@firebase/auth 1.1.0 → 1.2.0-canary.309f7a914

package/dist/cordova/{popup_redirect-71c1ff0a.js → popup_redirect-63074918.js}

@@ -918,6 +918,53 @@ var IndexedDBLocalPersistence = /** @class */ (function () {
  */
 var indexedDBLocalPersistence = IndexedDBLocalPersistence;
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isV2(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.getResponse !== undefined);
+}
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+var RecaptchaConfig = /** @class */ (function () {
+    function RecaptchaConfig(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
+            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+                enforcementState.enforcementState !== 'OFF';
+        });
+    }
+    return RecaptchaConfig;
+}());
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -1090,6 +1137,8 @@ function _debugErrorMap() {
         _a["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is missing when sending request to the backend.',
         _a["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */] = 'Invalid request parameters.',
         _a["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is invalid when sending request to the backend.',
+        _a["unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */] = 'The password policy received from the backend uses a schema version that is not supported by this version of the Firebase SDK.',
+        _a["password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */] = 'The password does not meet the requirements.',
         _a;
 }
 function _prodErrorMap() {
@@ -1635,6 +1684,7 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     _a$1["USER_NOT_FOUND" /* ServerError.USER_NOT_FOUND */] = "user-token-expired" /* AuthErrorCode.TOKEN_EXPIRED */,
     // Other errors.
     _a$1["TOO_MANY_ATTEMPTS_TRY_LATER" /* ServerError.TOO_MANY_ATTEMPTS_TRY_LATER */] = "too-many-requests" /* AuthErrorCode.TOO_MANY_ATTEMPTS_TRY_LATER */,
+    _a$1["PASSWORD_DOES_NOT_MEET_REQUIREMENTS" /* ServerError.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */] = "password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */,
     // Phone Auth related errors.
     _a$1["INVALID_CODE" /* ServerError.INVALID_CODE */] = "invalid-verification-code" /* AuthErrorCode.INVALID_CODE */,
     _a$1["INVALID_SESSION_INFO" /* ServerError.INVALID_SESSION_INFO */] = "invalid-verification-id" /* AuthErrorCode.INVALID_SESSION_INFO */,
@@ -1860,6 +1910,40 @@ function _makeTaggedError(auth, code, response) {
     return error;
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getRecaptchaParams(auth) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)];
+                case 1: return [2 /*return*/, ((_a.sent()).recaptchaSiteKey || '')];
+            }
+        });
+    });
+}
+function getRecaptchaConfig(auth, request) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+        });
+    });
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -3258,7 +3342,7 @@ function _getClientVersion(clientPlatform, frameworks) {
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2022 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -3272,27 +3356,129 @@ function _getClientVersion(clientPlatform, frameworks) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function getRecaptchaParams(auth) {
-    return __awaiter(this, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)];
-                case 1: return [2 /*return*/, ((_a.sent()).recaptchaSiteKey || '')];
-            }
+var AuthMiddlewareQueue = /** @class */ (function () {
+    function AuthMiddlewareQueue(auth) {
+        this.auth = auth;
+        this.queue = [];
+    }
+    AuthMiddlewareQueue.prototype.pushCallback = function (callback, onAbort) {
+        var _this = this;
+        // The callback could be sync or async. Wrap it into a
+        // function that is always async.
+        var wrappedCallback = function (user) {
+            return new Promise(function (resolve, reject) {
+                try {
+                    var result = callback(user);
+                    // Either resolve with existing promise or wrap a non-promise
+                    // return value into a promise.
+                    resolve(result);
+                }
+                catch (e) {
+                    // Sync callback throws.
+                    reject(e);
+                }
+            });
+        };
+        // Attach the onAbort if present
+        wrappedCallback.onAbort = onAbort;
+        this.queue.push(wrappedCallback);
+        var index = this.queue.length - 1;
+        return function () {
+            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
+            // indexing of other elements.
+            _this.queue[index] = function () { return Promise.resolve(); };
+        };
+    };
+    AuthMiddlewareQueue.prototype.runMiddleware = function (nextUser) {
+        return __awaiter(this, void 0, void 0, function () {
+            var onAbortStack, _i, _a, beforeStateCallback, e_1, _b, onAbortStack_1, onAbort;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        if (this.auth.currentUser === nextUser) {
+                            return [2 /*return*/];
+                        }
+                        onAbortStack = [];
+                        _c.label = 1;
+                    case 1:
+                        _c.trys.push([1, 6, , 7]);
+                        _i = 0, _a = this.queue;
+                        _c.label = 2;
+                    case 2:
+                        if (!(_i < _a.length)) return [3 /*break*/, 5];
+                        beforeStateCallback = _a[_i];
+                        return [4 /*yield*/, beforeStateCallback(nextUser)];
+                    case 3:
+                        _c.sent();
+                        // Only push the onAbort if the callback succeeds
+                        if (beforeStateCallback.onAbort) {
+                            onAbortStack.push(beforeStateCallback.onAbort);
+                        }
+                        _c.label = 4;
+                    case 4:
+                        _i++;
+                        return [3 /*break*/, 2];
+                    case 5: return [3 /*break*/, 7];
+                    case 6:
+                        e_1 = _c.sent();
+                        // Run all onAbort, with separate try/catch to ignore any errors and
+                        // continue
+                        onAbortStack.reverse();
+                        for (_b = 0, onAbortStack_1 = onAbortStack; _b < onAbortStack_1.length; _b++) {
+                            onAbort = onAbortStack_1[_b];
+                            try {
+                                onAbort();
+                            }
+                            catch (_) {
+                                /* swallow error */
+                            }
+                        }
+                        throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
+                            originalMessage: e_1 === null || e_1 === void 0 ? void 0 : e_1.message
+                        });
+                    case 7: return [2 /*return*/];
+                }
+            });
         });
-    });
-}
-function getRecaptchaConfig(auth, request) {
+    };
+    return AuthMiddlewareQueue;
+}());
+
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Fetches the password policy for the currently set tenant or the project if no tenant is set.
