@firebase/auth 0.21.5 → 0.21.6-20230329040242

package/dist/esm2017/index.d.ts

@@ -32,5 +32,6 @@ import { signInWithRedirect, linkWithRedirect, reauthenticateWithRedirect, getRe
 import { RecaptchaVerifier } from './src/platform_browser/recaptcha/recaptcha_verifier';
 import { browserPopupRedirectResolver } from './src/platform_browser/popup_redirect';
 import { PhoneMultiFactorGenerator } from './src/platform_browser/mfa/assertions/phone';
+import { TotpMultiFactorGenerator, TotpSecret } from './src/mfa/assertions/totp';
 import { getAuth } from './src/platform_browser';
-export { browserLocalPersistence, browserSessionPersistence, indexedDBLocalPersistence, PhoneAuthProvider, signInWithPhoneNumber, linkWithPhoneNumber, reauthenticateWithPhoneNumber, updatePhoneNumber, signInWithPopup, linkWithPopup, reauthenticateWithPopup, signInWithRedirect, linkWithRedirect, reauthenticateWithRedirect, getRedirectResult, RecaptchaVerifier, browserPopupRedirectResolver, PhoneMultiFactorGenerator, getAuth };
+export { browserLocalPersistence, browserSessionPersistence, indexedDBLocalPersistence, PhoneAuthProvider, signInWithPhoneNumber, linkWithPhoneNumber, reauthenticateWithPhoneNumber, updatePhoneNumber, signInWithPopup, linkWithPopup, reauthenticateWithPopup, signInWithRedirect, linkWithRedirect, reauthenticateWithRedirect, getRedirectResult, RecaptchaVerifier, browserPopupRedirectResolver, PhoneMultiFactorGenerator, TotpMultiFactorGenerator, TotpSecret, getAuth };

package/dist/esm2017/index.js

@@ -1,4 +1,4 @@
-export { A as ActionCodeOperation, ad as ActionCodeURL, H as AuthCredential, D as AuthErrorCodes, I as EmailAuthCredential, M as EmailAuthProvider, N as FacebookAuthProvider, F as FactorId, T as GithubAuthProvider, Q as GoogleAuthProvider, J as OAuthCredential, U as OAuthProvider, O as OperationType, K as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, o as ProviderId, R as RecaptchaVerifier, V as SAMLAuthProvider, S as SignInMethod, W as TwitterAuthProvider, a2 as applyActionCode, t as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a3 as checkActionCode, a1 as confirmPasswordReset, G as connectAuthEmulator, a5 as createUserWithEmailAndPassword, B as debugErrorMap, z as deleteUser, aa as fetchSignInMethodsForEmail, al as getAdditionalUserInfo, n as getAuth, ai as getIdToken, aj as getIdTokenResult, an as getMultiFactorResolver, j as getRedirectResult, L as inMemoryPersistence, i as indexedDBLocalPersistence, E as initializeAuth, a8 as isSignInWithEmailLink, Z as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, ao as multiFactor, v as onAuthStateChanged, q as onIdTokenChanged, ae as parseActionCodeURL, C as prodErrorMap, _ as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, am as reload, ab as sendEmailVerification, a0 as sendPasswordResetEmail, a7 as sendSignInLinkToEmail, p as setPersistence, X as signInAnonymously, Y as signInWithCredential, $ as signInWithCustomToken, a6 as signInWithEmailAndPassword, a9 as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, y as signOut, ak as unlink, x as updateCurrentUser, ag as updateEmail, ah as updatePassword, u as updatePhoneNumber, af as updateProfile, w as useDeviceLanguage, ac as verifyBeforeUpdateEmail, a4 as verifyPasswordResetCode } from './index-3363a72a.js';
+export { A as ActionCodeOperation, af as ActionCodeURL, I as AuthCredential, E as AuthErrorCodes, J as EmailAuthCredential, N as EmailAuthProvider, Q as FacebookAuthProvider, F as FactorId, V as GithubAuthProvider, U as GoogleAuthProvider, K as OAuthCredential, W as OAuthProvider, O as OperationType, L as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, X as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, Y as TwitterAuthProvider, a4 as applyActionCode, v as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a5 as checkActionCode, a3 as confirmPasswordReset, H as connectAuthEmulator, a7 as createUserWithEmailAndPassword, C as debugErrorMap, B as deleteUser, ac as fetchSignInMethodsForEmail, an as getAdditionalUserInfo, o as getAuth, ak as getIdToken, al as getIdTokenResult, ap as getMultiFactorResolver, j as getRedirectResult, M as inMemoryPersistence, i as indexedDBLocalPersistence, G as initializeAuth, aa as isSignInWithEmailLink, $ as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, aq as multiFactor, w as onAuthStateChanged, t as onIdTokenChanged, ag as parseActionCodeURL, D as prodErrorMap, a0 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ao as reload, ad as sendEmailVerification, a2 as sendPasswordResetEmail, a9 as sendSignInLinkToEmail, q as setPersistence, Z as signInAnonymously, _ as signInWithCredential, a1 as signInWithCustomToken, a8 as signInWithEmailAndPassword, ab as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, z as signOut, am as unlink, y as updateCurrentUser, ai as updateEmail, aj as updatePassword, u as updatePhoneNumber, ah as updateProfile, x as useDeviceLanguage, ae as verifyBeforeUpdateEmail, a6 as verifyPasswordResetCode } from './index-998a92c6.js';
 import '@firebase/util';
 import '@firebase/app';
 import '@firebase/logger';

