cloudflare-next-intl 0.8.35 → 0.8.37

package/README.md

@@ -304,6 +304,7 @@ Features include:
 - `createForgotPasswordAction(locale, actionCodeSettings?)`: Accepts optional Firebase `AuthActionCodeSettings` (e.g. `url` redirect link).
 - `sendVerificationEmail(actionCodeSettings?)` on `useAuthUser()`: Custom action email settings when resending email verification.
 - `followSameOriginContinueUrl`: Automatically forwards emailed action links with `continueUrl` to the specified path (or external URL) directly from `intlMiddleware` (default `true`; set `false` on `firebaseAuth` config to disable). If `continueUrl` points to home root (`/`), it resolves to `actionLinkPath` (if set) or the mode target path (e.g. `/reset-password`).
+- `appCheck`: Firebase App Check integration supporting reCAPTCHA Enterprise (`recaptchaEnterpriseSiteKey`) and reCAPTCHA v3 (`recaptchaV3SiteKey`). For reCAPTCHA v3, defaults to a `CustomProvider` using `IntlHelperScript`'s explicit script tag to avoid iframe/webworker CDN integrity issues in private windows (`useExplicitRecaptchaScript: false` to opt out). Supports server-side token minting via service accounts.
 
 ```tsx
 import ThemeSwitcher from "cloudflare-next-intl/ThemeSwitcher";

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -246,7 +246,20 @@ export default function AuthUserProvider({ initialUser = null, children }) {
                     }
                 }
                 const flipped = previous !== undefined && previous !== isSignedIn;
-                const contradictsPage = previous === undefined && isSignedIn === isAuthPage;
+                // `contradictsPage` infers "the server rendered this page for
+                // the opposite auth state, resync it" from the page's own
+                // auth/non-auth role. On a whitelisted path that inference is
+                // meaningless — the page renders identically signed-in or
+                // signed-out and neither guard ever redirects away from it —
+                // so a signed-out visitor on a non-auth whitelisted page
+                // (`isSignedIn === isAuthPage`, both false) matched on the
+                // first observation and refreshed. That refresh re-primes the
+                // router cache, re-firing every in-viewport `<Link>` prefetch,
+                // which lands back here and repeats: an unbounded refresh loop
+                // on exactly the public landing pages whitelisting exists for.
+                // A real `flipped` transition still refreshes, whitelisted or
+                // not — that one observed an actual state change.
+                const contradictsPage = !isWhiteListed && previous === undefined && isSignedIn === isAuthPage;
                 if (flipped || contradictsPage) {
                     router.refresh();
                 }
@@ -257,7 +270,7 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             unsubscribe?.();
         };
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [router, isAuthPage, maxAge, sessionCookieName, refreshTokenMaxAge, refreshTokenCookieName, emailVerifiedHintCookieName, appCheckTokenCookieName, appCheckTokenMaxAge]);
+    }, [router, isAuthPage, isWhiteListed, maxAge, sessionCookieName, refreshTokenMaxAge, refreshTokenCookieName, emailVerifiedHintCookieName, appCheckTokenCookieName, appCheckTokenMaxAge]);
     const reloadUser = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;

package/dist/src/firebase_auth/client/firebase_client.d.ts

@@ -1,13 +1,23 @@
 import type { FirebaseApp } from 'firebase/app';
 import type { Auth } from 'firebase/auth';
 import type { FirebasePerformance } from 'firebase/performance';
-/**
- * Current App Check token, or `undefined` if `appCheck` isn't configured or
- * hasn't initialized yet. Forces a refresh only when the cached token is
- * expired/near-expiry — mirrors `getToken`'s own semantics, just exposed
- * here so callers (e.g. `AuthUserProvider`'s session-cookie sync) don't need
- * to import `firebase/app-check` themselves.