+ *
+ * @param auth Auth object.
+ * @param request Password policy request.
+ * @returns Password policy response.
+ */
+function _getPasswordPolicy(auth, request) {
+    if (request === void 0) { request = {}; }
     return __awaiter(this, void 0, void 0, function () {
         return __generator(this, function (_a) {
-            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/passwordPolicy" /* Endpoint.GET_PASSWORD_POLICY */, _addTidIfNecessary(auth, request))];
         });
     });
 }
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -3306,336 +3492,138 @@ function getRecaptchaConfig(auth, request) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function isV2(grecaptcha) {
-    return (grecaptcha !== undefined &&
-        grecaptcha.getResponse !== undefined);
-}
-function isEnterprise(grecaptcha) {
-    return (grecaptcha !== undefined &&
-        grecaptcha.enterprise !== undefined);
-}
-var RecaptchaConfig = /** @class */ (function () {
-    function RecaptchaConfig(response) {
-        /**
-         * The reCAPTCHA site key.
-         */
-        this.siteKey = '';
-        /**
-         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
-         */
-        this.emailPasswordEnabled = false;
-        if (response.recaptchaKey === undefined) {
-            throw new Error('recaptchaKey undefined');
+// Minimum min password length enforced by the backend, even if no minimum length is set.
+var MINIMUM_MIN_PASSWORD_LENGTH = 6;
+/**
+ * Stores password policy requirements and provides password validation against the policy.
+ *
+ * @internal
+ */
+var PasswordPolicyImpl = /** @class */ (function () {
+    function PasswordPolicyImpl(response) {
+        var _a, _b, _c, _d;
+        // Only include custom strength options defined in the response.
+        var responseOptions = response.customStrengthOptions;
+        this.customStrengthOptions = {};
+        // TODO: Remove once the backend is updated to include the minimum min password length instead of undefined when there is no minimum length set.
+        this.customStrengthOptions.minPasswordLength =
+            (_a = responseOptions.minPasswordLength) !== null && _a !== void 0 ? _a : MINIMUM_MIN_PASSWORD_LENGTH;
+        if (responseOptions.maxPasswordLength) {
+            this.customStrengthOptions.maxPasswordLength =
+                responseOptions.maxPasswordLength;
+        }
+        if (responseOptions.containsLowercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsLowercaseLetter =
+                responseOptions.containsLowercaseCharacter;
+        }
+        if (responseOptions.containsUppercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsUppercaseLetter =
+                responseOptions.containsUppercaseCharacter;
+        }
+        if (responseOptions.containsNumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNumericCharacter =
+                responseOptions.containsNumericCharacter;
+        }
+        if (responseOptions.containsNonAlphanumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNonAlphanumericCharacter =
+                responseOptions.containsNonAlphanumericCharacter;
+        }
+        this.enforcementState = response.enforcementState;
+        if (this.enforcementState === 'ENFORCEMENT_STATE_UNSPECIFIED') {
+            this.enforcementState = 'OFF';
+        }
+        // Use an empty string if no non-alphanumeric characters are specified in the response.
+        this.allowedNonAlphanumericCharacters =
+            (_c = (_b = response.allowedNonAlphanumericCharacters) === null || _b === void 0 ? void 0 : _b.join('')) !== null && _c !== void 0 ? _c : '';
+        this.forceUpgradeOnSignin = (_d = response.forceUpgradeOnSignin) !== null && _d !== void 0 ? _d : false;
+        this.schemaVersion = response.schemaVersion;
+    }
+    PasswordPolicyImpl.prototype.validatePassword = function (password) {
+        var _a, _b, _c, _d, _e, _f;
+        var status = {
+            isValid: true,
+            passwordPolicy: this
+        };
+        // Check the password length and character options.
+        this.validatePasswordLengthOptions(password, status);
+        this.validatePasswordCharacterOptions(password, status);
+        // Combine the status into single isValid property.
+        status.isValid && (status.isValid = (_a = status.meetsMinPasswordLength) !== null && _a !== void 0 ? _a : true);
+        status.isValid && (status.isValid = (_b = status.meetsMaxPasswordLength) !== null && _b !== void 0 ? _b : true);
+        status.isValid && (status.isValid = (_c = status.containsLowercaseLetter) !== null && _c !== void 0 ? _c : true);
+        status.isValid && (status.isValid = (_d = status.containsUppercaseLetter) !== null && _d !== void 0 ? _d : true);
+        status.isValid && (status.isValid = (_e = status.containsNumericCharacter) !== null && _e !== void 0 ? _e : true);
+        status.isValid && (status.isValid = (_f = status.containsNonAlphanumericCharacter) !== null && _f !== void 0 ? _f : true);
+        return status;
+    };
+    /**
+     * Validates that the password meets the length options for the policy.
+     *
+     * @param password Password to validate.
+     * @param status Validation status.
+     */
+    PasswordPolicyImpl.prototype.validatePasswordLengthOptions = function (password, status) {
+        var minPasswordLength = this.customStrengthOptions.minPasswordLength;
+        var maxPasswordLength = this.customStrengthOptions.maxPasswordLength;
+        if (minPasswordLength) {
+            status.meetsMinPasswordLength = password.length >= minPasswordLength;
         }
-        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
-        this.siteKey = response.recaptchaKey.split('/')[3];
-        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
-            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
-                enforcementState.enforcementState !== 'OFF';
-        });
-    }
-    return RecaptchaConfig;
-}());
-
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-function getScriptParentElement() {
-    var _a, _b;
-    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
-}
-function _loadJS(url) {
-    // TODO: consider adding timeout support & cancellation
-    return new Promise(function (resolve, reject) {
-        var el = document.createElement('script');
-        el.setAttribute('src', url);
-        el.onload = resolve;
-        el.onerror = function (e) {
-            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            error.customData = e;
-            reject(error);
-        };
-        el.type = 'text/javascript';
-        el.charset = 'UTF-8';
-        getScriptParentElement().appendChild(el);
-    });
-}
-function _generateCallbackName(prefix) {
-    return "__".concat(prefix).concat(Math.floor(Math.random() * 1000000));
-}
-
-/* eslint-disable @typescript-eslint/no-require-imports */
-var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
-var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
-var FAKE_TOKEN = 'NO_RECAPTCHA';
-var RecaptchaEnterpriseVerifier = /** @class */ (function () {
-    /**
-     *
-     * @param authExtern - The corresponding Firebase {@link Auth} instance.
