@firebase/auth 0.22.0-canary.852ded64d → 0.22.0-canary.ea3849fff

package/dist/esm2017/index.js

@@ -1,4 +1,4 @@
-export { A as ActionCodeOperation, af as ActionCodeURL, I as AuthCredential, E as AuthErrorCodes, J as EmailAuthCredential, N as EmailAuthProvider, Q as FacebookAuthProvider, F as FactorId, V as GithubAuthProvider, U as GoogleAuthProvider, K as OAuthCredential, W as OAuthProvider, O as OperationType, L as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, X as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, Y as TwitterAuthProvider, a4 as applyActionCode, v as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a5 as checkActionCode, a3 as confirmPasswordReset, H as connectAuthEmulator, a7 as createUserWithEmailAndPassword, C as debugErrorMap, B as deleteUser, ac as fetchSignInMethodsForEmail, an as getAdditionalUserInfo, o as getAuth, ak as getIdToken, al as getIdTokenResult, ap as getMultiFactorResolver, j as getRedirectResult, M as inMemoryPersistence, i as indexedDBLocalPersistence, G as initializeAuth, aa as isSignInWithEmailLink, $ as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, aq as multiFactor, w as onAuthStateChanged, t as onIdTokenChanged, ag as parseActionCodeURL, D as prodErrorMap, a0 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ao as reload, ad as sendEmailVerification, a2 as sendPasswordResetEmail, a9 as sendSignInLinkToEmail, q as setPersistence, Z as signInAnonymously, _ as signInWithCredential, a1 as signInWithCustomToken, a8 as signInWithEmailAndPassword, ab as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, z as signOut, am as unlink, y as updateCurrentUser, ai as updateEmail, aj as updatePassword, u as updatePhoneNumber, ah as updateProfile, x as useDeviceLanguage, ae as verifyBeforeUpdateEmail, a6 as verifyPasswordResetCode } from './index-c088f05c.js';
+export { A as ActionCodeOperation, af as ActionCodeURL, I as AuthCredential, E as AuthErrorCodes, J as EmailAuthCredential, N as EmailAuthProvider, Q as FacebookAuthProvider, F as FactorId, V as GithubAuthProvider, U as GoogleAuthProvider, K as OAuthCredential, W as OAuthProvider, O as OperationType, L as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, X as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, Y as TwitterAuthProvider, a4 as applyActionCode, v as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a5 as checkActionCode, a3 as confirmPasswordReset, H as connectAuthEmulator, a7 as createUserWithEmailAndPassword, C as debugErrorMap, B as deleteUser, ac as fetchSignInMethodsForEmail, an as getAdditionalUserInfo, o as getAuth, ak as getIdToken, al as getIdTokenResult, ap as getMultiFactorResolver, j as getRedirectResult, M as inMemoryPersistence, i as indexedDBLocalPersistence, G as initializeAuth, aa as isSignInWithEmailLink, $ as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, aq as multiFactor, w as onAuthStateChanged, t as onIdTokenChanged, ag as parseActionCodeURL, D as prodErrorMap, a0 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ao as reload, ad as sendEmailVerification, a2 as sendPasswordResetEmail, a9 as sendSignInLinkToEmail, q as setPersistence, Z as signInAnonymously, _ as signInWithCredential, a1 as signInWithCustomToken, a8 as signInWithEmailAndPassword, ab as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, z as signOut, am as unlink, y as updateCurrentUser, ai as updateEmail, aj as updatePassword, u as updatePhoneNumber, ah as updateProfile, x as useDeviceLanguage, ae as verifyBeforeUpdateEmail, a6 as verifyPasswordResetCode } from './index-5eca8e8e.js';
 import '@firebase/util';
 import '@firebase/app';
 import '@firebase/logger';

