@firebase/auth 1.1.0-canary.e037eeed6 → 1.1.0-canary.f497a400a

package/dist/esm2017/index.js

@@ -1,7 +1,7 @@
-export { A as ActionCodeOperation, ag as ActionCodeURL, J as AuthCredential, G as AuthErrorCodes, K as EmailAuthCredential, Q as EmailAuthProvider, U as FacebookAuthProvider, F as FactorId, W as GithubAuthProvider, V as GoogleAuthProvider, L as OAuthCredential, X as OAuthProvider, O as OperationType, M as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, Y as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, Z as TwitterAuthProvider, a5 as applyActionCode, w as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a6 as checkActionCode, a4 as confirmPasswordReset, I as connectAuthEmulator, a8 as createUserWithEmailAndPassword, D as debugErrorMap, C as deleteUser, ad as fetchSignInMethodsForEmail, ao as getAdditionalUserInfo, o as getAuth, al as getIdToken, am as getIdTokenResult, aq as getMultiFactorResolver, j as getRedirectResult, N as inMemoryPersistence, i as indexedDBLocalPersistence, H as initializeAuth, t as initializeRecaptchaConfig, ab as isSignInWithEmailLink, a0 as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, ar as multiFactor, x as onAuthStateChanged, v as onIdTokenChanged, ah as parseActionCodeURL, E as prodErrorMap, a1 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ap as reload, ae as sendEmailVerification, a3 as sendPasswordResetEmail, aa as sendSignInLinkToEmail, q as setPersistence, _ as signInAnonymously, $ as signInWithCredential, a2 as signInWithCustomToken, a9 as signInWithEmailAndPassword, ac as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, B as signOut, an as unlink, z as updateCurrentUser, aj as updateEmail, ak as updatePassword, u as updatePhoneNumber, ai as updateProfile, y as useDeviceLanguage, af as verifyBeforeUpdateEmail, a7 as verifyPasswordResetCode } from './index-f8a66098.js';
+export { A as ActionCodeOperation, ah as ActionCodeURL, K as AuthCredential, H as AuthErrorCodes, L as EmailAuthCredential, U as EmailAuthProvider, V as FacebookAuthProvider, F as FactorId, X as GithubAuthProvider, W as GoogleAuthProvider, M as OAuthCredential, Y as OAuthProvider, O as OperationType, N as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, Z as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, _ as TwitterAuthProvider, a6 as applyActionCode, x as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a7 as checkActionCode, a5 as confirmPasswordReset, J as connectAuthEmulator, a9 as createUserWithEmailAndPassword, E as debugErrorMap, D as deleteUser, ae as fetchSignInMethodsForEmail, ap as getAdditionalUserInfo, o as getAuth, am as getIdToken, an as getIdTokenResult, ar as getMultiFactorResolver, j as getRedirectResult, Q as inMemoryPersistence, i as indexedDBLocalPersistence, I as initializeAuth, t as initializeRecaptchaConfig, ac as isSignInWithEmailLink, a1 as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, as as multiFactor, y as onAuthStateChanged, w as onIdTokenChanged, ai as parseActionCodeURL, G as prodErrorMap, a2 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, aq as reload, af as sendEmailVerification, a4 as sendPasswordResetEmail, ab as sendSignInLinkToEmail, q as setPersistence, $ as signInAnonymously, a0 as signInWithCredential, a3 as signInWithCustomToken, aa as signInWithEmailAndPassword, ad as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, C as signOut, ao as unlink, B as updateCurrentUser, ak as updateEmail, al as updatePassword, u as updatePhoneNumber, aj as updateProfile, z as useDeviceLanguage, v as validatePassword, ag as verifyBeforeUpdateEmail, a8 as verifyPasswordResetCode } from './index-9be3d514.js';
 import '@firebase/util';
 import '@firebase/app';
-import 'tslib';
 import '@firebase/logger';
+import 'tslib';
 import '@firebase/component';
 //# sourceMappingURL=index.js.map