package/dist/esm2017/internal.js

@@ -1,5 +1,5 @@
-import { ap as debugAssert, aq as _isIOS, ar as _isAndroid, as as _fail, at as _getRedirectUrl, au as _getProjectConfig, av as _isIOS7Or8, aw as _createError, ax as _assert, ay as AuthEventManager, az as _getInstance, b as browserLocalPersistence, aA as _persistenceKeyName, a as browserSessionPersistence, aB as _getRedirectResult, aC as _overrideRedirectResult, aD as _clearRedirectOutcomes, aE as _castAuth } from './index-3363a72a.js';
-export { A as ActionCodeOperation, ad as ActionCodeURL, H as AuthCredential, D as AuthErrorCodes, aG as AuthImpl, aJ as AuthPopup, I as EmailAuthCredential, M as EmailAuthProvider, N as FacebookAuthProvider, F as FactorId, aK as FetchProvider, T as GithubAuthProvider, Q as GoogleAuthProvider, J as OAuthCredential, U as OAuthProvider, O as OperationType, K as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, o as ProviderId, R as RecaptchaVerifier, aL as SAMLAuthCredential, V as SAMLAuthProvider, S as SignInMethod, W as TwitterAuthProvider, aF as UserImpl, ax as _assert, aE as _castAuth, as as _fail, aI as _generateEventId, aH as _getClientVersion, az as _getInstance, aB as _getRedirectResult, aC as _overrideRedirectResult, aA as _persistenceKeyName, a2 as applyActionCode, t as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a3 as checkActionCode, a1 as confirmPasswordReset, G as connectAuthEmulator, a5 as createUserWithEmailAndPassword, B as debugErrorMap, z as deleteUser, aa as fetchSignInMethodsForEmail, al as getAdditionalUserInfo, n as getAuth, ai as getIdToken, aj as getIdTokenResult, an as getMultiFactorResolver, j as getRedirectResult, L as inMemoryPersistence, i as indexedDBLocalPersistence, E as initializeAuth, a8 as isSignInWithEmailLink, Z as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, ao as multiFactor, v as onAuthStateChanged, q as onIdTokenChanged, ae as parseActionCodeURL, C as prodErrorMap, _ as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, am as reload, ab as sendEmailVerification, a0 as sendPasswordResetEmail, a7 as sendSignInLinkToEmail, p as setPersistence, X as signInAnonymously, Y as signInWithCredential, $ as signInWithCustomToken, a6 as signInWithEmailAndPassword, a9 as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, y as signOut, ak as unlink, x as updateCurrentUser, ag as updateEmail, ah as updatePassword, u as updatePhoneNumber, af as updateProfile, w as useDeviceLanguage, ac as verifyBeforeUpdateEmail, a4 as verifyPasswordResetCode } from './index-3363a72a.js';
+import { ar as debugAssert, as as _isIOS, at as _isAndroid, au as _fail, av as _getRedirectUrl, aw as _getProjectConfig, ax as _isIOS7Or8, ay as _createError, az as _assert, aA as AuthEventManager, aB as _getInstance, b as browserLocalPersistence, aC as _persistenceKeyName, a as browserSessionPersistence, aD as _getRedirectResult, aE as _overrideRedirectResult, aF as _clearRedirectOutcomes, aG as _castAuth } from './index-998a92c6.js';
+export { A as ActionCodeOperation, af as ActionCodeURL, I as AuthCredential, E as AuthErrorCodes, aI as AuthImpl, aL as AuthPopup, J as EmailAuthCredential, N as EmailAuthProvider, Q as FacebookAuthProvider, F as FactorId, aM as FetchProvider, V as GithubAuthProvider, U as GoogleAuthProvider, K as OAuthCredential, W as OAuthProvider, O as OperationType, L as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, aN as SAMLAuthCredential, X as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, Y as TwitterAuthProvider, aH as UserImpl, az as _assert, aG as _castAuth, au as _fail, aK as _generateEventId, aJ as _getClientVersion, aB as _getInstance, aD as _getRedirectResult, aE as _overrideRedirectResult, aC as _persistenceKeyName, a4 as applyActionCode, v as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a5 as checkActionCode, a3 as confirmPasswordReset, H as connectAuthEmulator, a7 as createUserWithEmailAndPassword, C as debugErrorMap, B as deleteUser, ac as fetchSignInMethodsForEmail, an as getAdditionalUserInfo, o as getAuth, ak as getIdToken, al as getIdTokenResult, ap as getMultiFactorResolver, j as getRedirectResult, M as inMemoryPersistence, i as indexedDBLocalPersistence, G as initializeAuth, aa as isSignInWithEmailLink, $ as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, aq as multiFactor, w as onAuthStateChanged, t as onIdTokenChanged, ag as parseActionCodeURL, D as prodErrorMap, a0 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ao as reload, ad as sendEmailVerification, a2 as sendPasswordResetEmail, a9 as sendSignInLinkToEmail, q as setPersistence, Z as signInAnonymously, _ as signInWithCredential, a1 as signInWithCustomToken, a8 as signInWithEmailAndPassword, ab as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, z as signOut, am as unlink, y as updateCurrentUser, ai as updateEmail, aj as updatePassword, u as updatePhoneNumber, ah as updateProfile, x as useDeviceLanguage, ae as verifyBeforeUpdateEmail, a6 as verifyPasswordResetCode } from './index-998a92c6.js';
 import { querystringDecode } from '@firebase/util';
 import '@firebase/app';
 import '@firebase/logger';