package/dist/esm2017/internal.js

@@ -1,5 +1,5 @@
-import { ar as debugAssert, as as _isIOS, at as _isAndroid, au as _fail, av as _getRedirectUrl, aw as _getProjectConfig, ax as _isIOS7Or8, ay as _createError, az as _assert, aA as AuthEventManager, aB as _getInstance, b as browserLocalPersistence, aC as _persistenceKeyName, a as browserSessionPersistence, aD as _getRedirectResult, aE as _overrideRedirectResult, aF as _clearRedirectOutcomes, aG as _castAuth } from './index-c088f05c.js';
-export { A as ActionCodeOperation, af as ActionCodeURL, I as AuthCredential, E as AuthErrorCodes, aI as AuthImpl, aL as AuthPopup, J as EmailAuthCredential, N as EmailAuthProvider, Q as FacebookAuthProvider, F as FactorId, aM as FetchProvider, V as GithubAuthProvider, U as GoogleAuthProvider, K as OAuthCredential, W as OAuthProvider, O as OperationType, L as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, aN as SAMLAuthCredential, X as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, Y as TwitterAuthProvider, aH as UserImpl, az as _assert, aG as _castAuth, au as _fail, aK as _generateEventId, aJ as _getClientVersion, aB as _getInstance, aD as _getRedirectResult, aE as _overrideRedirectResult, aC as _persistenceKeyName, a4 as applyActionCode, v as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a5 as checkActionCode, a3 as confirmPasswordReset, H as connectAuthEmulator, a7 as createUserWithEmailAndPassword, C as debugErrorMap, B as deleteUser, ac as fetchSignInMethodsForEmail, an as getAdditionalUserInfo, o as getAuth, ak as getIdToken, al as getIdTokenResult, ap as getMultiFactorResolver, j as getRedirectResult, M as inMemoryPersistence, i as indexedDBLocalPersistence, G as initializeAuth, aa as isSignInWithEmailLink, $ as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, aq as multiFactor, w as onAuthStateChanged, t as onIdTokenChanged, ag as parseActionCodeURL, D as prodErrorMap, a0 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ao as reload, ad as sendEmailVerification, a2 as sendPasswordResetEmail, a9 as sendSignInLinkToEmail, q as setPersistence, Z as signInAnonymously, _ as signInWithCredential, a1 as signInWithCustomToken, a8 as signInWithEmailAndPassword, ab as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, z as signOut, am as unlink, y as updateCurrentUser, ai as updateEmail, aj as updatePassword, u as updatePhoneNumber, ah as updateProfile, x as useDeviceLanguage, ae as verifyBeforeUpdateEmail, a6 as verifyPasswordResetCode } from './index-c088f05c.js';
+import { ar as debugAssert, as as _isIOS, at as _isAndroid, au as _fail, av as _getRedirectUrl, aw as _getProjectConfig, ax as _isIOS7Or8, ay as _createError, az as _assert, aA as AuthEventManager, aB as _getInstance, b as browserLocalPersistence, aC as _persistenceKeyName, a as browserSessionPersistence, aD as _getRedirectResult, aE as _overrideRedirectResult, aF as _clearRedirectOutcomes, aG as _castAuth } from './index-5eca8e8e.js';
+export { A as ActionCodeOperation, af as ActionCodeURL, I as AuthCredential, E as AuthErrorCodes, aI as AuthImpl, aL as AuthPopup, J as EmailAuthCredential, N as EmailAuthProvider, Q as FacebookAuthProvider, F as FactorId, aM as FetchProvider, V as GithubAuthProvider, U as GoogleAuthProvider, K as OAuthCredential, W as OAuthProvider, O as OperationType, L as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, aN as SAMLAuthCredential, X as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, Y as TwitterAuthProvider, aH as UserImpl, az as _assert, aG as _castAuth, au as _fail, aK as _generateEventId, aJ as _getClientVersion, aB as _getInstance, aD as _getRedirectResult, aE as _overrideRedirectResult, aC as _persistenceKeyName, a4 as applyActionCode, v as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a5 as checkActionCode, a3 as confirmPasswordReset, H as connectAuthEmulator, a7 as createUserWithEmailAndPassword, C as debugErrorMap, B as deleteUser, ac as fetchSignInMethodsForEmail, an as getAdditionalUserInfo, o as getAuth, ak as getIdToken, al as getIdTokenResult, ap as getMultiFactorResolver, j as getRedirectResult, M as inMemoryPersistence, i as indexedDBLocalPersistence, G as initializeAuth, aa as isSignInWithEmailLink, $ as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, aq as multiFactor, w as onAuthStateChanged, t as onIdTokenChanged, ag as parseActionCodeURL, D as prodErrorMap, a0 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ao as reload, ad as sendEmailVerification, a2 as sendPasswordResetEmail, a9 as sendSignInLinkToEmail, q as setPersistence, Z as signInAnonymously, _ as signInWithCredential, a1 as signInWithCustomToken, a8 as signInWithEmailAndPassword, ab as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, z as signOut, am as unlink, y as updateCurrentUser, ai as updateEmail, aj as updatePassword, u as updatePhoneNumber, ah as updateProfile, x as useDeviceLanguage, ae as verifyBeforeUpdateEmail, a6 as verifyPasswordResetCode } from './index-5eca8e8e.js';
 import { querystringDecode } from '@firebase/util';
 import '@firebase/app';
 import '@firebase/logger';

