@firebase/auth 0.22.0 → 0.23.0-canary.0a27d2fbf

package/dist/cordova/{popup_redirect-3519667a.js → popup_redirect-b3f8e40c.js}

@@ -1,5 +1,5 @@
 import { __awaiter, __generator, __spreadArray, __assign, __rest, __extends } from 'tslib';
-import { ErrorFactory, deepEqual, isBrowserExtension, isMobileCordova, isReactNative, FirebaseError, querystring, getModularInstance, base64Decode, isIE, getUA, createSubscribe, querystringDecode, extractQuerystring, isEmpty } from '@firebase/util';
+import { ErrorFactory, isBrowserExtension, isMobileCordova, isReactNative, FirebaseError, querystring, getModularInstance, base64Decode, isIE, getUA, createSubscribe, deepEqual, querystringDecode, extractQuerystring, isEmpty } from '@firebase/util';
 import { SDK_VERSION, _getProvider, _registerComponent, registerVersion } from '@firebase/app';
 import { Component } from '@firebase/component';
 import { Logger, LogLevel } from '@firebase/logger';
@@ -1082,6 +1082,14 @@ function _debugErrorMap() {
             'different options. To avoid this error, call initializeAuth() with the ' +
             'same options as when it was originally called, or call getAuth() to return the' +
             ' already initialized instance.',
+        _a["missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */] = 'The reCAPTCHA token is missing when sending request to the backend.',
+        _a["invalid-recaptcha-token" /* AuthErrorCode.INVALID_RECAPTCHA_TOKEN */] = 'The reCAPTCHA token is invalid when sending request to the backend.',
+        _a["invalid-recaptcha-action" /* AuthErrorCode.INVALID_RECAPTCHA_ACTION */] = 'The reCAPTCHA action is invalid when sending request to the backend.',
+        _a["recaptcha-not-enabled" /* AuthErrorCode.RECAPTCHA_NOT_ENABLED */] = 'reCAPTCHA Enterprise integration is not enabled for this project.',
+        _a["missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */] = 'The reCAPTCHA client type is missing when sending request to the backend.',
+        _a["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is missing when sending request to the backend.',
+        _a["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */] = 'Invalid request parameters.',
+        _a["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is invalid when sending request to the backend.',
         _a;
 }
 function _prodErrorMap() {
@@ -1218,7 +1226,15 @@ var AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
     USER_SIGNED_OUT: 'auth/user-signed-out',
     WEAK_PASSWORD: 'auth/weak-password',
     WEB_STORAGE_UNSUPPORTED: 'auth/web-storage-unsupported',
-    ALREADY_INITIALIZED: 'auth/already-initialized'
+    ALREADY_INITIALIZED: 'auth/already-initialized',
+    RECAPTCHA_NOT_ENABLED: 'auth/recaptcha-not-enabled',
+    MISSING_RECAPTCHA_TOKEN: 'auth/missing-recaptcha-token',
+    INVALID_RECAPTCHA_TOKEN: 'auth/invalid-recaptcha-token',
+    INVALID_RECAPTCHA_ACTION: 'auth/invalid-recaptcha-action',
+    MISSING_CLIENT_TYPE: 'auth/missing-client-type',
+    MISSING_RECAPTCHA_VERSION: 'auth/missing-recaptcha-version',
+    INVALID_RECAPTCHA_VERSION: 'auth/invalid-recaptcha-version',
+    INVALID_REQ_TYPE: 'auth/invalid-req-type'
 };
 
 /**
@@ -1238,6 +1254,15 @@ var AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
  * limitations under the License.
  */
 var logClient = new Logger('@firebase/auth');
+function _logWarn(msg) {
+    var args = [];
+    for (var _i = 1; _i < arguments.length; _i++) {
+        args[_i - 1] = arguments[_i];
+    }
+    if (logClient.logLevel <= LogLevel.WARN) {
+        logClient.warn.apply(logClient, __spreadArray(["Auth (".concat(SDK_VERSION, "): ").concat(msg)], args, false));
+    }
+}
 function _logError(msg) {
     var args = [];
     for (var _i = 1; _i < arguments.length; _i++) {
@@ -1350,103 +1375,6 @@ function debugAssert(assertion, message) {
     }
 }
 
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-var instanceCache = new Map();
-function _getInstance(cls) {
-    debugAssert(cls instanceof Function, 'Expected a class definition');
-    var instance = instanceCache.get(cls);
-    if (instance) {
-        debugAssert(instance instanceof cls, 'Instance stored in cache mismatched with class');
-        return instance;
-    }
-    instance = new cls();
-    instanceCache.set(cls, instance);
-    return instance;
-}
-
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * Initializes an {@link Auth} instance with fine-grained control over
- * {@link Dependencies}.
- *
- * @remarks
- *
- * This function allows more control over the {@link Auth} instance than
- * {@link getAuth}. `getAuth` uses platform-specific defaults to supply
- * the {@link Dependencies}. In general, `getAuth` is the easiest way to
- * initialize Auth and works for most use cases. Use `initializeAuth` if you
- * need control over which persistence layer is used, or to minimize bundle
- * size if you're not using either `signInWithPopup` or `signInWithRedirect`.
