@firebase/auth 0.21.5 → 0.21.6-canary.45a55330e

package/dist/node-esm/{index-1f9492de.js → totp-a3bfc07a.js}

@@ -1,9 +1,9 @@
 import { ErrorFactory, deepEqual, isBrowserExtension, isMobileCordova, isReactNative, FirebaseError, querystring, getModularInstance, base64Decode, getUA, isIE, createSubscribe, querystringDecode, extractQuerystring, getDefaultEmulatorHost } from '@firebase/util';
 import { SDK_VERSION, _getProvider, _registerComponent, registerVersion, getApp } from '@firebase/app';
 import { __rest } from 'tslib';
-import { Logger, LogLevel } from '@firebase/logger';
 import { Component } from '@firebase/component';
 import * as fetchImpl from 'node-fetch';
+import { Logger, LogLevel } from '@firebase/logger';
 
 /**
  * @license
@@ -28,7 +28,8 @@ import * as fetchImpl from 'node-fetch';
  */
 const FactorId = {
     /** Phone as second factor */
-    PHONE: 'phone'
+    PHONE: 'phone',
+    TOTP: 'totp'
 };
 /**
  * Enumeration of supported providers.
@@ -212,6 +213,7 @@ function _debugErrorMap() {
         ["missing-or-invalid-nonce" /* AuthErrorCode.MISSING_OR_INVALID_NONCE */]: 'The request does not contain a valid nonce. This can occur if the ' +
             'SHA-256 hash of the provided raw nonce does not match the hashed nonce ' +
             'in the ID token payload.',
+        ["missing-password" /* AuthErrorCode.MISSING_PASSWORD */]: 'A non-empty password must be provided',
         ["missing-multi-factor-info" /* AuthErrorCode.MISSING_MFA_INFO */]: 'No second factor identifier is provided.',
         ["missing-multi-factor-session" /* AuthErrorCode.MISSING_MFA_SESSION */]: 'The request is missing proof of first factor successful sign-in.',
         ["missing-phone-number" /* AuthErrorCode.MISSING_PHONE_NUMBER */]: 'To send verification codes, provide a phone number for the recipient.',
@@ -828,7 +830,7 @@ const SERVER_ERROR_MAP = {
     // Sign in with email and password errors (some apply to sign up too).
     ["INVALID_PASSWORD" /* ServerError.INVALID_PASSWORD */]: "wrong-password" /* AuthErrorCode.INVALID_PASSWORD */,
     // This can only happen if the SDK sends a bad request.
-    ["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */]: "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
+    ["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */]: "missing-password" /* AuthErrorCode.MISSING_PASSWORD */,
     // Sign up with email and password errors.
     ["EMAIL_EXISTS" /* ServerError.EMAIL_EXISTS */]: "email-already-in-use" /* AuthErrorCode.EMAIL_EXISTS */,
     ["PASSWORD_LOGIN_DISABLED" /* ServerError.PASSWORD_LOGIN_DISABLED */]: "operation-not-allowed" /* AuthErrorCode.OPERATION_NOT_ALLOWED */,
@@ -972,7 +974,10 @@ async function _performFetchWithErrorHandling(auth, customErrorMap, fetchFn) {
         if (e instanceof FirebaseError) {
             throw e;
         }
-        _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */, { 'message': String(e) });
+        // Changing this to a different error code will log user out when there is a network error
+        // because we treat any error other than NETWORK_REQUEST_FAILED as token is invalid.
+        // https://github.com/firebase/firebase-js-sdk/blob/4fbc73610d70be4e0852e7de63a39cb7897e8546/packages/auth/src/core/auth/auth_impl.ts#L309-L316
+        _fail(auth, "network-request-failed" /* AuthErrorCode.NETWORK_REQUEST_FAILED */, { 'message': String(e) });
     }
 }
 async function _performSignInRequest(auth, method, path, request, customErrorMap = {}) {
@@ -4843,6 +4848,9 @@ class MultiFactorInfoImpl {
         if ('phoneInfo' in enrollment) {
             return PhoneMultiFactorInfoImpl._fromServerResponse(auth, enrollment);
         }
+        else if ('totpInfo' in enrollment) {
+            return TotpMultiFactorInfoImpl._fromServerResponse(auth, enrollment);
+        }
         return _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
     }
 }
@@ -4854,6 +4862,14 @@ class PhoneMultiFactorInfoImpl extends MultiFactorInfoImpl {
     static _fromServerResponse(_auth, enrollment) {
         return new PhoneMultiFactorInfoImpl(enrollment);
     }
+}
+class TotpMultiFactorInfoImpl extends MultiFactorInfoImpl {
+    constructor(response) {
+        super("totp" /* FactorId.TOTP */, response);
+    }
+    static _fromServerResponse(_auth, enrollment) {
+        return new TotpMultiFactorInfoImpl(enrollment);
+    }
 }
 
