@firebase/auth 0.21.5 → 0.21.6-canary.45a55330e

package/dist/esm5/index.d.ts

@@ -32,5 +32,6 @@ import { signInWithRedirect, linkWithRedirect, reauthenticateWithRedirect, getRe
 import { RecaptchaVerifier } from './src/platform_browser/recaptcha/recaptcha_verifier';
 import { browserPopupRedirectResolver } from './src/platform_browser/popup_redirect';
 import { PhoneMultiFactorGenerator } from './src/platform_browser/mfa/assertions/phone';
+import { TotpMultiFactorGenerator, TotpSecret } from './src/mfa/assertions/totp';
 import { getAuth } from './src/platform_browser';
-export { browserLocalPersistence, browserSessionPersistence, indexedDBLocalPersistence, PhoneAuthProvider, signInWithPhoneNumber, linkWithPhoneNumber, reauthenticateWithPhoneNumber, updatePhoneNumber, signInWithPopup, linkWithPopup, reauthenticateWithPopup, signInWithRedirect, linkWithRedirect, reauthenticateWithRedirect, getRedirectResult, RecaptchaVerifier, browserPopupRedirectResolver, PhoneMultiFactorGenerator, getAuth };
+export { browserLocalPersistence, browserSessionPersistence, indexedDBLocalPersistence, PhoneAuthProvider, signInWithPhoneNumber, linkWithPhoneNumber, reauthenticateWithPhoneNumber, updatePhoneNumber, signInWithPopup, linkWithPopup, reauthenticateWithPopup, signInWithRedirect, linkWithRedirect, reauthenticateWithRedirect, getRedirectResult, RecaptchaVerifier, browserPopupRedirectResolver, PhoneMultiFactorGenerator, TotpMultiFactorGenerator, TotpSecret, getAuth };

package/dist/esm5/index.js

@@ -1,4 +1,4 @@
-export { A as ActionCodeOperation, ad as ActionCodeURL, H as AuthCredential, D as AuthErrorCodes, I as EmailAuthCredential, M as EmailAuthProvider, N as FacebookAuthProvider, F as FactorId, T as GithubAuthProvider, Q as GoogleAuthProvider, J as OAuthCredential, U as OAuthProvider, O as OperationType, K as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, o as ProviderId, R as RecaptchaVerifier, V as SAMLAuthProvider, S as SignInMethod, W as TwitterAuthProvider, a2 as applyActionCode, t as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a3 as checkActionCode, a1 as confirmPasswordReset, G as connectAuthEmulator, a5 as createUserWithEmailAndPassword, B as debugErrorMap, z as deleteUser, aa as fetchSignInMethodsForEmail, al as getAdditionalUserInfo, n as getAuth, ai as getIdToken, aj as getIdTokenResult, an as getMultiFactorResolver, j as getRedirectResult, L as inMemoryPersistence, i as indexedDBLocalPersistence, E as initializeAuth, a8 as isSignInWithEmailLink, Z as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, ao as multiFactor, v as onAuthStateChanged, q as onIdTokenChanged, ae as parseActionCodeURL, C as prodErrorMap, _ as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, am as reload, ab as sendEmailVerification, a0 as sendPasswordResetEmail, a7 as sendSignInLinkToEmail, p as setPersistence, X as signInAnonymously, Y as signInWithCredential, $ as signInWithCustomToken, a6 as signInWithEmailAndPassword, a9 as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, y as signOut, ak as unlink, x as updateCurrentUser, ag as updateEmail, ah as updatePassword, u as updatePhoneNumber, af as updateProfile, w as useDeviceLanguage, ac as verifyBeforeUpdateEmail, a4 as verifyPasswordResetCode } from './index-3f05dc7b.js';
+export { A as ActionCodeOperation, af as ActionCodeURL, I as AuthCredential, E as AuthErrorCodes, J as EmailAuthCredential, N as EmailAuthProvider, Q as FacebookAuthProvider, F as FactorId, V as GithubAuthProvider, U as GoogleAuthProvider, K as OAuthCredential, W as OAuthProvider, O as OperationType, L as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, X as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, Y as TwitterAuthProvider, a4 as applyActionCode, v as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a5 as checkActionCode, a3 as confirmPasswordReset, H as connectAuthEmulator, a7 as createUserWithEmailAndPassword, C as debugErrorMap, B as deleteUser, ac as fetchSignInMethodsForEmail, an as getAdditionalUserInfo, o as getAuth, ak as getIdToken, al as getIdTokenResult, ap as getMultiFactorResolver, j as getRedirectResult, M as inMemoryPersistence, i as indexedDBLocalPersistence, G as initializeAuth, aa as isSignInWithEmailLink, $ as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, aq as multiFactor, w as onAuthStateChanged, t as onIdTokenChanged, ag as parseActionCodeURL, D as prodErrorMap, a0 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ao as reload, ad as sendEmailVerification, a2 as sendPasswordResetEmail, a9 as sendSignInLinkToEmail, q as setPersistence, Z as signInAnonymously, _ as signInWithCredential, a1 as signInWithCustomToken, a8 as signInWithEmailAndPassword, ab as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, z as signOut, am as unlink, y as updateCurrentUser, ai as updateEmail, aj as updatePassword, u as updatePhoneNumber, ah as updateProfile, x as useDeviceLanguage, ae as verifyBeforeUpdateEmail, a6 as verifyPasswordResetCode } from './index-f3279380.js';
 import 'tslib';
 import '@firebase/util';
 import '@firebase/app';