- *
- * For example, if your app only uses anonymous accounts and you only want
- * accounts saved for the current session, initialize `Auth` with:
- *
- * ```js
- * const auth = initializeAuth(app, {
- *   persistence: browserSessionPersistence,
- *   popupRedirectResolver: undefined,
- * });
- * ```
- *
- * @public
- */
-function initializeAuth(app, deps) {
-    var provider = _getProvider(app, 'auth');
-    if (provider.isInitialized()) {
-        var auth_1 = provider.getImmediate();
-        var initialOptions = provider.getOptions();
-        if (deepEqual(initialOptions, deps !== null && deps !== void 0 ? deps : {})) {
-            return auth_1;
-        }
-        else {
-            _fail(auth_1, "already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */);
-        }
-    }
-    var auth = provider.initialize({ options: deps });
-    return auth;
-}
-function _initializeAuthInstance(auth, deps) {
-    var persistence = (deps === null || deps === void 0 ? void 0 : deps.persistence) || [];
-    var hierarchy = (Array.isArray(persistence) ? persistence : [persistence]).map(_getInstance);
-    if (deps === null || deps === void 0 ? void 0 : deps.errorMap) {
-        auth._updateErrorMap(deps.errorMap);
-    }
-    // This promise is intended to float; auth initialization happens in the
-    // background, meanwhile the auth object may be used by the app.
-    // eslint-disable-next-line @typescript-eslint/no-floating-promises
-    auth._initializeWithPersistence(hierarchy, deps === null || deps === void 0 ? void 0 : deps.popupRedirectResolver);
-}
-
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -1731,6 +1659,15 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     _a$1["SECOND_FACTOR_LIMIT_EXCEEDED" /* ServerError.SECOND_FACTOR_LIMIT_EXCEEDED */] = "maximum-second-factor-count-exceeded" /* AuthErrorCode.SECOND_FACTOR_LIMIT_EXCEEDED */,
     // Blocking functions related errors.
     _a$1["BLOCKING_FUNCTION_ERROR_RESPONSE" /* ServerError.BLOCKING_FUNCTION_ERROR_RESPONSE */] = "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
+    // Recaptcha related errors.
+    _a$1["RECAPTCHA_NOT_ENABLED" /* ServerError.RECAPTCHA_NOT_ENABLED */] = "recaptcha-not-enabled" /* AuthErrorCode.RECAPTCHA_NOT_ENABLED */,
+    _a$1["MISSING_RECAPTCHA_TOKEN" /* ServerError.MISSING_RECAPTCHA_TOKEN */] = "missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */,
+    _a$1["INVALID_RECAPTCHA_TOKEN" /* ServerError.INVALID_RECAPTCHA_TOKEN */] = "invalid-recaptcha-token" /* AuthErrorCode.INVALID_RECAPTCHA_TOKEN */,
+    _a$1["INVALID_RECAPTCHA_ACTION" /* ServerError.INVALID_RECAPTCHA_ACTION */] = "invalid-recaptcha-action" /* AuthErrorCode.INVALID_RECAPTCHA_ACTION */,
+    _a$1["MISSING_CLIENT_TYPE" /* ServerError.MISSING_CLIENT_TYPE */] = "missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */,
+    _a$1["MISSING_RECAPTCHA_VERSION" /* ServerError.MISSING_RECAPTCHA_VERSION */] = "missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */,
+    _a$1["INVALID_RECAPTCHA_VERSION" /* ServerError.INVALID_RECAPTCHA_VERSION */] = "invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */,
+    _a$1["INVALID_REQ_TYPE" /* ServerError.INVALID_REQ_TYPE */] = "invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */,
     _a$1);
 
 /**
@@ -2852,6 +2789,35 @@ var UserImpl = /** @class */ (function () {
     return UserImpl;
 }());
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var instanceCache = new Map();
+function _getInstance(cls) {
+    debugAssert(cls instanceof Function, 'Expected a class definition');
+    var instance = instanceCache.get(cls);
+    if (instance) {
+        debugAssert(instance instanceof cls, 'Instance stored in cache mismatched with class');
+        return instance;
+    }
+    instance = new cls();
+    instanceCache.set(cls, instance);
+    return instance;
+}
+
 /**
  * @license
  * Copyright 2019 Google LLC
@@ -3290,6 +3256,288 @@ function _getClientVersion(clientPlatform, frameworks) {
     return "".concat(reportedPlatform, "/").concat("JsCore" /* ClientImplementation.CORE */, "/").concat(SDK_VERSION, "/").concat(reportedFrameworks);
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getRecaptchaParams(auth) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)];
+                case 1: return [2 /*return*/, ((_a.sent()).recaptchaSiteKey || '')];
+            }
+        });
+    });
+}
+function getRecaptchaConfig(auth, request) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+        });
+    });
+}
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isV2(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.getResponse !== undefined);
+}
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+var RecaptchaConfig = /** @class */ (function () {
+    function RecaptchaConfig(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
+            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+                enforcementState.enforcementState !== 'OFF';
+        });
+    }
+    return RecaptchaConfig;
+}());
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise(function (resolve, reject) {
+        var el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = function (e) {
+            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+function _generateCallbackName(prefix) {
+    return "__".concat(prefix).concat(Math.floor(Math.random() * 1000000));
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+var RecaptchaEnterpriseVerifier = /** @class */ (function () {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    function RecaptchaEnterpriseVerifier(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
+        if (action === void 0) { action = 'verify'; }
+        if (forceRefresh === void 0) { forceRefresh = false; }
+        return __awaiter(this, void 0, void 0, function () {
+            function retrieveSiteKey(auth) {
+                return __awaiter(this, void 0, void 0, function () {
+                    var _this = this;
+                    return __generator(this, function (_a) {
+                        if (!forceRefresh) {
+                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
+                            }
+                            if (auth.tenantId != null &&
+                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
+                            }
+                        }
+                        return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    getRecaptchaConfig(auth, {
+                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                                    })
+                                        .then(function (response) {
+                                        if (response.recaptchaKey === undefined) {
+                                            reject(new Error('recaptcha Enterprise site key undefined'));
+                                        }
+                                        else {
+                                            var config = new RecaptchaConfig(response);
+                                            if (auth.tenantId == null) {
+                                                auth._agentRecaptchaConfig = config;
+                                            }
+                                            else {
+                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                                            }
+                                            return resolve(config.siteKey);
+                                        }
+                                    })
+                                        .catch(function (error) {
+                                        reject(error);
+                                    });
+                                    return [2 /*return*/];
+                                });
