@firebase/auth 1.1.0-canary.e037eeed6 → 1.1.0-canary.f497a400a

package/dist/browser-cjs/{index-1a2a2779.js → index-316b8221.js}

@@ -2,8 +2,8 @@
 
 var util = require('@firebase/util');
 var app = require('@firebase/app');
-var tslib = require('tslib');
 var logger = require('@firebase/logger');
+var tslib = require('tslib');
 var component = require('@firebase/component');
 
 /**
@@ -105,6 +105,50 @@ const ActionCodeOperation = {
     VERIFY_EMAIL: 'VERIFY_EMAIL'
 };
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isV2(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.getResponse !== undefined);
+}
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+class RecaptchaConfig {
+    constructor(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(enforcementState => enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+            enforcementState.enforcementState !== 'OFF');
+    }
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -275,7 +319,9 @@ function _debugErrorMap() {
         ["missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */]: 'The reCAPTCHA client type is missing when sending request to the backend.',
         ["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */]: 'The reCAPTCHA version is missing when sending request to the backend.',
         ["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */]: 'Invalid request parameters.',
-        ["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */]: 'The reCAPTCHA version is invalid when sending request to the backend.'
+        ["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */]: 'The reCAPTCHA version is invalid when sending request to the backend.',
+        ["unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */]: 'The password policy received from the backend uses a schema version that is not supported by this version of the Firebase SDK.',
+        ["password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */]: 'The password does not meet the requirements.'
     };
 }
 function _prodErrorMap() {
@@ -789,6 +835,7 @@ const SERVER_ERROR_MAP = {
     ["USER_NOT_FOUND" /* ServerError.USER_NOT_FOUND */]: "user-token-expired" /* AuthErrorCode.TOKEN_EXPIRED */,
     // Other errors.
     ["TOO_MANY_ATTEMPTS_TRY_LATER" /* ServerError.TOO_MANY_ATTEMPTS_TRY_LATER */]: "too-many-requests" /* AuthErrorCode.TOO_MANY_ATTEMPTS_TRY_LATER */,
+    ["PASSWORD_DOES_NOT_MEET_REQUIREMENTS" /* ServerError.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */]: "password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */,
     // Phone Auth related errors.
     ["INVALID_CODE" /* ServerError.INVALID_CODE */]: "invalid-verification-code" /* AuthErrorCode.INVALID_CODE */,
     ["INVALID_SESSION_INFO" /* ServerError.INVALID_SESSION_INFO */]: "invalid-verification-id" /* AuthErrorCode.INVALID_SESSION_INFO */,
@@ -973,6 +1020,29 @@ function _makeTaggedError(auth, code, response) {
     return error;
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+async function getRecaptchaParams(auth) {
+    return ((await _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)).recaptchaSiteKey || '');
+}
+async function getRecaptchaConfig(auth, request) {
+    return _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request));
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -2095,7 +2165,7 @@ function _getClientVersion(clientPlatform, frameworks = []) {
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2022 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2109,16 +2179,74 @@ function _getClientVersion(clientPlatform, frameworks = []) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-async function getRecaptchaParams(auth) {
-    return ((await _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)).recaptchaSiteKey || '');
-}
-async function getRecaptchaConfig(auth, request) {
-    return _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request));
+class AuthMiddlewareQueue {
+    constructor(auth) {
+        this.auth = auth;
+        this.queue = [];
+    }
+    pushCallback(callback, onAbort) {
+        // The callback could be sync or async. Wrap it into a
+        // function that is always async.
+        const wrappedCallback = (user) => new Promise((resolve, reject) => {
+            try {
+                const result = callback(user);
+                // Either resolve with existing promise or wrap a non-promise
+                // return value into a promise.
+                resolve(result);
+            }
+            catch (e) {
+                // Sync callback throws.
+                reject(e);
+            }
+        });
+        // Attach the onAbort if present
+        wrappedCallback.onAbort = onAbort;
+        this.queue.push(wrappedCallback);
+        const index = this.queue.length - 1;
+        return () => {
+            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
+            // indexing of other elements.
+            this.queue[index] = () => Promise.resolve();
+        };
+    }
+    async runMiddleware(nextUser) {
+        if (this.auth.currentUser === nextUser) {
+            return;
+        }
+        // While running the middleware, build a temporary stack of onAbort
+        // callbacks to call if one middleware callback rejects.
