@firebase/auth 0.22.0-canary.b66908df6 → 0.22.0-canary.ecb4454c3

package/dist/browser-cjs/{index-f15d4bca.js → index-2a5c9cce.js}

@@ -2,8 +2,8 @@
 
 var util = require('@firebase/util');
 var app = require('@firebase/app');
-var logger = require('@firebase/logger');
 var tslib = require('tslib');
+var logger = require('@firebase/logger');
 var component = require('@firebase/component');
 
 /**
@@ -267,7 +267,15 @@ function _debugErrorMap() {
         ["already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */]: 'initializeAuth() has already been called with ' +
             'different options. To avoid this error, call initializeAuth() with the ' +
             'same options as when it was originally called, or call getAuth() to return the' +
-            ' already initialized instance.'
+            ' already initialized instance.',
+        ["missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */]: 'The reCAPTCHA token is missing when sending request to the backend.',
+        ["invalid-recaptcha-token" /* AuthErrorCode.INVALID_RECAPTCHA_TOKEN */]: 'The reCAPTCHA token is invalid when sending request to the backend.',
+        ["invalid-recaptcha-action" /* AuthErrorCode.INVALID_RECAPTCHA_ACTION */]: 'The reCAPTCHA action is invalid when sending request to the backend.',
+        ["recaptcha-not-enabled" /* AuthErrorCode.RECAPTCHA_NOT_ENABLED */]: 'reCAPTCHA Enterprise integration is not enabled for this project.',
+        ["missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */]: 'The reCAPTCHA client type is missing when sending request to the backend.',
+        ["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */]: 'The reCAPTCHA version is missing when sending request to the backend.',
+        ["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */]: 'Invalid request parameters.',
+        ["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */]: 'The reCAPTCHA version is invalid when sending request to the backend.'
     };
 }
 function _prodErrorMap() {
@@ -403,7 +411,15 @@ const AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
     USER_SIGNED_OUT: 'auth/user-signed-out',
     WEAK_PASSWORD: 'auth/weak-password',
     WEB_STORAGE_UNSUPPORTED: 'auth/web-storage-unsupported',
-    ALREADY_INITIALIZED: 'auth/already-initialized'
+    ALREADY_INITIALIZED: 'auth/already-initialized',
+    RECAPTCHA_NOT_ENABLED: 'auth/recaptcha-not-enabled',
+    MISSING_RECAPTCHA_TOKEN: 'auth/missing-recaptcha-token',
+    INVALID_RECAPTCHA_TOKEN: 'auth/invalid-recaptcha-token',
+    INVALID_RECAPTCHA_ACTION: 'auth/invalid-recaptcha-action',
+    MISSING_CLIENT_TYPE: 'auth/missing-client-type',
+    MISSING_RECAPTCHA_VERSION: 'auth/missing-recaptcha-version',
+    INVALID_RECAPTCHA_VERSION: 'auth/invalid-recaptcha-version',
+    INVALID_REQ_TYPE: 'auth/invalid-req-type'
 };
 
 /**
@@ -518,103 +534,6 @@ function debugAssert(assertion, message) {
     }
 }
 
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-const instanceCache = new Map();
-function _getInstance(cls) {
-    debugAssert(cls instanceof Function, 'Expected a class definition');
-    let instance = instanceCache.get(cls);
-    if (instance) {
-        debugAssert(instance instanceof cls, 'Instance stored in cache mismatched with class');
-        return instance;
-    }
-    instance = new cls();
-    instanceCache.set(cls, instance);
-    return instance;
-}
-
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * Initializes an {@link Auth} instance with fine-grained control over
- * {@link Dependencies}.
- *
- * @remarks
- *
- * This function allows more control over the {@link Auth} instance than
- * {@link getAuth}. `getAuth` uses platform-specific defaults to supply
- * the {@link Dependencies}. In general, `getAuth` is the easiest way to
- * initialize Auth and works for most use cases. Use `initializeAuth` if you
- * need control over which persistence layer is used, or to minimize bundle
- * size if you're not using either `signInWithPopup` or `signInWithRedirect`.