+                            }); })];
+                    });
+                });
+            }
+            function retrieveRecaptchaToken(siteKey, resolve, reject) {
+                var grecaptcha = window.grecaptcha;
+                if (isEnterprise(grecaptcha)) {
+                    grecaptcha.enterprise.ready(function () {
+                        try {
+                            grecaptcha.enterprise
+                                .execute(siteKey, { action: action })
+                                .then(function (token) {
+                                resolve(token);
+                            })
+                                .catch(function (error) {
+                                reject(error);
+                            });
+                        }
+                        catch (error) {
+                            reject(error);
+                        }
+                    });
+                }
+                else {
+                    reject(Error('No reCAPTCHA enterprise script loaded.'));
+                }
+            }
+            var _this = this;
+            return __generator(this, function (_a) {
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        retrieveSiteKey(_this.auth)
+                            .then(function (siteKey) {
+                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                                retrieveRecaptchaToken(siteKey, resolve, reject);
+                            }
+                            else {
+                                if (typeof window === 'undefined') {
+                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
+                                    return;
+                                }
+                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                                    .then(function () {
+                                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                                })
+                                    .catch(function (error) {
+                                    reject(error);
+                                });
+                            }
+                        })
+                            .catch(function (error) {
+                            reject(error);
+                        });
+                    })];
+            });
+        });
+    };
+    return RecaptchaEnterpriseVerifier;
+}());
+function injectRecaptchaFields(auth, request, action, captchaResp) {
+    if (captchaResp === void 0) { captchaResp = false; }
+    return __awaiter(this, void 0, void 0, function () {
+        var verifier, captchaResponse, newRequest;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    verifier = new RecaptchaEnterpriseVerifier(auth);
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 5]);
+                    return [4 /*yield*/, verifier.verify(action)];
+                case 2:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, verifier.verify(action, true)];
+                case 4:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 5:
+                    newRequest = __assign({}, request);
+                    if (!captchaResp) {
+                        Object.assign(newRequest, { captchaResponse: captchaResponse });
+                    }
+                    else {
+                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+                    }
+                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+                    Object.assign(newRequest, {
+                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                    });
+                    return [2 /*return*/, newRequest];
+            }
+        });
+    });
+}
+
 /**
  * @license
  * Copyright 2022 Google LLC
@@ -3411,9 +3659,10 @@ var AuthMiddlewareQueue = /** @class */ (function () {
  * limitations under the License.
  */
 var AuthImpl = /** @class */ (function () {
-    function AuthImpl(app, heartbeatServiceProvider, config) {
+    function AuthImpl(app, heartbeatServiceProvider, appCheckServiceProvider, config) {
         this.app = app;
         this.heartbeatServiceProvider = heartbeatServiceProvider;
+        this.appCheckServiceProvider = appCheckServiceProvider;
         this.config = config;
         this.currentUser = null;
         this.emulatorConfig = null;
@@ -3431,6 +3680,8 @@ var AuthImpl = /** @class */ (function () {
         this._initializationPromise = null;
         this._popupRedirectResolver = null;
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
+        this._agentRecaptchaConfig = null;
+        this._tenantRecaptchaConfigs = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -3760,6 +4011,41 @@ var AuthImpl = /** @class */ (function () {
             });
         }); });
     };
+    AuthImpl.prototype.initializeRecaptchaConfig = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var response, config, verifier;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, getRecaptchaConfig(this, {
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                        })];
+                    case 1:
+                        response = _a.sent();
+                        config = new RecaptchaConfig(response);
+                        if (this.tenantId == null) {
+                            this._agentRecaptchaConfig = config;
+                        }
+                        else {
+                            this._tenantRecaptchaConfigs[this.tenantId] = config;
+                        }
+                        if (config.emailPasswordEnabled) {
+                            verifier = new RecaptchaEnterpriseVerifier(this);
+                            void verifier.verify();
+                        }
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    AuthImpl.prototype._getRecaptchaConfig = function () {
+        if (this.tenantId == null) {
+            return this._agentRecaptchaConfig;
+        }
+        else {
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    };
     AuthImpl.prototype._getPersistence = function () {
         return this.assertedPersistence.persistence.type;
     };
@@ -3987,7 +4273,7 @@ var AuthImpl = /** @class */ (function () {
     AuthImpl.prototype._getAdditionalHeaders = function () {
         var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var headers, heartbeatsHeader;
+            var headers, heartbeatsHeader, appCheckToken;
             var _b;
             return __generator(this, function (_c) {
                 switch (_c.label) {
@@ -4007,11 +4293,39 @@ var AuthImpl = /** @class */ (function () {
                         if (heartbeatsHeader) {
                             headers["X-Firebase-Client" /* HttpHeader.X_FIREBASE_CLIENT */] = heartbeatsHeader;
                         }
+                        return [4 /*yield*/, this._getAppCheckToken()];
+                    case 2:
+                        appCheckToken = _c.sent();
+                        if (appCheckToken) {
+                            headers["X-Firebase-AppCheck" /* HttpHeader.X_FIREBASE_APP_CHECK */] = appCheckToken;
+                        }
                         return [2 /*return*/, headers];
                 }
             });
         });
     };
+    AuthImpl.prototype._getAppCheckToken = function () {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var appCheckTokenResult;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, ((_a = this.appCheckServiceProvider
+                            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken())];
+                    case 1:
+                        appCheckTokenResult = _b.sent();
+                        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
+                            // Context: appCheck.getToken() will never throw even if an error happened.