package/dist/esm2017/src/api/account_management/mfa.d.ts

@@ -18,7 +18,7 @@ import { SignInWithPhoneNumberRequest } from '../authentication/sms';
 import { FinalizeMfaResponse } from '../authentication/mfa';
 import { AuthInternal } from '../../model/auth';
 /**
- * MFA Info as returned by the API
+ * MFA Info as returned by the API.
  */
 interface BaseMfaEnrollment {
     mfaEnrollmentId: string;
@@ -26,15 +26,20 @@ interface BaseMfaEnrollment {
     displayName?: string;
 }
 /**
- * An MFA provided by SMS verification
+ * An MFA provided by SMS verification.
  */
 export interface PhoneMfaEnrollment extends BaseMfaEnrollment {
     phoneInfo: string;
 }
 /**
- * MfaEnrollment can be any subtype of BaseMfaEnrollment, currently only PhoneMfaEnrollment is supported
+ * An MFA provided by TOTP (Time-based One Time Password).
  */
-export declare type MfaEnrollment = PhoneMfaEnrollment;
+export interface TotpMfaEnrollment extends BaseMfaEnrollment {
+}
+/**
+ * MfaEnrollment can be any subtype of BaseMfaEnrollment, currently only PhoneMfaEnrollment and TotpMfaEnrollment are supported.
+ */
+export declare type MfaEnrollment = PhoneMfaEnrollment | TotpMfaEnrollment;
 export interface StartPhoneMfaEnrollmentRequest {
     idToken: string;
     phoneEnrollmentInfo: {
@@ -58,6 +63,35 @@ export interface FinalizePhoneMfaEnrollmentRequest {
 export interface FinalizePhoneMfaEnrollmentResponse extends FinalizeMfaResponse {
 }
 export declare function finalizeEnrollPhoneMfa(auth: AuthInternal, request: FinalizePhoneMfaEnrollmentRequest): Promise<FinalizePhoneMfaEnrollmentResponse>;
+export interface StartTotpMfaEnrollmentRequest {
+    idToken: string;
+    totpEnrollmentInfo: {};
+    tenantId?: string;
+}
+export interface StartTotpMfaEnrollmentResponse {
+    totpSessionInfo: {
+        sharedSecretKey: string;
+        verificationCodeLength: number;
+        hashingAlgorithm: string;
+        periodSec: number;
+        sessionInfo: string;
+        finalizeEnrollmentTime: number;
+    };
+}
+export declare function startEnrollTotpMfa(auth: AuthInternal, request: StartTotpMfaEnrollmentRequest): Promise<StartTotpMfaEnrollmentResponse>;
+export interface TotpVerificationInfo {
+    sessionInfo: string;
+    verificationCode: string;
+}
+export interface FinalizeTotpMfaEnrollmentRequest {
+    idToken: string;
+    totpVerificationInfo: TotpVerificationInfo;
+    displayName?: string | null;
+    tenantId?: string;
+}
+export interface FinalizeTotpMfaEnrollmentResponse extends FinalizeMfaResponse {
+}
+export declare function finalizeEnrollTotpMfa(auth: AuthInternal, request: FinalizeTotpMfaEnrollmentRequest): Promise<FinalizeTotpMfaEnrollmentResponse>;
 export interface WithdrawMfaRequest {
     idToken: string;
     mfaEnrollmentId: string;

package/dist/esm2017/src/api/authentication/mfa.d.ts

@@ -49,9 +49,20 @@ export interface FinalizePhoneMfaSignInRequest {
     phoneVerificationInfo: SignInWithPhoneNumberRequest;
     tenantId?: string;
 }
+export interface FinalizeTotpMfaSignInRequest {
+    mfaPendingCredential: string;
+    totpVerificationInfo: {
+        verificationCode: string;
+    };
+    tenantId?: string;
+    mfaEnrollmentId: string;
+}
 export interface FinalizePhoneMfaSignInResponse extends FinalizeMfaResponse {
 }
+export interface FinalizeTotpMfaSignInResponse extends FinalizeMfaResponse {
+}
 export declare function finalizeSignInPhoneMfa(auth: Auth, request: FinalizePhoneMfaSignInRequest): Promise<FinalizePhoneMfaSignInResponse>;
+export declare function finalizeSignInTotpMfa(auth: Auth, request: FinalizeTotpMfaSignInRequest): Promise<FinalizeTotpMfaSignInResponse>;
 /**
  * @internal
  */