+        const onAbortStack = [];
+        try {
+            for (const beforeStateCallback of this.queue) {
+                await beforeStateCallback(nextUser);
+                // Only push the onAbort if the callback succeeds
+                if (beforeStateCallback.onAbort) {
+                    onAbortStack.push(beforeStateCallback.onAbort);
+                }
+            }
+        }
+        catch (e) {
+            // Run all onAbort, with separate try/catch to ignore any errors and
+            // continue
+            onAbortStack.reverse();
+            for (const onAbort of onAbortStack) {
+                try {
+                    onAbort();
+                }
+                catch (_) {
+                    /* swallow error */
+                }
+            }
+            throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
+                originalMessage: e === null || e === void 0 ? void 0 : e.message
+            });
+        }
+    }
 }
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2132,37 +2260,20 @@ async function getRecaptchaConfig(auth, request) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function isV2(grecaptcha) {
-    return (grecaptcha !== undefined &&
-        grecaptcha.getResponse !== undefined);
-}
-function isEnterprise(grecaptcha) {
-    return (grecaptcha !== undefined &&
-        grecaptcha.enterprise !== undefined);
-}
-class RecaptchaConfig {
-    constructor(response) {
-        /**
-         * The reCAPTCHA site key.
-         */
-        this.siteKey = '';
-        /**
-         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
-         */
-        this.emailPasswordEnabled = false;
-        if (response.recaptchaKey === undefined) {
-            throw new Error('recaptchaKey undefined');
-        }
-        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
-        this.siteKey = response.recaptchaKey.split('/')[3];
-        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(enforcementState => enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
-            enforcementState.enforcementState !== 'OFF');
-    }
+/**
+ * Fetches the password policy for the currently set tenant or the project if no tenant is set.
+ *
+ * @param auth Auth object.
+ * @param request Password policy request.
+ * @returns Password policy response.
+ */
+async function _getPasswordPolicy(auth, request = {}) {
+    return _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/passwordPolicy" /* Endpoint.GET_PASSWORD_POLICY */, _addTidIfNecessary(auth, request));
 }
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2176,232 +2287,135 @@ class RecaptchaConfig {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function getScriptParentElement() {
-    var _a, _b;
-    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
-}
-function _loadJS(url) {
-    // TODO: consider adding timeout support & cancellation
-    return new Promise((resolve, reject) => {
-        const el = document.createElement('script');
-        el.setAttribute('src', url);
-        el.onload = resolve;
-        el.onerror = e => {
-            const error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            error.customData = e;
-            reject(error);
+// Minimum min password length enforced by the backend, even if no minimum length is set.
+const MINIMUM_MIN_PASSWORD_LENGTH = 6;
+/**
+ * Stores password policy requirements and provides password validation against the policy.
+ *
+ * @internal
+ */
+class PasswordPolicyImpl {
+    constructor(response) {
+        var _a, _b, _c, _d;
+        // Only include custom strength options defined in the response.
+        const responseOptions = response.customStrengthOptions;
+        this.customStrengthOptions = {};
+        // TODO: Remove once the backend is updated to include the minimum min password length instead of undefined when there is no minimum length set.
+        this.customStrengthOptions.minPasswordLength =
+            (_a = responseOptions.minPasswordLength) !== null && _a !== void 0 ? _a : MINIMUM_MIN_PASSWORD_LENGTH;
+        if (responseOptions.maxPasswordLength) {
+            this.customStrengthOptions.maxPasswordLength =
+                responseOptions.maxPasswordLength;
+        }
+        if (responseOptions.containsLowercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsLowercaseLetter =
+                responseOptions.containsLowercaseCharacter;
+        }
+        if (responseOptions.containsUppercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsUppercaseLetter =
+                responseOptions.containsUppercaseCharacter;
+        }
+        if (responseOptions.containsNumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNumericCharacter =
+                responseOptions.containsNumericCharacter;
+        }
+        if (responseOptions.containsNonAlphanumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNonAlphanumericCharacter =
+                responseOptions.containsNonAlphanumericCharacter;
+        }
+        this.enforcementState = response.enforcementState;
+        if (this.enforcementState === 'ENFORCEMENT_STATE_UNSPECIFIED') {
+            this.enforcementState = 'OFF';
+        }
+        // Use an empty string if no non-alphanumeric characters are specified in the response.