+                            // In the error case, a dummy token will be returned along with an error field describing
+                            // the error. In general, we shouldn't care about the error condition and just use
+                            // the token (actual or dummy) to send requests.
+                            _logWarn("Error while retrieving App Check token: ".concat(appCheckTokenResult.error));
+                        }
+                        return [2 /*return*/, appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token];
+                }
+            });
+        });
+    };
     return AuthImpl;
 }());
 /**
@@ -4042,6 +4356,74 @@ var Subscription = /** @class */ (function () {
     return Subscription;
 }());
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Initializes an {@link Auth} instance with fine-grained control over
+ * {@link Dependencies}.
+ *
+ * @remarks
+ *
+ * This function allows more control over the {@link Auth} instance than
+ * {@link getAuth}. `getAuth` uses platform-specific defaults to supply
+ * the {@link Dependencies}. In general, `getAuth` is the easiest way to
+ * initialize Auth and works for most use cases. Use `initializeAuth` if you
+ * need control over which persistence layer is used, or to minimize bundle
+ * size if you're not using either `signInWithPopup` or `signInWithRedirect`.
+ *
+ * For example, if your app only uses anonymous accounts and you only want
+ * accounts saved for the current session, initialize `Auth` with:
+ *
+ * ```js
+ * const auth = initializeAuth(app, {
+ *   persistence: browserSessionPersistence,
+ *   popupRedirectResolver: undefined,
+ * });
+ * ```
+ *
+ * @public
+ */
+function initializeAuth(app, deps) {
+    var provider = _getProvider(app, 'auth');
+    if (provider.isInitialized()) {
+        var auth_1 = provider.getImmediate();
+        var initialOptions = provider.getOptions();
+        if (deepEqual(initialOptions, deps !== null && deps !== void 0 ? deps : {})) {
+            return auth_1;
+        }
+        else {
+            _fail(auth_1, "already-initialized" /* AuthErrorCode.ALREADY_INITIALIZED */);
+        }
+    }
+    var auth = provider.initialize({ options: deps });
+    return auth;
+}
+function _initializeAuthInstance(auth, deps) {
+    var persistence = (deps === null || deps === void 0 ? void 0 : deps.persistence) || [];
+    var hierarchy = (Array.isArray(persistence) ? persistence : [persistence]).map(_getInstance);
+    if (deps === null || deps === void 0 ? void 0 : deps.errorMap) {
+        auth._updateErrorMap(deps.errorMap);
+    }
+    // This promise is intended to float; auth initialization happens in the
+    // background, meanwhile the auth object may be used by the app.
+    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+    auth._initializeWithPersistence(hierarchy, deps === null || deps === void 0 ? void 0 : deps.popupRedirectResolver);
+}
+
 /**
  * Changes the {@link Auth} instance to communicate with the Firebase Auth Emulator, instead of production
  * Firebase Auth services.
@@ -4430,24 +4812,55 @@ var EmailAuthCredential = /** @class */ (function (_super) {
     };
     /** @internal */
     EmailAuthCredential.prototype._getIdTokenResponse = function (auth) {
+        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                switch (this.signInMethod) {
-                    case "password" /* SignInMethod.EMAIL_PASSWORD */:
-                        return [2 /*return*/, signInWithPassword(auth, {
-                                returnSecureToken: true,
-                                email: this._email,
-                                password: this._password
-                            })];
-                    case "emailLink" /* SignInMethod.EMAIL_LINK */:
-                        return [2 /*return*/, signInWithEmailLink$1(auth, {
-                                email: this._email,
-                                oobCode: this._password
-                            })];
-                    default:
+            var _b, request_1, requestWithRecaptcha;
+            var _this = this;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        _b = this.signInMethod;
+                        switch (_b) {
+                            case "password" /* SignInMethod.EMAIL_PASSWORD */: return [3 /*break*/, 1];
+                            case "emailLink" /* SignInMethod.EMAIL_LINK */: return [3 /*break*/, 4];
+                        }
+                        return [3 /*break*/, 5];
+                    case 1:
+                        request_1 = {
+                            returnSecureToken: true,
+                            email: this._email,
+                            password: this._password,
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+                        };
+                        if (!((_a = auth._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 3];
+                        return [4 /*yield*/, injectRecaptchaFields(auth, request_1, "signInWithPassword" /* RecaptchaActionName.SIGN_IN_WITH_PASSWORD */)];
+                    case 2:
+                        requestWithRecaptcha = _c.sent();
+                        return [2 /*return*/, signInWithPassword(auth, requestWithRecaptcha)];
+                    case 3: return [2 /*return*/, signInWithPassword(auth, request_1).catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                            var requestWithRecaptcha;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 2];
+                                        console.log('Sign-in with email address and password is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-in flow.');
+                                        return [4 /*yield*/, injectRecaptchaFields(auth, request_1, "signInWithPassword" /* RecaptchaActionName.SIGN_IN_WITH_PASSWORD */)];
+                                    case 1:
+                                        requestWithRecaptcha = _a.sent();
+                                        return [2 /*return*/, signInWithPassword(auth, requestWithRecaptcha)];
+                                    case 2: return [2 /*return*/, Promise.reject(error)];
+                                }
+                            });
+                        }); })];
+                    case 4: return [2 /*return*/, signInWithEmailLink$1(auth, {
+                            email: this._email,
+                            oobCode: this._password
+                        })];
+                    case 5:
                         _fail(auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+                        _c.label = 6;
+                    case 6: return [2 /*return*/];
                 }
-                return [2 /*return*/];
             });
         });
     };
@@ -6634,23 +7047,61 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * @public
  */
 function sendPasswordResetEmail(auth, email, actionCodeSettings) {
+    var _a;
     return __awaiter(this, void 0, void 0, function () {
-        var authModular, request;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
+        var authInternal, request, requestWithRecaptcha;
+        var _this = this;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
-                    authModular = getModularInstance(auth);
+                    authInternal = _castAuth(auth);
                     request = {
                         requestType: "PASSWORD_RESET" /* ActionCodeOperation.PASSWORD_RESET */,
-                        email: email
