cloudflare-next-intl 0.7.7 → 0.7.8

package/dist/src/firebase_auth/server/mint_server_app_check_token.d.ts

@@ -3,20 +3,28 @@ import type { FirebaseAppCheckConfig } from '../../types/types';
  * Mints a fresh App Check token server-side via a service account, for use
  * when the client-written App Check cookie (see `appCheckTokenCookieName`)
  * is absent — e.g. a cold navigation before `AuthUserProvider` has run and
- * had a chance to write it. Requires `clientEmail`/`privateKey`/`appId` on
- * `firebaseAuth.appCheck`; returns `undefined` (never throws) if the
- * exchange fails, so a caller can always fall back to "no App Check token"
- * exactly as before this existed.
+ * had a chance to write it. Requires `clientEmail`/`appId` on
+ * `firebaseAuth.appCheck`, plus either `privateKey` or the
+ * `oauthClientId`/`oauthClientSecret`/`oauthRefreshToken` triple; returns
+ * `undefined` (never throws) if the exchange fails, so a caller can always
+ * fall back to "no App Check token" exactly as before this existed.
  *
- * Signs a short-lived custom JWT with the service account's private key
- * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
- * it for an App Check token via `exchangeCustomToken`, authenticated with
- * the project's Web API key (`?key=`) — `exchangeCustomToken` otherwise
- * rejects the call outright as an unregistered/unidentified caller
- * (403 `PERMISSION_DENIED`), before the custom token itself is even
- * evaluated. Not cached beyond the caller's own request-scoped `cache()`
- * wrapper — a fresh mint costs one signing operation plus one network
- * round-trip, acceptable per-request but not worth doing more than once per
- * request.
+ * Signs a short-lived custom JWT, then exchanges it for an App Check token
+ * via `exchangeCustomToken`, authenticated with the project's Web API key
+ * (`?key=`) — `exchangeCustomToken` otherwise rejects the call outright as
+ * an unregistered/unidentified caller (403 `PERMISSION_DENIED`), before the
+ * custom token itself is even evaluated. Not cached beyond the caller's own
+ * request-scoped `cache()` wrapper — a fresh mint costs one signing
+ * operation plus one network round-trip, acceptable per-request but not
+ * worth doing more than once per request.
+ *
+ * The custom token is signed one of two ways, `privateKey` taking priority
+ * when both are set:
+ * - `privateKey` set: signed locally (`jose`, Edge/WebCrypto-compatible —
+ *   no `firebase-admin`).
+ * - OAuth triple set instead: signed remotely via
+ *   `sign_custom_token_remote.ts` (IAM Credentials `signJwt`) — the way to
+ *   mint tokens when a GCP org policy blocks creating the service-account
+ *   key `privateKey` would otherwise require.
  */
 export default function mintServerAppCheckToken(projectId: string, apiKey: string, appCheck: FirebaseAppCheckConfig | undefined): Promise<string | undefined>;