package/dist/esm5/internal.js

@@ -1,5 +1,5 @@
-import { ap as _isIOS, aq as _isAndroid, ar as _fail, as as _getRedirectUrl, at as debugAssert, au as _getProjectConfig, av as _isIOS7Or8, aw as _assert, ax as _createError, ay as AuthEventManager, az as _getInstance, b as browserLocalPersistence, aA as _persistenceKeyName, aB as _clearRedirectOutcomes, a as browserSessionPersistence, aC as _getRedirectResult, aD as _overrideRedirectResult, aE as _castAuth } from './index-3f05dc7b.js';
-export { A as ActionCodeOperation, ad as ActionCodeURL, H as AuthCredential, D as AuthErrorCodes, aG as AuthImpl, aJ as AuthPopup, I as EmailAuthCredential, M as EmailAuthProvider, N as FacebookAuthProvider, F as FactorId, aK as FetchProvider, T as GithubAuthProvider, Q as GoogleAuthProvider, J as OAuthCredential, U as OAuthProvider, O as OperationType, K as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, o as ProviderId, R as RecaptchaVerifier, aL as SAMLAuthCredential, V as SAMLAuthProvider, S as SignInMethod, W as TwitterAuthProvider, aF as UserImpl, aw as _assert, aE as _castAuth, ar as _fail, aI as _generateEventId, aH as _getClientVersion, az as _getInstance, aC as _getRedirectResult, aD as _overrideRedirectResult, aA as _persistenceKeyName, a2 as applyActionCode, t as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a3 as checkActionCode, a1 as confirmPasswordReset, G as connectAuthEmulator, a5 as createUserWithEmailAndPassword, B as debugErrorMap, z as deleteUser, aa as fetchSignInMethodsForEmail, al as getAdditionalUserInfo, n as getAuth, ai as getIdToken, aj as getIdTokenResult, an as getMultiFactorResolver, j as getRedirectResult, L as inMemoryPersistence, i as indexedDBLocalPersistence, E as initializeAuth, a8 as isSignInWithEmailLink, Z as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, ao as multiFactor, v as onAuthStateChanged, q as onIdTokenChanged, ae as parseActionCodeURL, C as prodErrorMap, _ as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, am as reload, ab as sendEmailVerification, a0 as sendPasswordResetEmail, a7 as sendSignInLinkToEmail, p as setPersistence, X as signInAnonymously, Y as signInWithCredential, $ as signInWithCustomToken, a6 as signInWithEmailAndPassword, a9 as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, y as signOut, ak as unlink, x as updateCurrentUser, ag as updateEmail, ah as updatePassword, u as updatePhoneNumber, af as updateProfile, w as useDeviceLanguage, ac as verifyBeforeUpdateEmail, a4 as verifyPasswordResetCode } from './index-3f05dc7b.js';
