@firebase/auth 0.21.6 → 0.22.0-canary.1d6771eb3

package/dist/node-esm/{totp-7b645f19.js → totp-aee19ee4.js}

@@ -1,4 +1,4 @@
-import { ErrorFactory, deepEqual, isBrowserExtension, isMobileCordova, isReactNative, FirebaseError, querystring, getModularInstance, base64Decode, getUA, isIE, createSubscribe, querystringDecode, extractQuerystring, getDefaultEmulatorHost } from '@firebase/util';
+import { ErrorFactory, isBrowserExtension, isMobileCordova, isReactNative, FirebaseError, querystring, getModularInstance, base64Decode, getUA, isIE, createSubscribe, deepEqual, querystringDecode, extractQuerystring, getDefaultEmulatorHost } from '@firebase/util';
 import { SDK_VERSION, _getProvider, _registerComponent, registerVersion, getApp } from '@firebase/app';
 import { __rest } from 'tslib';
 import { Component } from '@firebase/component';
@@ -213,6 +213,7 @@ function _debugErrorMap() {
         ["missing-or-invalid-nonce" /* AuthErrorCode.MISSING_OR_INVALID_NONCE */]: 'The request does not contain a valid nonce. This can occur if the ' +
             'SHA-256 hash of the provided raw nonce does not match the hashed nonce ' +
             'in the ID token payload.',
+        ["missing-password" /* AuthErrorCode.MISSING_PASSWORD */]: 'A non-empty password must be provided',
         ["missing-multi-factor-info" /* AuthErrorCode.MISSING_MFA_INFO */]: 'No second factor identifier is provided.',
         ["missing-multi-factor-session" /* AuthErrorCode.MISSING_MFA_SESSION */]: 'The request is missing proof of first factor successful sign-in.',
         ["missing-phone-number" /* AuthErrorCode.MISSING_PHONE_NUMBER */]: 'To send verification codes, provide a phone number for the recipient.',
@@ -265,7 +266,15 @@ function _debugErrorMap() {
         ["already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */]: 'initializeAuth() has already been called with ' +
             'different options. To avoid this error, call initializeAuth() with the ' +
             'same options as when it was originally called, or call getAuth() to return the' +
-            ' already initialized instance.'
+            ' already initialized instance.',
+        ["missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */]: 'The reCAPTCHA token is missing when sending request to the backend.',
+        ["invalid-recaptcha-token" /* AuthErrorCode.INVALID_RECAPTCHA_TOKEN */]: 'The reCAPTCHA token is invalid when sending request to the backend.',
+        ["invalid-recaptcha-action" /* AuthErrorCode.INVALID_RECAPTCHA_ACTION */]: 'The reCAPTCHA action is invalid when sending request to the backend.',
+        ["recaptcha-not-enabled" /* AuthErrorCode.RECAPTCHA_NOT_ENABLED */]: 'reCAPTCHA Enterprise integration is not enabled for this project.',
+        ["missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */]: 'The reCAPTCHA client type is missing when sending request to the backend.',
+        ["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */]: 'The reCAPTCHA version is missing when sending request to the backend.',
+        ["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */]: 'Invalid request parameters.',
+        ["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */]: 'The reCAPTCHA version is invalid when sending request to the backend.'
     };
 }
 function _prodErrorMap() {
@@ -401,7 +410,15 @@ const AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
     USER_SIGNED_OUT: 'auth/user-signed-out',
     WEAK_PASSWORD: 'auth/weak-password',
     WEB_STORAGE_UNSUPPORTED: 'auth/web-storage-unsupported',
-    ALREADY_INITIALIZED: 'auth/already-initialized'
+    ALREADY_INITIALIZED: 'auth/already-initialized',
+    RECAPTCHA_NOT_ENABLED: 'auth/recaptcha-not-enabled',
+    MISSING_RECAPTCHA_TOKEN: 'auth/missing-recaptcha-token',
+    INVALID_RECAPTCHA_TOKEN: 'auth/invalid-recaptcha-token',
+    INVALID_RECAPTCHA_ACTION: 'auth/invalid-recaptcha-action',
+    MISSING_CLIENT_TYPE: 'auth/missing-client-type',
+    MISSING_RECAPTCHA_VERSION: 'auth/missing-recaptcha-version',
+    INVALID_RECAPTCHA_VERSION: 'auth/invalid-recaptcha-version',
+    INVALID_REQ_TYPE: 'auth/invalid-req-type'
 };
 
 /**
@@ -421,6 +438,11 @@ const AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
  * limitations under the License.