package/dist/esm2017/src/api/index.d.ts

@@ -29,7 +29,8 @@ export declare const enum HttpHeader {
     X_FIREBASE_LOCALE = "X-Firebase-Locale",
     X_CLIENT_VERSION = "X-Client-Version",
     X_FIREBASE_GMPID = "X-Firebase-gmpid",
-    X_FIREBASE_CLIENT = "X-Firebase-Client"
+    X_FIREBASE_CLIENT = "X-Firebase-Client",
+    X_FIREBASE_APP_CHECK = "X-Firebase-AppCheck"
 }
 export declare const enum Endpoint {
     CREATE_AUTH_URI = "/v1/accounts:createAuthUri",

package/dist/esm2017/src/core/auth/auth_impl.d.ts

@@ -16,6 +16,7 @@
  */
 import { _FirebaseService, FirebaseApp } from '@firebase/app';
 import { Provider } from '@firebase/component';
+import { AppCheckInternalComponentName } from '@firebase/app-check-interop-types';
 import { Auth, AuthErrorMap, AuthSettings, EmulatorConfig, NextOrObserver, Persistence, PopupRedirectResolver, User, CompleteFn, ErrorFn, Unsubscribe } from '../../model/public_types';
 import { ErrorFactory } from '@firebase/util';
 import { AuthInternal, ConfigInternal } from '../../model/auth';
@@ -31,6 +32,7 @@ export declare const enum DefaultConfig {
 export declare class AuthImpl implements AuthInternal, _FirebaseService {
     readonly app: FirebaseApp;
     private readonly heartbeatServiceProvider;
+    private readonly appCheckServiceProvider;
     readonly config: ConfigInternal;
     currentUser: User | null;
     emulatorConfig: EmulatorConfig | null;
@@ -53,7 +55,7 @@ export declare class AuthImpl implements AuthInternal, _FirebaseService {
     languageCode: string | null;
     tenantId: string | null;
     settings: AuthSettings;
-    constructor(app: FirebaseApp, heartbeatServiceProvider: Provider<'heartbeat'>, config: ConfigInternal);
+    constructor(app: FirebaseApp, heartbeatServiceProvider: Provider<'heartbeat'>, appCheckServiceProvider: Provider<AppCheckInternalComponentName>, config: ConfigInternal);
     _initializeWithPersistence(persistenceHierarchy: PersistenceInternal[], popupRedirectResolver?: PopupRedirectResolver): Promise<void>;
     /**
      * If the persistence is changed in another window, the user manager will let us know
@@ -100,6 +102,7 @@ export declare class AuthImpl implements AuthInternal, _FirebaseService {
     _logFramework(framework: string): void;
     _getFrameworks(): readonly string[];
     _getAdditionalHeaders(): Promise<Record<string, string>>;
+    _getAppCheckToken(): Promise<string | undefined>;
 }
 /**
  * Method to be used to cast down to our private implmentation of Auth.