 /**
@@ -5657,6 +5673,7 @@ function setPersistence(auth, persistence) {
  *
  * @remarks
  * This includes sign-in, sign-out, and token refresh events.
+ * This will not be triggered automatically upon ID token expiration. Use {@link User.getIdToken} to refresh the ID token.
  *
  * @param auth - The {@link Auth} instance.
  * @param nextOrObserver - callback triggered on change.
@@ -5884,6 +5901,12 @@ function getMultiFactorResolver(auth, error) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+function startEnrollTotpMfa(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaEnrollment:start" /* Endpoint.START_MFA_ENROLLMENT */, _addTidIfNecessary(auth, request));
+}
+function finalizeEnrollTotpMfa(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaEnrollment:finalize" /* Endpoint.FINALIZE_MFA_ENROLLMENT */, _addTidIfNecessary(auth, request));
+}
 function withdrawMfa(auth, request) {
     return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaEnrollment:withdraw" /* Endpoint.WITHDRAW_MFA */, _addTidIfNecessary(auth, request));
 }
@@ -5958,7 +5981,7 @@ function multiFactor(user) {
 }
 
 var name = "@firebase/auth";
-var version = "0.21.5";
+var version = "0.21.6-canary.45a55330e";
 
 /**
  * @license
@@ -6188,5 +6211,188 @@ class PhoneMultiFactorGenerator {
 // auth.setPersistence(persistence) are covered.
 AuthImpl.prototype.setPersistence = async () => { };
 