  */
 const logClient = new Logger('@firebase/auth');
+function _logWarn(msg, ...args) {
+    if (logClient.logLevel <= LogLevel.WARN) {
+        logClient.warn(`Auth (${SDK_VERSION}): ${msg}`, ...args);
+    }
+}
 function _logError(msg, ...args) {
     if (logClient.logLevel <= LogLevel.ERROR) {
         logClient.error(`Auth (${SDK_VERSION}): ${msg}`, ...args);
@@ -501,103 +523,6 @@ function debugAssert(assertion, message) {
     }
 }
 
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-const instanceCache = new Map();
-function _getInstance(cls) {
-    debugAssert(cls instanceof Function, 'Expected a class definition');
-    let instance = instanceCache.get(cls);
-    if (instance) {
-        debugAssert(instance instanceof cls, 'Instance stored in cache mismatched with class');
-        return instance;
-    }
-    instance = new cls();
-    instanceCache.set(cls, instance);
-    return instance;
-}
-
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * Initializes an {@link Auth} instance with fine-grained control over
- * {@link Dependencies}.
- *
- * @remarks
- *
- * This function allows more control over the {@link Auth} instance than
- * {@link getAuth}. `getAuth` uses platform-specific defaults to supply
- * the {@link Dependencies}. In general, `getAuth` is the easiest way to
- * initialize Auth and works for most use cases. Use `initializeAuth` if you
- * need control over which persistence layer is used, or to minimize bundle
- * size if you're not using either `signInWithPopup` or `signInWithRedirect`.
- *
- * For example, if your app only uses anonymous accounts and you only want
- * accounts saved for the current session, initialize `Auth` with:
- *
- * ```js
- * const auth = initializeAuth(app, {
- *   persistence: browserSessionPersistence,
- *   popupRedirectResolver: undefined,
- * });
- * ```
- *
- * @public
- */
-function initializeAuth(app, deps) {
-    const provider = _getProvider(app, 'auth');
-    if (provider.isInitialized()) {
-        const auth = provider.getImmediate();
-        const initialOptions = provider.getOptions();
-        if (deepEqual(initialOptions, deps !== null && deps !== void 0 ? deps : {})) {
-            return auth;
-        }
-        else {
-            _fail(auth, "already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */);
-        }
-    }
-    const auth = provider.initialize({ options: deps });
-    return auth;
-}
-function _initializeAuthInstance(auth, deps) {
-    const persistence = (deps === null || deps === void 0 ? void 0 : deps.persistence) || [];
-    const hierarchy = (Array.isArray(persistence) ? persistence : [persistence]).map(_getInstance);
-    if (deps === null || deps === void 0 ? void 0 : deps.errorMap) {
-        auth._updateErrorMap(deps.errorMap);
-    }
-    // This promise is intended to float; auth initialization happens in the
-    // background, meanwhile the auth object may be used by the app.
-    // eslint-disable-next-line @typescript-eslint/no-floating-promises
-    auth._initializeWithPersistence(hierarchy, deps === null || deps === void 0 ? void 0 : deps.popupRedirectResolver);
-}
-
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -829,7 +754,7 @@ const SERVER_ERROR_MAP = {
     // Sign in with email and password errors (some apply to sign up too).
     ["INVALID_PASSWORD" /* ServerError.INVALID_PASSWORD */]: "wrong-password" /* AuthErrorCode.INVALID_PASSWORD */,
     // This can only happen if the SDK sends a bad request.
-    ["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */]: "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
+    ["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */]: "missing-password" /* AuthErrorCode.MISSING_PASSWORD */,
     // Sign up with email and password errors.
     ["EMAIL_EXISTS" /* ServerError.EMAIL_EXISTS */]: "email-already-in-use" /* AuthErrorCode.EMAIL_EXISTS */,
     ["PASSWORD_LOGIN_DISABLED" /* ServerError.PASSWORD_LOGIN_DISABLED */]: "operation-not-allowed" /* AuthErrorCode.OPERATION_NOT_ALLOWED */,
@@ -876,7 +801,16 @@ const SERVER_ERROR_MAP = {
     ["SECOND_FACTOR_EXISTS" /* ServerError.SECOND_FACTOR_EXISTS */]: "second-factor-already-in-use" /* AuthErrorCode.SECOND_FACTOR_ALREADY_ENROLLED */,
     ["SECOND_FACTOR_LIMIT_EXCEEDED" /* ServerError.SECOND_FACTOR_LIMIT_EXCEEDED */]: "maximum-second-factor-count-exceeded" /* AuthErrorCode.SECOND_FACTOR_LIMIT_EXCEEDED */,
     // Blocking functions related errors.
