@firebase/auth 0.21.5 → 0.21.6-20230329040242

package/dist/node/src/api/account_management/mfa.d.ts

@@ -18,7 +18,7 @@ import { SignInWithPhoneNumberRequest } from '../authentication/sms';
 import { FinalizeMfaResponse } from '../authentication/mfa';
 import { AuthInternal } from '../../model/auth';
 /**
- * MFA Info as returned by the API
+ * MFA Info as returned by the API.
  */
 interface BaseMfaEnrollment {
     mfaEnrollmentId: string;
@@ -26,15 +26,20 @@ interface BaseMfaEnrollment {
     displayName?: string;
 }
 /**
- * An MFA provided by SMS verification
+ * An MFA provided by SMS verification.
  */
 export interface PhoneMfaEnrollment extends BaseMfaEnrollment {
     phoneInfo: string;
 }
 /**
- * MfaEnrollment can be any subtype of BaseMfaEnrollment, currently only PhoneMfaEnrollment is supported
+ * An MFA provided by TOTP (Time-based One Time Password).
  */
-export declare type MfaEnrollment = PhoneMfaEnrollment;
+export interface TotpMfaEnrollment extends BaseMfaEnrollment {
+}
+/**
+ * MfaEnrollment can be any subtype of BaseMfaEnrollment, currently only PhoneMfaEnrollment and TotpMfaEnrollment are supported.
+ */
+export declare type MfaEnrollment = PhoneMfaEnrollment | TotpMfaEnrollment;
 export interface StartPhoneMfaEnrollmentRequest {
     idToken: string;
     phoneEnrollmentInfo: {
@@ -58,6 +63,35 @@ export interface FinalizePhoneMfaEnrollmentRequest {
 export interface FinalizePhoneMfaEnrollmentResponse extends FinalizeMfaResponse {
 }
 export declare function finalizeEnrollPhoneMfa(auth: AuthInternal, request: FinalizePhoneMfaEnrollmentRequest): Promise<FinalizePhoneMfaEnrollmentResponse>;
+export interface StartTotpMfaEnrollmentRequest {
+    idToken: string;
+    totpEnrollmentInfo: {};
+    tenantId?: string;
+}
+export interface StartTotpMfaEnrollmentResponse {
+    totpSessionInfo: {
+        sharedSecretKey: string;
+        verificationCodeLength: number;
+        hashingAlgorithm: string;
+        periodSec: number;
+        sessionInfo: string;
+        finalizeEnrollmentTime: number;
+    };
+}
+export declare function startEnrollTotpMfa(auth: AuthInternal, request: StartTotpMfaEnrollmentRequest): Promise<StartTotpMfaEnrollmentResponse>;
+export interface TotpVerificationInfo {
+    sessionInfo: string;
+    verificationCode: string;
+}
+export interface FinalizeTotpMfaEnrollmentRequest {
+    idToken: string;
+    totpVerificationInfo: TotpVerificationInfo;
+    displayName?: string | null;
+    tenantId?: string;
+}
+export interface FinalizeTotpMfaEnrollmentResponse extends FinalizeMfaResponse {
+}
+export declare function finalizeEnrollTotpMfa(auth: AuthInternal, request: FinalizeTotpMfaEnrollmentRequest): Promise<FinalizeTotpMfaEnrollmentResponse>;
 export interface WithdrawMfaRequest {
     idToken: string;
     mfaEnrollmentId: string;

package/dist/node/src/api/authentication/mfa.d.ts

@@ -49,9 +49,20 @@ export interface FinalizePhoneMfaSignInRequest {
     phoneVerificationInfo: SignInWithPhoneNumberRequest;
     tenantId?: string;
 }
+export interface FinalizeTotpMfaSignInRequest {
+    mfaPendingCredential: string;
+    totpVerificationInfo: {
+        verificationCode: string;
+    };
+    tenantId?: string;
+    mfaEnrollmentId: string;
+}
 export interface FinalizePhoneMfaSignInResponse extends FinalizeMfaResponse {
 }
+export interface FinalizeTotpMfaSignInResponse extends FinalizeMfaResponse {
+}
 export declare function finalizeSignInPhoneMfa(auth: Auth, request: FinalizePhoneMfaSignInRequest): Promise<FinalizePhoneMfaSignInResponse>;
+export declare function finalizeSignInTotpMfa(auth: Auth, request: FinalizeTotpMfaSignInRequest): Promise<FinalizeTotpMfaSignInResponse>;
 /**
  * @internal
  */

