cloudflare-next-intl 0.6.9 → 0.6.10

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -33,13 +33,14 @@ function clearRefreshTokenCookie(refreshTokenCookieName) {
 function writeEmailVerifiedHintCookie(emailVerifiedHintCookieName, emailVerified, maxAge) {
     setCookie({ name: emailVerifiedHintCookieName, value: String(emailVerified), maxAge });
 }
-function clearEmailVerifiedHintCookie(emailVerifiedHintCookieName) {
-    setCookie({ name: emailVerifiedHintCookieName, value: '', maxAge: 0 });
-}
-async function clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName) {
+async function clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, refreshTokenMaxAge) {
     clearSessionCookie(sessionCookieName);
     clearRefreshTokenCookie(refreshTokenCookieName);
-    clearEmailVerifiedHintCookie(emailVerifiedHintCookieName);
+    // Signed-out is not "unknown" — it's a confirmed non-verified state, so
+    // write 'false' explicitly rather than clearing (an absent hint means
+    // "no signal yet", which forces the middleware to refresh unnecessarily
+    // if a stale session cookie somehow still lingers).
+    writeEmailVerifiedHintCookie(emailVerifiedHintCookieName, false, refreshTokenMaxAge);
     try {
         await clearSessionAction();
     }
@@ -130,7 +131,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
                         await writeSession(user, sessionCookieName, maxAge, refreshTokenCookieName, refreshTokenMaxAge, emailVerifiedHintCookieName);
                     }
                     else {
-                        await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName);
+                        await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, refreshTokenMaxAge);
                     }
                 }
                 catch (e) {
@@ -195,7 +196,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             await signOut(auth);
         }
         finally {
-            await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName);
+            await clearSession(sessionCookieName, refreshTokenCookieName, emailVerifiedHintCookieName, refreshTokenMaxAge);
             router.push(fa.redirectAuthPath);
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps

package/dist/src/firebase_auth/middleware/update_session.js

@@ -228,18 +228,18 @@ export default async function updateSession(request, baseResponse, locale) {
     // (up to ~1hr later). AuthUserProvider (client) mirrors the live SDK
     // state into `emailVerifiedHintCookieName` on every auth-state change,
     // so it reflects verification status sooner than the session JWT does.
-    // If that hint disagrees with the stale claim, something changed since
-    // this claim was minted — force one refresh to confirm before
-    // redirecting, so this claim is no staler than a single refresh
-    // round-trip instead of up to an hour. If the hint AGREES with the
-    // claim (or is absent, e.g. first request before the client has run),
-    // trust the claim as-is — no extra network call, so a genuinely
-    // unverified user doesn't pay a refresh on every single request.
+    // Force one refresh to confirm before redirecting whenever that hint
+    // can't yet vouch for this claim: it disagrees outright, or it's absent
+    // (e.g. first request before the client has run at all, or a hint
+    // that expired/was never set) — either way there's no positive signal
+    // the claim is still accurate. Only when the hint AGREES with the claim
+    // is a refresh skipped, so a genuinely unverified user with an
+    // established, agreeing hint doesn't pay a refresh on every request.
     let unverifiedEmail = false;
     if (fa.verifyEmailPath && !isVerifyEmailPage && hasSession && decodeJwtPayload(token)?.email_verified === false) {
         const hint = request.cookies.get(emailVerifiedHintCookieName)?.value;
-        const hintDisagrees = hint === 'true';
-        if (hintDisagrees && !refreshedToken) {
+        const hintConfirms = hint === 'false';
+        if (!hintConfirms && !refreshedToken) {
             const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
             if (refreshToken) {
                 const result = await refreshIdToken(fa.apiKey, refreshToken);
@@ -264,7 +264,7 @@ export default async function updateSession(request, baseResponse, locale) {
             }
         }
         else {
-            // Hint agrees (or is absent) — no reason to distrust the claim.
+            // Hint confirms unverified — no reason to refresh, trust the claim.
             unverifiedEmail = true;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.9",
+  "version": "0.6.10",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",