-    ["BLOCKING_FUNCTION_ERROR_RESPONSE" /* ServerError.BLOCKING_FUNCTION_ERROR_RESPONSE */]: "internal-error" /* AuthErrorCode.INTERNAL_ERROR */
+    ["BLOCKING_FUNCTION_ERROR_RESPONSE" /* ServerError.BLOCKING_FUNCTION_ERROR_RESPONSE */]: "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
+    // Recaptcha related errors.
+    ["RECAPTCHA_NOT_ENABLED" /* ServerError.RECAPTCHA_NOT_ENABLED */]: "recaptcha-not-enabled" /* AuthErrorCode.RECAPTCHA_NOT_ENABLED */,
+    ["MISSING_RECAPTCHA_TOKEN" /* ServerError.MISSING_RECAPTCHA_TOKEN */]: "missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */,
+    ["INVALID_RECAPTCHA_TOKEN" /* ServerError.INVALID_RECAPTCHA_TOKEN */]: "invalid-recaptcha-token" /* AuthErrorCode.INVALID_RECAPTCHA_TOKEN */,
+    ["INVALID_RECAPTCHA_ACTION" /* ServerError.INVALID_RECAPTCHA_ACTION */]: "invalid-recaptcha-action" /* AuthErrorCode.INVALID_RECAPTCHA_ACTION */,
+    ["MISSING_CLIENT_TYPE" /* ServerError.MISSING_CLIENT_TYPE */]: "missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */,
+    ["MISSING_RECAPTCHA_VERSION" /* ServerError.MISSING_RECAPTCHA_VERSION */]: "missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */,
+    ["INVALID_RECAPTCHA_VERSION" /* ServerError.INVALID_RECAPTCHA_VERSION */]: "invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */,
+    ["INVALID_REQ_TYPE" /* ServerError.INVALID_REQ_TYPE */]: "invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */
 };
 
 /**
@@ -1778,6 +1712,35 @@ class UserImpl {
     }
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const instanceCache = new Map();
+function _getInstance(cls) {
+    debugAssert(cls instanceof Function, 'Expected a class definition');
+    let instance = instanceCache.get(cls);
+    if (instance) {
+        debugAssert(instance instanceof cls, 'Instance stored in cache mismatched with class');
+        return instance;
+    }
+    instance = new cls();
+    instanceCache.set(cls, instance);
+    return instance;
+}
+
 /**
  * @license
  * Copyright 2019 Google LLC
@@ -2115,6 +2078,232 @@ function _getClientVersion(clientPlatform, frameworks = []) {
     return `${reportedPlatform}/${"JsCore" /* ClientImplementation.CORE */}/${SDK_VERSION}/${reportedFrameworks}`;
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+async function getRecaptchaConfig(auth, request) {
+    return _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request));
+}
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+class RecaptchaConfig {
+    constructor(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(enforcementState => enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+            enforcementState.enforcementState !== 'OFF');
+    }
+}
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise((resolve, reject) => {
+        const el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = e => {
+            const error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+const RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+const RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+class RecaptchaEnterpriseVerifier {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    constructor(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    async verify(action = 'verify', forceRefresh = false) {
+        async function retrieveSiteKey(auth) {
+            if (!forceRefresh) {
+                if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                    return auth._agentRecaptchaConfig.siteKey;
+                }
+                if (auth.tenantId != null &&
+                    auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                    return auth._tenantRecaptchaConfigs[auth.tenantId].siteKey;
+                }
+            }
+            return new Promise(async (resolve, reject) => {
+                getRecaptchaConfig(auth, {
+                    clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                    version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                })
+                    .then(response => {
+                    if (response.recaptchaKey === undefined) {
+                        reject(new Error('recaptcha Enterprise site key undefined'));
+                    }
+                    else {
+                        const config = new RecaptchaConfig(response);
+                        if (auth.tenantId == null) {
+                            auth._agentRecaptchaConfig = config;
+                        }
+                        else {
+                            auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                        }
+                        return resolve(config.siteKey);
+                    }
+                })
+                    .catch(error => {
+                    reject(error);
+                });
+            });
+        }
+        function retrieveRecaptchaToken(siteKey, resolve, reject) {
+            const grecaptcha = window.grecaptcha;
+            if (isEnterprise(grecaptcha)) {
+                grecaptcha.enterprise.ready(() => {