- */
+interface Grecaptcha {
+    ready: (callback: () => void) => void;
+    render: (container: HTMLElement, params: {
+        sitekey: string;
+        size: 'invisible';
+        callback: () => void;
+        'error-callback': () => void;
+    }) => string;
+    execute: (widgetId: string, options: {
+        action: string;
+    }) => Promise<string>;
+}
+declare global {
+    interface Window {
+        grecaptcha?: Grecaptcha;
+    }
+}
 export declare function getAppCheckToken(): Promise<string | undefined>;
 /**
  * Lazily loads and initializes `firebase/app`/`firebase/auth` — a dynamic
@@ -29,3 +39,4 @@ export declare function getFirebaseAuthClientSync(): {
 export declare function getFirebasePerformanceSync(): FirebasePerformance | undefined;
 /** Memoized `import('firebase/auth')` — see {@link getFirebaseAuthClient} for why this is worth caching. */
 export declare function getFirebaseAuthModule(): Promise<typeof import('firebase/auth')>;
+export {};

package/dist/src/firebase_auth/client/firebase_client.js

@@ -3,15 +3,128 @@ import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
 let cachedAppCheck;
 let cachedPerformance;
+const GRECAPTCHA_LOAD_TIMEOUT_MS = 15000;
+const GRECAPTCHA_POLL_INTERVAL_MS = 50;
+/**
+ * Resolves once the reCAPTCHA script has defined `window.grecaptcha`. The
+ * script tag `IntlHelperScript` renders is `async`, and
+ * `initializeAppCheck` fetches a token immediately when
+ * `isTokenAutoRefreshEnabled` is on, so the first `getToken` regularly runs
+ * before the script has landed — this polls instead of failing outright.
+ */
+function waitForGrecaptcha() {
+    if (window.grecaptcha)
+        return Promise.resolve(window.grecaptcha);
+    return new Promise((resolve, reject) => {
+        const startedAt = Date.now();
+        const timer = setInterval(() => {
+            if (window.grecaptcha) {
+                clearInterval(timer);
+                resolve(window.grecaptcha);
+            }
+            else if (Date.now() - startedAt >= GRECAPTCHA_LOAD_TIMEOUT_MS) {
+                clearInterval(timer);
+                reject(new Error('window.grecaptcha never loaded; ensure the reCAPTCHA <script src="https://www.google.com/recaptcha/api.js?render=explicit"> tag is present'));
+            }
+        }, GRECAPTCHA_POLL_INTERVAL_MS);
+    });
+}
+/**
+ * Faithful reimplementation of `ReCaptchaV3Provider`'s internal
+ * widget-render + token-exchange flow (see `@firebase/app-check`'s
+ * `initializeV3`/`queueWidgetRender`/`getToken$1`/`exchangeToken`), minus
+ * its own internal `<script>` injection — that injection is what spawns the
+ * worker documented on `useExplicitRecaptchaScript`. Relies on the script
+ * tag `IntlHelperScript` renders, waiting for it rather than assuming it has
+ * already loaded. Hits the same public `exchangeRecaptchaV3Token` REST
+ * endpoint Firebase's own provider uses, so this stays correct even if
+ * `@firebase/app-check` changes its internal script-loading strategy.
+ */
+function createExplicitRecaptchaProvider(app, siteKey, CustomProvider) {
+    let widgetReady;
+    let widgetSucceeded = false;
+    function ensureWidget() {
+        if (widgetReady)
+            return widgetReady;
+        const pending = (async () => {
+            const grecaptcha = await waitForGrecaptcha();
+            return new Promise(resolve => {
+                grecaptcha.ready(() => {
+                    const containerId = `fire_app_check_${app.name}`;
+                    let container = document.getElementById(containerId);
+                    if (!container) {
+                        container = document.createElement('div');
+                        container.id = containerId;
+                        container.style.display = 'none';
+                        document.body.appendChild(container);
+                    }
+                    resolve({
+                        grecaptcha,
+                        widgetId: grecaptcha.render(container, {
+                            sitekey: siteKey,
+                            size: 'invisible',
+                            callback: () => {
+                                widgetSucceeded = true;
+                            },
+                            'error-callback': () => {
+                                widgetSucceeded = false;
+                            },
+                        }),
+                    });
+                });
+            });
+        })();
+        // Never memoize a rejection: a failed load (script still in flight,
+        // transient network error) must not permanently disable App Check for
+        // the rest of the page's lifetime.
+        widgetReady = pending.catch(error => {
+            widgetReady = undefined;
+            throw error;
+        });
+        return widgetReady;
+    }
+    return new CustomProvider({
+        getToken: async () => {
+            const { grecaptcha, widgetId } = await ensureWidget();
+            // `grecaptcha.execute()` rejects with `null` on failure, which
+            // surfaces as an unhelpful error — mirror Firebase's own remap.