package/dist/esm2017/src/mfa/assertions/totp.d.ts

@@ -0,0 +1,124 @@
+/**
+ * @license
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { TotpMultiFactorAssertion, MultiFactorSession, FactorId } from '../../model/public_types';
+import { AuthInternal } from '../../model/auth';
+import { StartTotpMfaEnrollmentResponse, TotpVerificationInfo } from '../../api/account_management/mfa';
+import { FinalizeMfaResponse } from '../../api/authentication/mfa';
+import { MultiFactorAssertionImpl } from '../../mfa/mfa_assertion';
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * @public
+ */
+export declare class TotpMultiFactorGenerator {
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of
+     * the TOTP (time-based one-time password) second factor.
+     * This assertion is used to complete enrollment in TOTP second factor.
+     *
+     * @param secret A {@link TotpSecret} containing the shared secret key and other TOTP parameters.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorUser.enroll}.
+     */
+    static assertionForEnrollment(secret: TotpSecret, oneTimePassword: string): TotpMultiFactorAssertion;
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of the TOTP second factor.
+     * This assertion is used to complete signIn with TOTP as the second factor.
+     *
+     * @param enrollmentId identifies the enrolled TOTP second factor.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorResolver.resolveSignIn}.
+     */
+    static assertionForSignIn(enrollmentId: string, oneTimePassword: string): TotpMultiFactorAssertion;
+    /**
+     * Returns a promise to {@link TotpSecret} which contains the TOTP shared secret key and other parameters.
+     * Creates a TOTP secret as part of enrolling a TOTP second factor.
+     * Used for generating a QR code URL or inputting into a TOTP app.
+     * This method uses the auth instance corresponding to the user in the multiFactorSession.
+     *
+     * @param session The {@link MultiFactorSession} that the user is part of.
+     * @returns A promise to {@link TotpSecret}.
+     */
+    static generateSecret(session: MultiFactorSession): Promise<TotpSecret>;
+    /**
+     * The identifier of the TOTP second factor: `totp`.
+     */
+    static FACTOR_ID: FactorId;
+}
+export declare class TotpMultiFactorAssertionImpl extends MultiFactorAssertionImpl implements TotpMultiFactorAssertion {
+    readonly otp: string;
+    readonly enrollmentId?: string | undefined;
+    readonly secret?: TotpSecret | undefined;
+    constructor(otp: string, enrollmentId?: string | undefined, secret?: TotpSecret | undefined);
+    /** @internal */
+    static _fromSecret(secret: TotpSecret, otp: string): TotpMultiFactorAssertionImpl;
+    /** @internal */
+    static _fromEnrollmentId(enrollmentId: string, otp: string): TotpMultiFactorAssertionImpl;
+    /** @internal */
+    _finalizeEnroll(auth: AuthInternal, idToken: string, displayName?: string | null): Promise<FinalizeMfaResponse>;
+    /** @internal */
+    _finalizeSignIn(auth: AuthInternal, mfaPendingCredential: string): Promise<FinalizeMfaResponse>;
+}
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * Stores the shared secret key and other parameters to generate time-based OTPs.
+ * Implements methods to retrieve the shared secret key and generate a QR code URL.
+ * @public
+ */
+export declare class TotpSecret {
+    private readonly sessionInfo;
+    private readonly auth;
+    /**
+     * Shared secret key/seed used for enrolling in TOTP MFA and generating OTPs.
+     */
+    readonly secretKey: string;
+    /**
+     * Hashing algorithm used.
+     */
+    readonly hashingAlgorithm: string;
+    /**
+     * Length of the one-time passwords to be generated.
+     */
+    readonly codeLength: number;
+    /**
+     * The interval (in seconds) when the OTP codes should change.
+     */
+    readonly codeIntervalSeconds: number;
+    /**
+     * The timestamp (UTC string) by which TOTP enrollment should be completed.
+     */
+    readonly enrollmentCompletionDeadline: string;
+    private constructor();
+    /** @internal */
+    static _fromStartTotpMfaEnrollmentResponse(response: StartTotpMfaEnrollmentResponse, auth: AuthInternal): TotpSecret;
+    /** @internal */
+    _makeTotpVerificationInfo(otp: string): TotpVerificationInfo;
+    /**
+     * Returns a QR code URL as described in
+     * https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+     * This can be displayed to the user as a QR code to be scanned into a TOTP app like Google Authenticator.
+     * If the optional parameters are unspecified, an accountName of <userEmail> and issuer of <firebaseAppName> are used.
+     *
+     * @param accountName the name of the account/app along with a user identifier.
+     * @param issuer issuer of the TOTP (likely the app name).
+     * @returns A QR code URL string.
+     */
+    generateQrCodeUrl(accountName?: string, issuer?: string): string;
+}

package/dist/esm2017/src/mfa/assertions/totp.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {};