-     *
-     */
-    function RecaptchaEnterpriseVerifier(authExtern) {
-        /**
-         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
-         */
-        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
-        this.auth = _castAuth(authExtern);
-    }
-    /**
-     * Executes the verification process.
-     *
-     * @returns A Promise for a token that can be used to assert the validity of a request.
-     */
-    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
-        if (action === void 0) { action = 'verify'; }
-        if (forceRefresh === void 0) { forceRefresh = false; }
-        return __awaiter(this, void 0, void 0, function () {
-            function retrieveSiteKey(auth) {
-                return __awaiter(this, void 0, void 0, function () {
-                    var _this = this;
-                    return __generator(this, function (_a) {
-                        if (!forceRefresh) {
-                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
-                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
-                            }
-                            if (auth.tenantId != null &&
-                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
-                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
-                            }
-                        }
-                        return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
-                                return __generator(this, function (_a) {
-                                    getRecaptchaConfig(auth, {
-                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                                    })
-                                        .then(function (response) {
-                                        if (response.recaptchaKey === undefined) {
-                                            reject(new Error('recaptcha Enterprise site key undefined'));
-                                        }
-                                        else {
-                                            var config = new RecaptchaConfig(response);
-                                            if (auth.tenantId == null) {
-                                                auth._agentRecaptchaConfig = config;
-                                            }
-                                            else {
-                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
-                                            }
-                                            return resolve(config.siteKey);
-                                        }
-                                    })
-                                        .catch(function (error) {
-                                        reject(error);
-                                    });
-                                    return [2 /*return*/];
-                                });
-                            }); })];
-                    });
-                });
-            }
-            function retrieveRecaptchaToken(siteKey, resolve, reject) {
-                var grecaptcha = window.grecaptcha;
-                if (isEnterprise(grecaptcha)) {
-                    grecaptcha.enterprise.ready(function () {
-                        grecaptcha.enterprise
-                            .execute(siteKey, { action: action })
-                            .then(function (token) {
-                            resolve(token);
-                        })
-                            .catch(function () {
-                            resolve(FAKE_TOKEN);
-                        });
-                    });
-                }
-                else {
-                    reject(Error('No reCAPTCHA enterprise script loaded.'));
-                }
-            }
-            var _this = this;
-            return __generator(this, function (_a) {
-                return [2 /*return*/, new Promise(function (resolve, reject) {
-                        retrieveSiteKey(_this.auth)
-                            .then(function (siteKey) {
-                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
-                                retrieveRecaptchaToken(siteKey, resolve, reject);
-                            }
-                            else {
-                                if (typeof window === 'undefined') {
-                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
-                                    return;
-                                }
-                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
-                                    .then(function () {
-                                    retrieveRecaptchaToken(siteKey, resolve, reject);
-                                })
-                                    .catch(function (error) {
-                                    reject(error);
-                                });
-                            }
-                        })
-                            .catch(function (error) {
-                            reject(error);
-                        });
-                    })];
-            });
-        });
-    };
-    return RecaptchaEnterpriseVerifier;
-}());
-function injectRecaptchaFields(auth, request, action, captchaResp) {
-    if (captchaResp === void 0) { captchaResp = false; }
-    return __awaiter(this, void 0, void 0, function () {
-        var verifier, captchaResponse, newRequest;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0:
-                    verifier = new RecaptchaEnterpriseVerifier(auth);
-                    _a.label = 1;
-                case 1:
-                    _a.trys.push([1, 3, , 5]);
-                    return [4 /*yield*/, verifier.verify(action)];
-                case 2:
-                    captchaResponse = _a.sent();
-                    return [3 /*break*/, 5];
-                case 3:
-                    _a.sent();
-                    return [4 /*yield*/, verifier.verify(action, true)];
-                case 4:
-                    captchaResponse = _a.sent();
-                    return [3 /*break*/, 5];
-                case 5:
-                    newRequest = __assign({}, request);
-                    if (!captchaResp) {
-                        Object.assign(newRequest, { captchaResponse: captchaResponse });
-                    }
-                    else {
-                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
-                    }
-                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
-                    Object.assign(newRequest, {
-                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                    });
-                    return [2 /*return*/, newRequest];
-            }
-        });
-    });
-}
-
-/**
- * @license
- * Copyright 2022 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-var AuthMiddlewareQueue = /** @class */ (function () {
-    function AuthMiddlewareQueue(auth) {
-        this.auth = auth;
-        this.queue = [];
-    }
-    AuthMiddlewareQueue.prototype.pushCallback = function (callback, onAbort) {
-        var _this = this;
-        // The callback could be sync or async. Wrap it into a
-        // function that is always async.
-        var wrappedCallback = function (user) {
-            return new Promise(function (resolve, reject) {
-                try {
-                    var result = callback(user);
-                    // Either resolve with existing promise or wrap a non-promise
-                    // return value into a promise.
-                    resolve(result);
-                }
-                catch (e) {
-                    // Sync callback throws.
-                    reject(e);
-                }
-            });
-        };
-        // Attach the onAbort if present
-        wrappedCallback.onAbort = onAbort;
-        this.queue.push(wrappedCallback);
-        var index = this.queue.length - 1;
-        return function () {
-            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
-            // indexing of other elements.