package/dist/node/src/mfa/assertions/totp.d.ts

@@ -0,0 +1,124 @@
+/**
+ * @license
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { TotpMultiFactorAssertion, MultiFactorSession, FactorId } from '../../model/public_types';
+import { AuthInternal } from '../../model/auth';
+import { StartTotpMfaEnrollmentResponse, TotpVerificationInfo } from '../../api/account_management/mfa';
+import { FinalizeMfaResponse } from '../../api/authentication/mfa';
+import { MultiFactorAssertionImpl } from '../../mfa/mfa_assertion';
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * @public
+ */
+export declare class TotpMultiFactorGenerator {
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of
+     * the TOTP (time-based one-time password) second factor.
+     * This assertion is used to complete enrollment in TOTP second factor.
+     *
+     * @param secret A {@link TotpSecret} containing the shared secret key and other TOTP parameters.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorUser.enroll}.
+     */
+    static assertionForEnrollment(secret: TotpSecret, oneTimePassword: string): TotpMultiFactorAssertion;
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of the TOTP second factor.
+     * This assertion is used to complete signIn with TOTP as the second factor.
+     *
+     * @param enrollmentId identifies the enrolled TOTP second factor.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorResolver.resolveSignIn}.
+     */
+    static assertionForSignIn(enrollmentId: string, oneTimePassword: string): TotpMultiFactorAssertion;
+    /**
+     * Returns a promise to {@link TotpSecret} which contains the TOTP shared secret key and other parameters.
+     * Creates a TOTP secret as part of enrolling a TOTP second factor.
+     * Used for generating a QR code URL or inputting into a TOTP app.
+     * This method uses the auth instance corresponding to the user in the multiFactorSession.
+     *
+     * @param session The {@link MultiFactorSession} that the user is part of.
+     * @returns A promise to {@link TotpSecret}.
+     */
+    static generateSecret(session: MultiFactorSession): Promise<TotpSecret>;
+    /**
+     * The identifier of the TOTP second factor: `totp`.
+     */
+    static FACTOR_ID: FactorId;
+}
+export declare class TotpMultiFactorAssertionImpl extends MultiFactorAssertionImpl implements TotpMultiFactorAssertion {
+    readonly otp: string;
+    readonly enrollmentId?: string | undefined;
+    readonly secret?: TotpSecret | undefined;
+    constructor(otp: string, enrollmentId?: string | undefined, secret?: TotpSecret | undefined);
+    /** @internal */
+    static _fromSecret(secret: TotpSecret, otp: string): TotpMultiFactorAssertionImpl;
+    /** @internal */
+    static _fromEnrollmentId(enrollmentId: string, otp: string): TotpMultiFactorAssertionImpl;
+    /** @internal */
+    _finalizeEnroll(auth: AuthInternal, idToken: string, displayName?: string | null): Promise<FinalizeMfaResponse>;
+    /** @internal */
+    _finalizeSignIn(auth: AuthInternal, mfaPendingCredential: string): Promise<FinalizeMfaResponse>;
+}
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * Stores the shared secret key and other parameters to generate time-based OTPs.
+ * Implements methods to retrieve the shared secret key and generate a QR code URL.
+ * @public
+ */
+export declare class TotpSecret {
+    private readonly sessionInfo;
+    private readonly auth;
+    /**
+     * Shared secret key/seed used for enrolling in TOTP MFA and generating OTPs.
+     */
+    readonly secretKey: string;
+    /**
+     * Hashing algorithm used.
+     */
+    readonly hashingAlgorithm: string;
+    /**
+     * Length of the one-time passwords to be generated.
+     */
+    readonly codeLength: number;
+    /**
+     * The interval (in seconds) when the OTP codes should change.
+     */
+    readonly codeIntervalSeconds: number;
+    /**
+     * The timestamp (UTC string) by which TOTP enrollment should be completed.
+     */
+    readonly enrollmentCompletionDeadline: string;
+    private constructor();
+    /** @internal */
+    static _fromStartTotpMfaEnrollmentResponse(response: StartTotpMfaEnrollmentResponse, auth: AuthInternal): TotpSecret;
+    /** @internal */
+    _makeTotpVerificationInfo(otp: string): TotpVerificationInfo;
+    /**
+     * Returns a QR code URL as described in
+     * https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+     * This can be displayed to the user as a QR code to be scanned into a TOTP app like Google Authenticator.
+     * If the optional parameters are unspecified, an accountName of <userEmail> and issuer of <firebaseAppName> are used.
+     *
+     * @param accountName the name of the account/app along with a user identifier.
+     * @param issuer issuer of the TOTP (likely the app name).
+     * @returns A QR code URL string.
+     */
+    generateQrCodeUrl(accountName?: string, issuer?: string): string;
+}