package/dist/esm2017/src/mfa/mfa_info.d.ts

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { FactorId, MultiFactorInfo, PhoneMultiFactorInfo } from '../model/public_types';
+import { FactorId, MultiFactorInfo, PhoneMultiFactorInfo, TotpMultiFactorInfo } from '../model/public_types';
 import { MfaEnrollment } from '../api/account_management/mfa';
 import { AuthInternal } from '../model/auth';
 export declare abstract class MultiFactorInfoImpl implements MultiFactorInfo {
@@ -30,3 +30,7 @@ export declare class PhoneMultiFactorInfoImpl extends MultiFactorInfoImpl implem
     private constructor();
     static _fromServerResponse(_auth: AuthInternal, enrollment: MfaEnrollment): PhoneMultiFactorInfoImpl;
 }
+export declare class TotpMultiFactorInfoImpl extends MultiFactorInfoImpl implements TotpMultiFactorInfo {
+    private constructor();
+    static _fromServerResponse(_auth: AuthInternal, enrollment: MfaEnrollment): TotpMultiFactorInfoImpl;
+}

package/dist/esm2017/src/model/enum_maps.d.ts

@@ -22,6 +22,7 @@
 export declare const FactorId: {
     /** Phone as second factor */
     readonly PHONE: "phone";
+    readonly TOTP: "totp";
 };
 /**
  * Enumeration of supported providers.

package/dist/esm2017/src/model/public_types.d.ts

@@ -502,7 +502,8 @@ export interface AuthProvider {
  */
 export declare const enum FactorId {
     /** Phone as second factor */
-    PHONE = "phone"
+    PHONE = "phone",
+    TOTP = "totp"
 }
 /**
  * A result from a phone number sign-in, link, or reauthenticate call.
@@ -609,6 +610,13 @@ export interface PhoneMultiFactorInfo extends MultiFactorInfo {
     /** The phone number associated with the current second factor. */
     readonly phoneNumber: string;
 }
+/**
+ * The subclass of the {@link MultiFactorInfo} interface for TOTP
+ * second factors. The `factorId` of this second factor is {@link FactorId}.TOTP.
+ * @public
+ */
+export interface TotpMultiFactorInfo extends MultiFactorInfo {
+}
 /**
  * The class used to facilitate recovery from {@link MultiFactorError} when a user needs to
  * provide a second factor to sign in.
@@ -1160,3 +1168,12 @@ export interface Dependencies {
      */
     errorMap?: AuthErrorMap;
 }
+/**
+ * The class for asserting ownership of a TOTP second factor. Provided by
+ * {@link TotpMultiFactorGenerator.assertionForEnrollment} and
+ * {@link TotpMultiFactorGenerator.assertionForSignIn}.
+ *
+ * @public
+ */
+export interface TotpMultiFactorAssertion extends MultiFactorAssertion {
+}

package/dist/esm2017/test/helpers/integration/helpers.d.ts

@@ -18,3 +18,6 @@ import { Auth } from '../../../src/model/public_types';
 export declare function randomEmail(): string;
 export declare function getTestInstance(requireEmulator?: boolean): Auth;
 export declare function cleanUpTestInstance(auth: Auth): Promise<void>;
+export declare function getTotpCode(sharedSecretKey: string, periodSec: number, verificationCodeLength: number, timestamp: Date): string;
+export declare const email = "totpuser-donotdelete@test.com";
+export declare const incorrectTotpCode = "1000000";

package/dist/esm2017/test/integration/flows/totp.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {};

package/dist/esm5/{index-3f05dc7b.js → index-14d0c8cb.js}

@@ -27,7 +27,8 @@ import { Component } from '@firebase/component';
  */
 var FactorId = {
     /** Phone as second factor */
-    PHONE: 'phone'
+    PHONE: 'phone',
+    TOTP: 'totp'
 };
 /**
  * Enumeration of supported providers.
@@ -1035,7 +1036,10 @@ function _performFetchWithErrorHandling(auth, customErrorMap, fetchFn) {
                     if (e_1 instanceof FirebaseError) {
                         throw e_1;
                     }
-                    _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */, { 'message': String(e_1) });
+                    // Changing this to a different error code will log user out when there is a network error
+                    // because we treat any error other than NETWORK_REQUEST_FAILED as token is invalid.
+                    // https://github.com/firebase/firebase-js-sdk/blob/4fbc73610d70be4e0852e7de63a39cb7897e8546/packages/auth/src/core/auth/auth_impl.ts#L309-L316
+                    _fail(auth, "network-request-failed" /* AuthErrorCode.NETWORK_REQUEST_FAILED */, { 'message': String(e_1) });
                     return [3 /*break*/, 5];
                 case 5: return [2 /*return*/];
             }
@@ -5698,6 +5702,9 @@ var MultiFactorInfoImpl = /** @class */ (function () {
         if ('phoneInfo' in enrollment) {
             return PhoneMultiFactorInfoImpl._fromServerResponse(auth, enrollment);
         }
+        else if ('totpInfo' in enrollment) {
+            return TotpMultiFactorInfoImpl._fromServerResponse(auth, enrollment);
+        }
         return _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
     };
     return MultiFactorInfoImpl;
@@ -5713,6 +5720,16 @@ var PhoneMultiFactorInfoImpl = /** @class */ (function (_super) {
         return new PhoneMultiFactorInfoImpl(enrollment);
     };
     return PhoneMultiFactorInfoImpl;
+}(MultiFactorInfoImpl));
+var TotpMultiFactorInfoImpl = /** @class */ (function (_super) {
+    __extends(TotpMultiFactorInfoImpl, _super);
+    function TotpMultiFactorInfoImpl(response) {
+        return _super.call(this, "totp" /* FactorId.TOTP */, response) || this;
+    }
+    TotpMultiFactorInfoImpl._fromServerResponse = function (_auth, enrollment) {
+        return new TotpMultiFactorInfoImpl(enrollment);
+    };
+    return TotpMultiFactorInfoImpl;
 }(MultiFactorInfoImpl));
 