package/dist/esm2017/internal.js

@@ -1,9 +1,9 @@
-import { as as debugAssert, at as _isIOS, au as _isAndroid, av as _fail, aw as _getRedirectUrl, ax as _getProjectConfig, ay as _isIOS7Or8, az as _createError, aA as _assert, aB as AuthEventManager, aC as _getInstance, b as browserLocalPersistence, aD as _persistenceKeyName, a as browserSessionPersistence, aE as _getRedirectResult, aF as _overrideRedirectResult, aG as _clearRedirectOutcomes, aH as _castAuth } from './index-f8a66098.js';
-export { A as ActionCodeOperation, ag as ActionCodeURL, J as AuthCredential, G as AuthErrorCodes, aJ as AuthImpl, aM as AuthPopup, K as EmailAuthCredential, Q as EmailAuthProvider, U as FacebookAuthProvider, F as FactorId, aN as FetchProvider, W as GithubAuthProvider, V as GoogleAuthProvider, L as OAuthCredential, X as OAuthProvider, O as OperationType, M as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, aO as SAMLAuthCredential, Y as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, Z as TwitterAuthProvider, aI as UserImpl, aA as _assert, aH as _castAuth, av as _fail, aL as _generateEventId, aK as _getClientVersion, aC as _getInstance, aE as _getRedirectResult, aF as _overrideRedirectResult, aD as _persistenceKeyName, a5 as applyActionCode, w as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a6 as checkActionCode, a4 as confirmPasswordReset, I as connectAuthEmulator, a8 as createUserWithEmailAndPassword, D as debugErrorMap, C as deleteUser, ad as fetchSignInMethodsForEmail, ao as getAdditionalUserInfo, o as getAuth, al as getIdToken, am as getIdTokenResult, aq as getMultiFactorResolver, j as getRedirectResult, N as inMemoryPersistence, i as indexedDBLocalPersistence, H as initializeAuth, t as initializeRecaptchaConfig, ab as isSignInWithEmailLink, a0 as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, ar as multiFactor, x as onAuthStateChanged, v as onIdTokenChanged, ah as parseActionCodeURL, E as prodErrorMap, a1 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, ap as reload, ae as sendEmailVerification, a3 as sendPasswordResetEmail, aa as sendSignInLinkToEmail, q as setPersistence, _ as signInAnonymously, $ as signInWithCredential, a2 as signInWithCustomToken, a9 as signInWithEmailAndPassword, ac as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, B as signOut, an as unlink, z as updateCurrentUser, aj as updateEmail, ak as updatePassword, u as updatePhoneNumber, ai as updateProfile, y as useDeviceLanguage, af as verifyBeforeUpdateEmail, a7 as verifyPasswordResetCode } from './index-f8a66098.js';
+import { at as debugAssert, au as _isIOS, av as _isAndroid, aw as _fail, ax as _getRedirectUrl, ay as _getProjectConfig, az as _isIOS7Or8, aA as _createError, aB as _assert, aC as AuthEventManager, aD as _getInstance, b as browserLocalPersistence, aE as _persistenceKeyName, a as browserSessionPersistence, aF as _getRedirectResult, aG as _overrideRedirectResult, aH as _clearRedirectOutcomes, aI as _castAuth } from './index-9be3d514.js';
+export { A as ActionCodeOperation, ah as ActionCodeURL, K as AuthCredential, H as AuthErrorCodes, aK as AuthImpl, aN as AuthPopup, L as EmailAuthCredential, U as EmailAuthProvider, V as FacebookAuthProvider, F as FactorId, aO as FetchProvider, X as GithubAuthProvider, W as GoogleAuthProvider, M as OAuthCredential, Y as OAuthProvider, O as OperationType, N as PhoneAuthCredential, P as PhoneAuthProvider, m as PhoneMultiFactorGenerator, p as ProviderId, R as RecaptchaVerifier, aP as SAMLAuthCredential, Z as SAMLAuthProvider, S as SignInMethod, T as TotpMultiFactorGenerator, n as TotpSecret, _ as TwitterAuthProvider, aJ as UserImpl, aB as _assert, aI as _castAuth, aw as _fail, aM as _generateEventId, aL as _getClientVersion, aD as _getInstance, aF as _getRedirectResult, aG as _overrideRedirectResult, aE as _persistenceKeyName, a6 as applyActionCode, x as beforeAuthStateChanged, b as browserLocalPersistence, k as browserPopupRedirectResolver, a as browserSessionPersistence, a7 as checkActionCode, a5 as confirmPasswordReset, J as connectAuthEmulator, a9 as createUserWithEmailAndPassword, E as debugErrorMap, D as deleteUser, ae as fetchSignInMethodsForEmail, ap as getAdditionalUserInfo, o as getAuth, am as getIdToken, an as getIdTokenResult, ar as getMultiFactorResolver, j as getRedirectResult, Q as inMemoryPersistence, i as indexedDBLocalPersistence, I as initializeAuth, t as initializeRecaptchaConfig, ac as isSignInWithEmailLink, a1 as linkWithCredential, l as linkWithPhoneNumber, d as linkWithPopup, g as linkWithRedirect, as as multiFactor, y as onAuthStateChanged, w as onIdTokenChanged, ai as parseActionCodeURL, G as prodErrorMap, a2 as reauthenticateWithCredential, r as reauthenticateWithPhoneNumber, e as reauthenticateWithPopup, h as reauthenticateWithRedirect, aq as reload, af as sendEmailVerification, a4 as sendPasswordResetEmail, ab as sendSignInLinkToEmail, q as setPersistence, $ as signInAnonymously, a0 as signInWithCredential, a3 as signInWithCustomToken, aa as signInWithEmailAndPassword, ad as signInWithEmailLink, s as signInWithPhoneNumber, c as signInWithPopup, f as signInWithRedirect, C as signOut, ao as unlink, B as updateCurrentUser, ak as updateEmail, al as updatePassword, u as updatePhoneNumber, aj as updateProfile, z as useDeviceLanguage, v as validatePassword, ag as verifyBeforeUpdateEmail, a8 as verifyPasswordResetCode } from './index-9be3d514.js';
 import { querystringDecode } from '@firebase/util';
 import '@firebase/app';
-import 'tslib';
 import '@firebase/logger';
+import 'tslib';
 import '@firebase/component';
 
