);
+    // Signed-out is not "unknown" — it's a confirmed non-verified state, so
+    // write 'false' explicitly rather than clearing (an absent hint means
+    // "no signal yet", which forces the middleware to refresh unnecessarily
+    // if a stale session cookie somehow still lingers).
+    writeEmailVerifiedHintCookie(emailVerifiedHintCookieName, false, refreshTokenMaxAge);
     try {
         await clearSessionAction();
     }
@@ -36,13 +48,14 @@ async function clearSession(sessionCookieName, refreshTokenCookieName) {
         console.error('AuthUserProvider: clearSessionAction failed', e);
     }
 }
-async function writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge) {
+async function writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName) {
     try {
         writeRefreshTokenCookie(refreshTokenCookieName, user, refreshTokenMaxAge);
     }
     catch (e) {
         console.error('AuthUserProvider: refresh-token cookie sync failed', e);
     }
+    writeEmailVerifiedHintCookie(emailVerifiedHintCookieName, user.emailVerified, refreshTokenMaxAge);
     writeSessionCookie(sessionCookieName, await user.getIdToken(true), maxAge);
 }
 /**
@@ -74,6 +87,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
     const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const refreshTokenMaxAge = fa.refreshTokenCookieMaxAge ?? 60 * 60 * 24 * 365;
     const refreshTokenCookieName = fa.refreshTokenCookieName ?? defaultRefreshTokenCookieName;
+    const emailVerifiedHintCookieName = fa.emailVerifiedHintCookieName ?? defaultEmailVerifiedHintCookieName;
     const [state, setState] = useState({
         user: initialUser,
         loading: initialUser === null,
@@ -114,10 +128,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
                 const previous = syncedSignedIn.current;
                 try {
                     if (user) {
-                        await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge);
+                        await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName);
                     }
                     else {
-                        await clearSession(sessionCookieName, refreshTokenCookieName);
+                        await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, refreshTokenMaxAge);
                     }
                 }
                 catch (e) {
@@ -150,7 +164,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             unsubscribe?.();
         };
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [router, isAuthPage, maxAge, sessionCookieName, refreshTokenMaxAge, refreshTokenCookieName]);
+    }, [router, isAuthPage, maxAge, sessionCookieName, refreshTokenMaxAge, refreshTokenCookieName, emailVerifiedHintCookieName]);
     const reloadUser = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;
@@ -159,7 +173,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
         try {
             const { reload } = await getFirebaseAuthModule();
             await reload(user);
-            await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge);
+            await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName);
             setAuthUserCache(user);
             setState({ user, loading: false });
         }
@@ -182,10 +196,10 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             await signOut(auth);
         }
         finally {
-            await clearSession(sessionCookieName, refreshTokenCookieName);
+            await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, refreshTokenMaxAge);
             router.push(fa.redirectAuthPath);
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [fa.redirectAuthPath, sessionCookieName, refreshTokenCookieName]);
+    }, [fa.redirectAuthPath, sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName]);
     return _jsx(AuthUserContext.Provider, { value: { ...state, reloadUser, sendVerificationEmail, logout }, children: children });
 }

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -1,6 +1,7 @@
 import { NextResponse, type NextRequest } from 'next/server';
 export declare const defaultSessionCookieName = "__fa_session__";
 export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
+export declare const defaultEmailVerifiedHintCookieName = "__fa_email_verified_hint__";
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`