 /**
@@ -6941,6 +6958,12 @@ function startEnrollPhoneMfa(auth, request) {
 function finalizeEnrollPhoneMfa(auth, request) {
     return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaEnrollment:finalize" /* Endpoint.FINALIZE_MFA_ENROLLMENT */, _addTidIfNecessary(auth, request));
 }
+function startEnrollTotpMfa(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaEnrollment:start" /* Endpoint.START_MFA_ENROLLMENT */, _addTidIfNecessary(auth, request));
+}
+function finalizeEnrollTotpMfa(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaEnrollment:finalize" /* Endpoint.FINALIZE_MFA_ENROLLMENT */, _addTidIfNecessary(auth, request));
+}
 function withdrawMfa(auth, request) {
     return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaEnrollment:withdraw" /* Endpoint.WITHDRAW_MFA */, _addTidIfNecessary(auth, request));
 }
@@ -8348,6 +8371,9 @@ function startSignInPhoneMfa(auth, request) {
 }
 function finalizeSignInPhoneMfa(auth, request) {
     return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaSignIn:finalize" /* Endpoint.FINALIZE_MFA_SIGN_IN */, _addTidIfNecessary(auth, request));
+}
+function finalizeSignInTotpMfa(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaSignIn:finalize" /* Endpoint.FINALIZE_MFA_SIGN_IN */, _addTidIfNecessary(auth, request));
 }
 
 /**
@@ -11101,8 +11127,181 @@ var PhoneMultiFactorGenerator = /** @class */ (function () {
     return PhoneMultiFactorGenerator;
 }());
 