+        this.allowedNonAlphanumericCharacters =
+            (_c = (_b = response.allowedNonAlphanumericCharacters) === null || _b === void 0 ? void 0 : _b.join('')) !== null && _c !== void 0 ? _c : '';
+        this.forceUpgradeOnSignin = (_d = response.forceUpgradeOnSignin) !== null && _d !== void 0 ? _d : false;
+        this.schemaVersion = response.schemaVersion;
+    }
+    validatePassword(password) {
+        var _a, _b, _c, _d, _e, _f;
+        const status = {
+            isValid: true,
+            passwordPolicy: this
         };
-        el.type = 'text/javascript';
-        el.charset = 'UTF-8';
-        getScriptParentElement().appendChild(el);
-    });
-}
-function _generateCallbackName(prefix) {
-    return `__${prefix}${Math.floor(Math.random() * 1000000)}`;
-}
-
-/* eslint-disable @typescript-eslint/no-require-imports */
-const RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
-const RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
-const FAKE_TOKEN = 'NO_RECAPTCHA';
-class RecaptchaEnterpriseVerifier {
-    /**
-     *
-     * @param authExtern - The corresponding Firebase {@link Auth} instance.
-     *
-     */
-    constructor(authExtern) {
-        /**
-         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
-         */
-        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
-        this.auth = _castAuth(authExtern);
+        // Check the password length and character options.
+        this.validatePasswordLengthOptions(password, status);
+        this.validatePasswordCharacterOptions(password, status);
+        // Combine the status into single isValid property.
+        status.isValid && (status.isValid = (_a = status.meetsMinPasswordLength) !== null && _a !== void 0 ? _a : true);
+        status.isValid && (status.isValid = (_b = status.meetsMaxPasswordLength) !== null && _b !== void 0 ? _b : true);
+        status.isValid && (status.isValid = (_c = status.containsLowercaseLetter) !== null && _c !== void 0 ? _c : true);
+        status.isValid && (status.isValid = (_d = status.containsUppercaseLetter) !== null && _d !== void 0 ? _d : true);
+        status.isValid && (status.isValid = (_e = status.containsNumericCharacter) !== null && _e !== void 0 ? _e : true);
+        status.isValid && (status.isValid = (_f = status.containsNonAlphanumericCharacter) !== null && _f !== void 0 ? _f : true);
+        return status;
     }
     /**
-     * Executes the verification process.
+     * Validates that the password meets the length options for the policy.
      *
-     * @returns A Promise for a token that can be used to assert the validity of a request.
+     * @param password Password to validate.
+     * @param status Validation status.
      */
-    async verify(action = 'verify', forceRefresh = false) {
-        async function retrieveSiteKey(auth) {
-            if (!forceRefresh) {
-                if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
-                    return auth._agentRecaptchaConfig.siteKey;
-                }
-                if (auth.tenantId != null &&
-                    auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
-                    return auth._tenantRecaptchaConfigs[auth.tenantId].siteKey;
-                }
-            }
-            return new Promise(async (resolve, reject) => {
-                getRecaptchaConfig(auth, {
-                    clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-                    version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                })
-                    .then(response => {
-                    if (response.recaptchaKey === undefined) {
-                        reject(new Error('recaptcha Enterprise site key undefined'));
-                    }
-                    else {
-                        const config = new RecaptchaConfig(response);
-                        if (auth.tenantId == null) {
-                            auth._agentRecaptchaConfig = config;
-                        }
-                        else {
-                            auth._tenantRecaptchaConfigs[auth.tenantId] = config;
-                        }
-                        return resolve(config.siteKey);
-                    }
-                })
-                    .catch(error => {
-                    reject(error);
-                });
-            });
+    validatePasswordLengthOptions(password, status) {
+        const minPasswordLength = this.customStrengthOptions.minPasswordLength;
+        const maxPasswordLength = this.customStrengthOptions.maxPasswordLength;
+        if (minPasswordLength) {
+            status.meetsMinPasswordLength = password.length >= minPasswordLength;
         }
-        function retrieveRecaptchaToken(siteKey, resolve, reject) {
-            const grecaptcha = window.grecaptcha;
-            if (isEnterprise(grecaptcha)) {
-                grecaptcha.enterprise.ready(() => {
-                    grecaptcha.enterprise
-                        .execute(siteKey, { action })
-                        .then(token => {
-                        resolve(token);
-                    })