- *
- * For example, if your app only uses anonymous accounts and you only want
- * accounts saved for the current session, initialize `Auth` with:
- *
- * ```js
- * const auth = initializeAuth(app, {
- *   persistence: browserSessionPersistence,
- *   popupRedirectResolver: undefined,
- * });
- * ```
- *
- * @public
- */
-function initializeAuth(app$1, deps) {
-    const provider = app._getProvider(app$1, 'auth');
-    if (provider.isInitialized()) {
-        const auth = provider.getImmediate();
-        const initialOptions = provider.getOptions();
-        if (util.deepEqual(initialOptions, deps !== null && deps !== void 0 ? deps : {})) {
-            return auth;
-        }
-        else {
-            _fail(auth, "already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */);
-        }
-    }
-    const auth = provider.initialize({ options: deps });
-    return auth;
-}
-function _initializeAuthInstance(auth, deps) {
-    const persistence = (deps === null || deps === void 0 ? void 0 : deps.persistence) || [];
-    const hierarchy = (Array.isArray(persistence) ? persistence : [persistence]).map(_getInstance);
-    if (deps === null || deps === void 0 ? void 0 : deps.errorMap) {
-        auth._updateErrorMap(deps.errorMap);
-    }
-    // This promise is intended to float; auth initialization happens in the
-    // background, meanwhile the auth object may be used by the app.
-    // eslint-disable-next-line @typescript-eslint/no-floating-promises
-    auth._initializeWithPersistence(hierarchy, deps === null || deps === void 0 ? void 0 : deps.popupRedirectResolver);
-}
-
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -893,7 +812,16 @@ const SERVER_ERROR_MAP = {
     ["SECOND_FACTOR_EXISTS" /* ServerError.SECOND_FACTOR_EXISTS */]: "second-factor-already-in-use" /* AuthErrorCode.SECOND_FACTOR_ALREADY_ENROLLED */,
     ["SECOND_FACTOR_LIMIT_EXCEEDED" /* ServerError.SECOND_FACTOR_LIMIT_EXCEEDED */]: "maximum-second-factor-count-exceeded" /* AuthErrorCode.SECOND_FACTOR_LIMIT_EXCEEDED */,
     // Blocking functions related errors.
-    ["BLOCKING_FUNCTION_ERROR_RESPONSE" /* ServerError.BLOCKING_FUNCTION_ERROR_RESPONSE */]: "internal-error" /* AuthErrorCode.INTERNAL_ERROR */
+    ["BLOCKING_FUNCTION_ERROR_RESPONSE" /* ServerError.BLOCKING_FUNCTION_ERROR_RESPONSE */]: "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
+    // Recaptcha related errors.
+    ["RECAPTCHA_NOT_ENABLED" /* ServerError.RECAPTCHA_NOT_ENABLED */]: "recaptcha-not-enabled" /* AuthErrorCode.RECAPTCHA_NOT_ENABLED */,
+    ["MISSING_RECAPTCHA_TOKEN" /* ServerError.MISSING_RECAPTCHA_TOKEN */]: "missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */,
+    ["INVALID_RECAPTCHA_TOKEN" /* ServerError.INVALID_RECAPTCHA_TOKEN */]: "invalid-recaptcha-token" /* AuthErrorCode.INVALID_RECAPTCHA_TOKEN */,
+    ["INVALID_RECAPTCHA_ACTION" /* ServerError.INVALID_RECAPTCHA_ACTION */]: "invalid-recaptcha-action" /* AuthErrorCode.INVALID_RECAPTCHA_ACTION */,
+    ["MISSING_CLIENT_TYPE" /* ServerError.MISSING_CLIENT_TYPE */]: "missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */,
+    ["MISSING_RECAPTCHA_VERSION" /* ServerError.MISSING_RECAPTCHA_VERSION */]: "missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */,
+    ["INVALID_RECAPTCHA_VERSION" /* ServerError.INVALID_RECAPTCHA_VERSION */]: "invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */,
+    ["INVALID_REQ_TYPE" /* ServerError.INVALID_REQ_TYPE */]: "invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */
 };
 
 /**
@@ -1795,6 +1723,35 @@ class UserImpl {
     }
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const instanceCache = new Map();
+function _getInstance(cls) {
+    debugAssert(cls instanceof Function, 'Expected a class definition');
+    let instance = instanceCache.get(cls);
+    if (instance) {
+        debugAssert(instance instanceof cls, 'Instance stored in cache mismatched with class');
+        return instance;
+    }
+    instance = new cls();
+    instanceCache.set(cls, instance);
+    return instance;
+}
+
 /**
  * @license
  * Copyright 2019 Google LLC
@@ -2136,6 +2093,242 @@ function _getClientVersion(clientPlatform, frameworks = []) {
     return `${reportedPlatform}/${"JsCore" /* ClientImplementation.CORE */}/${app.SDK_VERSION}/${reportedFrameworks}`;
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+async function getRecaptchaParams(auth) {
+    return ((await _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)).recaptchaSiteKey || '');
+}
+async function getRecaptchaConfig(auth, request) {
+    return _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request));
+}
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isV2(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.getResponse !== undefined);
+}
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+class RecaptchaConfig {
+    constructor(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(enforcementState => enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+            enforcementState.enforcementState !== 'OFF');
+    }
+}
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise((resolve, reject) => {
+        const el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = e => {
+            const error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+function _generateCallbackName(prefix) {
+    return `__${prefix}${Math.floor(Math.random() * 1000000)}`;
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+const RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+const RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+class RecaptchaEnterpriseVerifier {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    constructor(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    async verify(action = 'verify', forceRefresh = false) {