-            _this.queue[index] = function () { return Promise.resolve(); };
-        };
-    };
-    AuthMiddlewareQueue.prototype.runMiddleware = function (nextUser) {
-        return __awaiter(this, void 0, void 0, function () {
-            var onAbortStack, _i, _a, beforeStateCallback, e_1, _b, onAbortStack_1, onAbort;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
-                    case 0:
-                        if (this.auth.currentUser === nextUser) {
-                            return [2 /*return*/];
-                        }
-                        onAbortStack = [];
-                        _c.label = 1;
-                    case 1:
-                        _c.trys.push([1, 6, , 7]);
-                        _i = 0, _a = this.queue;
-                        _c.label = 2;
-                    case 2:
-                        if (!(_i < _a.length)) return [3 /*break*/, 5];
-                        beforeStateCallback = _a[_i];
-                        return [4 /*yield*/, beforeStateCallback(nextUser)];
-                    case 3:
-                        _c.sent();
-                        // Only push the onAbort if the callback succeeds
-                        if (beforeStateCallback.onAbort) {
-                            onAbortStack.push(beforeStateCallback.onAbort);
-                        }
-                        _c.label = 4;
-                    case 4:
-                        _i++;
-                        return [3 /*break*/, 2];
-                    case 5: return [3 /*break*/, 7];
-                    case 6:
-                        e_1 = _c.sent();
-                        // Run all onAbort, with separate try/catch to ignore any errors and
-                        // continue
-                        onAbortStack.reverse();
-                        for (_b = 0, onAbortStack_1 = onAbortStack; _b < onAbortStack_1.length; _b++) {
-                            onAbort = onAbortStack_1[_b];
-                            try {
-                                onAbort();
-                            }
-                            catch (_) {
-                                /* swallow error */
-                            }
-                        }
-                        throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
-                            originalMessage: e_1 === null || e_1 === void 0 ? void 0 : e_1.message
-                        });
-                    case 7: return [2 /*return*/];
-                }
-            });
-        });
-    };
-    return AuthMiddlewareQueue;
+        if (maxPasswordLength) {
+            status.meetsMaxPasswordLength = password.length <= maxPasswordLength;
+        }
+    };
+    /**
+     * Validates that the password meets the character options for the policy.
+     *
+     * @param password Password to validate.
+     * @param status Validation status.
+     */
+    PasswordPolicyImpl.prototype.validatePasswordCharacterOptions = function (password, status) {
+        // Assign statuses for requirements even if the password is an empty string.
+        this.updatePasswordCharacterOptionsStatuses(status, 
+        /* containsLowercaseCharacter= */ false, 
+        /* containsUppercaseCharacter= */ false, 
+        /* containsNumericCharacter= */ false, 
+        /* containsNonAlphanumericCharacter= */ false);
+        var passwordChar;
+        for (var i = 0; i < password.length; i++) {
+            passwordChar = password.charAt(i);
+            this.updatePasswordCharacterOptionsStatuses(status, 
+            /* containsLowercaseCharacter= */ passwordChar >= 'a' &&
+                passwordChar <= 'z', 
+            /* containsUppercaseCharacter= */ passwordChar >= 'A' &&
+                passwordChar <= 'Z', 
+            /* containsNumericCharacter= */ passwordChar >= '0' &&
+                passwordChar <= '9', 
+            /* containsNonAlphanumericCharacter= */ this.allowedNonAlphanumericCharacters.includes(passwordChar));
+        }
+    };
+    /**
+     * Updates the running validation status with the statuses for the character options.
+     * Expected to be called each time a character is processed to update each option status
+     * based on the current character.
+     *
+     * @param status Validation status.
+     * @param containsLowercaseCharacter Whether the character is a lowercase letter.
+     * @param containsUppercaseCharacter Whether the character is an uppercase letter.
+     * @param containsNumericCharacter Whether the character is a numeric character.
+     * @param containsNonAlphanumericCharacter Whether the character is a non-alphanumeric character.
+     */
+    PasswordPolicyImpl.prototype.updatePasswordCharacterOptionsStatuses = function (status, containsLowercaseCharacter, containsUppercaseCharacter, containsNumericCharacter, containsNonAlphanumericCharacter) {
+        if (this.customStrengthOptions.containsLowercaseLetter) {
+            status.containsLowercaseLetter || (status.containsLowercaseLetter = containsLowercaseCharacter);
+        }
+        if (this.customStrengthOptions.containsUppercaseLetter) {
+            status.containsUppercaseLetter || (status.containsUppercaseLetter = containsUppercaseCharacter);
+        }
+        if (this.customStrengthOptions.containsNumericCharacter) {
+            status.containsNumericCharacter || (status.containsNumericCharacter = containsNumericCharacter);
+        }
+        if (this.customStrengthOptions.containsNonAlphanumericCharacter) {
+            status.containsNonAlphanumericCharacter || (status.containsNonAlphanumericCharacter = containsNonAlphanumericCharacter);
+        }
+    };
+    return PasswordPolicyImpl;
 }());
 
 /**
@@ -3668,6 +3656,7 @@ var AuthImpl = /** @class */ (function () {
         this.beforeStateQueue = new AuthMiddlewareQueue(this);
         this.redirectUser = null;
         this.isProactiveRefreshEnabled = false;
+        this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION = 1;
         // Any network calls will set this to true and prevent subsequent emulator
         // initialization
         this._canInitEmulator = true;
@@ -3678,6 +3667,8 @@ var AuthImpl = /** @class */ (function () {
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
         this._agentRecaptchaConfig = null;
         this._tenantRecaptchaConfigs = {};
+        this._projectPasswordPolicy = null;
+        this._tenantPasswordPolicies = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -4007,41 +3998,66 @@ var AuthImpl = /** @class */ (function () {
             });
         }); });
     };
-    AuthImpl.prototype.initializeRecaptchaConfig = function () {
+    AuthImpl.prototype._getRecaptchaConfig = function () {
+        if (this.tenantId == null) {
+            return this._agentRecaptchaConfig;
+        }
+        else {
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    };
+    AuthImpl.prototype.validatePassword = function (password) {
         return __awaiter(this, void 0, void 0, function () {
-            var response, config, verifier;
+            var passwordPolicy;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, getRecaptchaConfig(this, {
-                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                        })];
+                    case 0:
+                        if (!!this._getPasswordPolicyInternal()) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this._updatePasswordPolicy()];
                     case 1:
-                        response = _a.sent();
-                        config = new RecaptchaConfig(response);
-                        if (this.tenantId == null) {
-                            this._agentRecaptchaConfig = config;
-                        }
-                        else {
-                            this._tenantRecaptchaConfigs[this.tenantId] = config;
-                        }
-                        if (config.emailPasswordEnabled) {
-                            verifier = new RecaptchaEnterpriseVerifier(this);
-                            void verifier.verify();
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        passwordPolicy = this._getPasswordPolicyInternal();
+                        // Check that the policy schema version is supported by the SDK.