package/dist/esm2017/src/core/util/handler.d.ts

@@ -17,4 +17,4 @@
 import { AuthProvider } from '../../model/public_types';
 import { AuthInternal } from '../../model/auth';
 import { AuthEventType } from '../../model/popup_redirect';
-export declare function _getRedirectUrl(auth: AuthInternal, provider: AuthProvider, authType: AuthEventType, redirectUrl?: string, eventId?: string, additionalParams?: Record<string, string>): string;
+export declare function _getRedirectUrl(auth: AuthInternal, provider: AuthProvider, authType: AuthEventType, redirectUrl?: string, eventId?: string, additionalParams?: Record<string, string>): Promise<string>;

package/dist/esm2017/src/core/util/log.d.ts

@@ -19,4 +19,5 @@ export { LogLevel };
 export declare function _getLogLevel(): LogLevel;
 export declare function _setLogLevel(newLevel: LogLevel): void;
 export declare function _logDebug(msg: string, ...args: string[]): void;
+export declare function _logWarn(msg: string, ...args: string[]): void;
 export declare function _logError(msg: string, ...args: string[]): void;

package/dist/esm2017/src/model/auth.d.ts

@@ -64,6 +64,7 @@ export interface AuthInternal extends Auth {
     _logFramework(framework: string): void;
     _getFrameworks(): readonly string[];
     _getAdditionalHeaders(): Promise<Record<string, string>>;
+    _getAppCheckToken(): Promise<string | undefined>;
     readonly name: AppName;
     readonly config: ConfigInternal;
     languageCode: string | null;

package/dist/esm2017/test/helpers/mock_auth.d.ts

@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 import { Provider } from '@firebase/component';
+import { AppCheckTokenResult } from '@firebase/app-check-interop-types';
 import { PopupRedirectResolver } from '../../src/model/public_types';
 import { AuthImpl } from '../../src/core/auth/auth_impl';
 import { PersistedBlob } from '../../src/core/persistence';
@@ -33,6 +34,10 @@ export declare const FAKE_HEARTBEAT_CONTROLLER: {
     getHeartbeatsHeader: () => Promise<string>;
 };
 export declare const FAKE_HEARTBEAT_CONTROLLER_PROVIDER: Provider<'heartbeat'>;
+export declare const FAKE_APP_CHECK_CONTROLLER: {
+    getToken: () => Promise<AppCheckTokenResult>;
+};
+export declare const FAKE_APP_CHECK_CONTROLLER_PROVIDER: Provider<'app-check-internal'>;
 export declare class MockPersistenceLayer extends InMemoryPersistence {
     lastObjectSet: PersistedBlob | null;
     _set(key: string, object: PersistedBlob): Promise<void>;