+                    try {
+                        grecaptcha.enterprise
+                            .execute(siteKey, { action })
+                            .then(token => {
+                            resolve(token);
+                        })
+                            .catch(error => {
+                            reject(error);
+                        });
+                    }
+                    catch (error) {
+                        reject(error);
+                    }
+                });
+            }
+            else {
+                reject(Error('No reCAPTCHA enterprise script loaded.'));
+            }
+        }
+        return new Promise((resolve, reject) => {
+            retrieveSiteKey(this.auth)
+                .then(siteKey => {
+                if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                }
+                else {
+                    if (typeof window === 'undefined') {
+                        reject(new Error('RecaptchaVerifier is only supported in browser'));
+                        return;
+                    }
+                    _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                        .then(() => {
+                        retrieveRecaptchaToken(siteKey, resolve, reject);
+                    })
+                        .catch(error => {
+                        reject(error);
+                    });
+                }
+            })
+                .catch(error => {
+                reject(error);
+            });
+        });
+    }
+}
+async function injectRecaptchaFields(auth, request, action, captchaResp = false) {
+    const verifier = new RecaptchaEnterpriseVerifier(auth);
+    let captchaResponse;
+    try {
+        captchaResponse = await verifier.verify(action);
+    }
+    catch (error) {
+        captchaResponse = await verifier.verify(action, true);
+    }
+    const newRequest = Object.assign({}, request);
+    if (!captchaResp) {
+        Object.assign(newRequest, { captchaResponse });
+    }
+    else {
+        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+    }
+    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+    Object.assign(newRequest, {
+        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+    });
+    return newRequest;
+}
+
 /**
  * @license
  * Copyright 2022 Google LLC
@@ -2213,9 +2402,10 @@ class AuthMiddlewareQueue {
  * limitations under the License.
  */
 class AuthImpl {
-    constructor(app, heartbeatServiceProvider, config) {
+    constructor(app, heartbeatServiceProvider, appCheckServiceProvider, config) {
         this.app = app;
         this.heartbeatServiceProvider = heartbeatServiceProvider;
+        this.appCheckServiceProvider = appCheckServiceProvider;
         this.config = config;
         this.currentUser = null;
         this.emulatorConfig = null;
@@ -2233,6 +2423,8 @@ class AuthImpl {
         this._initializationPromise = null;
         this._popupRedirectResolver = null;
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
+        this._agentRecaptchaConfig = null;
+        this._tenantRecaptchaConfigs = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -2452,6 +2644,31 @@ class AuthImpl {
             await this.assertedPersistence.setPersistence(_getInstance(persistence));
         });
     }
+    async initializeRecaptchaConfig() {
+        const response = await getRecaptchaConfig(this, {
+            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+        });
+        const config = new RecaptchaConfig(response);
+        if (this.tenantId == null) {
+            this._agentRecaptchaConfig = config;
+        }
+        else {
+            this._tenantRecaptchaConfigs[this.tenantId] = config;
+        }
+        if (config.emailPasswordEnabled) {
+            const verifier = new RecaptchaEnterpriseVerifier(this);
+            void verifier.verify();
+        }
+    }
+    _getRecaptchaConfig() {
+        if (this.tenantId == null) {
+            return this._agentRecaptchaConfig;
+        }
+        else {
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    }
     _getPersistence() {
         return this.assertedPersistence.persistence.type;
     }
@@ -2631,8 +2848,26 @@ class AuthImpl {
         if (heartbeatsHeader) {
             headers["X-Firebase-Client" /* HttpHeader.X_FIREBASE_CLIENT */] = heartbeatsHeader;
         }
+        // If the App Check service exists, add the App Check token in the headers
+        const appCheckToken = await this._getAppCheckToken();
+        if (appCheckToken) {
+            headers["X-Firebase-AppCheck" /* HttpHeader.X_FIREBASE_APP_CHECK */] = appCheckToken;
+        }
         return headers;
     }
+    async _getAppCheckToken() {
+        var _a;
+        const appCheckTokenResult = await ((_a = this.appCheckServiceProvider
+            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken());
+        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
+            // Context: appCheck.getToken() will never throw even if an error happened.