+                        // TODO: Update this logic to use a max supported policy schema version once we have multiple schema versions.
+                        if (passwordPolicy.schemaVersion !==
+                            this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION) {
+                            return [2 /*return*/, Promise.reject(this._errorFactory.create("unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */, {}))];
                         }
-                        return [2 /*return*/];
+                        return [2 /*return*/, passwordPolicy.validatePassword(password)];
                 }
             });
         });
     };
-    AuthImpl.prototype._getRecaptchaConfig = function () {
-        if (this.tenantId == null) {
-            return this._agentRecaptchaConfig;
+    AuthImpl.prototype._getPasswordPolicyInternal = function () {
+        if (this.tenantId === null) {
+            return this._projectPasswordPolicy;
         }
         else {
-            return this._tenantRecaptchaConfigs[this.tenantId];
+            return this._tenantPasswordPolicies[this.tenantId];
         }
     };
+    AuthImpl.prototype._updatePasswordPolicy = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var response, passwordPolicy;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, _getPasswordPolicy(this)];
+                    case 1:
+                        response = _a.sent();
+                        passwordPolicy = new PasswordPolicyImpl(response);
+                        if (this.tenantId === null) {
+                            this._projectPasswordPolicy = passwordPolicy;
+                        }
+                        else {
+                            this._tenantPasswordPolicies[this.tenantId] = passwordPolicy;
+                        }
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
     AuthImpl.prototype._getPersistence = function () {
         return this.assertedPersistence.persistence.type;
     };
@@ -4208,18 +4224,32 @@ var AuthImpl = /** @class */ (function () {
         var cb = typeof nextOrObserver === 'function'
             ? nextOrObserver
             : nextOrObserver.next.bind(nextOrObserver);
+        var isUnsubscribed = false;
         var promise = this._isInitialized
             ? Promise.resolve()
             : this._initializationPromise;
         _assert(promise, this, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
         // The callback needs to be called asynchronously per the spec.
         // eslint-disable-next-line @typescript-eslint/no-floating-promises
-        promise.then(function () { return cb(_this.currentUser); });
+        promise.then(function () {
+            if (isUnsubscribed) {
+                return;
+            }
+            cb(_this.currentUser);
+        });
         if (typeof nextOrObserver === 'function') {
-            return subscription.addObserver(nextOrObserver, error, completed);
+            var unsubscribe_2 = subscription.addObserver(nextOrObserver, error, completed);
+            return function () {
+                isUnsubscribed = true;
+                unsubscribe_2();
+            };
         }
         else {
-            return subscription.addObserver(nextOrObserver);
+            var unsubscribe_3 = subscription.addObserver(nextOrObserver);
+            return function () {
+                isUnsubscribed = true;
+                unsubscribe_3();
+            };
         }
     };
     /**
@@ -4317,54 +4347,280 @@ var AuthImpl = /** @class */ (function () {
     AuthImpl.prototype._getAppCheckToken = function () {
         var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var appCheckTokenResult;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, ((_a = this.appCheckServiceProvider
-                            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken())];
-                    case 1:
-                        appCheckTokenResult = _b.sent();
-                        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
-                            // Context: appCheck.getToken() will never throw even if an error happened.
-                            // In the error case, a dummy token will be returned along with an error field describing
-                            // the error. In general, we shouldn't care about the error condition and just use
-                            // the token (actual or dummy) to send requests.
-                            _logWarn("Error while retrieving App Check token: ".concat(appCheckTokenResult.error));
+            var appCheckTokenResult;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, ((_a = this.appCheckServiceProvider
+                            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken())];
+                    case 1:
+                        appCheckTokenResult = _b.sent();
+                        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
+                            // Context: appCheck.getToken() will never throw even if an error happened.
+                            // In the error case, a dummy token will be returned along with an error field describing
+                            // the error. In general, we shouldn't care about the error condition and just use
+                            // the token (actual or dummy) to send requests.
+                            _logWarn("Error while retrieving App Check token: ".concat(appCheckTokenResult.error));
+                        }
+                        return [2 /*return*/, appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token];
+                }
+            });
+        });
+    };
+    return AuthImpl;
+}());
+/**
+ * Method to be used to cast down to our private implmentation of Auth.