-                        .catch(() => {
-                        resolve(FAKE_TOKEN);
-                    });
-                });
-            }
-            else {
-                reject(Error('No reCAPTCHA enterprise script loaded.'));
-            }
+        if (maxPasswordLength) {
+            status.meetsMaxPasswordLength = password.length <= maxPasswordLength;
         }
-        return new Promise((resolve, reject) => {
-            retrieveSiteKey(this.auth)
-                .then(siteKey => {
-                if (!forceRefresh && isEnterprise(window.grecaptcha)) {
-                    retrieveRecaptchaToken(siteKey, resolve, reject);
-                }
-                else {
-                    if (typeof window === 'undefined') {
-                        reject(new Error('RecaptchaVerifier is only supported in browser'));
-                        return;
-                    }
-                    _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
-                        .then(() => {
-                        retrieveRecaptchaToken(siteKey, resolve, reject);
-                    })
-                        .catch(error => {
-                        reject(error);
-                    });
-                }
-            })
-                .catch(error => {
-                reject(error);
-            });
-        });
-    }
-}
-async function injectRecaptchaFields(auth, request, action, captchaResp = false) {
-    const verifier = new RecaptchaEnterpriseVerifier(auth);
-    let captchaResponse;
-    try {
-        captchaResponse = await verifier.verify(action);
-    }
-    catch (error) {
-        captchaResponse = await verifier.verify(action, true);
-    }
-    const newRequest = Object.assign({}, request);
-    if (!captchaResp) {
-        Object.assign(newRequest, { captchaResponse });
-    }
-    else {
-        Object.assign(newRequest, { 'captchaResp': captchaResponse });
-    }
-    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
-    Object.assign(newRequest, {
-        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-    });
-    return newRequest;
-}
-
-/**
- * @license
- * Copyright 2022 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-class AuthMiddlewareQueue {
-    constructor(auth) {
-        this.auth = auth;
-        this.queue = [];
     }
-    pushCallback(callback, onAbort) {
-        // The callback could be sync or async. Wrap it into a
-        // function that is always async.
-        const wrappedCallback = (user) => new Promise((resolve, reject) => {
-            try {
-                const result = callback(user);
-                // Either resolve with existing promise or wrap a non-promise
-                // return value into a promise.
-                resolve(result);
-            }
-            catch (e) {
-                // Sync callback throws.
-                reject(e);
-            }
-        });
-        // Attach the onAbort if present
-        wrappedCallback.onAbort = onAbort;
-        this.queue.push(wrappedCallback);
-        const index = this.queue.length - 1;
-        return () => {
-            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
-            // indexing of other elements.
-            this.queue[index] = () => Promise.resolve();
-        };
+    /**
+     * Validates that the password meets the character options for the policy.
+     *
+     * @param password Password to validate.
+     * @param status Validation status.
+     */
+    validatePasswordCharacterOptions(password, status) {
+        // Assign statuses for requirements even if the password is an empty string.
+        this.updatePasswordCharacterOptionsStatuses(status, 
+        /* containsLowercaseCharacter= */ false, 
+        /* containsUppercaseCharacter= */ false, 
+        /* containsNumericCharacter= */ false, 
+        /* containsNonAlphanumericCharacter= */ false);
+        let passwordChar;
+        for (let i = 0; i < password.length; i++) {
+            passwordChar = password.charAt(i);
+            this.updatePasswordCharacterOptionsStatuses(status, 
+            /* containsLowercaseCharacter= */ passwordChar >= 'a' &&
+                passwordChar <= 'z', 
+            /* containsUppercaseCharacter= */ passwordChar >= 'A' &&
+                passwordChar <= 'Z', 
+            /* containsNumericCharacter= */ passwordChar >= '0' &&
+                passwordChar <= '9', 
+            /* containsNonAlphanumericCharacter= */ this.allowedNonAlphanumericCharacters.includes(passwordChar));
+        }
     }
-    async runMiddleware(nextUser) {
-        if (this.auth.currentUser === nextUser) {
-            return;
+    /**
+     * Updates the running validation status with the statuses for the character options.
+     * Expected to be called each time a character is processed to update each option status
+     * based on the current character.
+     *
+     * @param status Validation status.
+     * @param containsLowercaseCharacter Whether the character is a lowercase letter.
+     * @param containsUppercaseCharacter Whether the character is an uppercase letter.
