cloudflare-next-intl 0.9.10 → 0.9.12

package/README.md

@@ -940,9 +940,11 @@ allowed to see the rows; call `.transaction(...)` on the handle either one
 hands your callback when a write needs more than one statement to succeed or
 fail together (see [Multi-statement transactions](#multi-statement-transactions-dbtransaction) above):
 
-- `withPublicDb(fn, dbOverride?)` — runs `fn` as the anonymous role: a pooled
-  connection with no transaction/role switch in connection-string mode, or the
-  anon key as the PostgREST bearer token in Supabase mode. No user id is
+- `withPublicDb(fn, dbOverride?)` — runs `fn` as the `anon` Postgres role.
+  In connection-string mode (Hyperdrive) the connection-string user is
+  temporarily downgraded to `anon` via `SET LOCAL ROLE anon` before your
+  callback executes, so RLS policies apply identically to the Supabase-mode
+  path (where the anon key is the PostgREST bearer token). No user id is
   attached either way, so RLS policies that test `auth.jwt()->>'sub'` will
   deny access — use `withUserDb` for user-owned rows.
 - `withUserDb(fn, uid?, dbOverride?)` — runs `fn` as the signed-in user. In

package/dist/src/config/cookie_key.d.ts

@@ -3,3 +3,5 @@ export declare const isBotCookieKey = "__is_bot_key__";
 export declare const isDarkCookieKey = "__is_dark_key__";
 export declare const cookieConsentCookieKey = "__cookie_consent_key__";
 export declare const privacyPolicyDateCookieKey = "__privacy_policy_date_key__";
+export declare const countryCookieKey = "__cf_country__";
+export declare const timezoneCookieKey = "__cf_timezone__";

package/dist/src/config/cookie_key.js

@@ -3,3 +3,5 @@ export const isBotCookieKey = '__is_bot_key__';
 export const isDarkCookieKey = '__is_dark_key__';
 export const cookieConsentCookieKey = '__cookie_consent_key__';
 export const privacyPolicyDateCookieKey = '__privacy_policy_date_key__';
+export const countryCookieKey = '__cf_country__';
+export const timezoneCookieKey = '__cf_timezone__';

package/dist/src/config/middleware.js

@@ -1,9 +1,10 @@
 import { NextResponse } from 'next/server.js';
 import { languageDetecotr } from '../server/functions/get_user_locale.js';
 import config from './intl_config.js';
-import { isBotCookieKey, localeCookieName } from './cookie_key.js';
+import { countryCookieKey, isBotCookieKey, localeCookieName, timezoneCookieKey } from './cookie_key.js';
 import { cache } from 'react';
 import reportError from '../error_handling/report_error.js';
+import { defaultCountryHeaderNames, defaultTimezoneHeaderNames } from '../server/functions/geo.js';
 const sameSite = false;
 const defaultCookieOption = {
     path: '/',
@@ -24,6 +25,14 @@ async function getIsBotValue(userAgent) {
 const getIsBotValueCache = cache(getIsBotValue);
 export const localesSet = new Set(config.locales);
 let updateSessionModule;
+function getFirstHeaderValue(headers, names) {
+    for (const name of names) {
+        const value = headers.get(name);
+        if (value)
+            return value;
+    }
+    return undefined;
+}
 export default async function intlMiddleware(request, options) {
     try {
         let initialChosenLocale;
@@ -59,14 +68,19 @@ export default async function intlMiddleware(request, options) {
             pathWithoutLocale = pathname;
         }
         const effectiveLocaleForRequest = urlLocale ?? initialChosenLocale;
-        const country = request.cf?.country ?? request.headers.get('cf-ipcountry') ?? request.headers.get('x-cf-country');
-        if (country) {
-            request.headers.set('x-cf-country', country);
-        }
-        const timezone = request.cf?.timezone ?? request.headers.get('cf-timezone') ?? request.headers.get('x-cf-timezone');
-        if (timezone) {
-            request.headers.set('x-cf-timezone', timezone);
-        }
+        const cf = request.cf;
+        const countryHeaderNames = config.cookieConsent?.countryHeaderNames
+            ?? config.generate?.countryHeaderNames
+            ?? defaultCountryHeaderNames;
+        const timezoneHeaderNames = config.generate?.timezoneHeaderNames
+            ?? defaultTimezoneHeaderNames;
+        const countryCookieName = config.cookieConsent?.countryCookieName
+            ?? config.generate?.countryCookieName
+            ?? countryCookieKey;
+        const timezoneCookieName = config.generate?.timezoneCookieName
+            ?? timezoneCookieKey;
+        const country = cf?.country || getFirstHeaderValue(request.headers, countryHeaderNames);
+        const timezone = cf?.timezone || getFirstHeaderValue(request.headers, timezoneHeaderNames);
         const requestHeaders = new Headers(request.headers);
         requestHeaders.set('x-pathname', pathWithoutLocale);
         requestHeaders.set('x-search', search);
@@ -123,9 +137,23 @@ export default async function intlMiddleware(request, options) {
         response.headers.set('x-search', search);
         if (country) {
             response.headers.set('x-cf-country', country);
+            response.cookies.set(countryCookieName, country, {
+                path: '/',
+                maxAge: 86400,
+                httpOnly: false,
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: 'lax',
+            });
         }
         if (timezone) {
             response.headers.set('x-cf-timezone', timezone);
+            response.cookies.set(timezoneCookieName, timezone, {
+                path: '/',
+                maxAge: 86400,
+                httpOnly: false,
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: 'lax',
+            });
         }
         if (!isRedirect && config.firebaseAuth && config.firebaseAuth.middlewareEnabled !== false) {
             if (!updateSessionModule) {