package/dist/src/firebase_auth/server/mint_server_app_check_token.js

@@ -1,5 +1,6 @@
 import config from '@intl-config';
 import reportError from '../../error_handling/report_error';
+import signCustomTokenRemote from './sign_custom_token_remote';
 // Matches `firebase-admin`'s own `AppCheckTokenGenerator.createCustomToken`
 // exactly (`token-generator.js`) — this specific audience (the App Check
 // TOKEN EXCHANGE service, not the App Check API resource name itself) is
@@ -21,36 +22,63 @@ const CUSTOM_TOKEN_LIFETIME = '5m';
  * Mints a fresh App Check token server-side via a service account, for use
  * when the client-written App Check cookie (see `appCheckTokenCookieName`)
  * is absent — e.g. a cold navigation before `AuthUserProvider` has run and
- * had a chance to write it. Requires `clientEmail`/`privateKey`/`appId` on
- * `firebaseAuth.appCheck`; returns `undefined` (never throws) if the
- * exchange fails, so a caller can always fall back to "no App Check token"
- * exactly as before this existed.
+ * had a chance to write it. Requires `clientEmail`/`appId` on
+ * `firebaseAuth.appCheck`, plus either `privateKey` or the
+ * `oauthClientId`/`oauthClientSecret`/`oauthRefreshToken` triple; returns
+ * `undefined` (never throws) if the exchange fails, so a caller can always
+ * fall back to "no App Check token" exactly as before this existed.
  *
- * Signs a short-lived custom JWT with the service account's private key
- * (`jose`, Edge/WebCrypto-compatible — no `firebase-admin`), then exchanges
- * it for an App Check token via `exchangeCustomToken`, authenticated with
- * the project's Web API key (`?key=`) — `exchangeCustomToken` otherwise
- * rejects the call outright as an unregistered/unidentified caller
- * (403 `PERMISSION_DENIED`), before the custom token itself is even
- * evaluated. Not cached beyond the caller's own request-scoped `cache()`
- * wrapper — a fresh mint costs one signing operation plus one network
- * round-trip, acceptable per-request but not worth doing more than once per
- * request.
+ * Signs a short-lived custom JWT, then exchanges it for an App Check token
+ * via `exchangeCustomToken`, authenticated with the project's Web API key
+ * (`?key=`) — `exchangeCustomToken` otherwise rejects the call outright as
+ * an unregistered/unidentified caller (403 `PERMISSION_DENIED`), before the
+ * custom token itself is even evaluated. Not cached beyond the caller's own
+ * request-scoped `cache()` wrapper — a fresh mint costs one signing
+ * operation plus one network round-trip, acceptable per-request but not
+ * worth doing more than once per request.
+ *
+ * The custom token is signed one of two ways, `privateKey` taking priority
+ * when both are set:
+ * - `privateKey` set: signed locally (`jose`, Edge/WebCrypto-compatible —
+ *   no `firebase-admin`).
+ * - OAuth triple set instead: signed remotely via
+ *   `sign_custom_token_remote.ts` (IAM Credentials `signJwt`) — the way to
+ *   mint tokens when a GCP org policy blocks creating the service-account
+ *   key `privateKey` would otherwise require.
  */
 export default async function mintServerAppCheckToken(projectId, apiKey, appCheck) {
-    if (!appCheck?.clientEmail || !appCheck.privateKey || !appCheck.appId)
+    if (!appCheck?.clientEmail || !appCheck.appId)
+        return undefined;
+    const hasOauthTriple = appCheck.oauthClientId && appCheck.oauthClientSecret && appCheck.oauthRefreshToken;
+    if (!appCheck.privateKey && !hasOauthTriple)
         return undefined;
     try {
-        const { SignJWT, importPKCS8 } = await import('jose');
-        const privateKey = await importPKCS8(appCheck.privateKey.replace(/\\n/g, '\n'), 'RS256');
-        const customToken = await new SignJWT({ app_id: appCheck.appId })
-            .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
-            .setIssuer(appCheck.clientEmail)
-            .setSubject(appCheck.clientEmail)
-            .setAudience(APP_CHECK_CUSTOM_TOKEN_AUDIENCE)
-            .setIssuedAt()
-            .setExpirationTime(CUSTOM_TOKEN_LIFETIME)
-            .sign(privateKey);
+        const claims = {
+            iss: appCheck.clientEmail,
+            sub: appCheck.clientEmail,
+            aud: APP_CHECK_CUSTOM_TOKEN_AUDIENCE,
+            iat: Math.floor(Date.now() / 1000),
+            exp: Math.floor(Date.now() / 1000) + 300,
+            app_id: appCheck.appId,
+        };
+        const customToken = appCheck.privateKey
+            ? await (async () => {
+                const { SignJWT, importPKCS8 } = await import('jose');
+                const privateKey = await importPKCS8(appCheck.privateKey.replace(/\\n/g, '\n'), 'RS256');
+                return new SignJWT({ app_id: appCheck.appId })
+                    .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
+                    .setIssuer(appCheck.clientEmail)
+                    .setSubject(appCheck.clientEmail)
+                    .setAudience(APP_CHECK_CUSTOM_TOKEN_AUDIENCE)
+                    .setIssuedAt()
+                    .setExpirationTime(CUSTOM_TOKEN_LIFETIME)
+                    .sign(privateKey);
+            })()
+            : await signCustomTokenRemote(appCheck.clientEmail, claims, {
+                clientId: appCheck.oauthClientId,
+                clientSecret: appCheck.oauthClientSecret,
+                refreshToken: appCheck.oauthRefreshToken,
+            });
         const url = `https://firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appCheck.appId}:exchangeCustomToken?key=${apiKey}`;
         const res = await fetch(url, {
             method: 'POST',

package/dist/src/firebase_auth/server/sign_custom_token_remote.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Signs the App Check custom token claims remotely via IAM Credentials'
+ * `signJwt`, instead of locally with a service-account private key. Lets
+ * `mintServerAppCheckToken` work under an org policy that enforces
+ * `iam.disableServiceAccountKeyCreation` — that constraint blocks
+ * `serviceAccounts.keys.create` only; it does not affect `signJwt`, which
+ * signs using a key Google holds and never exports.
+ *
+ * The caller's OAuth identity (the refresh token) must carry
+ * `roles/iam.serviceAccountTokenCreator` on `clientEmail` — grant it with:
+ * `gcloud iam service-accounts add-iam-policy-binding <clientEmail>
+ *   --member="user:<you>" --role="roles/iam.serviceAccountTokenCreator"`.
+ */
+export default function signCustomTokenRemote(clientEmail: string, claims: Record<string, unknown>, oauth: {
+    clientId: string;
+    clientSecret: string;
+    refreshToken: string;
+}): Promise<string>;