package/dist/node/src/mfa/assertions/totp.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {};

package/dist/node/src/mfa/mfa_info.d.ts

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { FactorId, MultiFactorInfo, PhoneMultiFactorInfo } from '../model/public_types';
+import { FactorId, MultiFactorInfo, PhoneMultiFactorInfo, TotpMultiFactorInfo } from '../model/public_types';
 import { MfaEnrollment } from '../api/account_management/mfa';
 import { AuthInternal } from '../model/auth';
 export declare abstract class MultiFactorInfoImpl implements MultiFactorInfo {
@@ -30,3 +30,7 @@ export declare class PhoneMultiFactorInfoImpl extends MultiFactorInfoImpl implem
     private constructor();
     static _fromServerResponse(_auth: AuthInternal, enrollment: MfaEnrollment): PhoneMultiFactorInfoImpl;
 }
+export declare class TotpMultiFactorInfoImpl extends MultiFactorInfoImpl implements TotpMultiFactorInfo {
+    private constructor();
+    static _fromServerResponse(_auth: AuthInternal, enrollment: MfaEnrollment): TotpMultiFactorInfoImpl;
+}

package/dist/node/src/model/enum_maps.d.ts

@@ -22,6 +22,7 @@
 export declare const FactorId: {
     /** Phone as second factor */
     readonly PHONE: "phone";
+    readonly TOTP: "totp";
 };
 /**
  * Enumeration of supported providers.

package/dist/node/src/model/public_types.d.ts

@@ -502,7 +502,8 @@ export interface AuthProvider {
  */
 export declare const enum FactorId {
     /** Phone as second factor */
-    PHONE = "phone"
+    PHONE = "phone",
+    TOTP = "totp"
 }
 /**
  * A result from a phone number sign-in, link, or reauthenticate call.
@@ -609,6 +610,13 @@ export interface PhoneMultiFactorInfo extends MultiFactorInfo {
     /** The phone number associated with the current second factor. */
     readonly phoneNumber: string;
 }
+/**
+ * The subclass of the {@link MultiFactorInfo} interface for TOTP
+ * second factors. The `factorId` of this second factor is {@link FactorId}.TOTP.
+ * @public
+ */
+export interface TotpMultiFactorInfo extends MultiFactorInfo {
+}
 /**
  * The class used to facilitate recovery from {@link MultiFactorError} when a user needs to
  * provide a second factor to sign in.
@@ -1160,3 +1168,12 @@ export interface Dependencies {
      */
     errorMap?: AuthErrorMap;
 }
+/**
+ * The class for asserting ownership of a TOTP second factor. Provided by
+ * {@link TotpMultiFactorGenerator.assertionForEnrollment} and
+ * {@link TotpMultiFactorGenerator.assertionForSignIn}.
+ *
+ * @public
+ */
+export interface TotpMultiFactorAssertion extends MultiFactorAssertion {
+}

package/dist/node/test/helpers/integration/helpers.d.ts

@@ -18,3 +18,6 @@ import { Auth } from '../../../src/model/public_types';
 export declare function randomEmail(): string;
 export declare function getTestInstance(requireEmulator?: boolean): Auth;
 export declare function cleanUpTestInstance(auth: Auth): Promise<void>;
+export declare function getTotpCode(sharedSecretKey: string, periodSec: number, verificationCodeLength: number, timestamp: Date): string;
+export declare const email = "totpuser-donotdelete@test.com";
+export declare const incorrectTotpCode = "1000000";

package/dist/node/test/integration/flows/totp.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {};

package/dist/node/{index-45468d80.js → totp-06ccbed7.js}

@@ -3,9 +3,9 @@
 var tslib = require('tslib');
 var util = require('@firebase/util');
 var app = require('@firebase/app');
-var logger = require('@firebase/logger');
 var component = require('@firebase/component');
 var fetchImpl = require('node-fetch');
+var logger = require('@firebase/logger');
 