+        async function retrieveSiteKey(auth) {
+            if (!forceRefresh) {
+                if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                    return auth._agentRecaptchaConfig.siteKey;
+                }
+                if (auth.tenantId != null &&
+                    auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                    return auth._tenantRecaptchaConfigs[auth.tenantId].siteKey;
+                }
+            }
+            return new Promise(async (resolve, reject) => {
+                getRecaptchaConfig(auth, {
+                    clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                    version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                })
+                    .then(response => {
+                    if (response.recaptchaKey === undefined) {
+                        reject(new Error('recaptcha Enterprise site key undefined'));
+                    }
+                    else {
+                        const config = new RecaptchaConfig(response);
+                        if (auth.tenantId == null) {
+                            auth._agentRecaptchaConfig = config;
+                        }
+                        else {
+                            auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                        }
+                        return resolve(config.siteKey);
+                    }
+                })
+                    .catch(error => {
+                    reject(error);
+                });
+            });
+        }
+        function retrieveRecaptchaToken(siteKey, resolve, reject) {
+            const grecaptcha = window.grecaptcha;
+            if (isEnterprise(grecaptcha)) {
+                grecaptcha.enterprise.ready(() => {
+                    try {
+                        grecaptcha.enterprise
+                            .execute(siteKey, { action })
+                            .then(token => {
+                            resolve(token);
+                        })
+                            .catch(error => {
+                            reject(error);
+                        });
+                    }
+                    catch (error) {
+                        reject(error);
+                    }
+                });
+            }
+            else {
+                reject(Error('No reCAPTCHA enterprise script loaded.'));
+            }
+        }
+        return new Promise((resolve, reject) => {
+            retrieveSiteKey(this.auth)
+                .then(siteKey => {
+                if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                }
+                else {
+                    if (typeof window === 'undefined') {
+                        reject(new Error('RecaptchaVerifier is only supported in browser'));
+                        return;
+                    }
+                    _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                        .then(() => {
+                        retrieveRecaptchaToken(siteKey, resolve, reject);
+                    })
+                        .catch(error => {
+                        reject(error);
+                    });
+                }
+            })
+                .catch(error => {
+                reject(error);
+            });
+        });
+    }
+}
+async function injectRecaptchaFields(auth, request, action, captchaResp = false) {
+    const verifier = new RecaptchaEnterpriseVerifier(auth);
+    let captchaResponse;
+    try {
+        captchaResponse = await verifier.verify(action);
+    }
+    catch (error) {
+        captchaResponse = await verifier.verify(action, true);
+    }
+    const newRequest = Object.assign({}, request);
+    if (!captchaResp) {
+        Object.assign(newRequest, { captchaResponse });
+    }
+    else {
+        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+    }
+    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+    Object.assign(newRequest, {
+        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+    });
+    return newRequest;
+}
+
 /**
  * @license
  * Copyright 2022 Google LLC
@@ -2255,6 +2448,8 @@ class AuthImpl {
         this._initializationPromise = null;
         this._popupRedirectResolver = null;
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
+        this._agentRecaptchaConfig = null;
+        this._tenantRecaptchaConfigs = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -2474,6 +2669,31 @@ class AuthImpl {
             await this.assertedPersistence.setPersistence(_getInstance(persistence));
         });
     }
+    async initializeRecaptchaConfig() {
+        const response = await getRecaptchaConfig(this, {
+            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+        });
+        const config = new RecaptchaConfig(response);
+        if (this.tenantId == null) {
+            this._agentRecaptchaConfig = config;
+        }
+        else {
+            this._tenantRecaptchaConfigs[this.tenantId] = config;
+        }
+        if (config.emailPasswordEnabled) {
+            const verifier = new RecaptchaEnterpriseVerifier(this);
+            void verifier.verify();
+        }
+    }
+    _getRecaptchaConfig() {
+        if (this.tenantId == null) {
+            return this._agentRecaptchaConfig;
+        }
+        else {
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    }
     _getPersistence() {
         return this.assertedPersistence.persistence.type;
     }
@@ -2696,6 +2916,74 @@ class Subscription {
     }
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Initializes an {@link Auth} instance with fine-grained control over
+ * {@link Dependencies}.