+ * It will also handle unwrapping from the compat type if necessary
+ *
+ * @param auth Auth object passed in from developer
+ */
+function _castAuth(auth) {
+    return getModularInstance(auth);
+}
+/** Helper class to wrap subscriber logic */
+var Subscription = /** @class */ (function () {
+    function Subscription(auth) {
+        var _this = this;
+        this.auth = auth;
+        this.observer = null;
+        this.addObserver = createSubscribe(function (observer) { return (_this.observer = observer); });
+    }
+    Object.defineProperty(Subscription.prototype, "next", {
+        get: function () {
+            _assert(this.observer, this.auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            return this.observer.next.bind(this.observer);
+        },
+        enumerable: false,
+        configurable: true
+    });
+    return Subscription;
+}());
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise(function (resolve, reject) {
+        var el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = function (e) {
+            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+function _generateCallbackName(prefix) {
+    return "__".concat(prefix).concat(Math.floor(Math.random() * 1000000));
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+var FAKE_TOKEN = 'NO_RECAPTCHA';
+var RecaptchaEnterpriseVerifier = /** @class */ (function () {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    function RecaptchaEnterpriseVerifier(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
+        if (action === void 0) { action = 'verify'; }
+        if (forceRefresh === void 0) { forceRefresh = false; }
+        return __awaiter(this, void 0, void 0, function () {
+            function retrieveSiteKey(auth) {
+                return __awaiter(this, void 0, void 0, function () {
+                    var _this = this;
+                    return __generator(this, function (_a) {
+                        if (!forceRefresh) {
+                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
+                            }
+                            if (auth.tenantId != null &&
+                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
+                            }
                         }
-                        return [2 /*return*/, appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token];
+                        return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    getRecaptchaConfig(auth, {
+                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                                    })
+                                        .then(function (response) {
+                                        if (response.recaptchaKey === undefined) {
+                                            reject(new Error('recaptcha Enterprise site key undefined'));
+                                        }
+                                        else {
+                                            var config = new RecaptchaConfig(response);
+                                            if (auth.tenantId == null) {
+                                                auth._agentRecaptchaConfig = config;
+                                            }
+                                            else {
+                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                                            }
+                                            return resolve(config.siteKey);
+                                        }
+                                    })
+                                        .catch(function (error) {
+                                        reject(error);
+                                    });
+                                    return [2 /*return*/];
+                                });
+                            }); })];
+                    });
+                });
+            }
+            function retrieveRecaptchaToken(siteKey, resolve, reject) {
+                var grecaptcha = window.grecaptcha;
+                if (isEnterprise(grecaptcha)) {
+                    grecaptcha.enterprise.ready(function () {
+                        grecaptcha.enterprise
+                            .execute(siteKey, { action: action })
+                            .then(function (token) {
+                            resolve(token);
+                        })
+                            .catch(function () {
+                            resolve(FAKE_TOKEN);
+                        });
+                    });
+                }
+                else {
+                    reject(Error('No reCAPTCHA enterprise script loaded.'));
                 }
+            }
+            var _this = this;
+            return __generator(this, function (_a) {
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        retrieveSiteKey(_this.auth)
+                            .then(function (siteKey) {
+                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                                retrieveRecaptchaToken(siteKey, resolve, reject);
+                            }
+                            else {
+                                if (typeof window === 'undefined') {
+                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
+                                    return;
+                                }
+                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                                    .then(function () {
+                                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                                })
+                                    .catch(function (error) {
+                                    reject(error);
+                                });
+                            }
+                        })
+                            .catch(function (error) {
+                            reject(error);
+                        });
+                    })];
             });
         });
     };
-    return AuthImpl;
+    return RecaptchaEnterpriseVerifier;
 }());
-/**
- * Method to be used to cast down to our private implmentation of Auth.
- * It will also handle unwrapping from the compat type if necessary
- *
- * @param auth Auth object passed in from developer
- */
-function _castAuth(auth) {
-    return getModularInstance(auth);
+function injectRecaptchaFields(auth, request, action, captchaResp) {
+    if (captchaResp === void 0) { captchaResp = false; }
+    return __awaiter(this, void 0, void 0, function () {
+        var verifier, captchaResponse, newRequest;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    verifier = new RecaptchaEnterpriseVerifier(auth);
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 5]);
+                    return [4 /*yield*/, verifier.verify(action)];
+                case 2:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, verifier.verify(action, true)];
+                case 4:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 5:
+                    newRequest = __assign({}, request);
+                    if (!captchaResp) {
+                        Object.assign(newRequest, { captchaResponse: captchaResponse });
+                    }
+                    else {
+                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+                    }
+                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+                    Object.assign(newRequest, {
+                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                    });
+                    return [2 /*return*/, newRequest];
+            }
+        });
+    });
 }
-/** Helper class to wrap subscriber logic */
-var Subscription = /** @class */ (function () {
-    function Subscription(auth) {
-        var _this = this;
-        this.auth = auth;
-        this.observer = null;
-        this.addObserver = createSubscribe(function (observer) { return (_this.observer = observer); });
-    }
-    Object.defineProperty(Subscription.prototype, "next", {
-        get: function () {
-            _assert(this.observer, this.auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            return this.observer.next.bind(this.observer);
-        },
-        enumerable: false,
-        configurable: true
+function _initializeRecaptchaConfig(auth) {
+    return __awaiter(this, void 0, void 0, function () {
+        var authInternal, response, config, verifier;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    authInternal = _castAuth(auth);
+                    return [4 /*yield*/, getRecaptchaConfig(authInternal, {
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                        })];
+                case 1:
+                    response = _a.sent();
+                    config = new RecaptchaConfig(response);
+                    if (authInternal.tenantId == null) {
+                        authInternal._agentRecaptchaConfig = config;
+                    }
+                    else {
+                        authInternal._tenantRecaptchaConfigs[authInternal.tenantId] = config;
+                    }
+                    if (config.emailPasswordEnabled) {
+                        verifier = new RecaptchaEnterpriseVerifier(authInternal);
+                        void verifier.verify();
+                    }
+                    return [2 /*return*/];
+            }
+        });
     });
-    return Subscription;
-}());
+}
 
 /**
  * @license
@@ -7024,6 +7280,36 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/**
+ * Updates the password policy cached in the {@link Auth} instance if a policy is already
+ * cached for the project or tenant.