package/dist/esm5/{index-7119ea16.js → index-ea49ccf6.js}

@@ -423,6 +423,15 @@ var AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
  * limitations under the License.
  */
 var logClient = new Logger('@firebase/auth');
+function _logWarn(msg) {
+    var args = [];
+    for (var _i = 1; _i < arguments.length; _i++) {
+        args[_i - 1] = arguments[_i];
+    }
+    if (logClient.logLevel <= LogLevel.WARN) {
+        logClient.warn.apply(logClient, __spreadArray(["Auth (".concat(SDK_VERSION, "): ").concat(msg)], args, false));
+    }
+}
 function _logError(msg) {
     var args = [];
     for (var _i = 1; _i < arguments.length; _i++) {
@@ -2596,9 +2605,10 @@ var AuthMiddlewareQueue = /** @class */ (function () {
  * limitations under the License.
  */
 var AuthImpl = /** @class */ (function () {
-    function AuthImpl(app, heartbeatServiceProvider, config) {
+    function AuthImpl(app, heartbeatServiceProvider, appCheckServiceProvider, config) {
         this.app = app;
         this.heartbeatServiceProvider = heartbeatServiceProvider;
+        this.appCheckServiceProvider = appCheckServiceProvider;
         this.config = config;
         this.currentUser = null;
         this.emulatorConfig = null;
@@ -3172,7 +3182,7 @@ var AuthImpl = /** @class */ (function () {
     AuthImpl.prototype._getAdditionalHeaders = function () {
         var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var headers, heartbeatsHeader;
+            var headers, heartbeatsHeader, appCheckToken;
             var _b;
             return __generator(this, function (_c) {
                 switch (_c.label) {
@@ -3192,11 +3202,39 @@ var AuthImpl = /** @class */ (function () {
                         if (heartbeatsHeader) {
                             headers["X-Firebase-Client" /* HttpHeader.X_FIREBASE_CLIENT */] = heartbeatsHeader;
                         }
+                        return [4 /*yield*/, this._getAppCheckToken()];
+                    case 2:
+                        appCheckToken = _c.sent();
+                        if (appCheckToken) {
+                            headers["X-Firebase-AppCheck" /* HttpHeader.X_FIREBASE_APP_CHECK */] = appCheckToken;
+                        }
                         return [2 /*return*/, headers];
                 }
             });
         });
     };
+    AuthImpl.prototype._getAppCheckToken = function () {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var appCheckTokenResult;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, ((_a = this.appCheckServiceProvider
+                            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken())];
+                    case 1:
+                        appCheckTokenResult = _b.sent();
+                        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
+                            // Context: appCheck.getToken() will never throw even if an error happened.
+                            // In the error case, a dummy token will be returned along with an error field describing
+                            // the error. In general, we shouldn't care about the error condition and just use
+                            // the token (actual or dummy) to send requests.
+                            _logWarn("Error while retrieving App Check token: ".concat(appCheckTokenResult.error));
+                        }
+                        return [2 /*return*/, appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token];
+                }
+            });
+        });
+    };
     return AuthImpl;
 }());
 /**
@@ -10867,48 +10905,67 @@ var WIDGET_PATH = '__/auth/handler';
  * @internal
  */
 var EMULATOR_WIDGET_PATH = 'emulator/auth/handler';
+/**
+ * Fragment name for the App Check token that gets passed to the widget
+ *
+ * @internal
+ */
+var FIREBASE_APP_CHECK_FRAGMENT_ID = encodeURIComponent('fac');
 function _getRedirectUrl(auth, provider, authType, redirectUrl, eventId, additionalParams) {
-    _assert(auth.config.authDomain, auth, "auth-domain-config-required" /* AuthErrorCode.MISSING_AUTH_DOMAIN */);
-    _assert(auth.config.apiKey, auth, "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */);
-    var params = {
-        apiKey: auth.config.apiKey,
-        appName: auth.name,
-        authType: authType,
-        redirectUrl: redirectUrl,
-        v: SDK_VERSION,
-        eventId: eventId
-    };
-    if (provider instanceof FederatedAuthProvider) {
-        provider.setDefaultLanguage(auth.languageCode);
-        params.providerId = provider.providerId || '';
-        if (!isEmpty(provider.getCustomParameters())) {
-            params.customParameters = JSON.stringify(provider.getCustomParameters());
-        }
-        // TODO set additionalParams from the provider as well?
-        for (var _i = 0, _a = Object.entries(additionalParams || {}); _i < _a.length; _i++) {
-            var _b = _a[_i], key = _b[0], value = _b[1];
-            params[key] = value;
-        }
-    }
-    if (provider instanceof BaseOAuthProvider) {
-        var scopes = provider.getScopes().filter(function (scope) { return scope !== ''; });
-        if (scopes.length > 0) {
-            params.scopes = scopes.join(',');
-        }
-    }
-    if (auth.tenantId) {
-        params.tid = auth.tenantId;
-    }
-    // TODO: maybe set eid as endipointId
-    // TODO: maybe set fw as Frameworks.join(",")