+import { ar as _isIOS, as as _isAndroid, at as _fail, au as _getRedirectUrl, av as debugAssert, aw as _getProjectConfig, ax as _isIOS7Or8, ay as _assert, az as _createError, aA as AuthEventManager, aB as _getInstance, b as browserLocalPersistence, aC as _persistenceKeyName, aD as _clearRedirectOutcomes, a as browserSessionPersistence, aE as _getRedirectResult, aF as _overrideRedirectResult, aG as _castAuth } from './index-f3279380.js';
+export { A as ActionCodeOperation, af as ActionCodeURL, I as AuthCredential, E as AuthErrorCodes, aI as AuthImpl, aL as AuthPopup, J as EmailAuthCredential, N as EmailAuthProvider, Q as FacebookAuthProvider, F as FactorId, aM as FetchProvider, V as GithubAuthProvider, U as GoogleAuthProvider, K as OAuthCredential, W as OAuthProvider, O as OperationType, L as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, aN as SAMLAuthCredential, X as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, Y as TwitterAuthProvider, aH as UserImpl, ay as _assert, aG as _castAuth, at as _fail, aK as _generateEventId, aJ as _getClientVersion, aB as _getInstance, aE as _getRedirectResult, aF as _overrideRedirectResult, aC as _persistenceKeyName, a4 as applyActionCode, v as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a5 as checkActionCode, a3 as confirmPasswordReset, H as connectAuthEmulator, a7 as createUserWithEmailAndPassword, C as debugErrorMap, B as deleteUser, ac as fetchSignInMethodsForEmail, an as getAdditionalUserInfo, o as getAuth, ak as getIdToken, al as getIdTokenResult, ap as getMultiFactorResolver, j as getRedirectResult, M as inMemoryPersistence, i as indexedDBLocalPersistence, G as initializeAuth, aa as isSignInWithEmailLink, $ as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, aq as multiFactor, w as onAuthStateChanged, t as onIdTokenChanged, ag as parseActionCodeURL, D as prodErrorMap, a0 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ao as reload, ad as sendEmailVerification, a2 as sendPasswordResetEmail, a9 as sendSignInLinkToEmail, q as setPersistence, Z as signInAnonymously, _ as signInWithCredential, a1 as signInWithCustomToken, a8 as signInWithEmailAndPassword, ab as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, z as signOut, am as unlink, y as updateCurrentUser, ai as updateEmail, aj as updatePassword, u as updatePhoneNumber, ah as updateProfile, x as useDeviceLanguage, ae as verifyBeforeUpdateEmail, a6 as verifyPasswordResetCode } from './index-f3279380.js';
 import { __awaiter, __generator, __extends } from 'tslib';
 import { querystringDecode } from '@firebase/util';
 import '@firebase/app';

