cloudflare-next-intl 0.8.26 → 0.8.27
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -378,7 +378,15 @@ export default async function updateSession(request, baseResponse, locale, rebui
|
|
|
378
378
|
if (result.status === 'refreshed') {
|
|
379
379
|
refreshedToken = { idToken: result.idToken, refreshToken: result.refreshToken };
|
|
380
380
|
token = refreshedToken.idToken;
|
|
381
|
-
|
|
381
|
+
// The hint can say `true` (client already confirmed
|
|
382
|
+
// verification live) while this refreshed claim still
|
|
383
|
+
// says `false` — token-claim propagation on Google's
|
|
384
|
+
// backend can lag behind the account-info read `reload()`
|
|
385
|
+
// used to set the hint. Trusting the stale claim here
|
|
386
|
+
// would redirect to verifyEmailPath, which independently
|
|
387
|
+
// resolves the user as verified via `getAuthUser()` and
|
|
388
|
+
// redirects home — an infinite loop. Hint `true` wins.
|
|
389
|
+
unverifiedEmail = hint !== 'true' && decodeJwtPayload(token)?.email_verified === false;
|
|
382
390
|
}
|
|
383
391
|
else if (result.status === 'invalid') {
|
|
384
392
|
clearInvalidSession = true;
|