 /**

package/dist/esm2017/src/api/errors.d.ts

@@ -96,7 +96,8 @@ export declare const enum ServerError {
     MISSING_CLIENT_TYPE = "MISSING_CLIENT_TYPE",
     MISSING_RECAPTCHA_VERSION = "MISSING_RECAPTCHA_VERSION",
     INVALID_RECAPTCHA_VERSION = "INVALID_RECAPTCHA_VERSION",
-    INVALID_REQ_TYPE = "INVALID_REQ_TYPE"
+    INVALID_REQ_TYPE = "INVALID_REQ_TYPE",
+    PASSWORD_DOES_NOT_MEET_REQUIREMENTS = "PASSWORD_DOES_NOT_MEET_REQUIREMENTS"
 }
 /**
  * API Response in the event of an error

package/dist/esm2017/src/api/index.d.ts

@@ -53,7 +53,8 @@ export declare const enum Endpoint {
     FINALIZE_MFA_SIGN_IN = "/v2/accounts/mfaSignIn:finalize",
     WITHDRAW_MFA = "/v2/accounts/mfaEnrollment:withdraw",
     GET_PROJECT_CONFIG = "/v1/projects",
-    GET_RECAPTCHA_CONFIG = "/v2/recaptchaConfig"
+    GET_RECAPTCHA_CONFIG = "/v2/recaptchaConfig",
+    GET_PASSWORD_POLICY = "/v2/passwordPolicy"
 }
 export declare const enum RecaptchaClientType {
     WEB = "CLIENT_TYPE_WEB",

package/dist/esm2017/src/api/password_policy/get_password_policy.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Auth } from '../../model/public_types';
+/**
+ * Request object for fetching the password policy.
+ */
+export interface GetPasswordPolicyRequest {
+    tenantId?: string;
+}
+/**
+ * Response object for fetching the password policy.
+ */
+export interface GetPasswordPolicyResponse {
+    customStrengthOptions: {
+        minPasswordLength?: number;
+        maxPasswordLength?: number;
+        containsLowercaseCharacter?: boolean;
+        containsUppercaseCharacter?: boolean;
+        containsNumericCharacter?: boolean;
+        containsNonAlphanumericCharacter?: boolean;
+    };
+    allowedNonAlphanumericCharacters?: string[];
+    enforcementState: string;
+    forceUpgradeOnSignin?: boolean;
+    schemaVersion: number;
+}
+/**
+ * Fetches the password policy for the currently set tenant or the project if no tenant is set.
+ *
+ * @param auth Auth object.
+ * @param request Password policy request.
+ * @returns Password policy response.
+ */
+export declare function _getPasswordPolicy(auth: Auth, request?: GetPasswordPolicyRequest): Promise<GetPasswordPolicyResponse>;

package/dist/esm2017/src/api/password_policy/get_password_policy.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {};