package/dist/esm5/src/api/account_management/mfa.d.ts

@@ -18,7 +18,7 @@ import { SignInWithPhoneNumberRequest } from '../authentication/sms';
 import { FinalizeMfaResponse } from '../authentication/mfa';
 import { AuthInternal } from '../../model/auth';
 /**
- * MFA Info as returned by the API
+ * MFA Info as returned by the API.
  */
 interface BaseMfaEnrollment {
     mfaEnrollmentId: string;
@@ -26,15 +26,20 @@ interface BaseMfaEnrollment {
     displayName?: string;
 }
 /**
- * An MFA provided by SMS verification
+ * An MFA provided by SMS verification.
  */
 export interface PhoneMfaEnrollment extends BaseMfaEnrollment {
     phoneInfo: string;
 }
 /**
- * MfaEnrollment can be any subtype of BaseMfaEnrollment, currently only PhoneMfaEnrollment is supported
+ * An MFA provided by TOTP (Time-based One Time Password).
  */
-export declare type MfaEnrollment = PhoneMfaEnrollment;
+export interface TotpMfaEnrollment extends BaseMfaEnrollment {
+}
+/**
+ * MfaEnrollment can be any subtype of BaseMfaEnrollment, currently only PhoneMfaEnrollment and TotpMfaEnrollment are supported.
+ */
+export declare type MfaEnrollment = PhoneMfaEnrollment | TotpMfaEnrollment;
 export interface StartPhoneMfaEnrollmentRequest {
     idToken: string;
     phoneEnrollmentInfo: {
@@ -58,6 +63,35 @@ export interface FinalizePhoneMfaEnrollmentRequest {
 export interface FinalizePhoneMfaEnrollmentResponse extends FinalizeMfaResponse {
 }
 export declare function finalizeEnrollPhoneMfa(auth: AuthInternal, request: FinalizePhoneMfaEnrollmentRequest): Promise<FinalizePhoneMfaEnrollmentResponse>;
+export interface StartTotpMfaEnrollmentRequest {
+    idToken: string;
+    totpEnrollmentInfo: {};
+    tenantId?: string;
+}
+export interface StartTotpMfaEnrollmentResponse {
+    totpSessionInfo: {
+        sharedSecretKey: string;
+        verificationCodeLength: number;
+        hashingAlgorithm: string;
+        periodSec: number;
+        sessionInfo: string;
+        finalizeEnrollmentTime: number;
+    };
+}
+export declare function startEnrollTotpMfa(auth: AuthInternal, request: StartTotpMfaEnrollmentRequest): Promise<StartTotpMfaEnrollmentResponse>;
+export interface TotpVerificationInfo {
+    sessionInfo: string;
+    verificationCode: string;
+}
+export interface FinalizeTotpMfaEnrollmentRequest {
+    idToken: string;
+    totpVerificationInfo: TotpVerificationInfo;
+    displayName?: string | null;
+    tenantId?: string;
+}
+export interface FinalizeTotpMfaEnrollmentResponse extends FinalizeMfaResponse {
+}
+export declare function finalizeEnrollTotpMfa(auth: AuthInternal, request: FinalizeTotpMfaEnrollmentRequest): Promise<FinalizeTotpMfaEnrollmentResponse>;
 export interface WithdrawMfaRequest {
     idToken: string;
     mfaEnrollmentId: string;

package/dist/esm5/src/api/authentication/mfa.d.ts

@@ -49,9 +49,20 @@ export interface FinalizePhoneMfaSignInRequest {
     phoneVerificationInfo: SignInWithPhoneNumberRequest;
     tenantId?: string;
 }
+export interface FinalizeTotpMfaSignInRequest {
+    mfaPendingCredential: string;
+    totpVerificationInfo: {
+        verificationCode: string;
+    };
+    tenantId?: string;
+    mfaEnrollmentId: string;
+}
 export interface FinalizePhoneMfaSignInResponse extends FinalizeMfaResponse {
 }
+export interface FinalizeTotpMfaSignInResponse extends FinalizeMfaResponse {
+}
 export declare function finalizeSignInPhoneMfa(auth: Auth, request: FinalizePhoneMfaSignInRequest): Promise<FinalizePhoneMfaSignInResponse>;
+export declare function finalizeSignInTotpMfa(auth: Auth, request: FinalizeTotpMfaSignInRequest): Promise<FinalizeTotpMfaSignInResponse>;
 /**
  * @internal
  */

package/dist/esm5/src/core/errors.d.ts

@@ -86,6 +86,7 @@ export declare const enum AuthErrorCode {
     MISSING_MFA_INFO = "missing-multi-factor-info",
     MISSING_MFA_SESSION = "missing-multi-factor-session",
     MISSING_PHONE_NUMBER = "missing-phone-number",
+    MISSING_PASSWORD = "missing-password",
     MISSING_SESSION_INFO = "missing-verification-id",
     MODULE_DESTROYED = "app-deleted",
     NEED_CONFIRMATION = "account-exists-with-different-credential",

