@firebase/auth 0.21.6 → 0.22.0-canary.1d6771eb3

package/dist/esm5/{index-44fc929c.js → index-169fb84f.js}

@@ -1,5 +1,5 @@
 import { __spreadArray, __assign, __awaiter, __generator, __rest, __extends } from 'tslib';
-import { ErrorFactory, deepEqual, isBrowserExtension, isMobileCordova, isReactNative, FirebaseError, querystring, getModularInstance, base64Decode, isIE, getUA, createSubscribe, querystringDecode, extractQuerystring, isEmpty, getExperimentalSetting, getDefaultEmulatorHost } from '@firebase/util';
+import { ErrorFactory, isBrowserExtension, isMobileCordova, isReactNative, FirebaseError, querystring, getModularInstance, base64Decode, isIE, getUA, createSubscribe, deepEqual, querystringDecode, extractQuerystring, isEmpty, getExperimentalSetting, getDefaultEmulatorHost } from '@firebase/util';
 import { SDK_VERSION, _getProvider, _registerComponent, registerVersion, getApp } from '@firebase/app';
 import { Logger, LogLevel } from '@firebase/logger';
 import { Component } from '@firebase/component';
@@ -213,6 +213,7 @@ function _debugErrorMap() {
         _a["missing-or-invalid-nonce" /* AuthErrorCode.MISSING_OR_INVALID_NONCE */] = 'The request does not contain a valid nonce. This can occur if the ' +
             'SHA-256 hash of the provided raw nonce does not match the hashed nonce ' +
             'in the ID token payload.',
+        _a["missing-password" /* AuthErrorCode.MISSING_PASSWORD */] = 'A non-empty password must be provided',
         _a["missing-multi-factor-info" /* AuthErrorCode.MISSING_MFA_INFO */] = 'No second factor identifier is provided.',
         _a["missing-multi-factor-session" /* AuthErrorCode.MISSING_MFA_SESSION */] = 'The request is missing proof of first factor successful sign-in.',
         _a["missing-phone-number" /* AuthErrorCode.MISSING_PHONE_NUMBER */] = 'To send verification codes, provide a phone number for the recipient.',
@@ -266,6 +267,14 @@ function _debugErrorMap() {
             'different options. To avoid this error, call initializeAuth() with the ' +
             'same options as when it was originally called, or call getAuth() to return the' +
             ' already initialized instance.',
+        _a["missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */] = 'The reCAPTCHA token is missing when sending request to the backend.',
+        _a["invalid-recaptcha-token" /* AuthErrorCode.INVALID_RECAPTCHA_TOKEN */] = 'The reCAPTCHA token is invalid when sending request to the backend.',
+        _a["invalid-recaptcha-action" /* AuthErrorCode.INVALID_RECAPTCHA_ACTION */] = 'The reCAPTCHA action is invalid when sending request to the backend.',
+        _a["recaptcha-not-enabled" /* AuthErrorCode.RECAPTCHA_NOT_ENABLED */] = 'reCAPTCHA Enterprise integration is not enabled for this project.',
+        _a["missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */] = 'The reCAPTCHA client type is missing when sending request to the backend.',
+        _a["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is missing when sending request to the backend.',
+        _a["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */] = 'Invalid request parameters.',
+        _a["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is invalid when sending request to the backend.',
         _a;
 }
 function _prodErrorMap() {
@@ -402,7 +411,15 @@ var AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
     USER_SIGNED_OUT: 'auth/user-signed-out',
     WEAK_PASSWORD: 'auth/weak-password',
     WEB_STORAGE_UNSUPPORTED: 'auth/web-storage-unsupported',
-    ALREADY_INITIALIZED: 'auth/already-initialized'
+    ALREADY_INITIALIZED: 'auth/already-initialized',
+    RECAPTCHA_NOT_ENABLED: 'auth/recaptcha-not-enabled',
+    MISSING_RECAPTCHA_TOKEN: 'auth/missing-recaptcha-token',
+    INVALID_RECAPTCHA_TOKEN: 'auth/invalid-recaptcha-token',
+    INVALID_RECAPTCHA_ACTION: 'auth/invalid-recaptcha-action',
+    MISSING_CLIENT_TYPE: 'auth/missing-client-type',
+    MISSING_RECAPTCHA_VERSION: 'auth/missing-recaptcha-version',
+    INVALID_RECAPTCHA_VERSION: 'auth/invalid-recaptcha-version',
+    INVALID_REQ_TYPE: 'auth/invalid-req-type'
 };
 
 /**
@@ -422,6 +439,15 @@ var AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
  * limitations under the License.
  */
 var logClient = new Logger('@firebase/auth');
+function _logWarn(msg) {
+    var args = [];
+    for (var _i = 1; _i < arguments.length; _i++) {
+        args[_i - 1] = arguments[_i];
+    }
+    if (logClient.logLevel <= LogLevel.WARN) {
+        logClient.warn.apply(logClient, __spreadArray(["Auth (".concat(SDK_VERSION, "): ").concat(msg)], args, false));
+    }
+}
 function _logError(msg) {
     var args = [];
     for (var _i = 1; _i < arguments.length; _i++) {
@@ -534,103 +560,6 @@ function debugAssert(assertion, message) {
     }
 }
 
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-var instanceCache = new Map();
-function _getInstance(cls) {
-    debugAssert(cls instanceof Function, 'Expected a class definition');
-    var instance = instanceCache.get(cls);
-    if (instance) {
-        debugAssert(instance instanceof cls, 'Instance stored in cache mismatched with class');
-        return instance;
-    }
-    instance = new cls();
-    instanceCache.set(cls, instance);
-    return instance;
-}
-
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * Initializes an {@link Auth} instance with fine-grained control over
- * {@link Dependencies}.
- *
- * @remarks
- *
- * This function allows more control over the {@link Auth} instance than
- * {@link getAuth}. `getAuth` uses platform-specific defaults to supply
- * the {@link Dependencies}. In general, `getAuth` is the easiest way to
- * initialize Auth and works for most use cases. Use `initializeAuth` if you
- * need control over which persistence layer is used, or to minimize bundle
- * size if you're not using either `signInWithPopup` or `signInWithRedirect`.