package/dist/src/cookie_consent/client/cookie_consent_provider.d.ts

@@ -1,6 +1,6 @@
 import type { CookieConsentContextType } from '../types.js';
 export declare const CookieConsentContext: import("react").Context<CookieConsentContextType | null>;
-export default function CookieConsentProvider({ requiresConsent, children }: {
+export default function CookieConsentProvider({ requiresConsent: requiresConsentProp, children }: {
     requiresConsent?: boolean;
     children: React.ReactNode;
 }): React.ReactElement;

package/dist/src/cookie_consent/client/cookie_consent_provider.js

@@ -6,7 +6,8 @@ import config from '../../config/intl_config.js';
 import requireCookieConsentConfig from '../require_config.js';
 import getCookie from '../../client/functions/get_cookie.js';
 import setCookie from '../../client/functions/set_cookie.js';
-import { cookieConsentCookieKey, privacyPolicyDateCookieKey } from '../../config/cookie_key.js';
+import { cookieConsentCookieKey, countryCookieKey, privacyPolicyDateCookieKey } from '../../config/cookie_key.js';
+import { defaultGdprCountries } from '../gdpr_countries.js';
 export const CookieConsentContext = createContext(null);
 function parseConsent(raw) {
     if (raw === 'true')
@@ -15,8 +16,9 @@ function parseConsent(raw) {
         return false;
     return null;
 }
-export default function CookieConsentProvider({ requiresConsent = true, children }) {
-    const { consentCookieName, dateCookieName, maxAge, policyDate, privacyPolicyPath, showPrivacyPolicy } = useMemo(() => {
+const defaultGdprCountriesSet = new Set(defaultGdprCountries);
+export default function CookieConsentProvider({ requiresConsent: requiresConsentProp = true, children }) {
+    const { consentCookieName, dateCookieName, maxAge, policyDate, privacyPolicyPath, showPrivacyPolicy, gdprCountries } = useMemo(() => {
         const cc = requireCookieConsentConfig(config.cookieConsent);
         return {
             consentCookieName: cc.consentCookieName ?? cookieConsentCookieKey,
@@ -25,17 +27,28 @@ export default function CookieConsentProvider({ requiresConsent = true, children
             policyDate: cc.privacyPolicyDate ? new Date(cc.privacyPolicyDate) : null,
             privacyPolicyPath: cc.privacyPolicyPath ?? '/privacy-policy',
             showPrivacyPolicy: cc.showPrivacyPolicy ?? true,
+            gdprCountries: cc.gdprCountries,
         };
     }, []);
     const [consent, setConsentState] = useState(null);
     const [privacyPolicyUpdated, setPrivacyPolicyUpdated] = useState(false);
     const [isMounted, setIsMounted] = useState(false);
+    const [requiresConsent, setRequiresConsent] = useState(requiresConsentProp);
     const pathname = usePathname();
     useEffect(() => {
         const rawConsent = getCookie(consentCookieName);
         const storedConsent = parseConsent(rawConsent);
         const isFirstVisit = rawConsent === null;
         setConsentState(storedConsent);
+        if (requiresConsentProp) {
+            const countryCookie = getCookie(countryCookieKey);
+            if (countryCookie) {
+                const gdprSet = gdprCountries
+                    ? new Set(gdprCountries)
+                    : defaultGdprCountriesSet;
+                setRequiresConsent(gdprSet.has(countryCookie));
+            }
+        }
         setIsMounted(true);
         if (isFirstVisit || !policyDate)
             return;
@@ -46,7 +59,7 @@ export default function CookieConsentProvider({ requiresConsent = true, children
         }
         const storedDate = new Date(storedDateRaw);
         setPrivacyPolicyUpdated(!Number.isNaN(storedDate.getTime()) && storedDate < policyDate);
-    }, [consentCookieName, dateCookieName, maxAge, policyDate]);
+    }, [consentCookieName, dateCookieName, maxAge, policyDate, requiresConsentProp, gdprCountries]);
     const setConsent = useCallback((value) => {
         if (value === null) {
             setCookie({ name: consentCookieName, value: 'null', maxAge });

package/dist/src/db/context.js

@@ -108,6 +108,7 @@ export async function withPublicDb(fn, dbOverride) {
     return await withDbClient(config, async (client) => {
         const { drizzle } = await import('drizzle-orm/node-postgres');
         const drizzleHandle = drizzle(client);
+        await client.query(`set local role anon`);
         return await fn(await postgresDb(drizzleHandle, client));
     });
 }

package/dist/src/server/components/server_provider.js

@@ -4,7 +4,6 @@ import { getMessage } from "../functions/server.js";
 import dynamic from "next/dynamic.js";
 import { localesSet } from "../../config/middleware.js";
 import config from "../../config/intl_config.js";
-import resolveRequiresConsent from "../../cookie_consent/gdpr_countries.js";
 import installConsoleErrorOverride from "../../error_handling/install_console_error_override.js";
 import reportError from "../../error_handling/report_error.js";
 const LocationzationClientProvider = dynamic(() => import("../../client/components/client_provider.js"));
@@ -43,9 +42,7 @@ export default async function LocationzationProvider({ language, messages, stati
     let requiresConsent = true;
     if (config.cookieConsent) {
         const isDevEnvironment = process.env.NODE_ENV === 'development';
-        requiresConsent = !isDevEnvironment
-            ? await resolveRequiresConsent(config.cookieConsent.getCountryCode, config.generate?.getCloudflareContext, config.cookieConsent.gdprCountries, config.errorHandling, config.cookieConsent.countryHeaderNames, config.generate)
-            : false;
+        requiresConsent = !isDevEnvironment;
         const analyticsAllowedInEnv = config.cookieConsent.enableAnalyticsInDevMode === true || !isDevEnvironment;
         if (config.cookieConsent.autoWireAnalytics !== false && analyticsAllowedInEnv) {
             if (config.cookieConsent.getAnalytics) {

package/dist/src/server/components/server_provider_static.js

@@ -4,7 +4,6 @@ import { getMessage } from "../functions/server.js";
 import dynamic from "next/dynamic.js";
 import { localesSet } from "../../config/middleware.js";
 import config from "../../config/intl_config.js";
-import resolveRequiresConsent from "../../cookie_consent/gdpr_countries.js";
 import installConsoleErrorOverride from "../../error_handling/install_console_error_override.js";
 import reportError from "../../error_handling/report_error.js";
 const LocationzationClientProvider = dynamic(() => import("../../client/components/client_provider_static.js"));
@@ -32,9 +31,7 @@ export default async function LocationzationProvider({ language, messages, child
     let requiresConsent = true;
     if (config.cookieConsent) {
         const isDevEnvironment = process.env.NODE_ENV === 'development';
-        requiresConsent = !isDevEnvironment
-            ? await resolveRequiresConsent(config.cookieConsent.getCountryCode, config.generate?.getCloudflareContext, config.cookieConsent.gdprCountries, config.errorHandling, config.cookieConsent.countryHeaderNames, config.generate)
-            : false;
+        requiresConsent = !isDevEnvironment;
         const analyticsAllowedInEnv = config.cookieConsent.enableAnalyticsInDevMode === true || !isDevEnvironment;
         if (config.cookieConsent.autoWireAnalytics !== false && analyticsAllowedInEnv) {
             if (config.cookieConsent.getAnalytics) {

package/dist/src/server/functions/geo.js

@@ -1,3 +1,4 @@
+import { countryCookieKey, timezoneCookieKey } from '../../config/cookie_key.js';
 export const defaultCountryHeaderNames = ['x-cf-country', 'cf-ipcountry'];
 export const defaultTimezoneHeaderNames = ['x-cf-timezone', 'cf-timezone'];
 function extractHeader(h, name) {
@@ -26,6 +27,28 @@ function extractFromHeaderNames(h, headerNames) {
     }
     return undefined;
 }
+function extractCookieHeader(h, name) {
+    const cookieHeader = extractHeader(h, 'cookie');
+    if (!cookieHeader)
+        return undefined;
+    const parts = cookieHeader.split(';');
+    for (const part of parts) {
+        const index = part.indexOf('=');
+        if (index === -1)
+            continue;
+        const key = part.slice(0, index).trim();
+        if (key !== name)
+            continue;
+        const value = part.slice(index + 1).trim();
+        return value ? decodeURIComponent(value) : undefined;
+    }
+    return undefined;
+}
+function extractCookie(cookieStore, name) {
+    const cookie = cookieStore?.get?.(name);
+    const value = typeof cookie === 'string' ? cookie : cookie?.value;
+    return value || undefined;
+}
 export async function getCountry(input, generate, headerNames) {
     const gen = generate ?? await configuredGenerate();
     const names = headerNames
@@ -36,11 +59,21 @@ export async function getCountry(input, generate, headerNames) {
             const country = extractFromHeaderNames(input.headers, names);
             if (country)
                 return country;
+            const cookieCountry = extractCookieHeader(input.headers, countryCookieKey);
+            if (cookieCountry)
+                return cookieCountry;
         }
         else if (typeof input.get === 'function') {
             const country = extractFromHeaderNames(input, names);
             if (country)
                 return country;
+            const cookieCountry = extractCookieHeader(input, countryCookieKey);
+            if (cookieCountry)
+                return cookieCountry;
+        }
+        const cookieCountry = extractCookie(input.cookies, countryCookieKey);
+        if (cookieCountry) {
+            return cookieCountry;
         }
         const cf = input.cf;
         if (cf?.country && typeof cf.country === 'string' && cf.country.length > 0) {
@@ -53,6 +86,18 @@ export async function getCountry(input, generate, headerNames) {
         const country = extractFromHeaderNames(h, names);
         if (country)
             return country;
+        const cookieCountry = extractCookieHeader(h, countryCookieKey);
+        if (cookieCountry)
+            return cookieCountry;
+    }
+    catch {
+    }
+    try {
+        const { cookies } = await import('next/headers.js');
+        const c = await cookies();
+        const country = extractCookie(c, countryCookieKey);
+        if (country)
+            return country;
     }
     catch {
     }
@@ -89,11 +134,21 @@ export async function getTimezone(input, fallback, generate, headerNames) {
             const tz = extractFromHeaderNames(input.headers, names);
             if (tz)
                 return tz;
+            const cookieTimezone = extractCookieHeader(input.headers, timezoneCookieKey);
+            if (cookieTimezone)
+                return cookieTimezone;
         }
         else if (typeof input.get === 'function') {
             const tz = extractFromHeaderNames(input, names);
             if (tz)
                 return tz;
+            const cookieTimezone = extractCookieHeader(input, timezoneCookieKey);
+            if (cookieTimezone)
+                return cookieTimezone;
+        }
+        const cookieTimezone = extractCookie(input.cookies, timezoneCookieKey);
+        if (cookieTimezone) {
+            return cookieTimezone;
         }
         const cf = input.cf;
         if (cf?.timezone && typeof cf.timezone === 'string' && cf.timezone.length > 0) {
@@ -106,6 +161,18 @@ export async function getTimezone(input, fallback, generate, headerNames) {
         const tz = extractFromHeaderNames(h, names);
         if (tz)
             return tz;
+        const cookieTimezone = extractCookieHeader(h, timezoneCookieKey);
+        if (cookieTimezone)
+            return cookieTimezone;
+    }
+    catch {
+    }
+    try {
+        const { cookies } = await import('next/headers.js');
+        const c = await cookies();
+        const tz = extractCookie(c, timezoneCookieKey);
+        if (tz)
+            return tz;
     }
     catch {
     }

package/dist/src/types/types.d.ts

@@ -29,10 +29,17 @@ export interface GenerateRoutingConfig {
     } | undefined);
     getCloudflareContext?: CookieConsentGetCloudflareContext;
     countryHeaderNames?: readonly string[];
+    countryCookieName?: string;
     timezoneHeaderNames?: readonly string[];
+    timezoneCookieName?: string;
 }
 export type RequestOrHeaders = Request | Headers | {
     headers?: Headers | Record<string, string | null | undefined>;
+    cookies?: {
+        get?: (name: string) => {
+            value?: string;
+        } | string | undefined;
+    };
     cf?: {
         country?: string;
         timezone?: string;
@@ -75,6 +82,7 @@ export interface CookieConsentRoutingConfig {
     autoAnalyticsEvents?: AutoAnalyticsEventsConfig;
     getCountryCode?: () => string | undefined | Promise<string | undefined>;
     countryHeaderNames?: readonly string[];
+    countryCookieName?: string;
     gdprCountries?: readonly string[];
     enableAnalyticsInDevMode?: boolean;
     autoWireDialogs?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",