-    var paramsDict = params;
-    for (var _c = 0, _d = Object.keys(paramsDict); _c < _d.length; _c++) {
-        var key = _d[_c];
-        if (paramsDict[key] === undefined) {
-            delete paramsDict[key];
-        }
-    }
-    return "".concat(getHandlerBase(auth), "?").concat(querystring(paramsDict).slice(1));
+    return __awaiter(this, void 0, void 0, function () {
+        var params, _i, _a, _b, key, value, scopes, paramsDict, _c, _d, key, appCheckToken, appCheckTokenFragment;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    _assert(auth.config.authDomain, auth, "auth-domain-config-required" /* AuthErrorCode.MISSING_AUTH_DOMAIN */);
+                    _assert(auth.config.apiKey, auth, "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */);
+                    params = {
+                        apiKey: auth.config.apiKey,
+                        appName: auth.name,
+                        authType: authType,
+                        redirectUrl: redirectUrl,
+                        v: SDK_VERSION,
+                        eventId: eventId
+                    };
+                    if (provider instanceof FederatedAuthProvider) {
+                        provider.setDefaultLanguage(auth.languageCode);
+                        params.providerId = provider.providerId || '';
+                        if (!isEmpty(provider.getCustomParameters())) {
+                            params.customParameters = JSON.stringify(provider.getCustomParameters());
+                        }
+                        // TODO set additionalParams from the provider as well?
+                        for (_i = 0, _a = Object.entries(additionalParams || {}); _i < _a.length; _i++) {
+                            _b = _a[_i], key = _b[0], value = _b[1];
+                            params[key] = value;
+                        }
+                    }
+                    if (provider instanceof BaseOAuthProvider) {
+                        scopes = provider.getScopes().filter(function (scope) { return scope !== ''; });
+                        if (scopes.length > 0) {
+                            params.scopes = scopes.join(',');
+                        }
+                    }
+                    if (auth.tenantId) {
+                        params.tid = auth.tenantId;
+                    }
+                    paramsDict = params;
+                    for (_c = 0, _d = Object.keys(paramsDict); _c < _d.length; _c++) {
+                        key = _d[_c];
+                        if (paramsDict[key] === undefined) {
+                            delete paramsDict[key];
+                        }
+                    }
+                    return [4 /*yield*/, auth._getAppCheckToken()];
+                case 1:
+                    appCheckToken = _e.sent();
+                    appCheckTokenFragment = appCheckToken
+                        ? "#".concat(FIREBASE_APP_CHECK_FRAGMENT_ID, "=").concat(encodeURIComponent(appCheckToken))
+                        : '';
+                    // Start at index 1 to skip the leading '&' in the query string
+                    return [2 /*return*/, "".concat(getHandlerBase(auth), "?").concat(querystring(paramsDict).slice(1)).concat(appCheckTokenFragment)];
+            }
+        });
+    });
 }
 function getHandlerBase(_a) {
     var config = _a.config;
@@ -10955,20 +11012,29 @@ var BrowserPopupRedirectResolver = /** @class */ (function () {
         return __awaiter(this, void 0, void 0, function () {
             var url;
             return __generator(this, function (_b) {
-                debugAssert((_a = this.eventManagers[auth._key()]) === null || _a === void 0 ? void 0 : _a.manager, '_initialize() not called before _openPopup()');
-                url = _getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId);
-                return [2 /*return*/, _open(auth, url, _generateEventId())];
+                switch (_b.label) {
+                    case 0:
+                        debugAssert((_a = this.eventManagers[auth._key()]) === null || _a === void 0 ? void 0 : _a.manager, '_initialize() not called before _openPopup()');
+                        return [4 /*yield*/, _getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId)];
+                    case 1:
+                        url = _b.sent();
+                        return [2 /*return*/, _open(auth, url, _generateEventId())];
+                }
             });
         });
     };
     BrowserPopupRedirectResolver.prototype._openRedirect = function (auth, provider, authType, eventId) {
         return __awaiter(this, void 0, void 0, function () {
+            var url;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0: return [4 /*yield*/, this._originValidation(auth)];
                     case 1:
                         _a.sent();
-                        _setWindowLocation(_getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId));
+                        return [4 /*yield*/, _getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId)];
+                    case 2:
+                        url = _a.sent();
+                        _setWindowLocation(url);
                         return [2 /*return*/, new Promise(function () { })];
                 }
             });
@@ -11303,7 +11369,7 @@ function _isEmptyString(input) {
 }
 