- *
- * For example, if your app only uses anonymous accounts and you only want
- * accounts saved for the current session, initialize `Auth` with:
- *
- * ```js
- * const auth = initializeAuth(app, {
- *   persistence: browserSessionPersistence,
- *   popupRedirectResolver: undefined,
- * });
- * ```
- *
- * @public
- */
-function initializeAuth(app, deps) {
-    var provider = _getProvider(app, 'auth');
-    if (provider.isInitialized()) {
-        var auth_1 = provider.getImmediate();
-        var initialOptions = provider.getOptions();
-        if (deepEqual(initialOptions, deps !== null && deps !== void 0 ? deps : {})) {
-            return auth_1;
-        }
-        else {
-            _fail(auth_1, "already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */);
-        }
-    }
-    var auth = provider.initialize({ options: deps });
-    return auth;
-}
-function _initializeAuthInstance(auth, deps) {
-    var persistence = (deps === null || deps === void 0 ? void 0 : deps.persistence) || [];
-    var hierarchy = (Array.isArray(persistence) ? persistence : [persistence]).map(_getInstance);
-    if (deps === null || deps === void 0 ? void 0 : deps.errorMap) {
-        auth._updateErrorMap(deps.errorMap);
-    }
-    // This promise is intended to float; auth initialization happens in the
-    // background, meanwhile the auth object may be used by the app.
-    // eslint-disable-next-line @typescript-eslint/no-floating-promises
-    auth._initializeWithPersistence(hierarchy, deps === null || deps === void 0 ? void 0 : deps.popupRedirectResolver);
-}
-
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -867,7 +796,7 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     // Sign in with email and password errors (some apply to sign up too).
     _a$1["INVALID_PASSWORD" /* ServerError.INVALID_PASSWORD */] = "wrong-password" /* AuthErrorCode.INVALID_PASSWORD */,
     // This can only happen if the SDK sends a bad request.
-    _a$1["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */] = "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
+    _a$1["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */] = "missing-password" /* AuthErrorCode.MISSING_PASSWORD */,
     // Sign up with email and password errors.
     _a$1["EMAIL_EXISTS" /* ServerError.EMAIL_EXISTS */] = "email-already-in-use" /* AuthErrorCode.EMAIL_EXISTS */,
     _a$1["PASSWORD_LOGIN_DISABLED" /* ServerError.PASSWORD_LOGIN_DISABLED */] = "operation-not-allowed" /* AuthErrorCode.OPERATION_NOT_ALLOWED */,
@@ -915,6 +844,15 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     _a$1["SECOND_FACTOR_LIMIT_EXCEEDED" /* ServerError.SECOND_FACTOR_LIMIT_EXCEEDED */] = "maximum-second-factor-count-exceeded" /* AuthErrorCode.SECOND_FACTOR_LIMIT_EXCEEDED */,
     // Blocking functions related errors.
     _a$1["BLOCKING_FUNCTION_ERROR_RESPONSE" /* ServerError.BLOCKING_FUNCTION_ERROR_RESPONSE */] = "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
+    // Recaptcha related errors.
+    _a$1["RECAPTCHA_NOT_ENABLED" /* ServerError.RECAPTCHA_NOT_ENABLED */] = "recaptcha-not-enabled" /* AuthErrorCode.RECAPTCHA_NOT_ENABLED */,
+    _a$1["MISSING_RECAPTCHA_TOKEN" /* ServerError.MISSING_RECAPTCHA_TOKEN */] = "missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */,
+    _a$1["INVALID_RECAPTCHA_TOKEN" /* ServerError.INVALID_RECAPTCHA_TOKEN */] = "invalid-recaptcha-token" /* AuthErrorCode.INVALID_RECAPTCHA_TOKEN */,
+    _a$1["INVALID_RECAPTCHA_ACTION" /* ServerError.INVALID_RECAPTCHA_ACTION */] = "invalid-recaptcha-action" /* AuthErrorCode.INVALID_RECAPTCHA_ACTION */,
+    _a$1["MISSING_CLIENT_TYPE" /* ServerError.MISSING_CLIENT_TYPE */] = "missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */,
+    _a$1["MISSING_RECAPTCHA_VERSION" /* ServerError.MISSING_RECAPTCHA_VERSION */] = "missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */,
+    _a$1["INVALID_RECAPTCHA_VERSION" /* ServerError.INVALID_RECAPTCHA_VERSION */] = "invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */,
+    _a$1["INVALID_REQ_TYPE" /* ServerError.INVALID_REQ_TYPE */] = "invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */,
     _a$1);
 
 /**
@@ -2036,6 +1974,35 @@ var UserImpl = /** @class */ (function () {
     return UserImpl;
 }());
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var instanceCache = new Map();
+function _getInstance(cls) {
+    debugAssert(cls instanceof Function, 'Expected a class definition');
+    var instance = instanceCache.get(cls);
+    if (instance) {
+        debugAssert(instance instanceof cls, 'Instance stored in cache mismatched with class');
+        return instance;
+    }
+    instance = new cls();
+    instanceCache.set(cls, instance);
+    return instance;
+}
+
 /**
  * @license
  * Copyright 2019 Google LLC
@@ -2474,6 +2441,288 @@ function _getClientVersion(clientPlatform, frameworks) {
     return "".concat(reportedPlatform, "/").concat("JsCore" /* ClientImplementation.CORE */, "/").concat(SDK_VERSION, "/").concat(reportedFrameworks);
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getRecaptchaParams(auth) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)];
+                case 1: return [2 /*return*/, ((_a.sent()).recaptchaSiteKey || '')];
+            }
+        });
+    });
+}
+function getRecaptchaConfig(auth, request) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+        });
+    });
+}
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isV2(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.getResponse !== undefined);
+}
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+var RecaptchaConfig = /** @class */ (function () {
+    function RecaptchaConfig(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
+            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+                enforcementState.enforcementState !== 'OFF';
+        });
+    }
+    return RecaptchaConfig;
+}());
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise(function (resolve, reject) {
+        var el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = function (e) {
+            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+function _generateCallbackName(prefix) {
+    return "__".concat(prefix).concat(Math.floor(Math.random() * 1000000));
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+var RecaptchaEnterpriseVerifier = /** @class */ (function () {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    function RecaptchaEnterpriseVerifier(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
+        if (action === void 0) { action = 'verify'; }
+        if (forceRefresh === void 0) { forceRefresh = false; }
+        return __awaiter(this, void 0, void 0, function () {
+            function retrieveSiteKey(auth) {
+                return __awaiter(this, void 0, void 0, function () {
+                    var _this = this;
+                    return __generator(this, function (_a) {
+                        if (!forceRefresh) {
+                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
+                            }
+                            if (auth.tenantId != null &&
+                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
+                            }
+                        }
+                        return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    getRecaptchaConfig(auth, {
+                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                                    })
+                                        .then(function (response) {
+                                        if (response.recaptchaKey === undefined) {
+                                            reject(new Error('recaptcha Enterprise site key undefined'));
+                                        }
+                                        else {
+                                            var config = new RecaptchaConfig(response);
+                                            if (auth.tenantId == null) {
+                                                auth._agentRecaptchaConfig = config;
+                                            }
+                                            else {
+                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                                            }
