cloudflare-next-intl 0.8.31 → 0.8.33

package/dist/src/firebase_auth/client/components/auto_firebase_performance_events.d.ts

@@ -2,9 +2,8 @@
  * Auto-rendered alongside `FirebaseAuthClientProvider` when
  * `firebaseAuth.performance` isn't `false` — records Firebase Performance
  * custom traces for Web Vitals metrics (`web_cls`, `web_fcp`, `web_fid`,
- * `web_lcp`, `web_ttfb`, `web_inp`) and SPA route changes (`route_change`),
- * alongside Firebase Performance's own automatic page-load/network traces.
- * No-ops if `firebaseAuth.performance` is disabled (`getFirebasePerformanceSync`
- * never resolves an instance).
+ * `web_lcp`, `web_ttfb`, `web_inp`), alongside Firebase Performance's own
+ * automatic page-load/network traces. No-ops if `firebaseAuth.performance`
+ * is disabled (`getFirebasePerformanceSync` never resolves an instance).
  */
 export default function AutoFirebasePerformanceEvents(): null;

package/dist/src/firebase_auth/client/components/auto_firebase_performance_events.js

@@ -1,7 +1,5 @@
 'use client';
-import { usePathname } from 'next/navigation';
 import { useReportWebVitals } from 'next/web-vitals';
-import { useEffect, useRef } from 'react';
 import reportError from '../../../error_handling/report_error';
 import { getFirebaseAuthClient, getFirebasePerformanceSync } from '../firebase_client';
 /**
@@ -28,84 +26,18 @@ async function recordFirebaseTrace(name, durationMs, attributes, metrics) {
         });
     }
 }
-const SLOW_RESOURCE_THRESHOLD_MS = 1000;
 /**
  * Auto-rendered alongside `FirebaseAuthClientProvider` when
  * `firebaseAuth.performance` isn't `false` — records Firebase Performance
  * custom traces for Web Vitals metrics (`web_cls`, `web_fcp`, `web_fid`,
- * `web_lcp`, `web_ttfb`, `web_inp`) and SPA route changes (`route_change`),
- * alongside Firebase Performance's own automatic page-load/network traces.
- * No-ops if `firebaseAuth.performance` is disabled (`getFirebasePerformanceSync`
- * never resolves an instance).
+ * `web_lcp`, `web_ttfb`, `web_inp`), alongside Firebase Performance's own
+ * automatic page-load/network traces. No-ops if `firebaseAuth.performance`
+ * is disabled (`getFirebasePerformanceSync` never resolves an instance).
  */
 export default function AutoFirebasePerformanceEvents() {
     useReportWebVitals((metric) => {
         const value = Math.round(metric.name === 'CLS' ? metric.value * 1000 : metric.value);
         void recordFirebaseTrace(`web_${metric.name.toLowerCase()}`, value, { rating: metric.rating });
     });
-    const path = usePathname();
-    const isFirstRoute = useRef(true);
-    const lastRouteChangeRef = useRef(Date.now());
-    const longTaskStats = useRef({ count: 0, totalDuration: 0 });
-    // Mount-only: registers a PerformanceObserver for long tasks (main-thread
-    // blocks >= 50ms). Not all browsers support the 'longtask' entry type, so
-    // this is a best-effort signal. The final route's tail of accumulated
-    // long tasks between the last route change and unmount is intentionally
-    // dropped rather than flushed here — this is a monitoring signal, not a
-    // billing metric, and an occasional dropped tail sample is acceptable.
-    useEffect(() => {
-        if (typeof PerformanceObserver === 'undefined' || !PerformanceObserver.supportedEntryTypes?.includes('longtask'))
-            return;
-        const observer = new PerformanceObserver((list) => {
-            for (const entry of list.getEntries()) {
-                longTaskStats.current.count += 1;
-                longTaskStats.current.totalDuration += entry.duration;
-            }
-        });
-        observer.observe({ type: 'longtask', buffered: true });
-        return () => observer.disconnect();
-    }, []);
-    // Mount-only: registers a PerformanceObserver for slow non-fetch/XHR
-    // resources (scripts, images, stylesheets, fonts, etc). Firebase
-    // Performance's own automatic network monitoring already instruments
-    // fetch/XHR, so those are skipped here to avoid duplicate signals.
-    // `buffered: true` also catches resources that loaded before this
-    // component mounted (it only mounts after `AuthUserProvider`).
-    useEffect(() => {
-        if (typeof PerformanceObserver === 'undefined' || !PerformanceObserver.supportedEntryTypes?.includes('resource'))
-            return;
-        const observer = new PerformanceObserver((list) => {
-            for (const entry of list.getEntries()) {
-                if (entry.initiatorType === 'fetch' || entry.initiatorType === 'xmlhttprequest')
-                    continue;
-                if (entry.duration < SLOW_RESOURCE_THRESHOLD_MS)
-                    continue;
-                void recordFirebaseTrace('slow_resource', entry.duration, {
-                    initiator_type: entry.initiatorType,
-                    resource: entry.name.slice(-100),
-                }, { transfer_size_bytes: Math.round(entry.transferSize ?? 0) });
-            }
-        });
-        observer.observe({ type: 'resource', buffered: true });
-        return () => observer.disconnect();
-    }, []);
-    useEffect(() => {
-        const now = Date.now();
-        const duration = now - lastRouteChangeRef.current;
-        lastRouteChangeRef.current = now;
-        if (isFirstRoute.current) {
-            isFirstRoute.current = false;
-            return;
-        }
-        // Approximates navigation duration as time between path-change commits —
-        // App Router exposes no public "navigation start" event this package
-        // can hook into, so this is not a precise navigation timing.
-        void recordFirebaseTrace('route_change', duration, { path: path.slice(-100) });
-        const { count, totalDuration } = longTaskStats.current;
-        longTaskStats.current = { count: 0, totalDuration: 0 };
-        if (count > 0) {
-            void recordFirebaseTrace('route_long_tasks', totalDuration, { path: path.slice(-100) }, { long_task_count: count });
-        }
-    }, [path]);
     return null;
 }

