cloudflare-next-intl 0.8.26 → 0.8.28

package/dist/src/firebase_auth/middleware/update_session.js

@@ -374,11 +374,28 @@ export default async function updateSession(request, baseResponse, locale, rebui
         if (!hintConfirms && !refreshedToken) {
             const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
             if (refreshToken) {
-                const result = await refreshIdToken(fa.apiKey, refreshToken);
+                // `skipCache`: the cached entry is what produced the very
+                // token whose claim is in question, so a normal refresh can
+                // hand back that same token and "confirm" nothing. Only a
+                // genuinely newly-minted token carries information here.
+                const previousToken = token;
+                const result = await refreshIdToken(fa.apiKey, refreshToken, { skipCache: true });
                 if (result.status === 'refreshed') {
                     refreshedToken = { idToken: result.idToken, refreshToken: result.refreshToken };
                     token = refreshedToken.idToken;
-                    unverifiedEmail = decodeJwtPayload(token)?.email_verified === false;
+                    // Redirecting to verifyEmailPath on a claim this refresh
+                    // did not actually re-confirm is what caused an infinite
+                    // loop: the destination page resolves the same user as
+                    // VERIFIED via `getAuthUser()` (`initializeServerApp`
+                    // reads live Auth-service state, not this frozen claim)
+                    // and redirects straight back home. So only trust the
+                    // claim when this mint genuinely re-stated it — the token
+                    // changed — and never against a hint that already
+                    // observed verification live.
+                    const reconfirmed = result.idToken !== previousToken;
+                    unverifiedEmail = hint !== 'true'
+                        && reconfirmed
+                        && decodeJwtPayload(token)?.email_verified === false;
                 }
                 else if (result.status === 'invalid') {
                     clearInvalidSession = true;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cloudflare-next-intl",
-	"version": "0.8.26",
+	"version": "0.8.28",
 	"description": "Optimized Next Intl Package Special for App Router and Cloudflare",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",