+                                            return resolve(config.siteKey);
+                                        }
+                                    })
+                                        .catch(function (error) {
+                                        reject(error);
+                                    });
+                                    return [2 /*return*/];
+                                });
+                            }); })];
+                    });
+                });
+            }
+            function retrieveRecaptchaToken(siteKey, resolve, reject) {
+                var grecaptcha = window.grecaptcha;
+                if (isEnterprise(grecaptcha)) {
+                    grecaptcha.enterprise.ready(function () {
+                        try {
+                            grecaptcha.enterprise
+                                .execute(siteKey, { action: action })
+                                .then(function (token) {
+                                resolve(token);
+                            })
+                                .catch(function (error) {
+                                reject(error);
+                            });
+                        }
+                        catch (error) {
+                            reject(error);
+                        }
+                    });
+                }
+                else {
+                    reject(Error('No reCAPTCHA enterprise script loaded.'));
+                }
+            }
+            var _this = this;
+            return __generator(this, function (_a) {
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        retrieveSiteKey(_this.auth)
+                            .then(function (siteKey) {
+                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                                retrieveRecaptchaToken(siteKey, resolve, reject);
+                            }
+                            else {
+                                if (typeof window === 'undefined') {
+                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
+                                    return;
+                                }
+                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                                    .then(function () {
+                                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                                })
+                                    .catch(function (error) {
+                                    reject(error);
+                                });
+                            }
+                        })
+                            .catch(function (error) {
+                            reject(error);
+                        });
+                    })];
+            });
+        });
+    };
+    return RecaptchaEnterpriseVerifier;
+}());
+function injectRecaptchaFields(auth, request, action, captchaResp) {
+    if (captchaResp === void 0) { captchaResp = false; }
+    return __awaiter(this, void 0, void 0, function () {
+        var verifier, captchaResponse, newRequest;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    verifier = new RecaptchaEnterpriseVerifier(auth);
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 5]);
+                    return [4 /*yield*/, verifier.verify(action)];
+                case 2:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, verifier.verify(action, true)];
+                case 4:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 5:
+                    newRequest = __assign({}, request);
+                    if (!captchaResp) {
+                        Object.assign(newRequest, { captchaResponse: captchaResponse });
+                    }
+                    else {
+                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+                    }
+                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+                    Object.assign(newRequest, {
+                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                    });
+                    return [2 /*return*/, newRequest];
+            }
+        });
+    });
+}
+
 /**
  * @license
  * Copyright 2022 Google LLC
@@ -2595,9 +2844,10 @@ var AuthMiddlewareQueue = /** @class */ (function () {
  * limitations under the License.
  */
 var AuthImpl = /** @class */ (function () {
-    function AuthImpl(app, heartbeatServiceProvider, config) {
+    function AuthImpl(app, heartbeatServiceProvider, appCheckServiceProvider, config) {
         this.app = app;
         this.heartbeatServiceProvider = heartbeatServiceProvider;
+        this.appCheckServiceProvider = appCheckServiceProvider;
         this.config = config;
         this.currentUser = null;
         this.emulatorConfig = null;
@@ -2615,6 +2865,8 @@ var AuthImpl = /** @class */ (function () {
         this._initializationPromise = null;
         this._popupRedirectResolver = null;
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
+        this._agentRecaptchaConfig = null;
+        this._tenantRecaptchaConfigs = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -2944,6 +3196,41 @@ var AuthImpl = /** @class */ (function () {
             });
         }); });
     };
+    AuthImpl.prototype.initializeRecaptchaConfig = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var response, config, verifier;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, getRecaptchaConfig(this, {
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                        })];
+                    case 1:
+                        response = _a.sent();
+                        config = new RecaptchaConfig(response);
+                        if (this.tenantId == null) {
+                            this._agentRecaptchaConfig = config;
+                        }
+                        else {
+                            this._tenantRecaptchaConfigs[this.tenantId] = config;
+                        }
+                        if (config.emailPasswordEnabled) {
+                            verifier = new RecaptchaEnterpriseVerifier(this);
+                            void verifier.verify();
+                        }
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    AuthImpl.prototype._getRecaptchaConfig = function () {
+        if (this.tenantId == null) {
+            return this._agentRecaptchaConfig;
+        }
+        else {
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    };
     AuthImpl.prototype._getPersistence = function () {
         return this.assertedPersistence.persistence.type;
     };
@@ -3171,7 +3458,7 @@ var AuthImpl = /** @class */ (function () {
     AuthImpl.prototype._getAdditionalHeaders = function () {
         var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var headers, heartbeatsHeader;
+            var headers, heartbeatsHeader, appCheckToken;
             var _b;
             return __generator(this, function (_c) {
                 switch (_c.label) {
@@ -3191,11 +3478,39 @@ var AuthImpl = /** @class */ (function () {
                         if (heartbeatsHeader) {
                             headers["X-Firebase-Client" /* HttpHeader.X_FIREBASE_CLIENT */] = heartbeatsHeader;
                         }
+                        return [4 /*yield*/, this._getAppCheckToken()];
+                    case 2:
+                        appCheckToken = _c.sent();
+                        if (appCheckToken) {
+                            headers["X-Firebase-AppCheck" /* HttpHeader.X_FIREBASE_APP_CHECK */] = appCheckToken;
+                        }
                         return [2 /*return*/, headers];
                 }
             });
         });
     };
+    AuthImpl.prototype._getAppCheckToken = function () {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var appCheckTokenResult;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, ((_a = this.appCheckServiceProvider
+                            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken())];
+                    case 1:
+                        appCheckTokenResult = _b.sent();
+                        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
+                            // Context: appCheck.getToken() will never throw even if an error happened.