package/dist/esm5/src/core/index.d.ts

@@ -43,6 +43,7 @@ export declare function setPersistence(auth: Auth, persistence: Persistence): Pr
  *
  * @remarks
  * This includes sign-in, sign-out, and token refresh events.
+ * This will not be triggered automatically upon ID token expiration. Use {@link User.getIdToken} to refresh the ID token.
  *
  * @param auth - The {@link Auth} instance.
  * @param nextOrObserver - callback triggered on change.

package/dist/esm5/src/mfa/assertions/totp.d.ts

@@ -0,0 +1,124 @@
+/**
+ * @license
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { TotpMultiFactorAssertion, MultiFactorSession } from '../../model/public_types';
+import { AuthInternal } from '../../model/auth';
+import { StartTotpMfaEnrollmentResponse, TotpVerificationInfo } from '../../api/account_management/mfa';
+import { FinalizeMfaResponse } from '../../api/authentication/mfa';
+import { MultiFactorAssertionImpl } from '../../mfa/mfa_assertion';
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * @public
+ */
+export declare class TotpMultiFactorGenerator {
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of
+     * the TOTP (time-based one-time password) second factor.
+     * This assertion is used to complete enrollment in TOTP second factor.
+     *
+     * @param secret A {@link TotpSecret} containing the shared secret key and other TOTP parameters.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorUser.enroll}.
+     */
+    static assertionForEnrollment(secret: TotpSecret, oneTimePassword: string): TotpMultiFactorAssertion;
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of the TOTP second factor.
+     * This assertion is used to complete signIn with TOTP as the second factor.
+     *
+     * @param enrollmentId identifies the enrolled TOTP second factor.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorResolver.resolveSignIn}.
+     */
+    static assertionForSignIn(enrollmentId: string, oneTimePassword: string): TotpMultiFactorAssertion;
+    /**
+     * Returns a promise to {@link TotpSecret} which contains the TOTP shared secret key and other parameters.
+     * Creates a TOTP secret as part of enrolling a TOTP second factor.
+     * Used for generating a QR code URL or inputting into a TOTP app.
+     * This method uses the auth instance corresponding to the user in the multiFactorSession.
+     *
+     * @param session The {@link MultiFactorSession} that the user is part of.
+     * @returns A promise to {@link TotpSecret}.
+     */
+    static generateSecret(session: MultiFactorSession): Promise<TotpSecret>;
+    /**
+     * The identifier of the TOTP second factor: `totp`.
+     */
+    static FACTOR_ID: 'totp';
+}
+export declare class TotpMultiFactorAssertionImpl extends MultiFactorAssertionImpl implements TotpMultiFactorAssertion {
+    readonly otp: string;
+    readonly enrollmentId?: string | undefined;
+    readonly secret?: TotpSecret | undefined;
+    constructor(otp: string, enrollmentId?: string | undefined, secret?: TotpSecret | undefined);
+    /** @internal */
+    static _fromSecret(secret: TotpSecret, otp: string): TotpMultiFactorAssertionImpl;
+    /** @internal */
+    static _fromEnrollmentId(enrollmentId: string, otp: string): TotpMultiFactorAssertionImpl;
+    /** @internal */
+    _finalizeEnroll(auth: AuthInternal, idToken: string, displayName?: string | null): Promise<FinalizeMfaResponse>;
+    /** @internal */
+    _finalizeSignIn(auth: AuthInternal, mfaPendingCredential: string): Promise<FinalizeMfaResponse>;
+}
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * Stores the shared secret key and other parameters to generate time-based OTPs.
+ * Implements methods to retrieve the shared secret key and generate a QR code URL.
+ * @public
+ */
+export declare class TotpSecret {
+    private readonly sessionInfo;
+    private readonly auth;
+    /**
+     * Shared secret key/seed used for enrolling in TOTP MFA and generating OTPs.
+     */
+    readonly secretKey: string;
+    /**
+     * Hashing algorithm used.
+     */
+    readonly hashingAlgorithm: string;
+    /**
+     * Length of the one-time passwords to be generated.
+     */
+    readonly codeLength: number;
+    /**
+     * The interval (in seconds) when the OTP codes should change.
+     */
+    readonly codeIntervalSeconds: number;
+    /**
+     * The timestamp (UTC string) by which TOTP enrollment should be completed.
+     */
+    readonly enrollmentCompletionDeadline: string;
+    private constructor();
+    /** @internal */
+    static _fromStartTotpMfaEnrollmentResponse(response: StartTotpMfaEnrollmentResponse, auth: AuthInternal): TotpSecret;
+    /** @internal */
+    _makeTotpVerificationInfo(otp: string): TotpVerificationInfo;
+    /**
+     * Returns a QR code URL as described in
+     * https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+     * This can be displayed to the user as a QR code to be scanned into a TOTP app like Google Authenticator.
+     * If the optional parameters are unspecified, an accountName of <userEmail> and issuer of <firebaseAppName> are used.
+     *
+     * @param accountName the name of the account/app along with a user identifier.
+     * @param issuer issuer of the TOTP (likely the app name).
+     * @returns A QR code URL string.
+     */
+    generateQrCodeUrl(accountName?: string, issuer?: string): string;
+}