package/dist/src/firebase_auth/client/firebase_client.js

@@ -62,7 +62,7 @@ export async function getFirebaseAuthClient() {
                 measurementId: fa.measurementId,
             };
             const app = getApps().length ? getApp() : initializeApp(firebaseConfig);
-            if (fa.appCheck) {
+            if (fa.appCheck && typeof window !== 'undefined') {
                 cachedAppCheck = await initializeFirebaseAppCheck(app, fa.appCheck);
             }
             if (perfModule) {

package/dist/src/firebase_auth/middleware/update_session.js

@@ -160,6 +160,7 @@ export async function refreshIdToken(apiKey, refreshToken, options) {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`,
+            cache: 'no-store',
         });
         if (!res.ok) {
             if (res.status === 400) {
@@ -243,7 +244,11 @@ export default async function updateSession(request, baseResponse, locale, rebui
         const mode = request.nextUrl.searchParams.get('mode');
         if (mode) {
             let target = resolveActionModePaths(fa)[mode];
-            if (fa.followSameOriginContinueUrl !== false) {
+            // Already on the page this mode routes to: the link has arrived.
+            // Following `continueUrl` from here would send it back to the
+            // action URL, which forwards to this same target again — an
+            // endless 307 ping-pong.
+            if (fa.followSameOriginContinueUrl !== false && target !== path) {
                 const continueUrl = request.nextUrl.searchParams.get('continueUrl');
                 if (continueUrl) {
                     try {
@@ -291,6 +296,15 @@ export default async function updateSession(request, baseResponse, locale, rebui
             if (target && target !== path) {
                 const url = localeUrl(target);
                 url.search = request.nextUrl.search;
+                // Staying on this origin: only `oobCode` (plus anything the app
+                // put there itself) is still needed. Dropping Firebase's own
+                // routing params keeps the landed URL clean and makes a second
+                // forwarding pass impossible.
+                if (fa.stripActionLinkQuery !== false) {
+                    for (const key of ['mode', 'apiKey', 'lang', 'continueUrl']) {
+                        url.searchParams.delete(key);
+                    }
+                }
                 return buildRedirect(baseResponse, url);
             }
         }
@@ -486,5 +500,7 @@ function buildRedirect(baseResponse, url) {
     const redirectResponse = NextResponse.redirect(url);
     baseResponse.cookies.getAll().forEach((cookie) => redirectResponse.cookies.set(cookie));
     baseResponse.headers.forEach((value, key) => redirectResponse.headers.set(key, value));
+    // Explicitly prevent OpenNext/Cloudflare from caching these auth redirects.
+    redirectResponse.headers.set('Cache-Control', 'private, no-cache, no-store, max-age=0, must-revalidate');
     return redirectResponse;
 }

package/dist/src/types/types.d.ts

@@ -546,14 +546,24 @@ export interface FirebaseAuthRoutingConfig {
      * auto-corrects a missing leading slash with a warning.
      */
     actionLinkPath?: string;
+    /**
+     * Whether a same-origin emailed-action-link forward strips Firebase's own
+     * `mode`/`apiKey`/`lang`/`continueUrl` params, landing the user on a clean
+     * `?oobCode=` URL. Defaults to `true`. Set `false` to keep the full query
+     * when the destination page reads those params itself. Cross-origin
+     * redirects always keep the full query.
+     */
+    stripActionLinkQuery?: boolean;
     /**
      * Whether the middleware's own redirects (`redirectAuthPath`, `homePath`,
      * `verifyEmailPath`) carry over the original request's query string —
      * e.g. `/login?ref=abc` stays `/login?ref=abc` after redirecting to
      * `homePath` for a signed-in user, instead of dropping to `/`. Defaults
      * to `true`. The emailed-action-link forward (see
-     * {@link resetPasswordPath}) always preserves its query string
-     * regardless of this setting, since `oobCode` must survive that hop.
+     * {@link resetPasswordPath}) always preserves `oobCode` regardless of
+     * this setting, since it must survive that hop; when the forward stays on
+     * this origin it drops Firebase's own `mode`/`apiKey`/`lang`/`continueUrl`
+     * params, which the destination page no longer needs.
      */
     preserveRedirectQuery?: boolean;
     /** Returns true if the given (locale-stripped) path is an auth page (login/signup/etc). */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cloudflare-next-intl",
-	"version": "0.8.31",
+	"version": "0.8.33",
 	"description": "Optimized Next Intl Package Special for App Router and Cloudflare",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",