+                            // In the error case, a dummy token will be returned along with an error field describing
+                            // the error. In general, we shouldn't care about the error condition and just use
+                            // the token (actual or dummy) to send requests.
+                            _logWarn("Error while retrieving App Check token: ".concat(appCheckTokenResult.error));
+                        }
+                        return [2 /*return*/, appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token];
+                }
+            });
+        });
+    };
     return AuthImpl;
 }());
 /**
@@ -3226,6 +3541,74 @@ var Subscription = /** @class */ (function () {
     return Subscription;
 }());
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Initializes an {@link Auth} instance with fine-grained control over
+ * {@link Dependencies}.
+ *
+ * @remarks
+ *
+ * This function allows more control over the {@link Auth} instance than
+ * {@link getAuth}. `getAuth` uses platform-specific defaults to supply
+ * the {@link Dependencies}. In general, `getAuth` is the easiest way to
+ * initialize Auth and works for most use cases. Use `initializeAuth` if you
+ * need control over which persistence layer is used, or to minimize bundle
+ * size if you're not using either `signInWithPopup` or `signInWithRedirect`.
+ *
+ * For example, if your app only uses anonymous accounts and you only want
+ * accounts saved for the current session, initialize `Auth` with:
+ *
+ * ```js
+ * const auth = initializeAuth(app, {
+ *   persistence: browserSessionPersistence,
+ *   popupRedirectResolver: undefined,
+ * });
+ * ```
+ *
+ * @public
+ */
+function initializeAuth(app, deps) {
+    var provider = _getProvider(app, 'auth');
+    if (provider.isInitialized()) {
+        var auth_1 = provider.getImmediate();
+        var initialOptions = provider.getOptions();
+        if (deepEqual(initialOptions, deps !== null && deps !== void 0 ? deps : {})) {
+            return auth_1;
+        }
+        else {
+            _fail(auth_1, "already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */);
+        }
+    }
+    var auth = provider.initialize({ options: deps });
+    return auth;
+}
+function _initializeAuthInstance(auth, deps) {
+    var persistence = (deps === null || deps === void 0 ? void 0 : deps.persistence) || [];
+    var hierarchy = (Array.isArray(persistence) ? persistence : [persistence]).map(_getInstance);
+    if (deps === null || deps === void 0 ? void 0 : deps.errorMap) {
+        auth._updateErrorMap(deps.errorMap);
+    }
+    // This promise is intended to float; auth initialization happens in the
+    // background, meanwhile the auth object may be used by the app.
+    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+    auth._initializeWithPersistence(hierarchy, deps === null || deps === void 0 ? void 0 : deps.popupRedirectResolver);
+}
+
 /**
  * Changes the {@link Auth} instance to communicate with the Firebase Auth Emulator, instead of production
  * Firebase Auth services.
@@ -3614,24 +3997,55 @@ var EmailAuthCredential = /** @class */ (function (_super) {
     };
     /** @internal */
     EmailAuthCredential.prototype._getIdTokenResponse = function (auth) {
+        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                switch (this.signInMethod) {
-                    case "password" /* SignInMethod.EMAIL_PASSWORD */:
-                        return [2 /*return*/, signInWithPassword(auth, {
-                                returnSecureToken: true,
-                                email: this._email,
-                                password: this._password
-                            })];
-                    case "emailLink" /* SignInMethod.EMAIL_LINK */:
-                        return [2 /*return*/, signInWithEmailLink$1(auth, {
-                                email: this._email,
-                                oobCode: this._password
-                            })];
-                    default:
+            var _b, request_1, requestWithRecaptcha;
+            var _this = this;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        _b = this.signInMethod;
+                        switch (_b) {
+                            case "password" /* SignInMethod.EMAIL_PASSWORD */: return [3 /*break*/, 1];
+                            case "emailLink" /* SignInMethod.EMAIL_LINK */: return [3 /*break*/, 4];
+                        }
+                        return [3 /*break*/, 5];
+                    case 1:
+                        request_1 = {
+                            returnSecureToken: true,
+                            email: this._email,
+                            password: this._password,
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+                        };
+                        if (!((_a = auth._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 3];
+                        return [4 /*yield*/, injectRecaptchaFields(auth, request_1, "signInWithPassword" /* RecaptchaActionName.SIGN_IN_WITH_PASSWORD */)];
+                    case 2:
+                        requestWithRecaptcha = _c.sent();
+                        return [2 /*return*/, signInWithPassword(auth, requestWithRecaptcha)];
+                    case 3: return [2 /*return*/, signInWithPassword(auth, request_1).catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                            var requestWithRecaptcha;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 2];
+                                        console.log('Sign-in with email address and password is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-in flow.');
+                                        return [4 /*yield*/, injectRecaptchaFields(auth, request_1, "signInWithPassword" /* RecaptchaActionName.SIGN_IN_WITH_PASSWORD */)];
+                                    case 1:
+                                        requestWithRecaptcha = _a.sent();
+                                        return [2 /*return*/, signInWithPassword(auth, requestWithRecaptcha)];
+                                    case 2: return [2 /*return*/, Promise.reject(error)];
+                                }
+                            });
+                        }); })];
+                    case 4: return [2 /*return*/, signInWithEmailLink$1(auth, {
+                            email: this._email,
+                            oobCode: this._password
+                        })];
+                    case 5:
                         _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+                        _c.label = 6;
+                    case 6: return [2 /*return*/];
                 }
-                return [2 /*return*/];
             });
         });
     };
@@ -5818,23 +6232,61 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * @public
  */
 function sendPasswordResetEmail(auth, email, actionCodeSettings) {
+    var _a;
     return __awaiter(this, void 0, void 0, function () {
-        var authModular, request;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
+        var authInternal, request, requestWithRecaptcha;
+        var _this = this;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
-                    authModular = getModularInstance(auth);
+                    authInternal = _castAuth(auth);
                     request = {
                         requestType: "PASSWORD_RESET" /* ActionCodeOperation.PASSWORD_RESET */,
-                        email: email
+                        email: email,
+                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
                     };
+                    if (!((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 3];
+                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
+                case 1:
+                    requestWithRecaptcha = _b.sent();
                     if (actionCodeSettings) {
-                        _setActionCodeSettingsOnRequest(authModular, request, actionCodeSettings);
+                        _setActionCodeSettingsOnRequest(authInternal, requestWithRecaptcha, actionCodeSettings);
                     }
-                    return [4 /*yield*/, sendPasswordResetEmail$1(authModular, request)];
-                case 1:
-                    _a.sent();
-                    return [2 /*return*/];
+                    return [4 /*yield*/, sendPasswordResetEmail$1(authInternal, requestWithRecaptcha)];
+                case 2:
+                    _b.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    if (actionCodeSettings) {
+                        _setActionCodeSettingsOnRequest(authInternal, request, actionCodeSettings);
+                    }
