cloudflare-next-intl 0.8.25 → 0.8.27

package/dist/src/firebase_auth/middleware/update_session.js

@@ -35,6 +35,8 @@ function resolveActionModePaths(fa) {
         paths.verifyEmail = fa.verifyEmailPath;
     if (fa.recoverEmailPath)
         paths.recoverEmail = fa.recoverEmailPath;
+    if (fa.signInPath)
+        paths.signIn = fa.signInPath;
     return { ...paths, ...fa.actionModePaths };
 }
 export const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
@@ -256,7 +258,13 @@ export default async function updateSession(request, baseResponse, locale, rebui
                                     continuePath = '/';
                                 }
                             }
-                            if (continuePath !== '/') {
+                            // A continueUrl pointing back at the request's own
+                            // path (e.g. the single project-wide action URL
+                            // echoing itself as `actionCodeSettings.url`)
+                            // carries no routing information — keep the
+                            // mode-derived target instead of overwriting it
+                            // with a no-op.
+                            if (continuePath !== '/' && continuePath !== path) {
                                 target = continuePath;
                             }
                         }
@@ -370,7 +378,15 @@ export default async function updateSession(request, baseResponse, locale, rebui
                 if (result.status === 'refreshed') {
                     refreshedToken = { idToken: result.idToken, refreshToken: result.refreshToken };
                     token = refreshedToken.idToken;
-                    unverifiedEmail = decodeJwtPayload(token)?.email_verified === false;
+                    // The hint can say `true` (client already confirmed
+                    // verification live) while this refreshed claim still
+                    // says `false` — token-claim propagation on Google's
+                    // backend can lag behind the account-info read `reload()`
+                    // used to set the hint. Trusting the stale claim here
+                    // would redirect to verifyEmailPath, which independently
+                    // resolves the user as verified via `getAuthUser()` and
+                    // redirects home — an infinite loop. Hint `true` wins.
+                    unverifiedEmail = hint !== 'true' && decodeJwtPayload(token)?.email_verified === false;
                 }
                 else if (result.status === 'invalid') {
                     clearInvalidSession = true;

package/dist/src/types/types.d.ts

@@ -508,6 +508,13 @@ export interface FirebaseAuthRoutingConfig {
      * warning.
      */
     recoverEmailPath?: string;
+    /**
+     * Path handling an emailed passwordless `signIn` action link. Omit to
+     * leave that mode unhandled — the request then falls through to normal
+     * routing instead of being forwarded. Must start with "/" —
+     * `setIntlConfig` auto-corrects a missing leading slash with a warning.
+     */
+    signInPath?: string;
     /**
      * Extra/overriding `?mode=` → path entries for the emailed-action-link
      * forward described on {@link resetPasswordPath}. Merged over the

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cloudflare-next-intl",
-	"version": "0.8.25",
+	"version": "0.8.27",
 	"description": "Optimized Next Intl Package Special for App Router and Cloudflare",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",