package/dist/src/firebase_auth/server/sign_custom_token_remote.js

@@ -0,0 +1,39 @@
+/**
+ * Signs the App Check custom token claims remotely via IAM Credentials'
+ * `signJwt`, instead of locally with a service-account private key. Lets
+ * `mintServerAppCheckToken` work under an org policy that enforces
+ * `iam.disableServiceAccountKeyCreation` — that constraint blocks
+ * `serviceAccounts.keys.create` only; it does not affect `signJwt`, which
+ * signs using a key Google holds and never exports.
+ *
+ * The caller's OAuth identity (the refresh token) must carry
+ * `roles/iam.serviceAccountTokenCreator` on `clientEmail` — grant it with:
+ * `gcloud iam service-accounts add-iam-policy-binding <clientEmail>
+ *   --member="user:<you>" --role="roles/iam.serviceAccountTokenCreator"`.
+ */
+export default async function signCustomTokenRemote(clientEmail, claims, oauth) {
+    const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: oauth.clientId,
+            client_secret: oauth.clientSecret,
+            refresh_token: oauth.refreshToken,
+            grant_type: 'refresh_token',
+        }),
+    });
+    if (!tokenRes.ok) {
+        throw new Error(`oauth2 refresh_token exchange failed: ${tokenRes.status} ${await tokenRes.text()}`);
+    }
+    const { access_token: accessToken } = await tokenRes.json();
+    const signRes = await fetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${clientEmail}:signJwt`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ payload: JSON.stringify(claims) }),
+    });
+    if (!signRes.ok) {
+        throw new Error(`iamcredentials.signJwt failed: ${signRes.status} ${await signRes.text()}`);
+    }
+    const { signedJwt } = await signRes.json();
+    return signedJwt;
+}

package/dist/src/types/types.d.ts

@@ -621,9 +621,10 @@ export interface FirebaseAppCheckConfig {
      * Service account client email, used ONLY server-side to mint an App
      * Check token when the client-written App Check cookie is absent (e.g.
      * a cold navigation before `AuthUserProvider` has run — see
-     * `appCheckTokenCookieName`). Required alongside `privateKey` and
-     * `appId` for server-side minting. Never sent to the client — read only
-     * by `firebase_server.ts`.
+     * `appCheckTokenCookieName`). Required alongside `appId`, plus either
+     * `privateKey` or the `oauthClientId`/`oauthClientSecret`/
+     * `oauthRefreshToken` triple, for server-side minting. Never sent to the
+     * client — read only by `firebase_server.ts`.
      */
     clientEmail: string;
     /**
@@ -633,13 +634,35 @@ export interface FirebaseAppCheckConfig {
      * (e.g. `process.env.FIREBASE_PRIVATE_KEY`), never exposed to the
      * browser. Escaped `\n` sequences (common when stored in a single-line
      * env var) are unescaped automatically before use.
-     */
-    privateKey: string;
+     *
+     * Omit this and set the `oauthClientId`/`oauthClientSecret`/
+     * `oauthRefreshToken` triple instead when your GCP org enforces
+     * `iam.disableServiceAccountKeyCreation`, which blocks issuing this key
+     * in the first place. When both are set, `privateKey` takes priority.
+     */
+    privateKey?: string;
+    /**
+     * Application Default Credentials OAuth client ID — the `client_id`
+     * field from `application_default_credentials.json` (see
+     * `gcloud auth application-default login`). Paired with
+     * `oauthClientSecret` and `oauthRefreshToken` as an alternative to
+     * `privateKey`: instead of signing the App Check custom token locally,
+     * it's signed remotely via IAM Credentials `signJwt`, authenticated as
+     * this OAuth identity. That identity needs
+     * `roles/iam.serviceAccountTokenCreator` on `clientEmail`. Use this when
+     * a service-account key can't be created (see `privateKey`). Ignored
+     * when `privateKey` is set.
+     */
+    oauthClientId?: string;
+    /** OAuth client secret paired with `oauthClientId`. Same ADC-JSON `client_secret` field, same secret-handling rules as `privateKey`. */
+    oauthClientSecret?: string;
+    /** OAuth refresh token paired with `oauthClientId`. Same ADC-JSON `refresh_token` field, same secret-handling rules as `privateKey`. */
+    oauthRefreshToken?: string;
     /**
      * Firebase App Check app ID (e.g. `"1:1234567890:web:abcdef123456"`),
-     * required alongside `clientEmail`/`privateKey` for server-side minting.
-     * Distinct from the Firebase Auth `appId` on `FirebaseAuthRoutingConfig`
-     * itself — App Check registers apps separately.
+     * required alongside `clientEmail` for server-side minting. Distinct
+     * from the Firebase Auth `appId` on `FirebaseAuthRoutingConfig` itself —
+     * App Check registers apps separately.
      */
     appId: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
 
   "main": "dist/index.js",