+ *
+ * @remarks
+ *
+ * This function allows more control over the {@link Auth} instance than
+ * {@link getAuth}. `getAuth` uses platform-specific defaults to supply
+ * the {@link Dependencies}. In general, `getAuth` is the easiest way to
+ * initialize Auth and works for most use cases. Use `initializeAuth` if you
+ * need control over which persistence layer is used, or to minimize bundle
+ * size if you're not using either `signInWithPopup` or `signInWithRedirect`.
+ *
+ * For example, if your app only uses anonymous accounts and you only want
+ * accounts saved for the current session, initialize `Auth` with:
+ *
+ * ```js
+ * const auth = initializeAuth(app, {
+ *   persistence: browserSessionPersistence,
+ *   popupRedirectResolver: undefined,
+ * });
+ * ```
+ *
+ * @public
+ */
+function initializeAuth(app$1, deps) {
+    const provider = app._getProvider(app$1, 'auth');
+    if (provider.isInitialized()) {
+        const auth = provider.getImmediate();
+        const initialOptions = provider.getOptions();
+        if (util.deepEqual(initialOptions, deps !== null && deps !== void 0 ? deps : {})) {
+            return auth;
+        }
+        else {
+            _fail(auth, "already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */);
+        }
+    }
+    const auth = provider.initialize({ options: deps });
+    return auth;
+}
+function _initializeAuthInstance(auth, deps) {
+    const persistence = (deps === null || deps === void 0 ? void 0 : deps.persistence) || [];
+    const hierarchy = (Array.isArray(persistence) ? persistence : [persistence]).map(_getInstance);
+    if (deps === null || deps === void 0 ? void 0 : deps.errorMap) {
+        auth._updateErrorMap(deps.errorMap);
+    }
+    // This promise is intended to float; auth initialization happens in the
+    // background, meanwhile the auth object may be used by the app.
+    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+    auth._initializeWithPersistence(hierarchy, deps === null || deps === void 0 ? void 0 : deps.popupRedirectResolver);
+}
+
 /**
  * Changes the {@link Auth} instance to communicate with the Firebase Auth Emulator, instead of production
  * Firebase Auth services.
@@ -3035,13 +3323,31 @@ class EmailAuthCredential extends AuthCredential {
     }
     /** @internal */
     async _getIdTokenResponse(auth) {
+        var _a;
         switch (this.signInMethod) {
             case "password" /* SignInMethod.EMAIL_PASSWORD */:
-                return signInWithPassword(auth, {
+                const request = {
                     returnSecureToken: true,
                     email: this._email,
-                    password: this._password
-                });
+                    password: this._password,
+                    clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+                };
+                if ((_a = auth._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled) {
+                    const requestWithRecaptcha = await injectRecaptchaFields(auth, request, "signInWithPassword" /* RecaptchaActionName.SIGN_IN_WITH_PASSWORD */);
+                    return signInWithPassword(auth, requestWithRecaptcha);
+                }
+                else {
+                    return signInWithPassword(auth, request).catch(async (error) => {
+                        if (error.code === `auth/${"missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */}`) {
+                            console.log('Sign-in with email address and password is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-in flow.');
+                            const requestWithRecaptcha = await injectRecaptchaFields(auth, request, "signInWithPassword" /* RecaptchaActionName.SIGN_IN_WITH_PASSWORD */);
+                            return signInWithPassword(auth, requestWithRecaptcha);
+                        }
+                        else {
+                            return Promise.reject(error);
+                        }
+                    });
+                }
             case "emailLink" /* SignInMethod.EMAIL_LINK */:
                 return signInWithEmailLink$1(auth, {
                     email: this._email,
@@ -5000,15 +5306,39 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * @public
  */
 async function sendPasswordResetEmail(auth, email, actionCodeSettings) {
-    const authModular = util.getModularInstance(auth);
+    var _a;
+    const authInternal = _castAuth(auth);
     const request = {
         requestType: "PASSWORD_RESET" /* ActionCodeOperation.PASSWORD_RESET */,
-        email
+        email,
+        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
     };
-    if (actionCodeSettings) {
-        _setActionCodeSettingsOnRequest(authModular, request, actionCodeSettings);
+    if ((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled) {
+        const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true);
+        if (actionCodeSettings) {
+            _setActionCodeSettingsOnRequest(authInternal, requestWithRecaptcha, actionCodeSettings);