package/dist/esm2017/src/core/auth/auth_impl.d.ts

@@ -17,7 +17,7 @@
 import { _FirebaseService, FirebaseApp } from '@firebase/app';
 import { Provider } from '@firebase/component';
 import { AppCheckInternalComponentName } from '@firebase/app-check-interop-types';
-import { Auth, AuthErrorMap, AuthSettings, EmulatorConfig, NextOrObserver, Persistence, PopupRedirectResolver, User, CompleteFn, ErrorFn, Unsubscribe } from '../../model/public_types';
+import { Auth, AuthErrorMap, AuthSettings, EmulatorConfig, NextOrObserver, Persistence, PopupRedirectResolver, User, CompleteFn, ErrorFn, Unsubscribe, PasswordValidationStatus } from '../../model/public_types';
 import { ErrorFactory } from '@firebase/util';
 import { AuthInternal, ConfigInternal } from '../../model/auth';
 import { PopupRedirectResolverInternal } from '../../model/popup_redirect';
@@ -25,6 +25,7 @@ import { UserInternal } from '../../model/user';
 import { AuthErrorCode, AuthErrorParams } from '../errors';
 import { PersistenceInternal } from '../persistence';
 import { RecaptchaConfig } from '../../platform_browser/recaptcha/recaptcha';
+import { PasswordPolicyInternal } from '../../model/password_policy';
 export declare const enum DefaultConfig {
     TOKEN_API_HOST = "securetoken.googleapis.com",
     API_HOST = "identitytoolkit.googleapis.com",
@@ -45,6 +46,7 @@ export declare class AuthImpl implements AuthInternal, _FirebaseService {
     private readonly beforeStateQueue;
     private redirectUser;
     private isProactiveRefreshEnabled;
+    private readonly EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION;
     _canInitEmulator: boolean;
     _isInitialized: boolean;
     _deleted: boolean;
@@ -53,6 +55,8 @@ export declare class AuthImpl implements AuthInternal, _FirebaseService {
     _errorFactory: ErrorFactory<AuthErrorCode, AuthErrorParams>;
     _agentRecaptchaConfig: RecaptchaConfig | null;
     _tenantRecaptchaConfigs: Record<string, RecaptchaConfig>;
+    _projectPasswordPolicy: PasswordPolicyInternal | null;
+    _tenantPasswordPolicies: Record<string, PasswordPolicyInternal>;
     readonly name: string;
     private lastNotifiedUid;
     languageCode: string | null;
@@ -73,8 +77,10 @@ export declare class AuthImpl implements AuthInternal, _FirebaseService {
     _updateCurrentUser(user: User | null, skipBeforeStateCallbacks?: boolean): Promise<void>;
     signOut(): Promise<void>;
     setPersistence(persistence: Persistence): Promise<void>;
-    initializeRecaptchaConfig(): Promise<void>;
     _getRecaptchaConfig(): RecaptchaConfig | null;
+    validatePassword(password: string): Promise<PasswordValidationStatus>;
+    _getPasswordPolicyInternal(): PasswordPolicyInternal | null;
+    _updatePasswordPolicy(): Promise<void>;
     _getPersistence(): string;
     _updateErrorMap(errorMap: AuthErrorMap): void;
     onAuthStateChanged(nextOrObserver: NextOrObserver<User>, error?: ErrorFn, completed?: CompleteFn): Unsubscribe;

package/dist/esm2017/src/core/auth/password_policy_impl.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { GetPasswordPolicyResponse } from '../../api/password_policy/get_password_policy';
+import { PasswordPolicyCustomStrengthOptions, PasswordPolicyInternal } from '../../model/password_policy';
+import { PasswordValidationStatus } from '../../model/public_types';
+/**
+ * Stores password policy requirements and provides password validation against the policy.
+ *
+ * @internal
+ */
+export declare class PasswordPolicyImpl implements PasswordPolicyInternal {
+    readonly customStrengthOptions: PasswordPolicyCustomStrengthOptions;
+    readonly allowedNonAlphanumericCharacters: string;
+    readonly enforcementState: string;
+    readonly forceUpgradeOnSignin: boolean;
+    readonly schemaVersion: number;
+    constructor(response: GetPasswordPolicyResponse);
+    validatePassword(password: string): PasswordValidationStatus;
+    /**
+     * Validates that the password meets the length options for the policy.
+     *
+     * @param password Password to validate.
+     * @param status Validation status.
+     */
+    private validatePasswordLengthOptions;
+    /**
+     * Validates that the password meets the character options for the policy.
+     *
+     * @param password Password to validate.
+     * @param status Validation status.
+     */
+    private validatePasswordCharacterOptions;
+    /**
+     * Updates the running validation status with the statuses for the character options.
+     * Expected to be called each time a character is processed to update each option status
+     * based on the current character.
+     *
+     * @param status Validation status.
+     * @param containsLowercaseCharacter Whether the character is a lowercase letter.
+     * @param containsUppercaseCharacter Whether the character is an uppercase letter.
+     * @param containsNumericCharacter Whether the character is a numeric character.
+     * @param containsNonAlphanumericCharacter Whether the character is a non-alphanumeric character.
+     */
+    private updatePasswordCharacterOptionsStatuses;
+}

