cloudflare-next-intl 0.8.31 → 0.8.32

package/dist/src/firebase_auth/client/firebase_client.js

@@ -62,7 +62,7 @@ export async function getFirebaseAuthClient() {
                 measurementId: fa.measurementId,
             };
             const app = getApps().length ? getApp() : initializeApp(firebaseConfig);
-            if (fa.appCheck) {
+            if (fa.appCheck && typeof window !== 'undefined') {
                 cachedAppCheck = await initializeFirebaseAppCheck(app, fa.appCheck);
             }
             if (perfModule) {

package/dist/src/firebase_auth/middleware/update_session.js

@@ -243,7 +243,11 @@ export default async function updateSession(request, baseResponse, locale, rebui
         const mode = request.nextUrl.searchParams.get('mode');
         if (mode) {
             let target = resolveActionModePaths(fa)[mode];
-            if (fa.followSameOriginContinueUrl !== false) {
+            // Already on the page this mode routes to: the link has arrived.
+            // Following `continueUrl` from here would send it back to the
+            // action URL, which forwards to this same target again — an
+            // endless 307 ping-pong.
+            if (fa.followSameOriginContinueUrl !== false && target !== path) {
                 const continueUrl = request.nextUrl.searchParams.get('continueUrl');
                 if (continueUrl) {
                     try {
@@ -291,6 +295,15 @@ export default async function updateSession(request, baseResponse, locale, rebui
             if (target && target !== path) {
                 const url = localeUrl(target);
                 url.search = request.nextUrl.search;
+                // Staying on this origin: only `oobCode` (plus anything the app
+                // put there itself) is still needed. Dropping Firebase's own
+                // routing params keeps the landed URL clean and makes a second
+                // forwarding pass impossible.
+                if (fa.stripActionLinkQuery !== false) {
+                    for (const key of ['mode', 'apiKey', 'lang', 'continueUrl']) {
+                        url.searchParams.delete(key);
+                    }
+                }
                 return buildRedirect(baseResponse, url);
             }
         }

package/dist/src/types/types.d.ts

@@ -546,14 +546,24 @@ export interface FirebaseAuthRoutingConfig {
      * auto-corrects a missing leading slash with a warning.
      */
     actionLinkPath?: string;
+    /**
+     * Whether a same-origin emailed-action-link forward strips Firebase's own
+     * `mode`/`apiKey`/`lang`/`continueUrl` params, landing the user on a clean
+     * `?oobCode=` URL. Defaults to `true`. Set `false` to keep the full query
+     * when the destination page reads those params itself. Cross-origin
+     * redirects always keep the full query.
+     */
+    stripActionLinkQuery?: boolean;
     /**
      * Whether the middleware's own redirects (`redirectAuthPath`, `homePath`,
      * `verifyEmailPath`) carry over the original request's query string —
      * e.g. `/login?ref=abc` stays `/login?ref=abc` after redirecting to
      * `homePath` for a signed-in user, instead of dropping to `/`. Defaults
      * to `true`. The emailed-action-link forward (see
-     * {@link resetPasswordPath}) always preserves its query string
-     * regardless of this setting, since `oobCode` must survive that hop.
+     * {@link resetPasswordPath}) always preserves `oobCode` regardless of
+     * this setting, since it must survive that hop; when the forward stays on
+     * this origin it drops Firebase's own `mode`/`apiKey`/`lang`/`continueUrl`
+     * params, which the destination page no longer needs.
      */
     preserveRedirectQuery?: boolean;
     /** Returns true if the given (locale-stripped) path is an auth page (login/signup/etc). */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cloudflare-next-intl",
-	"version": "0.8.31",
+	"version": "0.8.32",
 	"description": "Optimized Next Intl Package Special for App Router and Cloudflare",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",