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
@@ -50,7 +50,8 @@ var fetchImpl__namespace = /*#__PURE__*/_interopNamespace(fetchImpl);
  */
 var FactorId = {
     /** Phone as second factor */
-    PHONE: 'phone'
+    PHONE: 'phone',
+    TOTP: 'totp'
 };
 /**
  * Enumeration of supported providers.
@@ -1048,7 +1049,10 @@ function _performFetchWithErrorHandling(auth, customErrorMap, fetchFn) {
                     if (e_1 instanceof util.FirebaseError) {
                         throw e_1;
                     }
-                    _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */, { 'message': String(e_1) });
+                    // Changing this to a different error code will log user out when there is a network error
+                    // because we treat any error other than NETWORK_REQUEST_FAILED as token is invalid.
+                    // https://github.com/firebase/firebase-js-sdk/blob/4fbc73610d70be4e0852e7de63a39cb7897e8546/packages/auth/src/core/auth/auth_impl.ts#L309-L316
+                    _fail(auth, "network-request-failed" /* AuthErrorCode.NETWORK_REQUEST_FAILED */, { 'message': String(e_1) });
                     return [3 /*break*/, 5];
                 case 5: return [2 /*return*/];
             }
@@ -5699,6 +5703,9 @@ var MultiFactorInfoImpl = /** @class */ (function () {
         if ('phoneInfo' in enrollment) {
             return PhoneMultiFactorInfoImpl._fromServerResponse(auth, enrollment);
         }
+        else if ('totpInfo' in enrollment) {
+            return TotpMultiFactorInfoImpl._fromServerResponse(auth, enrollment);
+        }
         return _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
     };
     return MultiFactorInfoImpl;
@@ -5714,6 +5721,16 @@ var PhoneMultiFactorInfoImpl = /** @class */ (function (_super) {
         return new PhoneMultiFactorInfoImpl(enrollment);
     };
     return PhoneMultiFactorInfoImpl;
+}(MultiFactorInfoImpl));
+var TotpMultiFactorInfoImpl = /** @class */ (function (_super) {
+    tslib.__extends(TotpMultiFactorInfoImpl, _super);
+    function TotpMultiFactorInfoImpl(response) {
+        return _super.call(this, "totp" /* FactorId.TOTP */, response) || this;
+    }
+    TotpMultiFactorInfoImpl._fromServerResponse = function (_auth, enrollment) {
+        return new TotpMultiFactorInfoImpl(enrollment);
+    };
+    return TotpMultiFactorInfoImpl;
 }(MultiFactorInfoImpl));
 
 /**
@@ -6936,6 +6953,12 @@ function getMultiFactorResolver(auth, error) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+function startEnrollTotpMfa(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaEnrollment:start" /* Endpoint.START_MFA_ENROLLMENT */, _addTidIfNecessary(auth, request));
+}
+function finalizeEnrollTotpMfa(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaEnrollment:finalize" /* Endpoint.FINALIZE_MFA_ENROLLMENT */, _addTidIfNecessary(auth, request));
+}
 function withdrawMfa(auth, request) {
     return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaEnrollment:withdraw" /* Endpoint.WITHDRAW_MFA */, _addTidIfNecessary(auth, request));
 }
@@ -7066,7 +7089,7 @@ function multiFactor(user) {
 }
 
 var name = "@firebase/auth";
-var version = "0.21.5";
+var version = "0.21.6-20230329040242";
 