+     * @param containsNumericCharacter Whether the character is a numeric character.
+     * @param containsNonAlphanumericCharacter Whether the character is a non-alphanumeric character.
+     */
+    updatePasswordCharacterOptionsStatuses(status, containsLowercaseCharacter, containsUppercaseCharacter, containsNumericCharacter, containsNonAlphanumericCharacter) {
+        if (this.customStrengthOptions.containsLowercaseLetter) {
+            status.containsLowercaseLetter || (status.containsLowercaseLetter = containsLowercaseCharacter);
         }
-        // While running the middleware, build a temporary stack of onAbort
-        // callbacks to call if one middleware callback rejects.
-        const onAbortStack = [];
-        try {
-            for (const beforeStateCallback of this.queue) {
-                await beforeStateCallback(nextUser);
-                // Only push the onAbort if the callback succeeds
-                if (beforeStateCallback.onAbort) {
-                    onAbortStack.push(beforeStateCallback.onAbort);
-                }
-            }
+        if (this.customStrengthOptions.containsUppercaseLetter) {
+            status.containsUppercaseLetter || (status.containsUppercaseLetter = containsUppercaseCharacter);
         }
-        catch (e) {
-            // Run all onAbort, with separate try/catch to ignore any errors and
-            // continue
-            onAbortStack.reverse();
-            for (const onAbort of onAbortStack) {
-                try {
-                    onAbort();
-                }
-                catch (_) {
-                    /* swallow error */
-                }
-            }
-            throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
-                originalMessage: e === null || e === void 0 ? void 0 : e.message
-            });
+        if (this.customStrengthOptions.containsNumericCharacter) {
+            status.containsNumericCharacter || (status.containsNumericCharacter = containsNumericCharacter);
+        }
+        if (this.customStrengthOptions.containsNonAlphanumericCharacter) {
+            status.containsNonAlphanumericCharacter || (status.containsNonAlphanumericCharacter = containsNonAlphanumericCharacter);
         }
     }
 }
@@ -2436,6 +2450,7 @@ class AuthImpl {
         this.beforeStateQueue = new AuthMiddlewareQueue(this);
         this.redirectUser = null;
         this.isProactiveRefreshEnabled = false;
+        this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION = 1;
         // Any network calls will set this to true and prevent subsequent emulator
         // initialization
         this._canInitEmulator = true;
@@ -2446,6 +2461,8 @@ class AuthImpl {
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
         this._agentRecaptchaConfig = null;
         this._tenantRecaptchaConfigs = {};
+        this._projectPasswordPolicy = null;
+        this._tenantPasswordPolicies = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -2665,29 +2682,44 @@ class AuthImpl {
             await this.assertedPersistence.setPersistence(_getInstance(persistence));
         });
     }
-    async initializeRecaptchaConfig() {
-        const response = await getRecaptchaConfig(this, {
-            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-        });
-        const config = new RecaptchaConfig(response);
+    _getRecaptchaConfig() {
         if (this.tenantId == null) {
-            this._agentRecaptchaConfig = config;
+            return this._agentRecaptchaConfig;
         }
         else {
-            this._tenantRecaptchaConfigs[this.tenantId] = config;
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    }
+    async validatePassword(password) {
+        if (!this._getPasswordPolicyInternal()) {
+            await this._updatePasswordPolicy();
         }
-        if (config.emailPasswordEnabled) {
-            const verifier = new RecaptchaEnterpriseVerifier(this);
-            void verifier.verify();
+        // Password policy will be defined after fetching.
+        const passwordPolicy = this._getPasswordPolicyInternal();
+        // Check that the policy schema version is supported by the SDK.
+        // TODO: Update this logic to use a max supported policy schema version once we have multiple schema versions.