+ *
+ * @remarks
+ * We only fetch the password policy if the password did not meet policy requirements and
+ * there is an existing policy cached. A developer must call validatePassword at least
+ * once for the cache to be automatically updated.
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @private
+ */
+function recachePasswordPolicy(auth) {
+    return __awaiter(this, void 0, void 0, function () {
+        var authInternal;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    authInternal = _castAuth(auth);
+                    if (!authInternal._getPasswordPolicyInternal()) return [3 /*break*/, 2];
+                    return [4 /*yield*/, authInternal._updatePasswordPolicy()];
+                case 1:
+                    _a.sent();
+                    _a.label = 2;
+                case 2: return [2 /*return*/];
+            }
+        });
+    });
+}
 /**
  * Sends a password reset email to the given email address.
  *
@@ -7127,12 +7413,22 @@ function sendPasswordResetEmail(auth, email, actionCodeSettings) {
  */
 function confirmPasswordReset(auth, oobCode, newPassword) {
     return __awaiter(this, void 0, void 0, function () {
+        var _this = this;
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0: return [4 /*yield*/, resetPassword(getModularInstance(auth), {
                         oobCode: oobCode,
                         newPassword: newPassword
-                    })];
+                    })
+                        .catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            if (error.code ===
+                                "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                                void recachePasswordPolicy(auth);
+                            }
+                            throw error;
+                        });
+                    }); })];
                 case 1:
                     _a.sent();
                     return [2 /*return*/];
@@ -7288,13 +7584,16 @@ function createUserWithEmailAndPassword(auth, email, password) {
                                 case 1:
                                     requestWithRecaptcha = _a.sent();
                                     return [2 /*return*/, signUp(authInternal, requestWithRecaptcha)];
-                                case 2: return [2 /*return*/, Promise.reject(error)];
+                                case 2: throw error;
                             }
                         });
                     }); });
                     _b.label = 3;
                 case 3: return [4 /*yield*/, signUpResponse.catch(function (error) {
-                        return Promise.reject(error);
+                        if (error.code === "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                            void recachePasswordPolicy(auth);
+                        }
+                        throw error;
                     })];
                 case 4:
                     response = _b.sent();
@@ -7326,7 +7625,15 @@ function createUserWithEmailAndPassword(auth, email, password) {
  * @public
  */
 function signInWithEmailAndPassword(auth, email, password) {
-    return signInWithCredential(getModularInstance(auth), EmailAuthProvider.credential(email, password));
+    var _this = this;
+    return signInWithCredential(getModularInstance(auth), EmailAuthProvider.credential(email, password)).catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            if (error.code === "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                void recachePasswordPolicy(auth);
+            }
+            throw error;
+        });
+    }); });
 }
 
 /**
@@ -8064,8 +8371,39 @@ function setPersistence(auth, persistence) {
  * @public
  */
 function initializeRecaptchaConfig(auth) {
-    var authInternal = _castAuth(auth);
-    return authInternal.initializeRecaptchaConfig();
+    return _initializeRecaptchaConfig(auth);
+}
+/**
+ * Validates the password against the password policy configured for the project or tenant.
+ *
+ * @remarks
+ * If no tenant ID is set on the `Auth` instance, then this method will use the password
+ * policy configured for the project. Otherwise, this method will use the policy configured
+ * for the tenant. If a password policy has not been configured, then the default policy
+ * configured for all projects will be used.
+ *
+ * If an auth flow fails because a submitted password does not meet the password policy
+ * requirements and this method has previously been called, then this method will use the
+ * most recent policy available when called again.
+ *
+ * @example
+ * ```javascript
+ * validatePassword(auth, 'some-password');
+ * ```
+ *
+ * @param auth The {@link Auth} instance.
+ * @param password The password to validate.
+ *
+ * @public
+ */
+function validatePassword(auth, password) {
+    return __awaiter(this, void 0, void 0, function () {
+        var authInternal;
+        return __generator(this, function (_a) {
+            authInternal = _castAuth(auth);
+            return [2 /*return*/, authInternal.validatePassword(password)];
+        });
+    });
 }
 /**
  * Adds an observer for changes to the signed-in user's ID token.