-export { signInWithCustomToken as $, ActionCodeOperation as A, debugErrorMap as B, prodErrorMap as C, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as D, initializeAuth as E, FactorId as F, connectAuthEmulator as G, AuthCredential as H, EmailAuthCredential as I, OAuthCredential as J, PhoneAuthCredential as K, inMemoryPersistence as L, EmailAuthProvider as M, FacebookAuthProvider as N, OperationType as O, PhoneAuthProvider as P, GoogleAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, GithubAuthProvider as T, OAuthProvider as U, SAMLAuthProvider as V, TwitterAuthProvider as W, signInAnonymously as X, signInWithCredential as Y, linkWithCredential as Z, reauthenticateWithCredential as _, browserSessionPersistence as a, sendPasswordResetEmail as a0, confirmPasswordReset as a1, applyActionCode as a2, checkActionCode as a3, verifyPasswordResetCode as a4, createUserWithEmailAndPassword as a5, signInWithEmailAndPassword as a6, sendSignInLinkToEmail as a7, isSignInWithEmailLink as a8, signInWithEmailLink as a9, BaseOAuthProvider as aA, _emulatorUrl as aB, _performApiRequest as aC, _isIOS as aD, _isAndroid as aE, _isIOS7Or8 as aF, _createError as aG, _isIframe as aH, _isMobileBrowser as aI, _isIE10 as aJ, _isSafari as aK, UserImpl as aL, AuthImpl as aM, _getClientVersion as aN, FetchProvider as aO, SAMLAuthCredential as aP, fetchSignInMethodsForEmail as aa, sendEmailVerification as ab, verifyBeforeUpdateEmail as ac, ActionCodeURL as ad, parseActionCodeURL as ae, updateProfile as af, updateEmail as ag, updatePassword as ah, getIdToken as ai, getIdTokenResult as aj, unlink as ak, getAdditionalUserInfo as al, reload as am, getMultiFactorResolver as an, multiFactor as ao, _getInstance as ap, _assert as aq, _signInWithCredential as ar, _reauthenticate as as, _link as at, signInWithIdp as au, _fail as av, debugAssert as aw, _persistenceKeyName as ax, _castAuth as ay, FederatedAuthProvider as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, getAuth as n, ProviderId as o, setPersistence as p, onIdTokenChanged as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, beforeAuthStateChanged as t, updatePhoneNumber as u, onAuthStateChanged as v, useDeviceLanguage as w, updateCurrentUser as x, signOut as y, deleteUser as z };
-//# sourceMappingURL=index-1f9492de.js.map
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function finalizeSignInTotpMfa(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaSignIn:finalize" /* Endpoint.FINALIZE_MFA_SIGN_IN */, _addTidIfNecessary(auth, request));
+}
+
+class MultiFactorAssertionImpl {
+    constructor(factorId) {
+        this.factorId = factorId;
+    }
+    _process(auth, session, displayName) {
+        switch (session.type) {
+            case "enroll" /* MultiFactorSessionType.ENROLL */:
+                return this._finalizeEnroll(auth, session.credential, displayName);
+            case "signin" /* MultiFactorSessionType.SIGN_IN */:
+                return this._finalizeSignIn(auth, session.credential);
+            default:
+                return debugFail('unexpected MultiFactorSessionType');
+        }
+    }
+}
+
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * @public
+ */
+class TotpMultiFactorGenerator {
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of
+     * the TOTP (time-based one-time password) second factor.
+     * This assertion is used to complete enrollment in TOTP second factor.
+     *
+     * @param secret A {@link TotpSecret} containing the shared secret key and other TOTP parameters.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorUser.enroll}.
+     */
+    static assertionForEnrollment(secret, oneTimePassword) {
+        return TotpMultiFactorAssertionImpl._fromSecret(secret, oneTimePassword);
+    }
+    /**
+     * Provides a {@link TotpMultiFactorAssertion} to confirm ownership of the TOTP second factor.
+     * This assertion is used to complete signIn with TOTP as the second factor.
+     *
+     * @param enrollmentId identifies the enrolled TOTP second factor.
+     * @param oneTimePassword One-time password from TOTP App.
+     * @returns A {@link TotpMultiFactorAssertion} which can be used with
+     * {@link MultiFactorResolver.resolveSignIn}.
+     */
+    static assertionForSignIn(enrollmentId, oneTimePassword) {
+        return TotpMultiFactorAssertionImpl._fromEnrollmentId(enrollmentId, oneTimePassword);
+    }
+    /**
+     * Returns a promise to {@link TotpSecret} which contains the TOTP shared secret key and other parameters.
+     * Creates a TOTP secret as part of enrolling a TOTP second factor.
+     * Used for generating a QR code URL or inputting into a TOTP app.
+     * This method uses the auth instance corresponding to the user in the multiFactorSession.
+     *
+     * @param session The {@link MultiFactorSession} that the user is part of.
+     * @returns A promise to {@link TotpSecret}.
+     */
+    static async generateSecret(session) {
+        const mfaSession = session;
+        _assert(typeof mfaSession.auth !== 'undefined', "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+        const response = await startEnrollTotpMfa(mfaSession.auth, {
+            idToken: mfaSession.credential,
+            totpEnrollmentInfo: {}
+        });
+        return TotpSecret._fromStartTotpMfaEnrollmentResponse(response, mfaSession.auth);
+    }
+}
+/**
+ * The identifier of the TOTP second factor: `totp`.
+ */
+TotpMultiFactorGenerator.FACTOR_ID = "totp" /* FactorId.TOTP */;
+class TotpMultiFactorAssertionImpl extends MultiFactorAssertionImpl {
+    constructor(otp, enrollmentId, secret) {
+        super("totp" /* FactorId.TOTP */);
+        this.otp = otp;
+        this.enrollmentId = enrollmentId;
+        this.secret = secret;
+    }
+    /** @internal */
+    static _fromSecret(secret, otp) {
+        return new TotpMultiFactorAssertionImpl(otp, undefined, secret);
+    }
+    /** @internal */
+    static _fromEnrollmentId(enrollmentId, otp) {