+        if (passwordPolicy.schemaVersion !==
+            this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION) {
+            return Promise.reject(this._errorFactory.create("unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */, {}));
         }
+        return passwordPolicy.validatePassword(password);
     }
-    _getRecaptchaConfig() {
-        if (this.tenantId == null) {
-            return this._agentRecaptchaConfig;
+    _getPasswordPolicyInternal() {
+        if (this.tenantId === null) {
+            return this._projectPasswordPolicy;
         }
         else {
-            return this._tenantRecaptchaConfigs[this.tenantId];
+            return this._tenantPasswordPolicies[this.tenantId];
+        }
+    }
+    async _updatePasswordPolicy() {
+        const response = await _getPasswordPolicy(this);
+        const passwordPolicy = new PasswordPolicyImpl(response);
+        if (this.tenantId === null) {
+            this._projectPasswordPolicy = passwordPolicy;
+        }
+        else {
+            this._tenantPasswordPolicies[this.tenantId] = passwordPolicy;
         }
     }
     _getPersistence() {
@@ -2925,6 +2957,189 @@ class Subscription {
     }
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise((resolve, reject) => {
+        const el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = e => {
+            const error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+function _generateCallbackName(prefix) {
+    return `__${prefix}${Math.floor(Math.random() * 1000000)}`;
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+const RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+const RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+const FAKE_TOKEN = 'NO_RECAPTCHA';
+class RecaptchaEnterpriseVerifier {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    constructor(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    async verify(action = 'verify', forceRefresh = false) {
+        async function retrieveSiteKey(auth) {
+            if (!forceRefresh) {
+                if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                    return auth._agentRecaptchaConfig.siteKey;
+                }
+                if (auth.tenantId != null &&
+                    auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                    return auth._tenantRecaptchaConfigs[auth.tenantId].siteKey;
+                }
+            }
+            return new Promise(async (resolve, reject) => {
+                getRecaptchaConfig(auth, {
+                    clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                    version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                })
+                    .then(response => {
+                    if (response.recaptchaKey === undefined) {
+                        reject(new Error('recaptcha Enterprise site key undefined'));
+                    }
+                    else {
+                        const config = new RecaptchaConfig(response);
+                        if (auth.tenantId == null) {
+                            auth._agentRecaptchaConfig = config;
+                        }
+                        else {
+                            auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                        }
+                        return resolve(config.siteKey);
+                    }
+                })
+                    .catch(error => {
+                    reject(error);
+                });
+            });
+        }
+        function retrieveRecaptchaToken(siteKey, resolve, reject) {
+            const grecaptcha = window.grecaptcha;
+            if (isEnterprise(grecaptcha)) {
+                grecaptcha.enterprise.ready(() => {
+                    grecaptcha.enterprise
+                        .execute(siteKey, { action })
+                        .then(token => {
+                        resolve(token);
+                    })
+                        .catch(() => {
+                        resolve(FAKE_TOKEN);
+                    });
+                });
+            }
+            else {
+                reject(Error('No reCAPTCHA enterprise script loaded.'));
+            }
+        }
+        return new Promise((resolve, reject) => {
+            retrieveSiteKey(this.auth)
+                .then(siteKey => {
+                if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                }
+                else {
+                    if (typeof window === 'undefined') {
+                        reject(new Error('RecaptchaVerifier is only supported in browser'));
+                        return;
+                    }
+                    _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                        .then(() => {
+                        retrieveRecaptchaToken(siteKey, resolve, reject);
+                    })
+                        .catch(error => {
+                        reject(error);
+                    });
+                }
+            })
+                .catch(error => {
+                reject(error);
+            });
+        });
+    }
+}
+async function injectRecaptchaFields(auth, request, action, captchaResp = false) {
+    const verifier = new RecaptchaEnterpriseVerifier(auth);
+    let captchaResponse;
+    try {
+        captchaResponse = await verifier.verify(action);
+    }
+    catch (error) {
+        captchaResponse = await verifier.verify(action, true);
+    }
+    const newRequest = Object.assign({}, request);
+    if (!captchaResp) {
+        Object.assign(newRequest, { captchaResponse });
+    }
+    else {
+        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+    }
+    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+    Object.assign(newRequest, {
+        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+    });
+    return newRequest;
+}
+async function _initializeRecaptchaConfig(auth) {
+    const authInternal = _castAuth(auth);
+    const response = await getRecaptchaConfig(authInternal, {
+        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+    });
+    const config = new RecaptchaConfig(response);
+    if (authInternal.tenantId == null) {
+        authInternal._agentRecaptchaConfig = config;
+    }
+    else {
+        authInternal._tenantRecaptchaConfigs[authInternal.tenantId] = config;
+    }
+    if (config.emailPasswordEnabled) {
+        const verifier = new RecaptchaEnterpriseVerifier(authInternal);
+        void verifier.verify();
+    }
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -5282,6 +5497,25 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/**
+ * Updates the password policy cached in the {@link Auth} instance if a policy is already
+ * cached for the project or tenant.