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * @public
+ */
+var TotpMultiFactorGenerator = /** @class */ (function () {
+    function TotpMultiFactorGenerator() {
+    }
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of
+     * the TOTP (time-based one-time password) second factor.
+     * This assertion is used to complete enrollment in TOTP second factor.
+     *
+     * @param secret A {@link TotpSecret} containing the shared secret key and other TOTP parameters.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorUser.enroll}.
+     */
+    TotpMultiFactorGenerator.assertionForEnrollment = function (secret, oneTimePassword) {
+        return TotpMultiFactorAssertionImpl._fromSecret(secret, oneTimePassword);
+    };
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of the TOTP second factor.
+     * This assertion is used to complete signIn with TOTP as the second factor.
+     *
+     * @param enrollmentId identifies the enrolled TOTP second factor.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorResolver.resolveSignIn}.
+     */
+    TotpMultiFactorGenerator.assertionForSignIn = function (enrollmentId, oneTimePassword) {
+        return TotpMultiFactorAssertionImpl._fromEnrollmentId(enrollmentId, oneTimePassword);
+    };
+    /**
+     * Returns a promise to {@link TotpSecret} which contains the TOTP shared secret key and other parameters.
+     * Creates a TOTP secret as part of enrolling a TOTP second factor.
+     * Used for generating a QR code URL or inputting into a TOTP app.
+     * This method uses the auth instance corresponding to the user in the multiFactorSession.
+     *
+     * @param session The {@link MultiFactorSession} that the user is part of.
+     * @returns A promise to {@link TotpSecret}.
+     */
+    TotpMultiFactorGenerator.generateSecret = function (session) {
+        return __awaiter(this, void 0, void 0, function () {
+            var mfaSession, response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        mfaSession = session;
+                        _assert(typeof mfaSession.auth !== 'undefined', "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+                        return [4 /*yield*/, startEnrollTotpMfa(mfaSession.auth, {
+                                idToken: mfaSession.credential,
+                                totpEnrollmentInfo: {}
+                            })];
+                    case 1:
+                        response = _a.sent();
+                        return [2 /*return*/, TotpSecret._fromStartTotpMfaEnrollmentResponse(response, mfaSession.auth)];
+                }
+            });
+        });
+    };
+    /**
+     * The identifier of the TOTP second factor: `totp`.
+     */
+    TotpMultiFactorGenerator.FACTOR_ID = "totp" /* FactorId.TOTP */;
+    return TotpMultiFactorGenerator;
+}());
+var TotpMultiFactorAssertionImpl = /** @class */ (function (_super) {
+    __extends(TotpMultiFactorAssertionImpl, _super);
+    function TotpMultiFactorAssertionImpl(otp, enrollmentId, secret) {
+        var _this = _super.call(this, "totp" /* FactorId.TOTP */) || this;
+        _this.otp = otp;
+        _this.enrollmentId = enrollmentId;
+        _this.secret = secret;
+        return _this;
+    }
+    /** @internal */
+    TotpMultiFactorAssertionImpl._fromSecret = function (secret, otp) {
+        return new TotpMultiFactorAssertionImpl(otp, undefined, secret);
+    };
+    /** @internal */
+    TotpMultiFactorAssertionImpl._fromEnrollmentId = function (enrollmentId, otp) {
+        return new TotpMultiFactorAssertionImpl(otp, enrollmentId);
+    };
+    /** @internal */
+    TotpMultiFactorAssertionImpl.prototype._finalizeEnroll = function (auth, idToken, displayName) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                _assert(typeof this.secret !== 'undefined', auth, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+                return [2 /*return*/, finalizeEnrollTotpMfa(auth, {
+                        idToken: idToken,
+                        displayName: displayName,
+                        totpVerificationInfo: this.secret._makeTotpVerificationInfo(this.otp)
+                    })];
+            });
+        });
+    };
+    /** @internal */
+    TotpMultiFactorAssertionImpl.prototype._finalizeSignIn = function (auth, mfaPendingCredential) {
+        return __awaiter(this, void 0, void 0, function () {
+            var totpVerificationInfo;
+            return __generator(this, function (_a) {
+                _assert(this.enrollmentId !== undefined && this.otp !== undefined, auth, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+                totpVerificationInfo = { verificationCode: this.otp };
+                return [2 /*return*/, finalizeSignInTotpMfa(auth, {
+                        mfaPendingCredential: mfaPendingCredential,
+                        mfaEnrollmentId: this.enrollmentId,
+                        totpVerificationInfo: totpVerificationInfo
+                    })];
+            });
+        });
+    };
+    return TotpMultiFactorAssertionImpl;
+}(MultiFactorAssertionImpl));
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * Stores the shared secret key and other parameters to generate time-based OTPs.
+ * Implements methods to retrieve the shared secret key and generate a QR code URL.
+ * @public
+ */
+var TotpSecret = /** @class */ (function () {
+    // The public members are declared outside the constructor so the docs can be generated.
+    function TotpSecret(secretKey, hashingAlgorithm, codeLength, codeIntervalSeconds, enrollmentCompletionDeadline, sessionInfo, auth) {
+        this.sessionInfo = sessionInfo;
+        this.auth = auth;
+        this.secretKey = secretKey;
+        this.hashingAlgorithm = hashingAlgorithm;
+        this.codeLength = codeLength;
+        this.codeIntervalSeconds = codeIntervalSeconds;
+        this.enrollmentCompletionDeadline = enrollmentCompletionDeadline;
+    }
+    /** @internal */
+    TotpSecret._fromStartTotpMfaEnrollmentResponse = function (response, auth) {
+        return new TotpSecret(response.totpSessionInfo.sharedSecretKey, response.totpSessionInfo.hashingAlgorithm, response.totpSessionInfo.verificationCodeLength, response.totpSessionInfo.periodSec, new Date(response.totpSessionInfo.finalizeEnrollmentTime).toUTCString(), response.totpSessionInfo.sessionInfo, auth);
+    };
+    /** @internal */
+    TotpSecret.prototype._makeTotpVerificationInfo = function (otp) {
+        return { sessionInfo: this.sessionInfo, verificationCode: otp };
+    };
+    /**
+     * Returns a QR code URL as described in
+     * https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+     * This can be displayed to the user as a QR code to be scanned into a TOTP app like Google Authenticator.
+     * If the optional parameters are unspecified, an accountName of <userEmail> and issuer of <firebaseAppName> are used.
+     *
+     * @param accountName the name of the account/app along with a user identifier.
+     * @param issuer issuer of the TOTP (likely the app name).
+     * @returns A QR code URL string.
+     */
+    TotpSecret.prototype.generateQrCodeUrl = function (accountName, issuer) {
+        var _a;
+        var useDefaults = false;
+        if (_isEmptyString(accountName) || _isEmptyString(issuer)) {
+            useDefaults = true;
+        }
+        if (useDefaults) {
+            if (_isEmptyString(accountName)) {
+                accountName = ((_a = this.auth.currentUser) === null || _a === void 0 ? void 0 : _a.email) || 'unknownuser';
+            }
+            if (_isEmptyString(issuer)) {
+                issuer = this.auth.name;
+            }
+        }
+        return "otpauth://totp/".concat(issuer, ":").concat(accountName, "?secret=").concat(this.secretKey, "&issuer=").concat(issuer, "&algorithm=").concat(this.hashingAlgorithm, "&digits=").concat(this.codeLength);
+    };
+    return TotpSecret;
+}());
+/** @internal */
+function _isEmptyString(input) {
+    return typeof input === 'undefined' || (input === null || input === void 0 ? void 0 : input.length) === 0;
+}
+
 var name = "@firebase/auth";
-var version = "0.21.5";
+var version = "0.21.6-20230329040242";
 
