@firebase/auth 1.1.0-canary.223ac18f7 → 1.1.0-canary.43e402fb4

package/README.md

@@ -54,7 +54,7 @@ firebase emulators:exec --project foo-bar --only auth "yarn test:integration:loc
 
 ### Integration testing with the production backend
 
-Currently, MFA TOTP tests only run against the production backend (since they are not supported on the emulator yet).
+Currently, MFA TOTP and password policy tests only run against the production backend (since they are not supported on the emulator yet).
 Running against the backend also makes it a more reliable end-to-end test.
 
 The TOTP tests require the following email/password combination to exist in the project, so if you are running this test against your test project, please create this user:
@@ -71,6 +71,33 @@ curl   -H "Authorization: Bearer $(gcloud auth print-access-token)"   -H "Conten
     }'
 ```
 
+The password policy tests require a tenant configured with a password policy that requires all options to exist in the project.
+
+If you are running this test against your test project, please create the tenant and configure the policy with the following curl command:
+
+```
+curl   -H "Authorization: Bearer $(gcloud auth print-access-token)"   -H "Content-Type: application/json"   -H "X-Goog-User-Project: ${PROJECT_ID}"   -X POST https://identitytoolkit.googleapis.com/v2/projects/${PROJECT_ID}/tenants   -d     '{
+      "displayName": "passpol-tenant",
+      "passwordPolicyConfig": {
+        "passwordPolicyEnforcementState": "ENFORCE",
+        "passwordPolicyVersions": [
+          {
+            "customStrengthOptions": {
+              "minPasswordLength": 8,
+              "maxPasswordLength": 24,
+              "containsLowercaseCharacter": true,
+              "containsUppercaseCharacter": true,
+              "containsNumericCharacter": true,
+              "containsNonAlphanumericCharacter": true
+            }
+          }
+        ]
+      }
+    }'
+```
+
+Replace the tenant ID `passpol-tenant-d7hha` in [test/integration/flows/password_policy.test.ts](https://github.com/firebase/firebase-js-sdk/blob/master/packages/auth/test/integration/flows/password_policy.test.ts) with the ID for the newly created tenant. The tenant ID can be found at the end of the `name` property in the response and is in the format `passpol-tenant-xxxxx`.
+
 ### Selenium Webdriver tests
 
 These tests assume that you have both Firefox and Chrome installed on your

package/dist/auth-public.d.ts

@@ -2254,6 +2254,100 @@ export declare interface ParsedToken {
     [key: string]: unknown;
 }
 
+/**
+ * A structure specifying password policy requirements.
+ *
+ * @public
+ */
+export declare interface PasswordPolicy {
+    /**
+     * Requirements enforced by this password policy.
+     */
+    readonly customStrengthOptions: {
+        /**
+         * Minimum password length, or undefined if not configured.
+         */
+        readonly minPasswordLength?: number;
+        /**
+         * Maximum password length, or undefined if not configured.
+         */
+        readonly maxPasswordLength?: number;
+        /**
+         * Whether the password should contain a lowercase letter, or undefined if not configured.
+         */
+        readonly containsLowercaseLetter?: boolean;
+        /**
+         * Whether the password should contain an uppercase letter, or undefined if not configured.
+         */
+        readonly containsUppercaseLetter?: boolean;
+        /**
+         * Whether the password should contain a numeric character, or undefined if not configured.
+         */
+        readonly containsNumericCharacter?: boolean;
+        /**
+         * Whether the password should contain a non-alphanumeric character, or undefined if not configured.
+         */
+        readonly containsNonAlphanumericCharacter?: boolean;
+    };
+    /**
+     * List of characters that are considered non-alphanumeric during validation.
+     */
+    readonly allowedNonAlphanumericCharacters: string;
+    /**
+     * The enforcement state of the policy. Can be 'OFF' or 'ENFORCE'.
+     */
+    readonly enforcementState: string;
+    /**
+     * Whether existing passwords must meet the policy.
+     */
+    readonly forceUpgradeOnSignin: boolean;
+}
+
+/* Excluded from this release type: PasswordPolicyCustomStrengthOptions */
+
+/* Excluded from this release type: PasswordPolicyInternal */
+
+/**
+ * A structure indicating which password policy requirements were met or violated and what the
+ * requirements are.
+ *
+ * @public
+ */
+export declare interface PasswordValidationStatus {
+    /**
+     * Whether the password meets all requirements.
+     */
+    readonly isValid: boolean;
+    /**
+     * Whether the password meets the minimum password length, or undefined if not required.
+     */
+    readonly meetsMinPasswordLength?: boolean;
+    /**
+     * Whether the password meets the maximum password length, or undefined if not required.
+     */
+    readonly meetsMaxPasswordLength?: boolean;
+    /**
+     * Whether the password contains a lowercase letter, or undefined if not required.
+     */
+    readonly containsLowercaseLetter?: boolean;
+    /**
+     * Whether the password contains an uppercase letter, or undefined if not required.
+     */
+    readonly containsUppercaseLetter?: boolean;
+    /**
+     * Whether the password contains a numeric character, or undefined if not required.
+     */
+    readonly containsNumericCharacter?: boolean;
+    /**
+     * Whether the password contains a non-alphanumeric character, or undefined if not required.
+     */
+    readonly containsNonAlphanumericCharacter?: boolean;
+    /**
+     * The policy used to validate the password.
+     */
+    readonly passwordPolicy: PasswordPolicy;
+}
+
 declare type PersistedBlob = Record<string, unknown>;
 
 /**
@@ -3743,6 +3837,31 @@ declare class UserMetadata_2 implements UserMetadata {
  */
 export declare type UserProfile = Record<string, unknown>;
 
+/**
+ * Validates the password against the password policy configured for the project or tenant.
+ *
+ * @remarks
+ * If no tenant ID is set on the `Auth` instance, then this method will use the password
+ * policy configured for the project. Otherwise, this method will use the policy configured
+ * for the tenant. If a password policy has not been configured, then the default policy
+ * configured for all projects will be used.
+ *
+ * If an auth flow fails because a submitted password does not meet the password policy
+ * requirements and this method has previously been called, then this method will use the
+ * most recent policy available when called again.
+ *
+ * @example
+ * ```javascript
+ * validatePassword(auth, 'some-password');
+ * ```
+ *
+ * @param auth The {@link Auth} instance.
+ * @param password The password to validate.
+ *
+ * @public
+ */
+export declare function validatePassword(auth: Auth, password: string): Promise<PasswordValidationStatus>;
+
 /**
  * Sends a verification email to a new email address.
  *

package/dist/auth.d.ts

@@ -626,7 +626,9 @@ declare const enum AuthErrorCode {
     MISSING_CLIENT_TYPE = "missing-client-type",
     MISSING_RECAPTCHA_VERSION = "missing-recaptcha-version",
     INVALID_RECAPTCHA_VERSION = "invalid-recaptcha-version",
-    INVALID_REQ_TYPE = "invalid-req-type"
+    INVALID_REQ_TYPE = "invalid-req-type",
+    UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION = "unsupported-password-policy-schema-version",
+    PASSWORD_DOES_NOT_MEET_REQUIREMENTS = "password-does-not-meet-requirements"
 }
 
 /**
@@ -854,6 +856,8 @@ declare interface AuthInternal extends Auth {
     emulatorConfig: EmulatorConfig | null;
     _agentRecaptchaConfig: RecaptchaConfig | null;
     _tenantRecaptchaConfigs: Record<string, RecaptchaConfig>;
+    _projectPasswordPolicy: PasswordPolicy | null;
+    _tenantPasswordPolicies: Record<string, PasswordPolicy>;
     _canInitEmulator: boolean;
     _isInitialized: boolean;
     _initializationPromise: Promise<void> | null;
@@ -869,6 +873,8 @@ declare interface AuthInternal extends Auth {
     _stopProactiveRefresh(): void;
     _getPersistence(): string;
     _getRecaptchaConfig(): RecaptchaConfig | null;
+    _getPasswordPolicyInternal(): PasswordPolicyInternal | null;
+    _updatePasswordPolicy(): Promise<void>;
     _logFramework(framework: string): void;
     _getFrameworks(): readonly string[];
     _getAdditionalHeaders(): Promise<Record<string, string>>;
@@ -881,7 +887,7 @@ declare interface AuthInternal extends Auth {
     _errorFactory: ErrorFactory<AuthErrorCode, AuthErrorParams>;
     useDeviceLanguage(): void;
     signOut(): Promise<void>;
-    initializeRecaptchaConfig(): Promise<void>;
+    validatePassword(password: string): Promise<PasswordValidationStatus>;
 }
 
 declare class AuthPopup {
@@ -2593,6 +2599,152 @@ export declare interface ParsedToken {
     [key: string]: unknown;
 }
 
+/**
+ * A structure specifying password policy requirements.
+ *
+ * @public
+ */
+export declare interface PasswordPolicy {
+    /**
+     * Requirements enforced by this password policy.
+     */
+    readonly customStrengthOptions: {
+        /**
+         * Minimum password length, or undefined if not configured.
+         */
+        readonly minPasswordLength?: number;
+        /**
+         * Maximum password length, or undefined if not configured.
+         */
+        readonly maxPasswordLength?: number;
+        /**
+         * Whether the password should contain a lowercase letter, or undefined if not configured.
+         */
+        readonly containsLowercaseLetter?: boolean;
+        /**
+         * Whether the password should contain an uppercase letter, or undefined if not configured.
+         */
+        readonly containsUppercaseLetter?: boolean;
+        /**
+         * Whether the password should contain a numeric character, or undefined if not configured.
+         */
+        readonly containsNumericCharacter?: boolean;
+        /**
+         * Whether the password should contain a non-alphanumeric character, or undefined if not configured.
+         */
+        readonly containsNonAlphanumericCharacter?: boolean;
+    };
+    /**
+     * List of characters that are considered non-alphanumeric during validation.
+     */
+    readonly allowedNonAlphanumericCharacters: string;
+    /**
+     * The enforcement state of the policy. Can be 'OFF' or 'ENFORCE'.
+     */
+    readonly enforcementState: string;
+    /**
+     * Whether existing passwords must meet the policy.
+     */
+    readonly forceUpgradeOnSignin: boolean;
+}
+
+/**
+ * Internal typing of the password policy custom strength options that is modifiable. This
+ * allows us to construct the strength options before storing them in the policy.
+ *
+ * @internal
+ */
+declare interface PasswordPolicyCustomStrengthOptions {
+    /**
+     * Minimum password length.
+     */
+    minPasswordLength?: number;
+    /**
+     * Maximum password length.
+     */
+    maxPasswordLength?: number;
+    /**
+     * Whether the password should contain a lowercase letter.
+     */
+    containsLowercaseLetter?: boolean;
+    /**
+     * Whether the password should contain an uppercase letter.
+     */
+    containsUppercaseLetter?: boolean;
+    /**
+     * Whether the password should contain a numeric character.
+     */
+    containsNumericCharacter?: boolean;
+    /**
+     * Whether the password should contain a non-alphanumeric character.
+     */
+    containsNonAlphanumericCharacter?: boolean;
+}
+
+/**
+ * Internal typing of password policy that includes the schema version and methods for
+ * validating that a password meets the policy. The developer does not need access to
+ * these properties and methods, so they are excluded from the public typing.
+ *
+ * @internal
+ */
+declare interface PasswordPolicyInternal extends PasswordPolicy {
+    /**
+     * Requirements enforced by the password policy.
+     */
+    readonly customStrengthOptions: PasswordPolicyCustomStrengthOptions;
+    /**
+     * Schema version of the password policy.
+     */
+    readonly schemaVersion: number;
+    /**
+     * Validates the password against the policy.
+     * @param password Password to validate.
+     */
+    validatePassword(password: string): PasswordValidationStatus;
+}
+
+/**
+ * A structure indicating which password policy requirements were met or violated and what the
+ * requirements are.
+ *
+ * @public
+ */
+export declare interface PasswordValidationStatus {
+    /**
+     * Whether the password meets all requirements.
+     */
+    readonly isValid: boolean;
+    /**
+     * Whether the password meets the minimum password length, or undefined if not required.
+     */
+    readonly meetsMinPasswordLength?: boolean;
+    /**
+     * Whether the password meets the maximum password length, or undefined if not required.
+     */
+    readonly meetsMaxPasswordLength?: boolean;
+    /**
+     * Whether the password contains a lowercase letter, or undefined if not required.
+     */
+    readonly containsLowercaseLetter?: boolean;
+    /**
+     * Whether the password contains an uppercase letter, or undefined if not required.
+     */
+    readonly containsUppercaseLetter?: boolean;
+    /**
+     * Whether the password contains a numeric character, or undefined if not required.
+     */
+    readonly containsNumericCharacter?: boolean;
+    /**
+     * Whether the password contains a non-alphanumeric character, or undefined if not required.
+     */
+    readonly containsNonAlphanumericCharacter?: boolean;
+    /**
+     * The policy used to validate the password.
+     */
+    readonly passwordPolicy: PasswordPolicy;
+}
+
 declare type PersistedBlob = Record<string, unknown>;
 
 /**
@@ -4246,6 +4398,31 @@ declare class UserMetadata_2 implements UserMetadata {
  */
 export declare type UserProfile = Record<string, unknown>;
 
+/**
+ * Validates the password against the password policy configured for the project or tenant.
+ *
+ * @remarks
+ * If no tenant ID is set on the `Auth` instance, then this method will use the password
+ * policy configured for the project. Otherwise, this method will use the policy configured
+ * for the tenant. If a password policy has not been configured, then the default policy
+ * configured for all projects will be used.
+ *
+ * If an auth flow fails because a submitted password does not meet the password policy
+ * requirements and this method has previously been called, then this method will use the
+ * most recent policy available when called again.
+ *
+ * @example
+ * ```javascript
+ * validatePassword(auth, 'some-password');
+ * ```
+ *
+ * @param auth The {@link Auth} instance.
+ * @param password The password to validate.
+ *
+ * @public
+ */
+export declare function validatePassword(auth: Auth, password: string): Promise<PasswordValidationStatus>;
+
 /**
  * Sends a verification email to a new email address.
  *