+        return new TotpMultiFactorAssertionImpl(otp, enrollmentId);
+    }
+    /** @internal */
+    async _finalizeEnroll(auth, idToken, displayName) {
+        _assert(typeof this.secret !== 'undefined', auth, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+        return finalizeEnrollTotpMfa(auth, {
+            idToken,
+            displayName,
+            totpVerificationInfo: this.secret._makeTotpVerificationInfo(this.otp)
+        });
+    }
+    /** @internal */
+    async _finalizeSignIn(auth, mfaPendingCredential) {
+        _assert(this.enrollmentId !== undefined && this.otp !== undefined, auth, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+        const totpVerificationInfo = { verificationCode: this.otp };
+        return finalizeSignInTotpMfa(auth, {
+            mfaPendingCredential,
+            mfaEnrollmentId: this.enrollmentId,
+            totpVerificationInfo
+        });
+    }
+}
+/**
+ * Provider for generating a {@link TotpMultiFactorAssertion}.
+ *
+ * Stores the shared secret key and other parameters to generate time-based OTPs.
+ * Implements methods to retrieve the shared secret key and generate a QR code URL.
+ * @public
+ */
+class TotpSecret {
+    // The public members are declared outside the constructor so the docs can be generated.
+    constructor(secretKey, hashingAlgorithm, codeLength, codeIntervalSeconds, enrollmentCompletionDeadline, sessionInfo, auth) {
+        this.sessionInfo = sessionInfo;
+        this.auth = auth;
+        this.secretKey = secretKey;
+        this.hashingAlgorithm = hashingAlgorithm;
+        this.codeLength = codeLength;
+        this.codeIntervalSeconds = codeIntervalSeconds;
+        this.enrollmentCompletionDeadline = enrollmentCompletionDeadline;
+    }
+    /** @internal */
+    static _fromStartTotpMfaEnrollmentResponse(response, auth) {
+        return new TotpSecret(response.totpSessionInfo.sharedSecretKey, response.totpSessionInfo.hashingAlgorithm, response.totpSessionInfo.verificationCodeLength, response.totpSessionInfo.periodSec, new Date(response.totpSessionInfo.finalizeEnrollmentTime).toUTCString(), response.totpSessionInfo.sessionInfo, auth);
+    }
+    /** @internal */
+    _makeTotpVerificationInfo(otp) {
+        return { sessionInfo: this.sessionInfo, verificationCode: otp };
+    }
+    /**
+     * Returns a QR code URL as described in
+     * https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+     * This can be displayed to the user as a QR code to be scanned into a TOTP app like Google Authenticator.
+     * If the optional parameters are unspecified, an accountName of <userEmail> and issuer of <firebaseAppName> are used.
+     *
+     * @param accountName the name of the account/app along with a user identifier.
+     * @param issuer issuer of the TOTP (likely the app name).
+     * @returns A QR code URL string.
+     */
+    generateQrCodeUrl(accountName, issuer) {
+        var _a;
+        let useDefaults = false;
+        if (_isEmptyString(accountName) || _isEmptyString(issuer)) {
+            useDefaults = true;
+        }
+        if (useDefaults) {
+            if (_isEmptyString(accountName)) {
+                accountName = ((_a = this.auth.currentUser) === null || _a === void 0 ? void 0 : _a.email) || 'unknownuser';
+            }
+            if (_isEmptyString(issuer)) {
+                issuer = this.auth.name;
+            }
+        }
+        return `otpauth://totp/${issuer}:${accountName}?secret=${this.secretKey}&issuer=${issuer}&algorithm=${this.hashingAlgorithm}&digits=${this.codeLength}`;
+    }
+}
+/** @internal */
+function _isEmptyString(input) {
+    return typeof input === 'undefined' || (input === null || input === void 0 ? void 0 : input.length) === 0;
+}
+
+export { linkWithCredential as $, ActionCodeOperation as A, deleteUser as B, debugErrorMap as C, prodErrorMap as D, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as E, FactorId as F, initializeAuth as G, connectAuthEmulator as H, AuthCredential as I, EmailAuthCredential as J, OAuthCredential as K, PhoneAuthCredential as L, inMemoryPersistence as M, EmailAuthProvider as N, OperationType as O, PhoneAuthProvider as P, FacebookAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, GoogleAuthProvider as U, GithubAuthProvider as V, OAuthProvider as W, SAMLAuthProvider as X, TwitterAuthProvider as Y, signInAnonymously as Z, signInWithCredential as _, browserSessionPersistence as a, reauthenticateWithCredential as a0, signInWithCustomToken as a1, sendPasswordResetEmail as a2, confirmPasswordReset as a3, applyActionCode as a4, checkActionCode as a5, verifyPasswordResetCode as a6, createUserWithEmailAndPassword as a7, signInWithEmailAndPassword as a8, sendSignInLinkToEmail as a9, _castAuth as aA, FederatedAuthProvider as aB, BaseOAuthProvider as aC, _emulatorUrl as aD, _performApiRequest as aE, _isIOS as aF, _isAndroid as aG, _isIOS7Or8 as aH, _createError as aI, _isIframe as aJ, _isMobileBrowser as aK, _isIE10 as aL, _isSafari as aM, UserImpl as aN, AuthImpl as aO, _getClientVersion as aP, FetchProvider as aQ, SAMLAuthCredential as aR, isSignInWithEmailLink as aa, signInWithEmailLink as ab, fetchSignInMethodsForEmail as ac, sendEmailVerification as ad, verifyBeforeUpdateEmail as ae, ActionCodeURL as af, parseActionCodeURL as ag, updateProfile as ah, updateEmail as ai, updatePassword as aj, getIdToken as ak, getIdTokenResult as al, unlink as am, getAdditionalUserInfo as an, reload as ao, getMultiFactorResolver as ap, multiFactor as aq, _getInstance as ar, _assert as as, _signInWithCredential as at, _reauthenticate as au, _link as av, signInWithIdp as aw, _fail as ax, debugAssert as ay, _persistenceKeyName as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, onIdTokenChanged as t, updatePhoneNumber as u, beforeAuthStateChanged as v, onAuthStateChanged as w, useDeviceLanguage as x, updateCurrentUser as y, signOut as z };
+//# sourceMappingURL=totp-a3bfc07a.js.map