 /**
  * @license
@@ -11359,5 +11558,5 @@ function getAuth(app) {
 }
 registerAuth("Browser" /* ClientPlatform.BROWSER */);
 
-export { signInWithCustomToken as $, ActionCodeOperation as A, debugErrorMap as B, prodErrorMap as C, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as D, initializeAuth as E, FactorId as F, connectAuthEmulator as G, AuthCredential as H, EmailAuthCredential as I, OAuthCredential as J, PhoneAuthCredential as K, inMemoryPersistence as L, EmailAuthProvider as M, FacebookAuthProvider as N, OperationType as O, PhoneAuthProvider as P, GoogleAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, GithubAuthProvider as T, OAuthProvider as U, SAMLAuthProvider as V, TwitterAuthProvider as W, signInAnonymously as X, signInWithCredential as Y, linkWithCredential as Z, reauthenticateWithCredential as _, browserSessionPersistence as a, sendPasswordResetEmail as a0, confirmPasswordReset as a1, applyActionCode as a2, checkActionCode as a3, verifyPasswordResetCode as a4, createUserWithEmailAndPassword as a5, signInWithEmailAndPassword as a6, sendSignInLinkToEmail as a7, isSignInWithEmailLink as a8, signInWithEmailLink as a9, _persistenceKeyName as aA, _clearRedirectOutcomes as aB, _getRedirectResult as aC, _overrideRedirectResult as aD, _castAuth as aE, UserImpl as aF, AuthImpl as aG, _getClientVersion as aH, _generateEventId as aI, AuthPopup as aJ, FetchProvider as aK, SAMLAuthCredential as aL, fetchSignInMethodsForEmail as aa, sendEmailVerification as ab, verifyBeforeUpdateEmail as ac, ActionCodeURL as ad, parseActionCodeURL as ae, updateProfile as af, updateEmail as ag, updatePassword as ah, getIdToken as ai, getIdTokenResult as aj, unlink as ak, getAdditionalUserInfo as al, reload as am, getMultiFactorResolver as an, multiFactor as ao, _isIOS as ap, _isAndroid as aq, _fail as ar, _getRedirectUrl as as, debugAssert as at, _getProjectConfig as au, _isIOS7Or8 as av, _assert as aw, _createError as ax, AuthEventManager as ay, _getInstance as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, getAuth as n, ProviderId as o, setPersistence as p, onIdTokenChanged as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, beforeAuthStateChanged as t, updatePhoneNumber as u, onAuthStateChanged as v, useDeviceLanguage as w, updateCurrentUser as x, signOut as y, deleteUser as z };
-//# sourceMappingURL=index-3f05dc7b.js.map
+export { linkWithCredential as $, ActionCodeOperation as A, deleteUser as B, debugErrorMap as C, prodErrorMap as D, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as E, FactorId as F, initializeAuth as G, connectAuthEmulator as H, AuthCredential as I, EmailAuthCredential as J, OAuthCredential as K, PhoneAuthCredential as L, inMemoryPersistence as M, EmailAuthProvider as N, OperationType as O, PhoneAuthProvider as P, FacebookAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, GoogleAuthProvider as U, GithubAuthProvider as V, OAuthProvider as W, SAMLAuthProvider as X, TwitterAuthProvider as Y, signInAnonymously as Z, signInWithCredential as _, browserSessionPersistence as a, reauthenticateWithCredential as a0, signInWithCustomToken as a1, sendPasswordResetEmail as a2, confirmPasswordReset as a3, applyActionCode as a4, checkActionCode as a5, verifyPasswordResetCode as a6, createUserWithEmailAndPassword as a7, signInWithEmailAndPassword as a8, sendSignInLinkToEmail as a9, AuthEventManager as aA, _getInstance as aB, _persistenceKeyName as aC, _clearRedirectOutcomes as aD, _getRedirectResult as aE, _overrideRedirectResult as aF, _castAuth as aG, UserImpl as aH, AuthImpl as aI, _getClientVersion as aJ, _generateEventId as aK, AuthPopup as aL, FetchProvider as aM, SAMLAuthCredential as aN, isSignInWithEmailLink as aa, signInWithEmailLink as ab, fetchSignInMethodsForEmail as ac, sendEmailVerification as ad, verifyBeforeUpdateEmail as ae, ActionCodeURL as af, parseActionCodeURL as ag, updateProfile as ah, updateEmail as ai, updatePassword as aj, getIdToken as ak, getIdTokenResult as al, unlink as am, getAdditionalUserInfo as an, reload as ao, getMultiFactorResolver as ap, multiFactor as aq, _isIOS as ar, _isAndroid as as, _fail as at, _getRedirectUrl as au, debugAssert as av, _getProjectConfig as aw, _isIOS7Or8 as ax, _assert as ay, _createError as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, onIdTokenChanged as t, updatePhoneNumber as u, beforeAuthStateChanged as v, onAuthStateChanged as w, useDeviceLanguage as x, updateCurrentUser as y, signOut as z };
+//# sourceMappingURL=index-14d0c8cb.js.map