package/dist/esm5/src/mfa/assertions/totp.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {};

package/dist/esm5/src/mfa/mfa_info.d.ts

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { FactorId, MultiFactorInfo, PhoneMultiFactorInfo } from '../model/public_types';
+import { FactorId, MultiFactorInfo, PhoneMultiFactorInfo, TotpMultiFactorInfo } from '../model/public_types';
 import { MfaEnrollment } from '../api/account_management/mfa';
 import { AuthInternal } from '../model/auth';
 export declare abstract class MultiFactorInfoImpl implements MultiFactorInfo {
@@ -30,3 +30,7 @@ export declare class PhoneMultiFactorInfoImpl extends MultiFactorInfoImpl implem
     private constructor();
     static _fromServerResponse(_auth: AuthInternal, enrollment: MfaEnrollment): PhoneMultiFactorInfoImpl;
 }
+export declare class TotpMultiFactorInfoImpl extends MultiFactorInfoImpl implements TotpMultiFactorInfo {
+    private constructor();
+    static _fromServerResponse(_auth: AuthInternal, enrollment: MfaEnrollment): TotpMultiFactorInfoImpl;
+}

package/dist/esm5/src/model/enum_maps.d.ts

@@ -22,6 +22,7 @@
 export declare const FactorId: {
     /** Phone as second factor */
     readonly PHONE: "phone";
+    readonly TOTP: "totp";
 };
 /**
  * Enumeration of supported providers.

package/dist/esm5/src/model/public_types.d.ts

@@ -502,7 +502,8 @@ export interface AuthProvider {
  */
 export declare const enum FactorId {
     /** Phone as second factor */
-    PHONE = "phone"
+    PHONE = "phone",
+    TOTP = "totp"
 }
 /**
  * A result from a phone number sign-in, link, or reauthenticate call.
@@ -609,6 +610,13 @@ export interface PhoneMultiFactorInfo extends MultiFactorInfo {
     /** The phone number associated with the current second factor. */
     readonly phoneNumber: string;
 }
+/**
+ * The subclass of the {@link MultiFactorInfo} interface for TOTP
+ * second factors. The `factorId` of this second factor is {@link FactorId}.TOTP.
+ * @public
+ */
+export interface TotpMultiFactorInfo extends MultiFactorInfo {
+}
 /**
  * The class used to facilitate recovery from {@link MultiFactorError} when a user needs to
  * provide a second factor to sign in.
@@ -1160,3 +1168,12 @@ export interface Dependencies {
      */
     errorMap?: AuthErrorMap;
 }
+/**
+ * The class for asserting ownership of a TOTP second factor. Provided by
+ * {@link TotpMultiFactorGenerator.assertionForEnrollment} and
+ * {@link TotpMultiFactorGenerator.assertionForSignIn}.
+ *
+ * @public
+ */
+export interface TotpMultiFactorAssertion extends MultiFactorAssertion {
+}