+                        email: email,
+                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
                     };
+                    if (!((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 3];
+                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
+                case 1:
+                    requestWithRecaptcha = _b.sent();
                     if (actionCodeSettings) {
-                        _setActionCodeSettingsOnRequest(authModular, request, actionCodeSettings);
+                        _setActionCodeSettingsOnRequest(authInternal, requestWithRecaptcha, actionCodeSettings);
                     }
-                    return [4 /*yield*/, sendPasswordResetEmail$1(authModular, request)];
-                case 1:
-                    _a.sent();
-                    return [2 /*return*/];
+                    return [4 /*yield*/, sendPasswordResetEmail$1(authInternal, requestWithRecaptcha)];
+                case 2:
+                    _b.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    if (actionCodeSettings) {
+                        _setActionCodeSettingsOnRequest(authInternal, request, actionCodeSettings);
+                    }
+                    return [4 /*yield*/, sendPasswordResetEmail$1(authInternal, request)
+                            .catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                            var requestWithRecaptcha;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 3];
+                                        console.log('Password resets are protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the password reset flow.');
+                                        return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
+                                    case 1:
+                                        requestWithRecaptcha = _a.sent();
+                                        if (actionCodeSettings) {
+                                            _setActionCodeSettingsOnRequest(authInternal, requestWithRecaptcha, actionCodeSettings);
+                                        }
+                                        return [4 /*yield*/, sendPasswordResetEmail$1(authInternal, requestWithRecaptcha)];
+                                    case 2:
+                                        _a.sent();
+                                        return [3 /*break*/, 4];
+                                    case 3: return [2 /*return*/, Promise.reject(error)];
+                                    case 4: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 4:
+                    _b.sent();
+                    _b.label = 5;
+                case 5: return [2 /*return*/];
             }
         });
     });
@@ -6795,25 +7246,54 @@ function verifyPasswordResetCode(auth, code) {
  * @public
  */
 function createUserWithEmailAndPassword(auth, email, password) {
+    var _a;
     return __awaiter(this, void 0, void 0, function () {
-        var authInternal, response, userCredential;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
+        var authInternal, request, signUpResponse, requestWithRecaptcha, response, userCredential;
+        var _this = this;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
                     authInternal = _castAuth(auth);
-                    return [4 /*yield*/, signUp(authInternal, {
-                            returnSecureToken: true,
-                            email: email,
-                            password: password
-                        })];
+                    request = {
+                        returnSecureToken: true,
+                        email: email,
+                        password: password,
+                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+                    };
+                    if (!((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 2];
+                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */)];
                 case 1:
-                    response = _a.sent();
-                    return [4 /*yield*/, UserCredentialImpl._fromIdTokenResponse(authInternal, "signIn" /* OperationType.SIGN_IN */, response)];
+                    requestWithRecaptcha = _b.sent();
+                    signUpResponse = signUp(authInternal, requestWithRecaptcha);
+                    return [3 /*break*/, 3];
                 case 2:
-                    userCredential = _a.sent();
+                    signUpResponse = signUp(authInternal, request).catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                        var requestWithRecaptcha;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 2];
+                                    console.log('Sign-up is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-up flow.');
+                                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */)];
+                                case 1:
+                                    requestWithRecaptcha = _a.sent();
+                                    return [2 /*return*/, signUp(authInternal, requestWithRecaptcha)];
+                                case 2: return [2 /*return*/, Promise.reject(error)];
+                            }
+                        });
+                    }); });
+                    _b.label = 3;
+                case 3: return [4 /*yield*/, signUpResponse.catch(function (error) {
+                        return Promise.reject(error);
+                    })];
+                case 4:
+                    response = _b.sent();
+                    return [4 /*yield*/, UserCredentialImpl._fromIdTokenResponse(authInternal, "signIn" /* OperationType.SIGN_IN */, response)];
+                case 5:
+                    userCredential = _b.sent();
                     return [4 /*yield*/, authInternal._updateCurrentUser(userCredential.user)];
-                case 3:
-                    _a.sent();
+                case 6:
+                    _b.sent();
                     return [2 /*return*/, userCredential];
             }
         });
@@ -6894,24 +7374,61 @@ function signInWithEmailAndPassword(auth, email, password) {
  * @public
  */
 function sendSignInLinkToEmail(auth, email, actionCodeSettings) {
+    var _a;
     return __awaiter(this, void 0, void 0, function () {
-        var authModular, request;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
+        function setActionCodeSettings(request, actionCodeSettings) {
+            _assert(actionCodeSettings.handleCodeInApp, authInternal, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
+            if (actionCodeSettings) {
+                _setActionCodeSettingsOnRequest(authInternal, request, actionCodeSettings);
+            }
+        }
+        var authInternal, request, requestWithRecaptcha;
+        var _this = this;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
-                    authModular = getModularInstance(auth);
+                    authInternal = _castAuth(auth);
                     request = {
                         requestType: "EMAIL_SIGNIN" /* ActionCodeOperation.EMAIL_SIGNIN */,
-                        email: email
+                        email: email,
+                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
                     };
-                    _assert(actionCodeSettings.handleCodeInApp, authModular, "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */);
-                    if (actionCodeSettings) {
-                        _setActionCodeSettingsOnRequest(authModular, request, actionCodeSettings);