package/dist/esm2017/src/core/auth/password_policy_impl.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {};

package/dist/esm2017/src/core/errors.d.ts

@@ -129,7 +129,9 @@ export declare const enum AuthErrorCode {
     MISSING_CLIENT_TYPE = "missing-client-type",
     MISSING_RECAPTCHA_VERSION = "missing-recaptcha-version",
     INVALID_RECAPTCHA_VERSION = "invalid-recaptcha-version",
-    INVALID_REQ_TYPE = "invalid-req-type"
+    INVALID_REQ_TYPE = "invalid-req-type",
+    UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION = "unsupported-password-policy-schema-version",
+    PASSWORD_DOES_NOT_MEET_REQUIREMENTS = "password-does-not-meet-requirements"
 }
 export interface ErrorMapRetriever extends AuthErrorMap {
     (): ErrorMap<AuthErrorCode>;

package/dist/esm2017/src/core/index.d.ts

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { Auth, NextOrObserver, Persistence, User, CompleteFn, ErrorFn, Unsubscribe } from '../model/public_types';
+import { Auth, NextOrObserver, Persistence, User, CompleteFn, ErrorFn, Unsubscribe, PasswordValidationStatus } from '../model/public_types';
 export { debugErrorMap, prodErrorMap, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as AuthErrorCodes } from './errors';
 /**
  * Changes the type of persistence on the {@link Auth} instance for the currently saved
@@ -68,6 +68,30 @@ export declare function setPersistence(auth: Auth, persistence: Persistence): Pr
  * @public
  */
 export declare function initializeRecaptchaConfig(auth: Auth): Promise<void>;
+/**
+ * Validates the password against the password policy configured for the project or tenant.
+ *
+ * @remarks
+ * If no tenant ID is set on the `Auth` instance, then this method will use the password
+ * policy configured for the project. Otherwise, this method will use the policy configured
+ * for the tenant. If a password policy has not been configured, then the default policy
+ * configured for all projects will be used.
+ *
+ * If an auth flow fails because a submitted password does not meet the password policy
+ * requirements and this method has previously been called, then this method will use the
+ * most recent policy available when called again.
+ *
+ * @example
+ * ```javascript
+ * validatePassword(auth, 'some-password');
+ * ```
+ *
+ * @param auth The {@link Auth} instance.
+ * @param password The password to validate.
+ *
+ * @public
+ */
+export declare function validatePassword(auth: Auth, password: string): Promise<PasswordValidationStatus>;
 /**
  * Adds an observer for changes to the signed-in user's ID token.
  *