package/dist/esm5/test/helpers/integration/helpers.d.ts

@@ -18,3 +18,6 @@ import { Auth } from '../../../src/model/public_types';
 export declare function randomEmail(): string;
 export declare function getTestInstance(requireEmulator?: boolean): Auth;
 export declare function cleanUpTestInstance(auth: Auth): Promise<void>;
+export declare function getTotpCode(sharedSecretKey: string, periodSec: number, verificationCodeLength: number, timestamp: Date): string;
+export declare const email = "totpuser-donotdelete@test.com";
+export declare const incorrectTotpCode = "1000000";

package/dist/esm5/test/integration/flows/totp.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {};

package/dist/index.d.ts

@@ -32,5 +32,6 @@ import { signInWithRedirect, linkWithRedirect, reauthenticateWithRedirect, getRe
 import { RecaptchaVerifier } from './src/platform_browser/recaptcha/recaptcha_verifier';
 import { browserPopupRedirectResolver } from './src/platform_browser/popup_redirect';
 import { PhoneMultiFactorGenerator } from './src/platform_browser/mfa/assertions/phone';
+import { TotpMultiFactorGenerator, TotpSecret } from './src/mfa/assertions/totp';
 import { getAuth } from './src/platform_browser';
-export { browserLocalPersistence, browserSessionPersistence, indexedDBLocalPersistence, PhoneAuthProvider, signInWithPhoneNumber, linkWithPhoneNumber, reauthenticateWithPhoneNumber, updatePhoneNumber, signInWithPopup, linkWithPopup, reauthenticateWithPopup, signInWithRedirect, linkWithRedirect, reauthenticateWithRedirect, getRedirectResult, RecaptchaVerifier, browserPopupRedirectResolver, PhoneMultiFactorGenerator, getAuth };
+export { browserLocalPersistence, browserSessionPersistence, indexedDBLocalPersistence, PhoneAuthProvider, signInWithPhoneNumber, linkWithPhoneNumber, reauthenticateWithPhoneNumber, updatePhoneNumber, signInWithPopup, linkWithPopup, reauthenticateWithPopup, signInWithRedirect, linkWithRedirect, reauthenticateWithRedirect, getRedirectResult, RecaptchaVerifier, browserPopupRedirectResolver, PhoneMultiFactorGenerator, TotpMultiFactorGenerator, TotpSecret, getAuth };

package/dist/index.webworker.esm5.js

@@ -114,6 +114,7 @@ function _debugErrorMap() {
         _a["missing-or-invalid-nonce" /* AuthErrorCode.MISSING_OR_INVALID_NONCE */] = 'The request does not contain a valid nonce. This can occur if the ' +
             'SHA-256 hash of the provided raw nonce does not match the hashed nonce ' +
             'in the ID token payload.',
+        _a["missing-password" /* AuthErrorCode.MISSING_PASSWORD */] = 'A non-empty password must be provided',
         _a["missing-multi-factor-info" /* AuthErrorCode.MISSING_MFA_INFO */] = 'No second factor identifier is provided.',
         _a["missing-multi-factor-session" /* AuthErrorCode.MISSING_MFA_SESSION */] = 'The request is missing proof of first factor successful sign-in.',
         _a["missing-phone-number" /* AuthErrorCode.MISSING_PHONE_NUMBER */] = 'To send verification codes, provide a phone number for the recipient.',
@@ -523,7 +524,7 @@ function _initializeAuthInstance(auth, deps) {
 }
 
 var name = "@firebase/auth";
-var version = "0.21.5";
+var version = "0.21.6-canary.45a55330e";
 