@@ -8487,7 +8825,7 @@ function multiFactor(user) {
 }
 
 var name = "@firebase/auth";
-var version = "1.1.0";
+var version = "1.2.0-canary.309f7a914";
 
 /**
  * @license
@@ -10690,5 +11028,5 @@ function generateNoEvent() {
     };
 }
 
-export { isSignInWithEmailLink as $, ActionCodeOperation as A, EmailAuthProvider as B, FacebookAuthProvider as C, GithubAuthProvider as D, EmailAuthCredential as E, FactorId as F, GoogleAuthProvider as G, OAuthProvider as H, SAMLAuthProvider as I, signInAnonymously as J, signInWithCredential as K, linkWithCredential as L, reauthenticateWithCredential as M, signInWithCustomToken as N, OperationType as O, ProviderId as P, sendPasswordResetEmail as Q, confirmPasswordReset as R, SignInMethod as S, TwitterAuthProvider as T, applyActionCode as U, checkActionCode as V, verifyPasswordResetCode as W, createUserWithEmailAndPassword as X, signInWithEmailAndPassword as Y, sendSignInLinkToEmail as Z, _signInWithRedirect as _, _reauthenticateWithRedirect as a, FetchProvider as a$, signInWithEmailLink as a0, fetchSignInMethodsForEmail as a1, sendEmailVerification as a2, verifyBeforeUpdateEmail as a3, ActionCodeURL as a4, parseActionCodeURL as a5, updateProfile as a6, updateEmail as a7, updatePassword as a8, getIdToken as a9, _assertInstanceOf as aA, _withDefaultResolver as aB, FederatedAuthProvider as aC, _fail as aD, _getProjectConfig as aE, _getCurrentUrl as aF, _emulatorUrl as aG, _isChromeIOS as aH, _isFirefox as aI, _isIOSStandalone as aJ, _getRedirectUrl as aK, _setWindowLocation as aL, _isMobileBrowser as aM, _isSafari as aN, _isIOS as aO, _getRedirectResult as aP, _overrideRedirectResult as aQ, AuthEventManager as aR, debugFail as aS, finalizeEnrollPhoneMfa as aT, finalizeEnrollTotpMfa as aU, startEnrollTotpMfa as aV, _persistenceKeyName as aW, UserImpl as aX, _getInstance as aY, AuthImpl as aZ, _getClientVersion as a_, getIdTokenResult as aa, unlink as ab, getAdditionalUserInfo as ac, reload as ad, getMultiFactorResolver as ae, multiFactor as af, _performApiRequest as ag, _addTidIfNecessary as ah, _assert as ai, Delay as aj, _window as ak, isV2 as al, _createError as am, _loadJS as an, _generateCallbackName as ao, getRecaptchaParams as ap, _isHttpOrHttps as aq, _isWorker as ar, _castAuth as as, _assertLinkedStatus as at, sendPhoneVerificationCode as au, startEnrollPhoneMfa as av, _link$1 as aw, debugAssert as ax, _generateEventId as ay, AbstractPopupRedirectOperation as az, _linkWithRedirect as b, SAMLAuthCredential as b0, signInWithRedirect as b1, linkWithRedirect as b2, reauthenticateWithRedirect as b3, indexedDBLocalPersistence as c, cordovaPopupRedirectResolver as d, browserLocalPersistence as e, browserSessionPersistence as f, getRedirectResult as g, initializeRecaptchaConfig as h, initializeAuth as i, beforeAuthStateChanged as j, onAuthStateChanged as k, updateCurrentUser as l, signOut as m, deleteUser as n, onIdTokenChanged as o, debugErrorMap as p, prodErrorMap as q, registerAuth as r, setPersistence as s, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as t, useDeviceLanguage as u, connectAuthEmulator as v, AuthCredential as w, OAuthCredential as x, PhoneAuthCredential as y, inMemoryPersistence as z };
-//# sourceMappingURL=popup_redirect-71c1ff0a.js.map
+export { sendSignInLinkToEmail as $, ActionCodeOperation as A, inMemoryPersistence as B, EmailAuthProvider as C, FacebookAuthProvider as D, EmailAuthCredential as E, FactorId as F, GoogleAuthProvider as G, GithubAuthProvider as H, OAuthProvider as I, SAMLAuthProvider as J, signInAnonymously as K, signInWithCredential as L, linkWithCredential as M, reauthenticateWithCredential as N, OperationType as O, ProviderId as P, signInWithCustomToken as Q, sendPasswordResetEmail as R, SignInMethod as S, TwitterAuthProvider as T, confirmPasswordReset as U, applyActionCode as V, checkActionCode as W, verifyPasswordResetCode as X, createUserWithEmailAndPassword as Y, signInWithEmailAndPassword as Z, _signInWithRedirect as _, _reauthenticateWithRedirect as a, _getClientVersion as a$, isSignInWithEmailLink as a0, signInWithEmailLink as a1, fetchSignInMethodsForEmail as a2, sendEmailVerification as a3, verifyBeforeUpdateEmail as a4, ActionCodeURL as a5, parseActionCodeURL as a6, updateProfile as a7, updateEmail as a8, updatePassword as a9, AbstractPopupRedirectOperation as aA, _assertInstanceOf as aB, _withDefaultResolver as aC, FederatedAuthProvider as aD, _fail as aE, _getProjectConfig as aF, _getCurrentUrl as aG, _emulatorUrl as aH, _isChromeIOS as aI, _isFirefox as aJ, _isIOSStandalone as aK, _getRedirectUrl as aL, _setWindowLocation as aM, _isMobileBrowser as aN, _isSafari as aO, _isIOS as aP, _getRedirectResult as aQ, _overrideRedirectResult as aR, AuthEventManager as aS, debugFail as aT, finalizeEnrollPhoneMfa as aU, finalizeEnrollTotpMfa as aV, startEnrollTotpMfa as aW, _persistenceKeyName as aX, UserImpl as aY, _getInstance as aZ, AuthImpl as a_, getIdToken as aa, getIdTokenResult as ab, unlink as ac, getAdditionalUserInfo as ad, reload as ae, getMultiFactorResolver as af, multiFactor as ag, _performApiRequest as ah, _addTidIfNecessary as ai, _assert as aj, Delay as ak, _window as al, isV2 as am, _createError as an, _loadJS as ao, _generateCallbackName as ap, getRecaptchaParams as aq, _isHttpOrHttps as ar, _isWorker as as, _castAuth as at, _assertLinkedStatus as au, sendPhoneVerificationCode as av, startEnrollPhoneMfa as aw, _link$1 as ax, debugAssert as ay, _generateEventId as az, _linkWithRedirect as b, FetchProvider as b0, SAMLAuthCredential as b1, signInWithRedirect as b2, linkWithRedirect as b3, reauthenticateWithRedirect as b4, indexedDBLocalPersistence as c, cordovaPopupRedirectResolver as d, browserLocalPersistence as e, browserSessionPersistence as f, getRedirectResult as g, initializeRecaptchaConfig as h, initializeAuth as i, beforeAuthStateChanged as j, onAuthStateChanged as k, updateCurrentUser as l, signOut as m, deleteUser as n, onIdTokenChanged as o, debugErrorMap as p, prodErrorMap as q, registerAuth as r, setPersistence as s, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as t, useDeviceLanguage as u, validatePassword as v, connectAuthEmulator as w, AuthCredential as x, OAuthCredential as y, PhoneAuthCredential as z };
+//# sourceMappingURL=popup_redirect-63074918.js.map