 /**
  * @license
@@ -7321,6 +7344,216 @@ AuthImpl.prototype.setPersistence = function () { return tslib.__awaiter(void 0,
     return [2 /*return*/];
 }); }); };
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function finalizeSignInTotpMfa(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaSignIn:finalize" /* Endpoint.FINALIZE_MFA_SIGN_IN */, _addTidIfNecessary(auth, request));
+}
+
+var MultiFactorAssertionImpl = /** @class */ (function () {
+    function MultiFactorAssertionImpl(factorId) {
+        this.factorId = factorId;
+    }
+    MultiFactorAssertionImpl.prototype._process = function (auth, session, displayName) {
+        switch (session.type) {
+            case "enroll" /* MultiFactorSessionType.ENROLL */:
+                return this._finalizeEnroll(auth, session.credential, displayName);
+            case "signin" /* MultiFactorSessionType.SIGN_IN */:
+                return this._finalizeSignIn(auth, session.credential);
+            default:
+                return debugFail('unexpected MultiFactorSessionType');
+        }
+    };
+    return MultiFactorAssertionImpl;
+}());
+
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * @public
+ */
+var TotpMultiFactorGenerator = /** @class */ (function () {
+    function TotpMultiFactorGenerator() {
+    }
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of
+     * the TOTP (time-based one-time password) second factor.
+     * This assertion is used to complete enrollment in TOTP second factor.
+     *
+     * @param secret A {@link TotpSecret} containing the shared secret key and other TOTP parameters.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorUser.enroll}.
+     */
+    TotpMultiFactorGenerator.assertionForEnrollment = function (secret, oneTimePassword) {
+        return TotpMultiFactorAssertionImpl._fromSecret(secret, oneTimePassword);
+    };
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of the TOTP second factor.
+     * This assertion is used to complete signIn with TOTP as the second factor.
+     *
+     * @param enrollmentId identifies the enrolled TOTP second factor.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorResolver.resolveSignIn}.
+     */
+    TotpMultiFactorGenerator.assertionForSignIn = function (enrollmentId, oneTimePassword) {
+        return TotpMultiFactorAssertionImpl._fromEnrollmentId(enrollmentId, oneTimePassword);
+    };
+    /**
+     * Returns a promise to {@link TotpSecret} which contains the TOTP shared secret key and other parameters.
+     * Creates a TOTP secret as part of enrolling a TOTP second factor.
+     * Used for generating a QR code URL or inputting into a TOTP app.
+     * This method uses the auth instance corresponding to the user in the multiFactorSession.
+     *
+     * @param session The {@link MultiFactorSession} that the user is part of.
+     * @returns A promise to {@link TotpSecret}.
+     */
+    TotpMultiFactorGenerator.generateSecret = function (session) {
+        return tslib.__awaiter(this, void 0, void 0, function () {
+            var mfaSession, response;
+            return tslib.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        mfaSession = session;
+                        _assert(typeof mfaSession.auth !== 'undefined', "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+                        return [4 /*yield*/, startEnrollTotpMfa(mfaSession.auth, {
+                                idToken: mfaSession.credential,
+                                totpEnrollmentInfo: {}
+                            })];
+                    case 1:
+                        response = _a.sent();
+                        return [2 /*return*/, TotpSecret._fromStartTotpMfaEnrollmentResponse(response, mfaSession.auth)];
+                }
+            });
+        });
+    };
+    /**
+     * The identifier of the TOTP second factor: `totp`.
+     */
+    TotpMultiFactorGenerator.FACTOR_ID = "totp" /* FactorId.TOTP */;
+    return TotpMultiFactorGenerator;
+}());
+var TotpMultiFactorAssertionImpl = /** @class */ (function (_super) {
+    tslib.__extends(TotpMultiFactorAssertionImpl, _super);
+    function TotpMultiFactorAssertionImpl(otp, enrollmentId, secret) {
+        var _this = _super.call(this, "totp" /* FactorId.TOTP */) || this;
+        _this.otp = otp;
+        _this.enrollmentId = enrollmentId;
+        _this.secret = secret;
+        return _this;
+    }
+    /** @internal */
+    TotpMultiFactorAssertionImpl._fromSecret = function (secret, otp) {
+        return new TotpMultiFactorAssertionImpl(otp, undefined, secret);
+    };
+    /** @internal */
+    TotpMultiFactorAssertionImpl._fromEnrollmentId = function (enrollmentId, otp) {
+        return new TotpMultiFactorAssertionImpl(otp, enrollmentId);
+    };
+    /** @internal */
+    TotpMultiFactorAssertionImpl.prototype._finalizeEnroll = function (auth, idToken, displayName) {
+        return tslib.__awaiter(this, void 0, void 0, function () {
+            return tslib.__generator(this, function (_a) {
+                _assert(typeof this.secret !== 'undefined', auth, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+                return [2 /*return*/, finalizeEnrollTotpMfa(auth, {