-                    }
-                    return [4 /*yield*/, sendSignInLinkToEmail$1(authModular, request)];
+                    if (!((_a = authInternal._getRecaptchaConfig()) === null || _a === void 0 ? void 0 : _a.emailPasswordEnabled)) return [3 /*break*/, 3];
+                    return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
                 case 1:
-                    _a.sent();
-                    return [2 /*return*/];
+                    requestWithRecaptcha = _b.sent();
+                    setActionCodeSettings(requestWithRecaptcha, actionCodeSettings);
+                    return [4 /*yield*/, sendSignInLinkToEmail$1(authInternal, requestWithRecaptcha)];
+                case 2:
+                    _b.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    setActionCodeSettings(request, actionCodeSettings);
+                    return [4 /*yield*/, sendSignInLinkToEmail$1(authInternal, request)
+                            .catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                            var requestWithRecaptcha;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        if (!(error.code === "auth/".concat("missing-recaptcha-token" /* AuthErrorCode.MISSING_RECAPTCHA_TOKEN */))) return [3 /*break*/, 3];
+                                        console.log('Email link sign-in is protected by reCAPTCHA for this project. Automatically triggering the reCAPTCHA flow and restarting the sign-in flow.');
+                                        return [4 /*yield*/, injectRecaptchaFields(authInternal, request, "getOobCode" /* RecaptchaActionName.GET_OOB_CODE */, true)];
+                                    case 1:
+                                        requestWithRecaptcha = _a.sent();
+                                        setActionCodeSettings(requestWithRecaptcha, actionCodeSettings);
+                                        return [4 /*yield*/, sendSignInLinkToEmail$1(authInternal, requestWithRecaptcha)];
+                                    case 2:
+                                        _a.sent();
+                                        return [3 /*break*/, 4];
+                                    case 3: return [2 /*return*/, Promise.reject(error)];
+                                    case 4: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 4:
+                    _b.sent();
+                    _b.label = 5;
+                case 5: return [2 /*return*/];
             }
         });
     });
@@ -7507,6 +8024,35 @@ function getAdditionalUserInfo(userCredential) {
 function setPersistence(auth, persistence) {
     return getModularInstance(auth).setPersistence(persistence);
 }
+/**
+ * Loads the reCAPTCHA configuration into the `Auth` instance.
+ *
+ * @remarks
+ * This will load the reCAPTCHA config, which indicates whether the reCAPTCHA
+ * verification flow should be triggered for each auth provider, into the
+ * current Auth session.
+ *
+ * If initializeRecaptchaConfig() is not invoked, the auth flow will always start
+ * without reCAPTCHA verification. If the provider is configured to require reCAPTCHA
+ * verification, the SDK will transparently load the reCAPTCHA config and restart the
+ * auth flows.
+ *
+ * Thus, by calling this optional method, you will reduce the latency of future auth flows.
+ * Loading the reCAPTCHA config early will also enhance the signal collected by reCAPTCHA.
+ *
+ * @example
+ * ```javascript
+ * initializeRecaptchaConfig(auth);
+ * ```
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @public
+ */
+function initializeRecaptchaConfig(auth) {
+    var authInternal = _castAuth(auth);
+    return authInternal.initializeRecaptchaConfig();
+}
 /**
  * Adds an observer for changes to the signed-in user's ID token.
  *
@@ -7911,7 +8457,7 @@ function multiFactor(user) {
 }
 
 var name = "@firebase/auth";
-var version = "0.22.0";
+var version = "0.23.0-canary.0a27d2fbf";
 
 /**
  * @license
@@ -8031,26 +8577,25 @@ function registerAuth(clientPlatform) {
         var deps = _a.options;
         var app = container.getProvider('app').getImmediate();
         var heartbeatServiceProvider = container.getProvider('heartbeat');
+        var appCheckServiceProvider = container.getProvider('app-check-internal');
         var _b = app.options, apiKey = _b.apiKey, authDomain = _b.authDomain;
-        return (function (app, heartbeatServiceProvider) {
-            _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
-            // Auth domain is optional if IdP sign in isn't being used
-            _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
-                appName: app.name
-            });
-            var config = {
-                apiKey: apiKey,
-                authDomain: authDomain,
-                clientPlatform: clientPlatform,
-                apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
-                tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
-                apiScheme: "https" /* DefaultConfig.API_SCHEME */,
-                sdkClientVersion: _getClientVersion(clientPlatform)
-            };
-            var authInstance = new AuthImpl(app, heartbeatServiceProvider, config);
-            _initializeAuthInstance(authInstance, deps);
-            return authInstance;
-        })(app, heartbeatServiceProvider);
+        _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
+        // Auth domain is optional if IdP sign in isn't being used
+        _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
+            appName: app.name
+        });
+        var config = {
+            apiKey: apiKey,
+            authDomain: authDomain,
+            clientPlatform: clientPlatform,
+            apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
+            tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
+            apiScheme: "https" /* DefaultConfig.API_SCHEME */,
+            sdkClientVersion: _getClientVersion(clientPlatform)
+        };
+        var authInstance = new AuthImpl(app, heartbeatServiceProvider, appCheckServiceProvider, config);
+        _initializeAuthInstance(authInstance, deps);
+        return authInstance;
     }, "PUBLIC" /* ComponentType.PUBLIC */)
         /**
          * Auth can only be initialized by explicitly calling getAuth() or initializeAuth()
@@ -9251,48 +9796,67 @@ var WIDGET_PATH = '__/auth/handler';
  * @internal
  */
 var EMULATOR_WIDGET_PATH = 'emulator/auth/handler';
+/**
+ * Fragment name for the App Check token that gets passed to the widget
+ *
+ * @internal
+ */
+var FIREBASE_APP_CHECK_FRAGMENT_ID = encodeURIComponent('fac');
 function _getRedirectUrl(auth, provider, authType, redirectUrl, eventId, additionalParams) {
-    _assert(auth.config.authDomain, auth, "auth-domain-config-required" /* AuthErrorCode.MISSING_AUTH_DOMAIN */);
-    _assert(auth.config.apiKey, auth, "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */);
-    var params = {
-        apiKey: auth.config.apiKey,
-        appName: auth.name,
-        authType: authType,
-        redirectUrl: redirectUrl,
-        v: SDK_VERSION,
-        eventId: eventId
-    };
-    if (provider instanceof FederatedAuthProvider) {
-        provider.setDefaultLanguage(auth.languageCode);
-        params.providerId = provider.providerId || '';
-        if (!isEmpty(provider.getCustomParameters())) {
-            params.customParameters = JSON.stringify(provider.getCustomParameters());
-        }
-        // TODO set additionalParams from the provider as well?