 var name = "@firebase/auth";
-var version = "0.22.0-canary.852ded64d";
+var version = "0.22.0-canary.ea3849fff";
 
 /**
  * @license
@@ -11423,26 +11489,25 @@ function registerAuth(clientPlatform) {
         var deps = _a.options;
         var app = container.getProvider('app').getImmediate();
         var heartbeatServiceProvider = container.getProvider('heartbeat');
+        var appCheckServiceProvider = container.getProvider('app-check-internal');
         var _b = app.options, apiKey = _b.apiKey, authDomain = _b.authDomain;
-        return (function (app, heartbeatServiceProvider) {
-            _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
-            // Auth domain is optional if IdP sign in isn't being used
-            _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
-                appName: app.name
-            });
-            var config = {
-                apiKey: apiKey,
-                authDomain: authDomain,
-                clientPlatform: clientPlatform,
-                apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
-                tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
-                apiScheme: "https" /* DefaultConfig.API_SCHEME */,
-                sdkClientVersion: _getClientVersion(clientPlatform)
-            };
-            var authInstance = new AuthImpl(app, heartbeatServiceProvider, config);
-            _initializeAuthInstance(authInstance, deps);
-            return authInstance;
-        })(app, heartbeatServiceProvider);
+        _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
+        // Auth domain is optional if IdP sign in isn't being used
+        _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
+            appName: app.name
+        });
+        var config = {
+            apiKey: apiKey,
+            authDomain: authDomain,
+            clientPlatform: clientPlatform,
+            apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
+            tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
+            apiScheme: "https" /* DefaultConfig.API_SCHEME */,
+            sdkClientVersion: _getClientVersion(clientPlatform)
+        };
+        var authInstance = new AuthImpl(app, heartbeatServiceProvider, appCheckServiceProvider, config);
+        _initializeAuthInstance(authInstance, deps);
+        return authInstance;
     }, "PUBLIC" /* ComponentType.PUBLIC */)
         /**
          * Auth can only be initialized by explicitly calling getAuth() or initializeAuth()
@@ -11561,4 +11626,4 @@ function getAuth(app) {
 registerAuth("Browser" /* ClientPlatform.BROWSER */);
 
 export { linkWithCredential as $, ActionCodeOperation as A, deleteUser as B, debugErrorMap as C, prodErrorMap as D, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as E, FactorId as F, initializeAuth as G, connectAuthEmulator as H, AuthCredential as I, EmailAuthCredential as J, OAuthCredential as K, PhoneAuthCredential as L, inMemoryPersistence as M, EmailAuthProvider as N, OperationType as O, PhoneAuthProvider as P, FacebookAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, GoogleAuthProvider as U, GithubAuthProvider as V, OAuthProvider as W, SAMLAuthProvider as X, TwitterAuthProvider as Y, signInAnonymously as Z, signInWithCredential as _, browserSessionPersistence as a, reauthenticateWithCredential as a0, signInWithCustomToken as a1, sendPasswordResetEmail as a2, confirmPasswordReset as a3, applyActionCode as a4, checkActionCode as a5, verifyPasswordResetCode as a6, createUserWithEmailAndPassword as a7, signInWithEmailAndPassword as a8, sendSignInLinkToEmail as a9, AuthEventManager as aA, _getInstance as aB, _persistenceKeyName as aC, _clearRedirectOutcomes as aD, _getRedirectResult as aE, _overrideRedirectResult as aF, _castAuth as aG, UserImpl as aH, AuthImpl as aI, _getClientVersion as aJ, _generateEventId as aK, AuthPopup as aL, FetchProvider as aM, SAMLAuthCredential as aN, isSignInWithEmailLink as aa, signInWithEmailLink as ab, fetchSignInMethodsForEmail as ac, sendEmailVerification as ad, verifyBeforeUpdateEmail as ae, ActionCodeURL as af, parseActionCodeURL as ag, updateProfile as ah, updateEmail as ai, updatePassword as aj, getIdToken as ak, getIdTokenResult as al, unlink as am, getAdditionalUserInfo as an, reload as ao, getMultiFactorResolver as ap, multiFactor as aq, _isIOS as ar, _isAndroid as as, _fail as at, _getRedirectUrl as au, debugAssert as av, _getProjectConfig as aw, _isIOS7Or8 as ax, _assert as ay, _createError as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, onIdTokenChanged as t, updatePhoneNumber as u, beforeAuthStateChanged as v, onAuthStateChanged as w, useDeviceLanguage as x, updateCurrentUser as y, signOut as z };
-//# sourceMappingURL=index-7119ea16.js.map
+//# sourceMappingURL=index-ea49ccf6.js.map