package/dist/esm2017/src/model/auth.d.ts

@@ -14,13 +14,14 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { Auth, AuthSettings, Config, EmulatorConfig, PopupRedirectResolver, User } from './public_types';
+import { Auth, AuthSettings, Config, EmulatorConfig, PasswordPolicy, PasswordValidationStatus, PopupRedirectResolver, User } from './public_types';
 import { ErrorFactory } from '@firebase/util';
 import { AuthErrorCode, AuthErrorParams } from '../core/errors';
 import { PopupRedirectResolverInternal } from './popup_redirect';
 import { UserInternal } from './user';
 import { ClientPlatform } from '../core/util/version';
 import { RecaptchaConfig } from '../platform_browser/recaptcha/recaptcha';
+import { PasswordPolicyInternal } from './password_policy';
 export declare type AppName = string;
 export declare type ApiKey = string;
 export declare type AuthDomain = string;
@@ -50,6 +51,8 @@ export interface AuthInternal extends Auth {
     emulatorConfig: EmulatorConfig | null;
     _agentRecaptchaConfig: RecaptchaConfig | null;
     _tenantRecaptchaConfigs: Record<string, RecaptchaConfig>;
+    _projectPasswordPolicy: PasswordPolicy | null;
+    _tenantPasswordPolicies: Record<string, PasswordPolicy>;
     _canInitEmulator: boolean;
     _isInitialized: boolean;
     _initializationPromise: Promise<void> | null;
@@ -65,6 +68,8 @@ export interface AuthInternal extends Auth {
     _stopProactiveRefresh(): void;
     _getPersistence(): string;
     _getRecaptchaConfig(): RecaptchaConfig | null;
+    _getPasswordPolicyInternal(): PasswordPolicyInternal | null;
+    _updatePasswordPolicy(): Promise<void>;
     _logFramework(framework: string): void;
     _getFrameworks(): readonly string[];
     _getAdditionalHeaders(): Promise<Record<string, string>>;
@@ -77,5 +82,5 @@ export interface AuthInternal extends Auth {
     _errorFactory: ErrorFactory<AuthErrorCode, AuthErrorParams>;
     useDeviceLanguage(): void;
     signOut(): Promise<void>;
-    initializeRecaptchaConfig(): Promise<void>;
+    validatePassword(password: string): Promise<PasswordValidationStatus>;
 }

package/dist/esm2017/src/model/password_policy.d.ts

@@ -0,0 +1,111 @@
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { PasswordPolicy, PasswordValidationStatus } from './public_types';
+/**
+ * Internal typing of password policy that includes the schema version and methods for
+ * validating that a password meets the policy. The developer does not need access to
+ * these properties and methods, so they are excluded from the public typing.
+ *
+ * @internal
+ */
+export interface PasswordPolicyInternal extends PasswordPolicy {
+    /**
+     * Requirements enforced by the password policy.
+     */
+    readonly customStrengthOptions: PasswordPolicyCustomStrengthOptions;
+    /**
+     * Schema version of the password policy.
+     */
+    readonly schemaVersion: number;
+    /**
+     * Validates the password against the policy.
+     * @param password Password to validate.
+     */
+    validatePassword(password: string): PasswordValidationStatus;
+}
+/**
+ * Internal typing of the password policy custom strength options that is modifiable. This
+ * allows us to construct the strength options before storing them in the policy.
+ *
+ * @internal
+ */
+export interface PasswordPolicyCustomStrengthOptions {
+    /**
+     * Minimum password length.
+     */
+    minPasswordLength?: number;
+    /**
+     * Maximum password length.
+     */
+    maxPasswordLength?: number;
+    /**
+     * Whether the password should contain a lowercase letter.
+     */
+    containsLowercaseLetter?: boolean;
+    /**
+     * Whether the password should contain an uppercase letter.
+     */
+    containsUppercaseLetter?: boolean;
+    /**
+     * Whether the password should contain a numeric character.
+     */
+    containsNumericCharacter?: boolean;
+    /**
+     * Whether the password should contain a non-alphanumeric character.
+     */
+    containsNonAlphanumericCharacter?: boolean;
+}
+/**
+ * Internal typing of password validation status that is modifiable. This allows us to
+ * construct the validation status before returning it.
+ *
+ * @internal
+ */
+export interface PasswordValidationStatusInternal extends PasswordValidationStatus {
+    /**
+     * Whether the password meets all requirements.
+     */
+    isValid: boolean;
+    /**
+     * Whether the password meets the minimum password length.
+     */
+    meetsMinPasswordLength?: boolean;
+    /**
+     * Whether the password meets the maximum password length.
+     */
+    meetsMaxPasswordLength?: boolean;
+    /**
+     * Whether the password contains a lowercase letter, if required.
+     */
+    containsLowercaseLetter?: boolean;
+    /**
+     * Whether the password contains an uppercase letter, if required.
+     */
+    containsUppercaseLetter?: boolean;
+    /**
+     * Whether the password contains a numeric character, if required.
+     */
+    containsNumericCharacter?: boolean;
+    /**
+     * Whether the password contains a non-alphanumeric character, if required.
+     */
+    containsNonAlphanumericCharacter?: boolean;
+    /**
+     * The policy used to validate the password.
+     */
+    passwordPolicy: PasswordPolicy;
+}