+        }
+        await sendPasswordResetEmail$1(authInternal, requestWithRecaptcha);
+    }
+    else {
+        if (actionCodeSettings) {
+            _setActionCodeSettingsOnRequest(authInternal, request, actionCodeSettings);
+        }
+        await sendPasswordResetEmail$1(authInternal, request)
+            .catch(async (error) => {
+            if (error.code === `auth/${"missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */}`) {
+                console.log('Password resets are protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the password reset flow.');
+                const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true);
+                if (actionCodeSettings) {
+                    _setActionCodeSettingsOnRequest(authInternal, requestWithRecaptcha, actionCodeSettings);
+                }
+                await sendPasswordResetEmail$1(authInternal, requestWithRecaptcha);
+            }
+            else {
+                return Promise.reject(error);
+            }
+        });
     }
-    await sendPasswordResetEmail$1(authModular, request);
 }
 /**
  * Completes the password reset process, given a confirmation code and new password.
@@ -5121,11 +5451,33 @@ async function verifyPasswordResetCode(auth, code) {
  * @public
  */
 async function createUserWithEmailAndPassword(auth, email, password) {
+    var _a;
     const authInternal = _castAuth(auth);
-    const response = await signUp(authInternal, {
+    const request = {
         returnSecureToken: true,
         email,
-        password
+        password,
+        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+    };
+    let signUpResponse;
+    if ((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled) {
+        const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */);
+        signUpResponse = signUp(authInternal, requestWithRecaptcha);
+    }
+    else {
+        signUpResponse = signUp(authInternal, request).catch(async (error) => {
+            if (error.code === `auth/${"missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */}`) {
+                console.log('Sign-up is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-up flow.');
+                const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */);
+                return signUp(authInternal, requestWithRecaptcha);
+            }
+            else {
+                return Promise.reject(error);
+            }
+        });
+    }
+    const response = await signUpResponse.catch(error => {
+        return Promise.reject(error);
     });
     const userCredential = await UserCredentialImpl._fromIdTokenResponse(authInternal, "signIn" /* OperationType.SIGN_IN */, response);
     await authInternal._updateCurrentUser(userCredential.user);
@@ -5206,16 +5558,39 @@ function signInWithEmailAndPassword(auth, email, password) {
  * @public
  */
 async function sendSignInLinkToEmail(auth, email, actionCodeSettings) {
-    const authModular = util.getModularInstance(auth);
+    var _a;
+    const authInternal = _castAuth(auth);
     const request = {
         requestType: "EMAIL_SIGNIN" /* ActionCodeOperation.EMAIL_SIGNIN */,
-        email
+        email,
+        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
     };
-    _assert(actionCodeSettings.handleCodeInApp, authModular, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
-    if (actionCodeSettings) {
-        _setActionCodeSettingsOnRequest(authModular, request, actionCodeSettings);
+    function setActionCodeSettings(request, actionCodeSettings) {
+        _assert(actionCodeSettings.handleCodeInApp, authInternal, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+        if (actionCodeSettings) {
+            _setActionCodeSettingsOnRequest(authInternal, request, actionCodeSettings);
+        }
+    }
+    if ((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled) {
+        const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true);
+        setActionCodeSettings(requestWithRecaptcha, actionCodeSettings);
+        await sendSignInLinkToEmail$1(authInternal, requestWithRecaptcha);
+    }
+    else {
+        setActionCodeSettings(request, actionCodeSettings);
+        await sendSignInLinkToEmail$1(authInternal, request)
+            .catch(async (error) => {
+            if (error.code === `auth/${"missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */}`) {
+                console.log('Email link sign-in is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-in flow.');
+                const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true);
+                setActionCodeSettings(requestWithRecaptcha, actionCodeSettings);
+                await sendSignInLinkToEmail$1(authInternal, requestWithRecaptcha);
+            }
+            else {
+                return Promise.reject(error);
+            }
+        });
     }
-    await sendSignInLinkToEmail$1(authModular, request);
 }
 /**
  * Checks if an incoming link is a sign-in with email link suitable for {@link signInWithEmailLink}.