+            // In the error case, a dummy token will be returned along with an error field describing
+            // the error. In general, we shouldn't care about the error condition and just use
+            // the token (actual or dummy) to send requests.
+            _logWarn(`Error while retrieving App Check token: ${appCheckTokenResult.error}`);
+        }
+        return appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token;
+    }
 }
 /**
  * Method to be used to cast down to our private implmentation of Auth.
@@ -2656,6 +2891,74 @@ class Subscription {
     }
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Initializes an {@link Auth} instance with fine-grained control over
+ * {@link Dependencies}.
+ *
+ * @remarks
+ *
+ * This function allows more control over the {@link Auth} instance than
+ * {@link getAuth}. `getAuth` uses platform-specific defaults to supply
+ * the {@link Dependencies}. In general, `getAuth` is the easiest way to
+ * initialize Auth and works for most use cases. Use `initializeAuth` if you
+ * need control over which persistence layer is used, or to minimize bundle
+ * size if you're not using either `signInWithPopup` or `signInWithRedirect`.
+ *
+ * For example, if your app only uses anonymous accounts and you only want
+ * accounts saved for the current session, initialize `Auth` with:
+ *
+ * ```js
+ * const auth = initializeAuth(app, {
+ *   persistence: browserSessionPersistence,
+ *   popupRedirectResolver: undefined,
+ * });
+ * ```
+ *
+ * @public
+ */
+function initializeAuth(app, deps) {
+    const provider = _getProvider(app, 'auth');
+    if (provider.isInitialized()) {
+        const auth = provider.getImmediate();
+        const initialOptions = provider.getOptions();
+        if (deepEqual(initialOptions, deps !== null && deps !== void 0 ? deps : {})) {
+            return auth;
+        }
+        else {
+            _fail(auth, "already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */);
+        }
+    }
+    const auth = provider.initialize({ options: deps });
+    return auth;
+}
+function _initializeAuthInstance(auth, deps) {
+    const persistence = (deps === null || deps === void 0 ? void 0 : deps.persistence) || [];
+    const hierarchy = (Array.isArray(persistence) ? persistence : [persistence]).map(_getInstance);
+    if (deps === null || deps === void 0 ? void 0 : deps.errorMap) {
+        auth._updateErrorMap(deps.errorMap);
+    }
+    // This promise is intended to float; auth initialization happens in the
+    // background, meanwhile the auth object may be used by the app.
+    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+    auth._initializeWithPersistence(hierarchy, deps === null || deps === void 0 ? void 0 : deps.popupRedirectResolver);
+}
+
 /**
  * Changes the {@link Auth} instance to communicate with the Firebase Auth Emulator, instead of production
  * Firebase Auth services.
@@ -2995,13 +3298,31 @@ class EmailAuthCredential extends AuthCredential {
     }
     /** @internal */
     async _getIdTokenResponse(auth) {
+        var _a;
         switch (this.signInMethod) {
             case "password" /* SignInMethod.EMAIL_PASSWORD */:
-                return signInWithPassword(auth, {
+                const request = {
                     returnSecureToken: true,
                     email: this._email,
-                    password: this._password
-                });
+                    password: this._password,
+                    clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+                };
+                if ((_a = auth._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled) {
+                    const requestWithRecaptcha = await injectRecaptchaFields(auth, request, "signInWithPassword" /* RecaptchaActionName.SIGN_IN_WITH_PASSWORD */);
+                    return signInWithPassword(auth, requestWithRecaptcha);
+                }
+                else {
+                    return signInWithPassword(auth, request).catch(async (error) => {
+                        if (error.code === `auth/${"missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */}`) {
+                            console.log('Sign-in with email address and password is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-in flow.');
+                            const requestWithRecaptcha = await injectRecaptchaFields(auth, request, "signInWithPassword" /* RecaptchaActionName.SIGN_IN_WITH_PASSWORD */);
+                            return signInWithPassword(auth, requestWithRecaptcha);
+                        }
+                        else {
+                            return Promise.reject(error);
+                        }
+                    });
+                }
             case "emailLink" /* SignInMethod.EMAIL_LINK */:
                 return signInWithEmailLink$1(auth, {
                     email: this._email,
@@ -4957,15 +5278,39 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * @public
  */
 async function sendPasswordResetEmail(auth, email, actionCodeSettings) {
-    const authModular = getModularInstance(auth);
+    var _a;
+    const authInternal = _castAuth(auth);
     const request = {
         requestType: "PASSWORD_RESET" /* ActionCodeOperation.PASSWORD_RESET */,
-        email
+        email,
+        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
     };
-    if (actionCodeSettings) {
-        _setActionCodeSettingsOnRequest(authModular, request, actionCodeSettings);
+    if ((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled) {
+        const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true);
+        if (actionCodeSettings) {
+            _setActionCodeSettingsOnRequest(authInternal, requestWithRecaptcha, actionCodeSettings);
+        }
+        await sendPasswordResetEmail$1(authInternal, requestWithRecaptcha);
+    }
+    else {
+        if (actionCodeSettings) {
+            _setActionCodeSettingsOnRequest(authInternal, request, actionCodeSettings);
+        }
+        await sendPasswordResetEmail$1(authInternal, request)
+            .catch(async (error) => {
+            if (error.code === `auth/${"missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */}`) {
+                console.log('Password resets are protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the password reset flow.');
+                const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true);
+                if (actionCodeSettings) {
+                    _setActionCodeSettingsOnRequest(authInternal, requestWithRecaptcha, actionCodeSettings);
+                }
+                await sendPasswordResetEmail$1(authInternal, requestWithRecaptcha);
+            }
+            else {
+                return Promise.reject(error);
+            }
+        });
     }
-    await sendPasswordResetEmail$1(authModular, request);
 }
 /**
  * Completes the password reset process, given a confirmation code and new password.