+                    return [4 /*yield*/, sendPasswordResetEmail$1(authInternal, request)
+                            .catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                            var requestWithRecaptcha;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 3];
+                                        console.log('Password resets are protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the password reset flow.');
+                                        return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
+                                    case 1:
+                                        requestWithRecaptcha = _a.sent();
+                                        if (actionCodeSettings) {
+                                            _setActionCodeSettingsOnRequest(authInternal, requestWithRecaptcha, actionCodeSettings);
+                                        }
+                                        return [4 /*yield*/, sendPasswordResetEmail$1(authInternal, requestWithRecaptcha)];
+                                    case 2:
+                                        _a.sent();
+                                        return [3 /*break*/, 4];
+                                    case 3: return [2 /*return*/, Promise.reject(error)];
+                                    case 4: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 4:
+                    _b.sent();
+                    _b.label = 5;
+                case 5: return [2 /*return*/];
             }
         });
     });
@@ -5979,25 +6431,54 @@ function verifyPasswordResetCode(auth, code) {
  * @public
  */
 function createUserWithEmailAndPassword(auth, email, password) {
+    var _a;
     return __awaiter(this, void 0, void 0, function () {
-        var authInternal, response, userCredential;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
+        var authInternal, request, signUpResponse, requestWithRecaptcha, response, userCredential;
+        var _this = this;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
                     authInternal = _castAuth(auth);
-                    return [4 /*yield*/, signUp(authInternal, {
-                            returnSecureToken: true,
-                            email: email,
-                            password: password
-                        })];
+                    request = {
+                        returnSecureToken: true,
+                        email: email,
+                        password: password,
+                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+                    };
+                    if (!((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 2];
+                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */)];
                 case 1:
-                    response = _a.sent();
-                    return [4 /*yield*/, UserCredentialImpl._fromIdTokenResponse(authInternal, "signIn" /* OperationType.SIGN_IN */, response)];
+                    requestWithRecaptcha = _b.sent();
+                    signUpResponse = signUp(authInternal, requestWithRecaptcha);
+                    return [3 /*break*/, 3];
                 case 2:
-                    userCredential = _a.sent();
+                    signUpResponse = signUp(authInternal, request).catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                        var requestWithRecaptcha;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 2];
+                                    console.log('Sign-up is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-up flow.');
+                                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */)];
+                                case 1:
+                                    requestWithRecaptcha = _a.sent();
+                                    return [2 /*return*/, signUp(authInternal, requestWithRecaptcha)];
+                                case 2: return [2 /*return*/, Promise.reject(error)];
+                            }
+                        });
+                    }); });
+                    _b.label = 3;
+                case 3: return [4 /*yield*/, signUpResponse.catch(function (error) {
+                        return Promise.reject(error);
+                    })];
+                case 4:
+                    response = _b.sent();
+                    return [4 /*yield*/, UserCredentialImpl._fromIdTokenResponse(authInternal, "signIn" /* OperationType.SIGN_IN */, response)];
+                case 5:
+                    userCredential = _b.sent();
                     return [4 /*yield*/, authInternal._updateCurrentUser(userCredential.user)];
-                case 3:
-                    _a.sent();
+                case 6:
+                    _b.sent();
                     return [2 /*return*/, userCredential];
             }
         });
@@ -6078,24 +6559,61 @@ function signInWithEmailAndPassword(auth, email, password) {
  * @public
  */
 function sendSignInLinkToEmail(auth, email, actionCodeSettings) {
+    var _a;
     return __awaiter(this, void 0, void 0, function () {
-        var authModular, request;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
+        function setActionCodeSettings(request, actionCodeSettings) {
+            _assert(actionCodeSettings.handleCodeInApp, authInternal, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+            if (actionCodeSettings) {
+                _setActionCodeSettingsOnRequest(authInternal, request, actionCodeSettings);
+            }
+        }
+        var authInternal, request, requestWithRecaptcha;
+        var _this = this;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
-                    authModular = getModularInstance(auth);
+                    authInternal = _castAuth(auth);
                     request = {
                         requestType: "EMAIL_SIGNIN" /* ActionCodeOperation.EMAIL_SIGNIN */,
-                        email: email
+                        email: email,
+                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
                     };
-                    _assert(actionCodeSettings.handleCodeInApp, authModular, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
-                    if (actionCodeSettings) {
-                        _setActionCodeSettingsOnRequest(authModular, request, actionCodeSettings);
-                    }
-                    return [4 /*yield*/, sendSignInLinkToEmail$1(authModular, request)];
+                    if (!((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 3];
+                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
                 case 1:
-                    _a.sent();
-                    return [2 /*return*/];
+                    requestWithRecaptcha = _b.sent();
+                    setActionCodeSettings(requestWithRecaptcha, actionCodeSettings);
+                    return [4 /*yield*/, sendSignInLinkToEmail$1(authInternal, requestWithRecaptcha)];
+                case 2:
+                    _b.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    setActionCodeSettings(request, actionCodeSettings);
+                    return [4 /*yield*/, sendSignInLinkToEmail$1(authInternal, request)
+                            .catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                            var requestWithRecaptcha;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 3];
+                                        console.log('Email link sign-in is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-in flow.');
+                                        return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
+                                    case 1:
+                                        requestWithRecaptcha = _a.sent();
+                                        setActionCodeSettings(requestWithRecaptcha, actionCodeSettings);
+                                        return [4 /*yield*/, sendSignInLinkToEmail$1(authInternal, requestWithRecaptcha)];
+                                    case 2:
+                                        _a.sent();
+                                        return [3 /*break*/, 4];
+                                    case 3: return [2 /*return*/, Promise.reject(error)];
+                                    case 4: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 4:
+                    _b.sent();
+                    _b.label = 5;
+                case 5: return [2 /*return*/];
             }
         });
     });
@@ -6691,11 +7209,41 @@ function getAdditionalUserInfo(userCredential) {
 function setPersistence(auth, persistence) {
     return getModularInstance(auth).setPersistence(persistence);
 }
+/**
+ * Loads the reCAPTCHA configuration into the `Auth` instance.
+ *
+ * @remarks
+ * This will load the reCAPTCHA config, which indicates whether the reCAPTCHA
+ * verification flow should be triggered for each auth provider, into the
+ * current Auth session.
+ *
+ * If initializeRecaptchaConfig() is not invoked, the auth flow will always start
+ * without reCAPTCHA verification. If the provider is configured to require reCAPTCHA
+ * verification, the SDK will transparently load the reCAPTCHA config and restart the
+ * auth flows.
+ *
+ * Thus, by calling this optional method, you will reduce the latency of future auth flows.
+ * Loading the reCAPTCHA config early will also enhance the signal collected by reCAPTCHA.
+ *
+ * @example
+ * ```javascript
+ * initializeRecaptchaConfig(auth);
+ * ```
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @public
+ */
+function initializeRecaptchaConfig(auth) {
+    var authInternal = _castAuth(auth);
+    return authInternal.initializeRecaptchaConfig();
+}
 /**
  * Adds an observer for changes to the signed-in user's ID token.
  *
  * @remarks
  * This includes sign-in, sign-out, and token refresh events.
+ * This will not be triggered automatically upon ID token expiration. Use {@link User.getIdToken} to refresh the ID token.
  *
  * @param auth - The {@link Auth} instance.
  * @param nextOrObserver - callback triggered on change.
@@ -8376,73 +8924,6 @@ function finalizeSignInTotpMfa(auth, request) {
     return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaSignIn:finalize" /* Endpoint.FINALIZE_MFA_SIGN_IN */, _addTidIfNecessary(auth, request));
 }
 
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-function getRecaptchaParams(auth) {
-    return __awaiter(this, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)];
-                case 1: return [2 /*return*/, ((_a.sent()).recaptchaSiteKey || '')];
-            }
-        });
-    });
-}
-
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-function getScriptParentElement() {
-    var _a, _b;
-    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
-}
-function _loadJS(url) {
-    // TODO: consider adding timeout support & cancellation
-    return new Promise(function (resolve, reject) {
-        var el = document.createElement('script');
-        el.setAttribute('src', url);
-        el.onload = resolve;
-        el.onerror = function (e) {
-            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            error.customData = e;
-            reject(error);
-        };
-        el.type = 'text/javascript';
-        el.charset = 'UTF-8';
-        getScriptParentElement().appendChild(el);
-    });
-}
-function _generateCallbackName(prefix) {
-    return "__".concat(prefix).concat(Math.floor(Math.random() * 1000000));
-}
-
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -8620,7 +9101,7 @@ var ReCaptchaLoaderImpl = /** @class */ (function () {
         var _this = this;
         if (hl === void 0) { hl = ''; }
         _assert(isHostLanguageValid(hl), auth, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
-        if (this.shouldResolveImmediately(hl)) {
+        if (this.shouldResolveImmediately(hl) && isV2(_window().grecaptcha)) {
             return Promise.resolve(_window().grecaptcha);
         }
         return new Promise(function (resolve, reject) {
@@ -8631,7 +9112,7 @@ var ReCaptchaLoaderImpl = /** @class */ (function () {
                 _window().clearTimeout(networkTimeout);
                 delete _window()[_JSLOAD_CALLBACK];
                 var recaptcha = _window().grecaptcha;
-                if (!recaptcha) {
+                if (!recaptcha || !isV2(recaptcha)) {
                     reject(_createError(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */));
                     return;
                 }
@@ -9813,11 +10294,13 @@ var PopupOperation = /** @class */ (function (_super) {
             if ((_b = (_a = _this.authWindow) === null || _a === void 0 ? void 0 : _a.window) === null || _b === void 0 ? void 0 : _b.closed) {
                 // Make sure that there is sufficient time for whatever action to
                 // complete. The window could have closed but the sign in network
-                // call could still be in flight.
+                // call could still be in flight. This is specifically true for
+                // Firefox or if the opener is in an iframe, in which case the oauth
+                // helper closes the popup.
                 _this.pollId = window.setTimeout(function () {
                     _this.pollId = null;
                     _this.reject(_createError(_this.auth, "popup-closed-by-user" /* AuthErrorCode.POPUP_CLOSED_BY_USER */));
-                }, 2000 /* _Timeout.AUTH_EVENT */);
+                }, 8000 /* _Timeout.AUTH_EVENT */);
                 return;
             }
             _this.pollId = window.setTimeout(poll, _POLL_WINDOW_CLOSE_TIMEOUT.get());
@@ -10865,48 +11348,67 @@ var WIDGET_PATH = '__/auth/handler';
  * @internal
  */
 var EMULATOR_WIDGET_PATH = 'emulator/auth/handler';
+/**
+ * Fragment name for the App Check token that gets passed to the widget
+ *
+ * @internal
+ */
+var FIREBASE_APP_CHECK_FRAGMENT_ID = encodeURIComponent('fac');
 function _getRedirectUrl(auth, provider, authType, redirectUrl, eventId, additionalParams) {
-    _assert(auth.config.authDomain, auth, "auth-domain-config-required" /* AuthErrorCode.MISSING_AUTH_DOMAIN */);
-    _assert(auth.config.apiKey, auth, "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */);
-    var params = {
-        apiKey: auth.config.apiKey,
-        appName: auth.name,
-        authType: authType,
-        redirectUrl: redirectUrl,
-        v: SDK_VERSION,
-        eventId: eventId
-    };
-    if (provider instanceof FederatedAuthProvider) {
-        provider.setDefaultLanguage(auth.languageCode);
-        params.providerId = provider.providerId || '';
-        if (!isEmpty(provider.getCustomParameters())) {
-            params.customParameters = JSON.stringify(provider.getCustomParameters());
-        }
-        // TODO set additionalParams from the provider as well?
-        for (var _i = 0, _a = Object.entries(additionalParams || {}); _i < _a.length; _i++) {
-            var _b = _a[_i], key = _b[0], value = _b[1];
-            params[key] = value;
-        }
-    }
-    if (provider instanceof BaseOAuthProvider) {
-        var scopes = provider.getScopes().filter(function (scope) { return scope !== ''; });
-        if (scopes.length > 0) {
-            params.scopes = scopes.join(',');
-        }
-    }
-    if (auth.tenantId) {
-        params.tid = auth.tenantId;
-    }
-    // TODO: maybe set eid as endipointId
-    // TODO: maybe set fw as Frameworks.join(",")
-    var paramsDict = params;
-    for (var _c = 0, _d = Object.keys(paramsDict); _c < _d.length; _c++) {
-        var key = _d[_c];
-        if (paramsDict[key] === undefined) {
-            delete paramsDict[key];
-        }
-    }
-    return "".concat(getHandlerBase(auth), "?").concat(querystring(paramsDict).slice(1));
+    return __awaiter(this, void 0, void 0, function () {
+        var params, _i, _a, _b, key, value, scopes, paramsDict, _c, _d, key, appCheckToken, appCheckTokenFragment;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    _assert(auth.config.authDomain, auth, "auth-domain-config-required" /* AuthErrorCode.MISSING_AUTH_DOMAIN */);
+                    _assert(auth.config.apiKey, auth, "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */);
+                    params = {
+                        apiKey: auth.config.apiKey,
+                        appName: auth.name,
+                        authType: authType,
+                        redirectUrl: redirectUrl,
+                        v: SDK_VERSION,
+                        eventId: eventId
+                    };
+                    if (provider instanceof FederatedAuthProvider) {
+                        provider.setDefaultLanguage(auth.languageCode);
+                        params.providerId = provider.providerId || '';
+                        if (!isEmpty(provider.getCustomParameters())) {
+                            params.customParameters = JSON.stringify(provider.getCustomParameters());
+                        }
+                        // TODO set additionalParams from the provider as well?
+                        for (_i = 0, _a = Object.entries(additionalParams || {}); _i < _a.length; _i++) {
+                            _b = _a[_i], key = _b[0], value = _b[1];
+                            params[key] = value;
+                        }
+                    }
+                    if (provider instanceof BaseOAuthProvider) {
+                        scopes = provider.getScopes().filter(function (scope) { return scope !== ''; });
+                        if (scopes.length > 0) {
+                            params.scopes = scopes.join(',');
+                        }
+                    }
+                    if (auth.tenantId) {
+                        params.tid = auth.tenantId;
+                    }
+                    paramsDict = params;
+                    for (_c = 0, _d = Object.keys(paramsDict); _c < _d.length; _c++) {
+                        key = _d[_c];
+                        if (paramsDict[key] === undefined) {
+                            delete paramsDict[key];
+                        }
+                    }
+                    return [4 /*yield*/, auth._getAppCheckToken()];
+                case 1:
+                    appCheckToken = _e.sent();
+                    appCheckTokenFragment = appCheckToken
+                        ? "#".concat(FIREBASE_APP_CHECK_FRAGMENT_ID, "=").concat(encodeURIComponent(appCheckToken))
+                        : '';
+                    // Start at index 1 to skip the leading '&' in the query string
+                    return [2 /*return*/, "".concat(getHandlerBase(auth), "?").concat(querystring(paramsDict).slice(1)).concat(appCheckTokenFragment)];
+            }
+        });
+    });
 }
 function getHandlerBase(_a) {
     var config = _a.config;
@@ -10953,20 +11455,29 @@ var BrowserPopupRedirectResolver = /** @class */ (function () {
         return __awaiter(this, void 0, void 0, function () {
             var url;
             return __generator(this, function (_b) {
-                debugAssert((_a = this.eventManagers[auth._key()]) === null || _a === void 0 ? void 0 : _a.manager, '_initialize() not called before _openPopup()');
-                url = _getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId);
-                return [2 /*return*/, _open(auth, url, _generateEventId())];
+                switch (_b.label) {
+                    case 0:
+                        debugAssert((_a = this.eventManagers[auth._key()]) === null || _a === void 0 ? void 0 : _a.manager, '_initialize() not called before _openPopup()');
+                        return [4 /*yield*/, _getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId)];
+                    case 1:
+                        url = _b.sent();
+                        return [2 /*return*/, _open(auth, url, _generateEventId())];
+                }
             });
         });
     };
     BrowserPopupRedirectResolver.prototype._openRedirect = function (auth, provider, authType, eventId) {
         return __awaiter(this, void 0, void 0, function () {
+            var url;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0: return [4 /*yield*/, this._originValidation(auth)];
                     case 1:
                         _a.sent();
-                        _setWindowLocation(_getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId));
+                        return [4 /*yield*/, _getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId)];
+                    case 2:
+                        url = _a.sent();
+                        _setWindowLocation(url);
                         return [2 /*return*/, new Promise(function () { })];
                 }
             });
@@ -11301,7 +11812,7 @@ function _isEmptyString(input) {
 }
 
 var name = "@firebase/auth";
-var version = "0.21.6";
+var version = "0.22.0-canary.1d6771eb3";
 
 /**
  * @license
@@ -11421,26 +11932,25 @@ function registerAuth(clientPlatform) {
         var deps = _a.options;
         var app = container.getProvider('app').getImmediate();
         var heartbeatServiceProvider = container.getProvider('heartbeat');
+        var appCheckServiceProvider = container.getProvider('app-check-internal');
         var _b = app.options, apiKey = _b.apiKey, authDomain = _b.authDomain;
-        return (function (app, heartbeatServiceProvider) {
-            _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
-            // Auth domain is optional if IdP sign in isn't being used
-            _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
-                appName: app.name
-            });
-            var config = {
-                apiKey: apiKey,
-                authDomain: authDomain,
-                clientPlatform: clientPlatform,
-                apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
-                tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
-                apiScheme: "https" /* DefaultConfig.API_SCHEME */,
-                sdkClientVersion: _getClientVersion(clientPlatform)
-            };
-            var authInstance = new AuthImpl(app, heartbeatServiceProvider, config);
-            _initializeAuthInstance(authInstance, deps);
-            return authInstance;
-        })(app, heartbeatServiceProvider);
+        _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
+        // Auth domain is optional if IdP sign in isn't being used
+        _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
+            appName: app.name
+        });
+        var config = {
+            apiKey: apiKey,
+            authDomain: authDomain,
+            clientPlatform: clientPlatform,
+            apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
+            tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
+            apiScheme: "https" /* DefaultConfig.API_SCHEME */,
+            sdkClientVersion: _getClientVersion(clientPlatform)
+        };
+        var authInstance = new AuthImpl(app, heartbeatServiceProvider, appCheckServiceProvider, config);
+        _initializeAuthInstance(authInstance, deps);
+        return authInstance;
     }, "PUBLIC" /* ComponentType.PUBLIC */)
         /**
          * Auth can only be initialized by explicitly calling getAuth() or initializeAuth()
@@ -11558,5 +12068,5 @@ function getAuth(app) {
 }
 registerAuth("Browser" /* ClientPlatform.BROWSER */);
 
-export { linkWithCredential as $, ActionCodeOperation as A, deleteUser as B, debugErrorMap as C, prodErrorMap as D, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as E, FactorId as F, initializeAuth as G, connectAuthEmulator as H, AuthCredential as I, EmailAuthCredential as J, OAuthCredential as K, PhoneAuthCredential as L, inMemoryPersistence as M, EmailAuthProvider as N, OperationType as O, PhoneAuthProvider as P, FacebookAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, GoogleAuthProvider as U, GithubAuthProvider as V, OAuthProvider as W, SAMLAuthProvider as X, TwitterAuthProvider as Y, signInAnonymously as Z, signInWithCredential as _, browserSessionPersistence as a, reauthenticateWithCredential as a0, signInWithCustomToken as a1, sendPasswordResetEmail as a2, confirmPasswordReset as a3, applyActionCode as a4, checkActionCode as a5, verifyPasswordResetCode as a6, createUserWithEmailAndPassword as a7, signInWithEmailAndPassword as a8, sendSignInLinkToEmail as a9, AuthEventManager as aA, _getInstance as aB, _persistenceKeyName as aC, _clearRedirectOutcomes as aD, _getRedirectResult as aE, _overrideRedirectResult as aF, _castAuth as aG, UserImpl as aH, AuthImpl as aI, _getClientVersion as aJ, _generateEventId as aK, AuthPopup as aL, FetchProvider as aM, SAMLAuthCredential as aN, isSignInWithEmailLink as aa, signInWithEmailLink as ab, fetchSignInMethodsForEmail as ac, sendEmailVerification as ad, verifyBeforeUpdateEmail as ae, ActionCodeURL as af, parseActionCodeURL as ag, updateProfile as ah, updateEmail as ai, updatePassword as aj, getIdToken as ak, getIdTokenResult as al, unlink as am, getAdditionalUserInfo as an, reload as ao, getMultiFactorResolver as ap, multiFactor as aq, _isIOS as ar, _isAndroid as as, _fail as at, _getRedirectUrl as au, debugAssert as av, _getProjectConfig as aw, _isIOS7Or8 as ax, _assert as ay, _createError as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, onIdTokenChanged as t, updatePhoneNumber as u, beforeAuthStateChanged as v, onAuthStateChanged as w, useDeviceLanguage as x, updateCurrentUser as y, signOut as z };
-//# sourceMappingURL=index-44fc929c.js.map
+export { signInWithCredential as $, ActionCodeOperation as A, signOut as B, deleteUser as C, debugErrorMap as D, prodErrorMap as E, FactorId as F, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as G, initializeAuth as H, connectAuthEmulator as I, AuthCredential as J, EmailAuthCredential as K, OAuthCredential as L, PhoneAuthCredential as M, inMemoryPersistence as N, OperationType as O, PhoneAuthProvider as P, EmailAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, FacebookAuthProvider as U, GoogleAuthProvider as V, GithubAuthProvider as W, OAuthProvider as X, SAMLAuthProvider as Y, TwitterAuthProvider as Z, signInAnonymously as _, browserSessionPersistence as a, linkWithCredential as a0, reauthenticateWithCredential as a1, signInWithCustomToken as a2, sendPasswordResetEmail as a3, confirmPasswordReset as a4, applyActionCode as a5, checkActionCode as a6, verifyPasswordResetCode as a7, createUserWithEmailAndPassword as a8, signInWithEmailAndPassword as a9, _createError as aA, AuthEventManager as aB, _getInstance as aC, _persistenceKeyName as aD, _clearRedirectOutcomes as aE, _getRedirectResult as aF, _overrideRedirectResult as aG, _castAuth as aH, UserImpl as aI, AuthImpl as aJ, _getClientVersion as aK, _generateEventId as aL, AuthPopup as aM, FetchProvider as aN, SAMLAuthCredential as aO, sendSignInLinkToEmail as aa, isSignInWithEmailLink as ab, signInWithEmailLink as ac, fetchSignInMethodsForEmail as ad, sendEmailVerification as ae, verifyBeforeUpdateEmail as af, ActionCodeURL as ag, parseActionCodeURL as ah, updateProfile as ai, updateEmail as aj, updatePassword as ak, getIdToken as al, getIdTokenResult as am, unlink as an, getAdditionalUserInfo as ao, reload as ap, getMultiFactorResolver as aq, multiFactor as ar, _isIOS as as, _isAndroid as at, _fail as au, _getRedirectUrl as av, debugAssert as aw, _getProjectConfig as ax, _isIOS7Or8 as ay, _assert as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, initializeRecaptchaConfig as t, updatePhoneNumber as u, onIdTokenChanged as v, beforeAuthStateChanged as w, onAuthStateChanged as x, useDeviceLanguage as y, updateCurrentUser as z };
+//# sourceMappingURL=index-169fb84f.js.map