-        for (var _i = 0, _a = Object.entries(additionalParams || {}); _i < _a.length; _i++) {
-            var _b = _a[_i], key = _b[0], value = _b[1];
-            params[key] = value;
-        }
-    }
-    if (provider instanceof BaseOAuthProvider) {
-        var scopes = provider.getScopes().filter(function (scope) { return scope !== ''; });
-        if (scopes.length > 0) {
-            params.scopes = scopes.join(',');
-        }
-    }
-    if (auth.tenantId) {
-        params.tid = auth.tenantId;
-    }
-    // TODO: maybe set eid as endipointId
-    // TODO: maybe set fw as Frameworks.join(",")
-    var paramsDict = params;
-    for (var _c = 0, _d = Object.keys(paramsDict); _c < _d.length; _c++) {
-        var key = _d[_c];
-        if (paramsDict[key] === undefined) {
-            delete paramsDict[key];
-        }
-    }
-    return "".concat(getHandlerBase(auth), "?").concat(querystring(paramsDict).slice(1));
+    return __awaiter(this, void 0, void 0, function () {
+        var params, _i, _a, _b, key, value, scopes, paramsDict, _c, _d, key, appCheckToken, appCheckTokenFragment;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    _assert(auth.config.authDomain, auth, "auth-domain-config-required" /* AuthErrorCode.MISSING_AUTH_DOMAIN */);
+                    _assert(auth.config.apiKey, auth, "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */);
+                    params = {
+                        apiKey: auth.config.apiKey,
+                        appName: auth.name,
+                        authType: authType,
+                        redirectUrl: redirectUrl,
+                        v: SDK_VERSION,
+                        eventId: eventId
+                    };
+                    if (provider instanceof FederatedAuthProvider) {
+                        provider.setDefaultLanguage(auth.languageCode);
+                        params.providerId = provider.providerId || '';
+                        if (!isEmpty(provider.getCustomParameters())) {
+                            params.customParameters = JSON.stringify(provider.getCustomParameters());
+                        }
+                        // TODO set additionalParams from the provider as well?
+                        for (_i = 0, _a = Object.entries(additionalParams || {}); _i < _a.length; _i++) {
+                            _b = _a[_i], key = _b[0], value = _b[1];
+                            params[key] = value;
+                        }
+                    }
+                    if (provider instanceof BaseOAuthProvider) {
+                        scopes = provider.getScopes().filter(function (scope) { return scope !== ''; });
+                        if (scopes.length > 0) {
+                            params.scopes = scopes.join(',');
+                        }
+                    }
+                    if (auth.tenantId) {
+                        params.tid = auth.tenantId;
+                    }
+                    paramsDict = params;
+                    for (_c = 0, _d = Object.keys(paramsDict); _c < _d.length; _c++) {
+                        key = _d[_c];
+                        if (paramsDict[key] === undefined) {
+                            delete paramsDict[key];
+                        }
+                    }
+                    return [4 /*yield*/, auth._getAppCheckToken()];
+                case 1:
+                    appCheckToken = _e.sent();
+                    appCheckTokenFragment = appCheckToken
+                        ? "#".concat(FIREBASE_APP_CHECK_FRAGMENT_ID, "=").concat(encodeURIComponent(appCheckToken))
+                        : '';
+                    // Start at index 1 to skip the leading '&' in the query string
+                    return [2 /*return*/, "".concat(getHandlerBase(auth), "?").concat(querystring(paramsDict).slice(1)).concat(appCheckTokenFragment)];
+            }
+        });
+    });
 }
 function getHandlerBase(_a) {
     var config = _a.config;
@@ -10093,5 +10657,5 @@ function generateNoEvent() {
     };
 }
 
-export { signInWithEmailLink as $, ActionCodeOperation as A, FacebookAuthProvider as B, GithubAuthProvider as C, OAuthProvider as D, EmailAuthCredential as E, FactorId as F, GoogleAuthProvider as G, SAMLAuthProvider as H, signInAnonymously as I, signInWithCredential as J, linkWithCredential as K, reauthenticateWithCredential as L, signInWithCustomToken as M, sendPasswordResetEmail as N, OperationType as O, ProviderId as P, confirmPasswordReset as Q, applyActionCode as R, SignInMethod as S, TwitterAuthProvider as T, checkActionCode as U, verifyPasswordResetCode as V, createUserWithEmailAndPassword as W, signInWithEmailAndPassword as X, sendSignInLinkToEmail as Y, isSignInWithEmailLink as Z, _signInWithRedirect as _, _reauthenticateWithRedirect as a, fetchSignInMethodsForEmail as a0, sendEmailVerification as a1, verifyBeforeUpdateEmail as a2, ActionCodeURL as a3, parseActionCodeURL as a4, updateProfile as a5, updateEmail as