 /**
  * @license
@@ -905,7 +906,7 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     // Sign in with email and password errors (some apply to sign up too).
     _a$1["INVALID_PASSWORD" /* ServerError.INVALID_PASSWORD */] = "wrong-password" /* AuthErrorCode.INVALID_PASSWORD */,
     // This can only happen if the SDK sends a bad request.
-    _a$1["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */] = "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
+    _a$1["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */] = "missing-password" /* AuthErrorCode.MISSING_PASSWORD */,
     // Sign up with email and password errors.
     _a$1["EMAIL_EXISTS" /* ServerError.EMAIL_EXISTS */] = "email-already-in-use" /* AuthErrorCode.EMAIL_EXISTS */,
     _a$1["PASSWORD_LOGIN_DISABLED" /* ServerError.PASSWORD_LOGIN_DISABLED */] = "operation-not-allowed" /* AuthErrorCode.OPERATION_NOT_ALLOWED */,
@@ -1074,7 +1075,10 @@ function _performFetchWithErrorHandling(auth, customErrorMap, fetchFn) {
                     if (e_1 instanceof FirebaseError) {
                         throw e_1;
                     }
-                    _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */, { 'message': String(e_1) });
+                    // Changing this to a different error code will log user out when there is a network error
+                    // because we treat any error other than NETWORK_REQUEST_FAILED as token is invalid.
+                    // https://github.com/firebase/firebase-js-sdk/blob/4fbc73610d70be4e0852e7de63a39cb7897e8546/packages/auth/src/core/auth/auth_impl.ts#L309-L316
+                    _fail(auth, "network-request-failed" /* AuthErrorCode.NETWORK_REQUEST_FAILED */, { 'message': String(e_1) });
                     return [3 /*break*/, 5];
                 case 5: return [2 /*return*/];
             }
@@ -4174,7 +4178,8 @@ var indexedDBLocalPersistence = IndexedDBLocalPersistence;
  */
 var FactorId = {
     /** Phone as second factor */
-    PHONE: 'phone'
+    PHONE: 'phone',
+    TOTP: 'totp'
 };
 /**
  * Enumeration of supported providers.
@@ -6718,6 +6723,9 @@ var MultiFactorInfoImpl = /** @class */ (function () {
         if ('phoneInfo' in enrollment) {
             return PhoneMultiFactorInfoImpl._fromServerResponse(auth, enrollment);
         }
+        else if ('totpInfo' in enrollment) {
+            return TotpMultiFactorInfoImpl._fromServerResponse(auth, enrollment);
+        }
         return _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
     };
     return MultiFactorInfoImpl;
@@ -6733,6 +6741,16 @@ var PhoneMultiFactorInfoImpl = /** @class */ (function (_super) {
         return new PhoneMultiFactorInfoImpl(enrollment);
     };
     return PhoneMultiFactorInfoImpl;
+}(MultiFactorInfoImpl));
+var TotpMultiFactorInfoImpl = /** @class */ (function (_super) {
+    __extends(TotpMultiFactorInfoImpl, _super);
+    function TotpMultiFactorInfoImpl(response) {
+        return _super.call(this, "totp" /* FactorId.TOTP */, response) || this;
+    }
+    TotpMultiFactorInfoImpl._fromServerResponse = function (_auth, enrollment) {
+        return new TotpMultiFactorInfoImpl(enrollment);
+    };
+    return TotpMultiFactorInfoImpl;
 }(MultiFactorInfoImpl));
 
 /**
@@ -7699,6 +7717,7 @@ function setPersistence(auth, persistence) {
  *
  * @remarks
  * This includes sign-in, sign-out, and token refresh events.
+ * This will not be triggered automatically upon ID token expiration. Use {@link User.getIdToken} to refresh the ID token.
  *
  * @param auth - The {@link Auth} instance.
  * @param nextOrObserver - callback triggered on change.