+            const recaptchaToken = await grecaptcha
+                .execute(widgetId, { action: 'fire_app_check' })
+                .catch(() => {
+                throw new Error('reCAPTCHA error');
+            });
+            if (!widgetSucceeded) {
+                throw new Error('reCAPTCHA error');
+            }
+            const { projectId, appId, apiKey } = app.options;
+            const response = await fetch(`https://content-firebaseappcheck.googleapis.com/v1/projects/${projectId}/apps/${appId}:exchangeRecaptchaV3Token?key=${apiKey}`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ recaptcha_v3_token: recaptchaToken }),
+            });
+            if (response.status !== 200) {
+                throw new Error(`App Check token exchange failed with status ${response.status}`);
+            }
+            const body = (await response.json());
+            const match = body.ttl.match(/^([\d.]+)s$/);
+            if (!match) {
+                throw new Error(`Unexpected ttl format in App Check exchange response: ${body.ttl}`);
+            }
+            return { token: body.token, expireTimeMillis: Date.now() + Number(match[1]) * 1000 };
+        },
+    });
+}
 async function initializeFirebaseAppCheck(app, appCheckConfig) {
-    const { initializeAppCheck, ReCaptchaV3Provider, ReCaptchaEnterpriseProvider } = await import('firebase/app-check');
+    const { initializeAppCheck, ReCaptchaV3Provider, ReCaptchaEnterpriseProvider, CustomProvider } = await import('firebase/app-check');
     if (appCheckConfig.debugToken) {
         globalThis.FIREBASE_APPCHECK_DEBUG_TOKEN =
             appCheckConfig.debugToken;
     }
     const provider = appCheckConfig.recaptchaEnterpriseSiteKey
         ? new ReCaptchaEnterpriseProvider(appCheckConfig.recaptchaEnterpriseSiteKey)
-        : new ReCaptchaV3Provider(appCheckConfig.recaptchaV3SiteKey);
+        : appCheckConfig.useExplicitRecaptchaScript !== false
+            ? createExplicitRecaptchaProvider(app, appCheckConfig.recaptchaV3SiteKey, CustomProvider)
+            : new ReCaptchaV3Provider(appCheckConfig.recaptchaV3SiteKey);
     return initializeAppCheck(app, {
         provider,
         isTokenAutoRefreshEnabled: appCheckConfig.isTokenAutoRefreshEnabled ?? true,
@@ -24,12 +137,22 @@ async function initializeFirebaseAppCheck(app, appCheckConfig) {
  * here so callers (e.g. `AuthUserProvider`'s session-cookie sync) don't need
  * to import `firebase/app-check` themselves.
  */
+const APP_CHECK_TOKEN_TIMEOUT_MS = 10000;
 export async function getAppCheckToken() {
     if (!cachedAppCheck)
         return undefined;
     const { getToken } = await import('firebase/app-check');
-    const result = await getToken(cachedAppCheck);
-    return result.token;
+    try {
+        const result = await Promise.race([
+            getToken(cachedAppCheck),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('App Check token timed out')), APP_CHECK_TOKEN_TIMEOUT_MS)),
+        ]);
+        return result.token;
+    }
+    catch (error) {
+        console.warn('App Check token fetch failed, continuing without it', error);
+        return undefined;
+    }
 }
 let cached;
 let cachedPromise;
@@ -63,7 +186,12 @@ export async function getFirebaseAuthClient() {
             };
             const app = getApps().length ? getApp() : initializeApp(firebaseConfig);
             if (fa.appCheck && typeof window !== 'undefined') {
-                cachedAppCheck = await initializeFirebaseAppCheck(app, fa.appCheck);
+                try {
+                    cachedAppCheck = await initializeFirebaseAppCheck(app, fa.appCheck);
+                }
+                catch (error) {
+                    console.warn('App Check initialization failed, continuing without it', error);
+                }
             }
             if (perfModule) {
                 cachedPerformance = perfModule.getPerformance(app);

package/dist/src/server/components/helper_script.d.ts

@@ -6,6 +6,10 @@
  * - redirects to the locale-prefixed URL if the locale cookie disagrees
  *   with the current path (covers client-side navigation edge cases)
  * - (prod only) checks `BUILD_ID` and force-reloads on stale deploys
+ * - loads `recaptcha/api.js?render=explicit` when `firebaseAuth.appCheck`
+ *   has a `recaptchaV3SiteKey` and `useExplicitRecaptchaScript` isn't
+ *   `false`, so `window.grecaptcha` is ready before App Check's
+ *   `CustomProvider` needs it (see `firebase_client.ts`)
  *
  * Place it once in your root layout's `<head>`, alongside `IntlProvider`.