+                        idToken: idToken,
+                        displayName: displayName,
+                        totpVerificationInfo: this.secret._makeTotpVerificationInfo(this.otp)
+                    })];
+            });
+        });
+    };
+    /** @internal */
+    TotpMultiFactorAssertionImpl.prototype._finalizeSignIn = function (auth, mfaPendingCredential) {
+        return tslib.__awaiter(this, void 0, void 0, function () {
+            var totpVerificationInfo;
+            return tslib.__generator(this, function (_a) {
+                _assert(this.enrollmentId !== undefined && this.otp !== undefined, auth, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+                totpVerificationInfo = { verificationCode: this.otp };
+                return [2 /*return*/, finalizeSignInTotpMfa(auth, {
+                        mfaPendingCredential: mfaPendingCredential,
+                        mfaEnrollmentId: this.enrollmentId,
+                        totpVerificationInfo: totpVerificationInfo
+                    })];
+            });
+        });
+    };
+    return TotpMultiFactorAssertionImpl;
+}(MultiFactorAssertionImpl));
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * Stores the shared secret key and other parameters to generate time-based OTPs.
+ * Implements methods to retrieve the shared secret key and generate a QR code URL.
+ * @public
+ */
+var TotpSecret = /** @class */ (function () {
+    // The public members are declared outside the constructor so the docs can be generated.
+    function TotpSecret(secretKey, hashingAlgorithm, codeLength, codeIntervalSeconds, enrollmentCompletionDeadline, sessionInfo, auth) {
+        this.sessionInfo = sessionInfo;
+        this.auth = auth;
+        this.secretKey = secretKey;
+        this.hashingAlgorithm = hashingAlgorithm;
+        this.codeLength = codeLength;
+        this.codeIntervalSeconds = codeIntervalSeconds;
+        this.enrollmentCompletionDeadline = enrollmentCompletionDeadline;
+    }
+    /** @internal */
+    TotpSecret._fromStartTotpMfaEnrollmentResponse = function (response, auth) {
+        return new TotpSecret(response.totpSessionInfo.sharedSecretKey, response.totpSessionInfo.hashingAlgorithm, response.totpSessionInfo.verificationCodeLength, response.totpSessionInfo.periodSec, new Date(response.totpSessionInfo.finalizeEnrollmentTime).toUTCString(), response.totpSessionInfo.sessionInfo, auth);
+    };
+    /** @internal */
+    TotpSecret.prototype._makeTotpVerificationInfo = function (otp) {
+        return { sessionInfo: this.sessionInfo, verificationCode: otp };
+    };
+    /**
+     * Returns a QR code URL as described in
+     * https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+     * This can be displayed to the user as a QR code to be scanned into a TOTP app like Google Authenticator.
+     * If the optional parameters are unspecified, an accountName of <userEmail> and issuer of <firebaseAppName> are used.
+     *
+     * @param accountName the name of the account/app along with a user identifier.
+     * @param issuer issuer of the TOTP (likely the app name).
+     * @returns A QR code URL string.
+     */
+    TotpSecret.prototype.generateQrCodeUrl = function (accountName, issuer) {
+        var _a;
+        var useDefaults = false;
+        if (_isEmptyString(accountName) || _isEmptyString(issuer)) {
+            useDefaults = true;
+        }
+        if (useDefaults) {
+            if (_isEmptyString(accountName)) {
+                accountName = ((_a = this.auth.currentUser) === null || _a === void 0 ? void 0 : _a.email) || 'unknownuser';
+            }
+            if (_isEmptyString(issuer)) {
+                issuer = this.auth.name;
+            }
+        }
+        return "otpauth://totp/".concat(issuer, ":").concat(accountName, "?secret=").concat(this.secretKey, "&issuer=").concat(issuer, "&algorithm=").concat(this.hashingAlgorithm, "&digits=").concat(this.codeLength);
+    };
+    return TotpSecret;
+}());
+/** @internal */
+function _isEmptyString(input) {
+    return typeof input === 'undefined' || (input === null || input === void 0 ? void 0 : input.length) === 0;
+}
+
 exports.AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY;
 exports.ActionCodeOperation = ActionCodeOperation;
 exports.ActionCodeURL = ActionCodeURL;
@@ -7346,6 +7579,8 @@ exports.RecaptchaVerifier = RecaptchaVerifier;
 exports.SAMLAuthCredential = SAMLAuthCredential;
 exports.SAMLAuthProvider = SAMLAuthProvider;
 exports.SignInMethod = SignInMethod;
+exports.TotpMultiFactorGenerator = TotpMultiFactorGenerator;
+exports.TotpSecret = TotpSecret;
 exports.TwitterAuthProvider = TwitterAuthProvider;
 exports.UserImpl = UserImpl;
 exports._assert = _assert;
@@ -7427,4 +7662,4 @@ exports.updateProfile = updateProfile;
 exports.useDeviceLanguage = useDeviceLanguage;
 exports.verifyBeforeUpdateEmail = verifyBeforeUpdateEmail;
 exports.verifyPasswordResetCode = verifyPasswordResetCode;
-//# sourceMappingURL=index-45468d80.js.map
+//# sourceMappingURL=totp-06ccbed7.js.map