package/dist/src/firebase_auth/middleware/update_session.js

@@ -2,6 +2,13 @@ import { NextResponse } from 'next/server';
 import config from '@intl-config';
 export const defaultSessionCookieName = '__fa_session__';
 export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
+// Non-httpOnly: written by AuthUserProvider (client) every time it observes
+// the live Firebase user's emailVerified state, so the middleware can tell
+// "the client already agrees with this claim" (no refresh needed) apart
+// from "the client last observed something different" (claim may be stale
+// — force one refresh). Readable client-side is fine: it carries no secret,
+// only a boolean mirror of a claim already inside the session JWT.
+export const defaultEmailVerifiedHintCookieName = '__fa_email_verified_hint__';
 const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
 const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
 // Refresh slightly before the real expiry — treating a token as expired
@@ -164,6 +171,7 @@ export default async function updateSession(request, baseResponse, locale) {
         return baseResponse;
     const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const refreshTokenCookieName = fa.refreshTokenCookieName ?? defaultRefreshTokenCookieName;
+    const emailVerifiedHintCookieName = fa.emailVerifiedHintCookieName ?? defaultEmailVerifiedHintCookieName;
     const rawPath = request.nextUrl.pathname;
     const requestPrefix = `/${locale}`;
     const path = rawPath === requestPrefix || rawPath.startsWith(`${requestPrefix}/`)
@@ -214,6 +222,52 @@ export default async function updateSession(request, baseResponse, locale) {
     const hasSession = !!token;
     let response;
     const isVerifyEmailPage = !!fa.verifyEmailPath && path === fa.verifyEmailPath;
+    // The session cookie's `email_verified` claim is only as fresh as the
+    // last ID-token mint — it does NOT update the moment a user clicks an
+    // emailed verification link, only once the token naturally refreshes
+    // (up to ~1hr later). AuthUserProvider (client) mirrors the live SDK
+    // state into `emailVerifiedHintCookieName` on every auth-state change,
+    // so it reflects verification status sooner than the session JWT does.
+    // Force one refresh to confirm before redirecting whenever that hint
+    // can't yet vouch for this claim: it disagrees outright, or it's absent
+    // (e.g. first request before the client has run at all, or a hint
+    // that expired/was never set) — either way there's no positive signal
+    // the claim is still accurate. Only when the hint AGREES with the claim
+    // is a refresh skipped, so a genuinely unverified user with an
+    // established, agreeing hint doesn't pay a refresh on every request.
+    let unverifiedEmail = false;
+    if (fa.verifyEmailPath && !isVerifyEmailPage && hasSession && decodeJwtPayload(token)?.email_verified === false) {
+        const hint = request.cookies.get(emailVerifiedHintCookieName)?.value;
+        const hintConfirms = hint === 'false';
+        if (!hintConfirms && !refreshedToken) {
+            const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
+            if (refreshToken) {
+                const result = await refreshIdToken(fa.apiKey, refreshToken);
+                if (result.status === 'refreshed') {
+                    refreshedToken = { idToken: result.idToken, refreshToken: result.refreshToken };
+                    token = refreshedToken.idToken;
+                    unverifiedEmail = decodeJwtPayload(token)?.email_verified === false;
+                }
+                else if (result.status === 'invalid') {
+                    clearInvalidSession = true;
+                }
+                else {
+                    // Transient failure — can't confirm the live claim, fall
+                    // back to trusting the (possibly stale) existing claim
+                    // rather than blocking the request.
+                    unverifiedEmail = true;
+                }
+            }
+            else {
+                // No refresh token to re-check with — trust the existing claim.
+                unverifiedEmail = true;
+            }
+        }
+        else {
+            // Hint confirms unverified — no reason to refresh, trust the claim.
+            unverifiedEmail = true;
+        }
+    }
     if (refreshWasTransientFailure) {
         // Couldn't confirm the session either way — pass through without
         // forcing a redirect in either direction. The next request (or the
@@ -221,13 +275,13 @@ export default async function updateSession(request, baseResponse, locale) {
         // chance to resolve this correctly instead of guessing wrong.
         response = baseResponse;
     }
-    else if (!hasSession) {
+    else if (!hasSession || clearInvalidSession) {
         response = isAuthPage ? baseResponse : buildRedirect(baseResponse, localeUrl(fa.redirectAuthPath));
     }
     else if (isAuthPage) {
         response = buildRedirect(baseResponse, localeUrl(fa.homePath));
     }
-    else if (fa.verifyEmailPath && !isVerifyEmailPage && token && decodeJwtPayload(token)?.email_verified === false) {
+    else if (unverifiedEmail) {
         response = buildRedirect(baseResponse, localeUrl(fa.verifyEmailPath));
     }
     else {

package/dist/src/types/types.d.ts

@@ -457,6 +457,8 @@ export interface FirebaseAuthRoutingConfig {
     sessionCookieName?: string;
     /** Refresh-token cookie name. Defaults to `'__fa_refresh_token__'`. Override this if your app already uses a different name for its Firebase refresh-token cookie. */
     refreshTokenCookieName?: string;
+    /** Email-verified hint cookie name. Defaults to `'__fa_email_verified_hint__'`. Client-written, non-httpOnly; lets the middleware avoid an unnecessary token refresh when its view already matches the client's. */
+    emailVerifiedHintCookieName?: string;
 }
 export interface CookieAttributes {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.8",
+  "version": "0.6.10",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",