@@ -5710,6 +6085,35 @@ function getAdditionalUserInfo(userCredential) {
 function setPersistence(auth, persistence) {
     return util.getModularInstance(auth).setPersistence(persistence);
 }
+/**
+ * Loads the reCAPTCHA configuration into the `Auth` instance.
+ *
+ * @remarks
+ * This will load the reCAPTCHA config, which indicates whether the reCAPTCHA
+ * verification flow should be triggered for each auth provider, into the
+ * current Auth session.
+ *
+ * If initializeRecaptchaConfig() is not invoked, the auth flow will always start
+ * without reCAPTCHA verification. If the provider is configured to require reCAPTCHA
+ * verification, the SDK will transparently load the reCAPTCHA config and restart the
+ * auth flows.
+ *
+ * Thus, by calling this optional method, you will reduce the latency of future auth flows.
+ * Loading the reCAPTCHA config early will also enhance the signal collected by reCAPTCHA.
+ *
+ * @example
+ * ```javascript
+ * initializeRecaptchaConfig(auth);
+ * ```
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @public
+ */
+function initializeRecaptchaConfig(auth) {
+    const authInternal = _castAuth(auth);
+    return authInternal.initializeRecaptchaConfig();
+}
 /**
  * Adds an observer for changes to the signed-in user's ID token.
  *
@@ -7055,66 +7459,6 @@ function finalizeSignInTotpMfa(auth, request) {
     return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/mfaSignIn:finalize" /* Endpoint.FINALIZE_MFA_SIGN_IN */, _addTidIfNecessary(auth, request));
 }
 
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-async function getRecaptchaParams(auth) {
-    return ((await _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)).recaptchaSiteKey || '');
-}
-
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-function getScriptParentElement() {
-    var _a, _b;
-    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
-}
-function _loadJS(url) {
-    // TODO: consider adding timeout support & cancellation
-    return new Promise((resolve, reject) => {
-        const el = document.createElement('script');
-        el.setAttribute('src', url);
-        el.onload = resolve;
-        el.onerror = e => {
-            const error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            error.customData = e;
-            reject(error);
-        };
-        el.type = 'text/javascript';
-        el.charset = 'UTF-8';
-        getScriptParentElement().appendChild(el);
-    });
-}
-function _generateCallbackName(prefix) {
-    return `__${prefix}${Math.floor(Math.random() * 1000000)}`;
-}
-
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -7281,7 +7625,7 @@ class ReCaptchaLoaderImpl {
     }
     load(auth, hl = '') {
         _assert(isHostLanguageValid(hl), auth, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
-        if (this.shouldResolveImmediately(hl)) {
+        if (this.shouldResolveImmediately(hl) && isV2(_window().grecaptcha)) {
             return Promise.resolve(_window().grecaptcha);
         }
         return new Promise((resolve, reject) => {
@@ -7292,7 +7636,7 @@ class ReCaptchaLoaderImpl {
                 _window().clearTimeout(networkTimeout);
                 delete _window()[_JSLOAD_CALLBACK];
                 const recaptcha = _window().grecaptcha;
-                if (!recaptcha) {
+                if (!recaptcha || !isV2(recaptcha)) {
                     reject(_createError(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */));
                     return;
                 }
@@ -9524,7 +9868,7 @@ function _isEmptyString(input) {
 }
 
 var name = "@firebase/auth";
-var version = "0.22.0-canary.b66908df6";
+var version = "0.22.0-canary.ecb4454c3";
 
 /**
  * @license
@@ -9815,6 +10159,7 @@ exports.getRedirectResult = getRedirectResult;
 exports.inMemoryPersistence = inMemoryPersistence;
 exports.indexedDBLocalPersistence = indexedDBLocalPersistence;
 exports.initializeAuth = initializeAuth;
+exports.initializeRecaptchaConfig = initializeRecaptchaConfig;
 exports.isSignInWithEmailLink = isSignInWithEmailLink;
 exports.linkWithCredential = linkWithCredential;
 exports.linkWithPhoneNumber = linkWithPhoneNumber;
@@ -9852,4 +10197,4 @@ exports.updateProfile = updateProfile;
 exports.useDeviceLanguage = useDeviceLanguage;
 exports.verifyBeforeUpdateEmail = verifyBeforeUpdateEmail;
 exports.verifyPasswordResetCode = verifyPasswordResetCode;
-//# sourceMappingURL=index-f15d4bca.js.map
+//# sourceMappingURL=index-2a5c9cce.js.map