@@ -5078,11 +5423,33 @@ async function verifyPasswordResetCode(auth, code) {
  * @public
  */
 async function createUserWithEmailAndPassword(auth, email, password) {
+    var _a;
     const authInternal = _castAuth(auth);
-    const response = await signUp(authInternal, {
+    const request = {
         returnSecureToken: true,
         email,
-        password
+        password,
+        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+    };
+    let signUpResponse;
+    if ((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled) {
+        const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */);
+        signUpResponse = signUp(authInternal, requestWithRecaptcha);
+    }
+    else {
+        signUpResponse = signUp(authInternal, request).catch(async (error) => {
+            if (error.code === `auth/${"missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */}`) {
+                console.log('Sign-up is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-up flow.');
+                const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */);
+                return signUp(authInternal, requestWithRecaptcha);
+            }
+            else {
+                return Promise.reject(error);
+            }
+        });
+    }
+    const response = await signUpResponse.catch(error => {
+        return Promise.reject(error);
     });
     const userCredential = await UserCredentialImpl._fromIdTokenResponse(authInternal, "signIn" /* OperationType.SIGN_IN */, response);
     await authInternal._updateCurrentUser(userCredential.user);
@@ -5163,16 +5530,39 @@ function signInWithEmailAndPassword(auth, email, password) {
  * @public
  */
 async function sendSignInLinkToEmail(auth, email, actionCodeSettings) {
-    const authModular = getModularInstance(auth);
+    var _a;
+    const authInternal = _castAuth(auth);
     const request = {
         requestType: "EMAIL_SIGNIN" /* ActionCodeOperation.EMAIL_SIGNIN */,
-        email
+        email,
+        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
     };
-    _assert(actionCodeSettings.handleCodeInApp, authModular, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
-    if (actionCodeSettings) {
-        _setActionCodeSettingsOnRequest(authModular, request, actionCodeSettings);
+    function setActionCodeSettings(request, actionCodeSettings) {
+        _assert(actionCodeSettings.handleCodeInApp, authInternal, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+        if (actionCodeSettings) {
+            _setActionCodeSettingsOnRequest(authInternal, request, actionCodeSettings);
+        }
+    }
+    if ((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled) {
+        const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true);
+        setActionCodeSettings(requestWithRecaptcha, actionCodeSettings);
+        await sendSignInLinkToEmail$1(authInternal, requestWithRecaptcha);
+    }
+    else {
+        setActionCodeSettings(request, actionCodeSettings);
+        await sendSignInLinkToEmail$1(authInternal, request)
+            .catch(async (error) => {
+            if (error.code === `auth/${"missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */}`) {
+                console.log('Email link sign-in is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-in flow.');
+                const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true);
+                setActionCodeSettings(requestWithRecaptcha, actionCodeSettings);
+                await sendSignInLinkToEmail$1(authInternal, requestWithRecaptcha);
+            }
+            else {
+                return Promise.reject(error);
+            }
+        });
     }
-    await sendSignInLinkToEmail$1(authModular, request);
 }
 /**
  * Checks if an incoming link is a sign-in with email link suitable for {@link signInWithEmailLink}.