  * No props.

package/dist/src/server/components/helper_script.js

@@ -3,6 +3,8 @@ import { isDarkCookieKey, localeCookieName } from "../../config/cookie_key";
 import config from "../../config/intl_config";
 import ClientHelperScript from "../../client/components/client_helper_script";
 const isDev = process.env.NODE_ENV === 'development';
+const appCheck = config.firebaseAuth?.appCheck;
+const shouldLoadExplicitRecaptchaScript = !!appCheck?.recaptchaV3SiteKey && appCheck.useExplicitRecaptchaScript !== false;
 const secureCookieAttribute = isDev ? '+ " Secure;"' : '';
 /**
  * Server component exported as `IntlHelperScript` from
@@ -12,6 +14,10 @@ const secureCookieAttribute = isDev ? '+ " Secure;"' : '';
  * - redirects to the locale-prefixed URL if the locale cookie disagrees
  *   with the current path (covers client-side navigation edge cases)
  * - (prod only) checks `BUILD_ID` and force-reloads on stale deploys
+ * - loads `recaptcha/api.js?render=explicit` when `firebaseAuth.appCheck`
+ *   has a `recaptchaV3SiteKey` and `useExplicitRecaptchaScript` isn't
+ *   `false`, so `window.grecaptcha` is ready before App Check's
+ *   `CustomProvider` needs it (see `firebase_client.ts`)
  *
  * Place it once in your root layout's `<head>`, alongside `IntlProvider`.
  * No props.
@@ -24,7 +30,8 @@ const secureCookieAttribute = isDev ? '+ " Secure;"' : '';
  * ```
  */
 export default function HelperScript() {
-    return _jsxs(_Fragment, { children: [!isDev &&
+    return _jsxs(_Fragment, { children: [shouldLoadExplicitRecaptchaScript &&
+                _jsx("script", { src: "https://www.google.com/recaptcha/api.js?render=explicit", async: true, defer: true }), !isDev &&
                 _jsx("script", { id: "build-id-script", children: `(async function() {
                 try {
                     const resp = await fetch('/BUILD_ID', { method: 'HEAD', cache: 'no-store' });

package/dist/src/types/types.d.ts

@@ -632,6 +632,25 @@ export interface FirebaseAppCheckConfig {
     recaptchaV3SiteKey?: string;
     /** reCAPTCHA Enterprise site key. Mutually exclusive with `recaptchaV3SiteKey`. */
     recaptchaEnterpriseSiteKey?: string;
+    /**
+     * When `recaptchaV3SiteKey` is set, App Check defaults (`true`, or
+     * omitted) to a `CustomProvider` that renders an invisible reCAPTCHA
+     * widget and calls `window.grecaptcha.execute` directly, instead of
+     * Firebase's `ReCaptchaV3Provider`. `ReCaptchaV3Provider` injects its
+     * own `<script>` internally, which spawns a background worker
+     * (`api2/webworker.js`) that independently re-fetches
+     * `recaptcha__en.js` — in browsers with no persistent HTTP cache (e.g.
+     * Firefox private windows), that second fetch can hit a different CDN
+     * edge than the main-thread script tag, tripping a `sha384` integrity
+     * mismatch and an infinite retry loop that freezes the tab. The
+     * `CustomProvider` path requires the consumer to load
+     * `https://www.google.com/recaptcha/api.js?render=explicit` themselves
+     * (e.g. via `next/script`) before App Check initializes; it replicates
+     * `ReCaptchaV3Provider`'s widget-render and token-exchange flow against
+     * the same public `exchangeRecaptchaV3Token` endpoint. Set to `false`
+     * to use Firebase's own `ReCaptchaV3Provider` instead.
+     */
+    useExplicitRecaptchaScript?: boolean;
     /**
      * Enables App Check's debug token on this client. Pass `true` to have
      * the Firebase SDK generate a new random token each run (logged to the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.8.35",
+  "version": "0.8.37",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",