+ *
+ * @remarks
+ * We only fetch the password policy if the password did not meet policy requirements and
+ * there is an existing policy cached. A developer must call validatePassword at least
+ * once for the cache to be automatically updated.
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @private
+ */
+async function recachePasswordPolicy(auth) {
+    const authInternal = _castAuth(auth);
+    if (authInternal._getPasswordPolicyInternal()) {
+        await authInternal._updatePasswordPolicy();
+    }
+}
 /**
  * Sends a password reset email to the given email address.
  *
@@ -5362,6 +5596,13 @@ async function confirmPasswordReset(auth, oobCode, newPassword) {
     await resetPassword(util.getModularInstance(auth), {
         oobCode,
         newPassword
+    })
+        .catch(async (error) => {
+        if (error.code ===
+            `auth/${"password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */}`) {
+            void recachePasswordPolicy(auth);
+        }
+        throw error;
     });
     // Do not return the email.
 }
@@ -5480,13 +5721,14 @@ async function createUserWithEmailAndPassword(auth, email, password) {
                 const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */);
                 return signUp(authInternal, requestWithRecaptcha);
             }
-            else {
-                return Promise.reject(error);
-            }
+            throw error;
         });
     }
     const response = await signUpResponse.catch(error => {
-        return Promise.reject(error);
+        if (error.code === `auth/${"password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */}`) {
+            void recachePasswordPolicy(auth);
+        }
+        throw error;
     });
     const userCredential = await UserCredentialImpl._fromIdTokenResponse(authInternal, "signIn" /* OperationType.SIGN_IN */, response);
     await authInternal._updateCurrentUser(userCredential.user);
@@ -5509,7 +5751,12 @@ async function createUserWithEmailAndPassword(auth, email, password) {
  * @public
  */
 function signInWithEmailAndPassword(auth, email, password) {
-    return signInWithCredential(util.getModularInstance(auth), EmailAuthProvider.credential(email, password));
+    return signInWithCredential(util.getModularInstance(auth), EmailAuthProvider.credential(email, password)).catch(async (error) => {
+        if (error.code === `auth/${"password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */}`) {
+            void recachePasswordPolicy(auth);
+        }
+        throw error;
+    });
 }
 
 /**
@@ -6124,8 +6371,34 @@ function setPersistence(auth, persistence) {
  * @public
  */
 function initializeRecaptchaConfig(auth) {
+    return _initializeRecaptchaConfig(auth);
+}
+/**
+ * Validates the password against the password policy configured for the project or tenant.
+ *
+ * @remarks
+ * If no tenant ID is set on the `Auth` instance, then this method will use the password
+ * policy configured for the project. Otherwise, this method will use the policy configured
+ * for the tenant. If a password policy has not been configured, then the default policy
+ * configured for all projects will be used.
+ *
+ * If an auth flow fails because a submitted password does not meet the password policy
+ * requirements and this method has previously been called, then this method will use the
+ * most recent policy available when called again.
+ *
+ * @example
+ * ```javascript
+ * validatePassword(auth, 'some-password');
+ * ```
+ *
+ * @param auth The {@link Auth} instance.
+ * @param password The password to validate.
+ *
+ * @public
+ */
+async function validatePassword(auth, password) {
     const authInternal = _castAuth(auth);
-    return authInternal.initializeRecaptchaConfig();
+    return authInternal.validatePassword(password);
 }
 /**
  * Adds an observer for changes to the signed-in user's ID token.
@@ -9933,7 +10206,7 @@ function _isEmptyString(input) {
 }
 
 var name = "@firebase/auth";
-var version = "1.1.0-canary.e037eeed6";
+var version = "1.1.0-canary.f497a400a";
 
 /**
  * @license
@@ -10256,6 +10529,7 @@ exports.updatePassword = updatePassword;
 exports.updatePhoneNumber = updatePhoneNumber;
 exports.updateProfile = updateProfile;
 exports.useDeviceLanguage = useDeviceLanguage;
+exports.validatePassword = validatePassword;
 exports.verifyBeforeUpdateEmail = verifyBeforeUpdateEmail;
 exports.verifyPasswordResetCode = verifyPasswordResetCode;
-//# sourceMappingURL=index-1a2a2779.js.map
+//# sourceMappingURL=index-316b8221.js.map