package/dist/esm2017/src/model/public_types.d.ts

@@ -1188,3 +1188,91 @@ export interface Dependencies {
  */
 export interface TotpMultiFactorAssertion extends MultiFactorAssertion {
 }
+/**
+ * A structure specifying password policy requirements.
+ *
+ * @public
+ */
+export interface PasswordPolicy {
+    /**
+     * Requirements enforced by this password policy.
+     */
+    readonly customStrengthOptions: {
+        /**
+         * Minimum password length, or undefined if not configured.
+         */
+        readonly minPasswordLength?: number;
+        /**
+         * Maximum password length, or undefined if not configured.
+         */
+        readonly maxPasswordLength?: number;
+        /**
+         * Whether the password should contain a lowercase letter, or undefined if not configured.
+         */
+        readonly containsLowercaseLetter?: boolean;
+        /**
+         * Whether the password should contain an uppercase letter, or undefined if not configured.
+         */
+        readonly containsUppercaseLetter?: boolean;
+        /**
+         * Whether the password should contain a numeric character, or undefined if not configured.
+         */
+        readonly containsNumericCharacter?: boolean;
+        /**
+         * Whether the password should contain a non-alphanumeric character, or undefined if not configured.
+         */
+        readonly containsNonAlphanumericCharacter?: boolean;
+    };
+    /**
+     * List of characters that are considered non-alphanumeric during validation.
+     */
+    readonly allowedNonAlphanumericCharacters: string;
+    /**
+     * The enforcement state of the policy. Can be 'OFF' or 'ENFORCE'.
+     */
+    readonly enforcementState: string;
+    /**
+     * Whether existing passwords must meet the policy.
+     */
+    readonly forceUpgradeOnSignin: boolean;
+}
+/**
+ * A structure indicating which password policy requirements were met or violated and what the
+ * requirements are.
+ *
+ * @public
+ */
+export interface PasswordValidationStatus {
+    /**
+     * Whether the password meets all requirements.
+     */
+    readonly isValid: boolean;
+    /**
+     * Whether the password meets the minimum password length, or undefined if not required.
+     */
+    readonly meetsMinPasswordLength?: boolean;
+    /**
+     * Whether the password meets the maximum password length, or undefined if not required.
+     */
+    readonly meetsMaxPasswordLength?: boolean;
+    /**
+     * Whether the password contains a lowercase letter, or undefined if not required.
+     */
+    readonly containsLowercaseLetter?: boolean;
+    /**
+     * Whether the password contains an uppercase letter, or undefined if not required.
+     */
+    readonly containsUppercaseLetter?: boolean;
+    /**
+     * Whether the password contains a numeric character, or undefined if not required.
+     */
+    readonly containsNumericCharacter?: boolean;
+    /**
+     * Whether the password contains a non-alphanumeric character, or undefined if not required.
+     */
+    readonly containsNonAlphanumericCharacter?: boolean;
+    /**
+     * The policy used to validate the password.
+     */
+    readonly passwordPolicy: PasswordPolicy;
+}

package/dist/esm2017/src/platform_browser/recaptcha/recaptcha_enterprise_verifier.d.ts

@@ -39,3 +39,4 @@ export declare class RecaptchaEnterpriseVerifier {
     verify(action?: string, forceRefresh?: boolean): Promise<string>;
 }
 export declare function injectRecaptchaFields<T>(auth: AuthInternal, request: T, action: RecaptchaActionName, captchaResp?: boolean): Promise<T>;
+export declare function _initializeRecaptchaConfig(auth: Auth): Promise<void>;

package/dist/esm2017/src/platform_node/index.d.ts

@@ -43,6 +43,7 @@ export declare const linkWithRedirect: typeof fail;
 export declare const reauthenticateWithRedirect: typeof fail;
 export declare const getRedirectResult: typeof fail;
 export declare const RecaptchaVerifier: typeof FailClass;
+export declare const initializeRecaptchaConfig: typeof fail;
 export declare class PhoneMultiFactorGenerator {
     static assertion(): unknown;
 }

package/dist/esm2017/test/helpers/integration/helpers.d.ts

@@ -22,3 +22,9 @@ export declare function getTotpCode(sharedSecretKey: string, periodSec: number,
 export declare const email = "totpuser-donotdelete@test.com";
 export declare const password = "password";
 export declare const incorrectTotpCode = "1000000";
+/**
+ * Generates a valid password for the project or tenant password policy in the Auth instance.
+ * @param auth The {@link Auth} instance.
+ * @returns A valid password according to the password policy.
+ */
+export declare function generateValidPassword(auth: Auth): Promise<string>;

package/dist/esm2017/test/integration/flows/password_policy.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {};