Hmbown
aff2cf782c
Extracts the marketing site's hard-coded English copy into per-locale
dictionaries (19 chrome keys + 40 home keys for en, es, ja, ko, pt-BR,
ru, uk, vi) and routes nav, footer, locale switcher, sitemap, and the
home page through them.
Also:
- `lib/i18n/detect.ts` pulls Accept-Language negotiation out of
middleware into a tested module. This fixes the pt-BR bug: a browser
sending `pt-BR` was matched on the bare `pt` prefix against the wrong
candidate and could land on the English page.
- page-meta derives hreflang alternates from the locale registry instead
of a hand-maintained list, so a new locale can no longer ship without
its alternates.
- `web/scripts/check-locales.mjs` is a new CI gate: it holds every locale
dictionary at exact key parity with `en` and fails if a translation
drops a `{template}` token. Wired into ci.yml and `npm run
check:locales`.
Gates: `npm test` 168 passed (24 files), `npx tsc --noEmit` clean, `npm
run lint` clean, `node web/scripts/check-locales.mjs` PASS.
Harvested from the v0.9.2 localization lane (#3092, #4749, #4791).
60 lines
2.1 KiB
TypeScript
60 lines
2.1 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { locales } from "@/lib/i18n/config";
|
|
import { detectLocaleFromHeaders } from "@/lib/i18n/detect";
|
|
|
|
const COOKIE = "NEXT_LOCALE";
|
|
|
|
const SECURITY_HEADERS: Record<string, string> = {
|
|
"X-Frame-Options": "DENY",
|
|
"X-Content-Type-Options": "nosniff",
|
|
"Referrer-Policy": "strict-origin-when-cross-origin",
|
|
"Permissions-Policy": "camera=(), microphone=(), geolocation=(), interest-cohort=()",
|
|
"Strict-Transport-Security": "max-age=63072000; includeSubDomains; preload",
|
|
};
|
|
|
|
function applySecurityHeaders(res: NextResponse): NextResponse {
|
|
for (const [k, v] of Object.entries(SECURITY_HEADERS)) res.headers.set(k, v);
|
|
return res;
|
|
}
|
|
|
|
export function middleware(req: NextRequest) {
|
|
const { pathname } = req.nextUrl;
|
|
|
|
// Skip API routes, static files, _next, and the dot-less metadata route
|
|
// for the shared OG image (but still apply security headers).
|
|
if (
|
|
pathname.startsWith("/api/") ||
|
|
pathname.startsWith("/_next/") ||
|
|
pathname === "/opengraph-image" ||
|
|
pathname.includes(".")
|
|
) {
|
|
return applySecurityHeaders(NextResponse.next());
|
|
}
|
|
|
|
// Check if locale is already in path
|
|
const seg = pathname.split("/")[1];
|
|
if (locales.includes(seg as typeof locales[number])) {
|
|
const res = NextResponse.next();
|
|
res.cookies.set(COOKIE, seg, { path: "/", maxAge: 60 * 60 * 24 * 365 });
|
|
return applySecurityHeaders(res);
|
|
}
|
|
|
|
// Redirect bare paths to the detected locale (deterministic: cookie, then
|
|
// Accept-Language full-tag/primary-subtag matching, then the default).
|
|
const locale = detectLocaleFromHeaders(
|
|
req.cookies.get(COOKIE)?.value,
|
|
req.headers.get("accept-language"),
|
|
);
|
|
const url = req.nextUrl.clone();
|
|
url.pathname = `/${locale}${pathname}`;
|
|
const res = NextResponse.redirect(url);
|
|
res.cookies.set(COOKIE, locale, { path: "/", maxAge: 60 * 60 * 24 * 365 });
|
|
return applySecurityHeaders(res);
|
|
}
|
|
|
|
export const config = {
|
|
// Match everything so security headers apply globally; the function
|
|
// bypasses redirect/locale logic for /_next, /api, and dotted paths.
|
|
matcher: ["/:path*"],
|
|
};
|