a6, updatePassword as a7, getIdToken as a8, getIdTokenResult as a9, _getCurrentUrl as aA, _emulatorUrl as aB, _isChromeIOS as aC, _isFirefox as aD, _isIOSStandalone as aE, _getRedirectUrl as aF, _setWindowLocation as aG, _isMobileBrowser as aH, _isSafari as aI, _isIOS as aJ, _getRedirectResult as aK, _overrideRedirectResult as aL, AuthEventManager as aM, debugFail as aN, finalizeEnrollPhoneMfa as aO, finalizeEnrollTotpMfa as aP, startEnrollTotpMfa as aQ, _persistenceKeyName as aR, UserImpl as aS, _getInstance as aT, AuthImpl as aU, _getClientVersion as aV, FetchProvider as aW, SAMLAuthCredential as aX, signInWithRedirect as aY, linkWithRedirect as aZ, reauthenticateWithRedirect as a_, unlink as aa, getAdditionalUserInfo as ab, reload as ac, getMultiFactorResolver as ad, multiFactor as ae, _performApiRequest as af, _addTidIfNecessary as ag, _createError as ah, _assert as ai, Delay as aj, _window as ak, _isHttpOrHttps as al, _isWorker as am, _castAuth as an, _assertLinkedStatus as ao, sendPhoneVerificationCode as ap, startEnrollPhoneMfa as aq, _link$1 as ar, debugAssert as as, _generateEventId as at, AbstractPopupRedirectOperation as au, _assertInstanceOf as av, _withDefaultResolver as aw, FederatedAuthProvider as ax, _fail as ay, _getProjectConfig as az, _linkWithRedirect as b, indexedDBLocalPersistence as c, cordovaPopupRedirectResolver as d, browserLocalPersistence as e, browserSessionPersistence as f, getRedirectResult as g, beforeAuthStateChanged as h, initializeAuth as i, onAuthStateChanged as j, updateCurrentUser as k, signOut as l, deleteUser as m, debugErrorMap as n, onIdTokenChanged as o, prodErrorMap as p, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as q, registerAuth as r, setPersistence as s, connectAuthEmulator as t, useDeviceLanguage as u, AuthCredential as v, OAuthCredential as w, PhoneAuthCredential as x, inMemoryPersistence as y, EmailAuthProvider as z };
-//# sourceMappingURL=popup_redirect-3519667a.js.map
+export { isSignInWithEmailLink as $, ActionCodeOperation as A, EmailAuthProvider as B, FacebookAuthProvider as C, GithubAuthProvider as D, EmailAuthCredential as E, FactorId as F, GoogleAuthProvider as G, OAuthProvider as H, SAMLAuthProvider as I, signInAnonymously as J, signInWithCredential as K, linkWithCredential as L, reauthenticateWithCredential as M, signInWithCustomToken as N, OperationType as O, ProviderId as P, sendPasswordResetEmail as Q, confirmPasswordReset as R, SignInMethod as S, TwitterAuthProvider as T, applyActionCode as U, checkActionCode as V, verifyPasswordResetCode as W, createUserWithEmailAndPassword as X, signInWithEmailAndPassword as Y, sendSignInLinkToEmail as Z, _signInWithRedirect as _, _reauthenticateWithRedirect as a, FetchProvider as a$, signInWithEmailLink as a0, fetchSignInMethodsForEmail as a1, sendEmailVerification as a2, verifyBeforeUpdateEmail as a3, ActionCodeURL as a4, parseActionCodeURL as a5, updateProfile as a6, updateEmail as a7, updatePassword as a8, getIdToken as a9, _assertInstanceOf as aA, _withDefaultResolver as aB, FederatedAuthProvider as aC, _fail as aD, _getProjectConfig as aE, _getCurrentUrl as aF, _emulatorUrl as aG, _isChromeIOS as aH, _isFirefox as aI, _isIOSStandalone as aJ, _getRedirectUrl as aK, _setWindowLocation as aL, _isMobileBrowser as aM, _isSafari as aN, _isIOS as aO, _getRedirectResult as aP, _overrideRedirectResult as aQ, AuthEventManager as aR, debugFail as aS, finalizeEnrollPhoneMfa as aT, finalizeEnrollTotpMfa as aU, startEnrollTotpMfa as aV, _persistenceKeyName as aW, UserImpl as aX, _getInstance as aY, AuthImpl as aZ, _getClientVersion as a_, getIdTokenResult as aa, unlink as ab, getAdditionalUserInfo as ac, reload as ad, getMultiFactorResolver as ae, multiFactor as af, _performApiRequest as ag, _addTidIfNecessary as ah, _assert as ai, Delay as aj, _window as ak, isV2 as al, _createError as am, _loadJS as an, _generateCallbackName as ao, getRecaptchaParams as ap, _isHttpOrHttps as aq, _isWorker as ar, _castAuth as as, _assertLinkedStatus as at, sendPhoneVerificationCode as au, startEnrollPhoneMfa as av, _link$1 as aw, debugAssert as ax, _generateEventId as ay, AbstractPopupRedirectOperation as az, _linkWithRedirect as b, SAMLAuthCredential as b0, signInWithRedirect as b1, linkWithRedirect as b2, reauthenticateWithRedirect as b3, indexedDBLocalPersistence as c, cordovaPopupRedirectResolver as d, browserLocalPersistence as e, browserSessionPersistence as f, getRedirectResult as g, initializeRecaptchaConfig as h, initializeAuth as i, beforeAuthStateChanged as j, onAuthStateChanged as k, updateCurrentUser as l, signOut as m, deleteUser as n, onIdTokenChanged as o, debugErrorMap as p, prodErrorMap as q, registerAuth as r, setPersistence as s, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as t, useDeviceLanguage as u, connectAuthEmulator as v, AuthCredential as w, OAuthCredential as x, PhoneAuthCredential as y, inMemoryPersistence as z };
+//# sourceMappingURL=popup_redirect-b3f8e40c.js.map