@@ -5667,11 +6057,41 @@ function getAdditionalUserInfo(userCredential) {
 function setPersistence(auth, persistence) {
     return getModularInstance(auth).setPersistence(persistence);
 }
+/**
+ * Loads the reCAPTCHA configuration into the `Auth` instance.
+ *
+ * @remarks
+ * This will load the reCAPTCHA config, which indicates whether the reCAPTCHA
+ * verification flow should be triggered for each auth provider, into the
+ * current Auth session.
+ *
+ * If initializeRecaptchaConfig() is not invoked, the auth flow will always start
+ * without reCAPTCHA verification. If the provider is configured to require reCAPTCHA
+ * verification, the SDK will transparently load the reCAPTCHA config and restart the
+ * auth flows.
+ *
+ * Thus, by calling this optional method, you will reduce the latency of future auth flows.
+ * Loading the reCAPTCHA config early will also enhance the signal collected by reCAPTCHA.
+ *
+ * @example
+ * ```javascript
+ * initializeRecaptchaConfig(auth);
+ * ```
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @public
+ */
+function initializeRecaptchaConfig(auth) {
+    const authInternal = _castAuth(auth);
+    return authInternal.initializeRecaptchaConfig();
+}
 /**
  * Adds an observer for changes to the signed-in user's ID token.
  *
  * @remarks
  * This includes sign-in, sign-out, and token refresh events.
+ * This will not be triggered automatically upon ID token expiration. Use {@link User.getIdToken} to refresh the ID token.
  *
  * @param auth - The {@link Auth} instance.
  * @param nextOrObserver - callback triggered on change.
@@ -5979,7 +6399,7 @@ function multiFactor(user) {
 }
 
 var name = "@firebase/auth";
-var version = "0.21.6";
+var version = "0.22.0-canary.1d6771eb3";
 
 /**
  * @license
@@ -6085,26 +6505,25 @@ function registerAuth(clientPlatform) {
     _registerComponent(new Component("auth" /* _ComponentName.AUTH */, (container, { options: deps }) => {
         const app = container.getProvider('app').getImmediate();
         const heartbeatServiceProvider = container.getProvider('heartbeat');
+        const appCheckServiceProvider = container.getProvider('app-check-internal');
         const { apiKey, authDomain } = app.options;
-        return ((app, heartbeatServiceProvider) => {
-            _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
-            // Auth domain is optional if IdP sign in isn't being used
-            _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
-                appName: app.name
-            });
-            const config = {
-                apiKey,
-                authDomain,
-                clientPlatform,
-                apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
-                tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
-                apiScheme: "https" /* DefaultConfig.API_SCHEME */,
-                sdkClientVersion: _getClientVersion(clientPlatform)
-            };
-            const authInstance = new AuthImpl(app, heartbeatServiceProvider, config);
-            _initializeAuthInstance(authInstance, deps);
-            return authInstance;
-        })(app, heartbeatServiceProvider);
+        _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
+        // Auth domain is optional if IdP sign in isn't being used
+        _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
+            appName: app.name
+        });
+        const config = {
+            apiKey,
+            authDomain,
+            clientPlatform,
+            apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
+            tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
+            apiScheme: "https" /* DefaultConfig.API_SCHEME */,
+            sdkClientVersion: _getClientVersion(clientPlatform)
+        };
+        const authInstance = new AuthImpl(app, heartbeatServiceProvider, appCheckServiceProvider, config);
+        _initializeAuthInstance(authInstance, deps);
+        return authInstance;
     }, "PUBLIC" /* ComponentType.PUBLIC */)
         /**
          * Auth can only be initialized by explicitly calling getAuth() or initializeAuth()
@@ -6392,5 +6811,5 @@ function _isEmptyString(input) {
     return typeof input === 'undefined' || (input === null || input === void 0 ? void 0 : input.length) === 0;
 }
 
-export { linkWithCredential as $, ActionCodeOperation as A, deleteUser as B, debugErrorMap as C, prodErrorMap as D, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as E, FactorId as F, initializeAuth as G, connectAuthEmulator as H, AuthCredential as I, EmailAuthCredential as J, OAuthCredential as K, PhoneAuthCredential as L, inMemoryPersistence as M, EmailAuthProvider as N, OperationType as O, PhoneAuthProvider as P, FacebookAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, GoogleAuthProvider as U, GithubAuthProvider as V, OAuthProvider as W, SAMLAuthProvider as X, TwitterAuthProvider as Y, signInAnonymously as Z, signInWithCredential as _, browserSessionPersistence as a, reauthenticateWithCredential as a0, signInWithCustomToken as a1, sendPasswordResetEmail as a2, confirmPasswordReset as a3, applyActionCode as a4, checkActionCode as a5, verifyPasswordResetCode as a6, createUserWithEmailAndPassword as a7, signInWithEmailAndPassword as a8, sendSignInLinkToEmail as a9, _castAuth as aA, FederatedAuthProvider as aB, BaseOAuthProvider as aC, _emulatorUrl as aD, _performApiRequest as aE, _isIOS as aF, _isAndroid as aG, _isIOS7Or8 as aH, _createError as aI, _isIframe as aJ, _isMobileBrowser as aK, _isIE10 as aL, _isSafari as aM, UserImpl as aN, AuthImpl as aO, _getClientVersion as aP, FetchProvider as aQ, SAMLAuthCredential as aR, isSignInWithEmailLink as aa, signInWithEmailLink as ab, fetchSignInMethodsForEmail as ac, sendEmailVerification as ad, verifyBeforeUpdateEmail as ae, ActionCodeURL as af, parseActionCodeURL as ag, updateProfile as ah, updateEmail as ai, updatePassword as aj, getIdToken as ak, getIdTokenResult as al, unlink as am, getAdditionalUserInfo as an, reload as ao, getMultiFactorResolver as ap, multiFactor as aq, _getInstance as ar, _assert as as, _signInWithCredential as at, _reauthenticate as au, _link as av, signInWithIdp as aw, _fail as ax, debugAssert as ay, _persistenceKeyName as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, onIdTokenChanged as t, updatePhoneNumber as u, beforeAuthStateChanged as v, onAuthStateChanged as w, useDeviceLanguage as x, updateCurrentUser as y, signOut as z };
-//# sourceMappingURL=totp-7b645f19.js.map
+export { signInWithCredential as $, ActionCodeOperation as A, signOut as B, deleteUser as C, debugErrorMap as D, prodErrorMap as E, FactorId as F, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as G, initializeAuth as H, connectAuthEmulator as I, AuthCredential as J, EmailAuthCredential as K, OAuthCredential as L, PhoneAuthCredential as M, inMemoryPersistence as N, OperationType as O, PhoneAuthProvider as P, EmailAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, FacebookAuthProvider as U, GoogleAuthProvider as V, GithubAuthProvider as W, OAuthProvider as X, SAMLAuthProvider as Y, TwitterAuthProvider as Z, signInAnonymously as _, browserSessionPersistence as a, linkWithCredential as a0, reauthenticateWithCredential as a1, signInWithCustomToken as a2, sendPasswordResetEmail as a3, confirmPasswordReset as a4, applyActionCode as a5, checkActionCode as a6, verifyPasswordResetCode as a7, createUserWithEmailAndPassword as a8, signInWithEmailAndPassword as a9, _persistenceKeyName as aA, _castAuth as aB, FederatedAuthProvider as aC, BaseOAuthProvider as aD, _emulatorUrl as aE, _performApiRequest as aF, _isIOS as aG, _isAndroid as aH, _isIOS7Or8 as aI, _createError as aJ, _isIframe as aK, _isMobileBrowser as aL, _isIE10 as aM, _isSafari as aN, UserImpl as aO, AuthImpl as aP, _getClientVersion as aQ, FetchProvider as aR, SAMLAuthCredential as aS, sendSignInLinkToEmail as aa, isSignInWithEmailLink as ab, signInWithEmailLink as ac, fetchSignInMethodsForEmail as ad, sendEmailVerification as ae, verifyBeforeUpdateEmail as af, ActionCodeURL as ag, parseActionCodeURL as ah, updateProfile as ai, updateEmail as aj, updatePassword as ak, getIdToken as al, getIdTokenResult as am, unlink as an, getAdditionalUserInfo as ao, reload as ap, getMultiFactorResolver as aq, multiFactor as ar, _getInstance as as, _assert as at, _signInWithCredential as au, _reauthenticate as av, _link as aw, signInWithIdp as ax, _fail as ay, debugAssert as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, initializeRecaptchaConfig as t, updatePhoneNumber as u, onIdTokenChanged as v, beforeAuthStateChanged as w, onAuthStateChanged as x, useDeviceLanguage as y, updateCurrentUser as z };
+//# sourceMappingURL=totp-aee19ee4.js.map