@firebase/auth 1.1.0 → 1.2.0-canary.78d2738c2

package/dist/esm5/{index-be7bff78.js → index-e3004618.js}

@@ -103,6 +103,53 @@ var ActionCodeOperation = {
     VERIFY_EMAIL: 'VERIFY_EMAIL'
 };
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isV2(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.getResponse !== undefined);
+}
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+var RecaptchaConfig = /** @class */ (function () {
+    function RecaptchaConfig(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
+            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+                enforcementState.enforcementState !== 'OFF';
+        });
+    }
+    return RecaptchaConfig;
+}());
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -275,6 +322,8 @@ function _debugErrorMap() {
         _a["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is missing when sending request to the backend.',
         _a["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */] = 'Invalid request parameters.',
         _a["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is invalid when sending request to the backend.',
+        _a["unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */] = 'The password policy received from the backend uses a schema version that is not supported by this version of the Firebase SDK.',
+        _a["password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */] = 'The password does not meet the requirements.',
         _a;
 }
 function _prodErrorMap() {
@@ -820,6 +869,7 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     _a$1["USER_NOT_FOUND" /* ServerError.USER_NOT_FOUND */] = "user-token-expired" /* AuthErrorCode.TOKEN_EXPIRED */,
     // Other errors.
     _a$1["TOO_MANY_ATTEMPTS_TRY_LATER" /* ServerError.TOO_MANY_ATTEMPTS_TRY_LATER */] = "too-many-requests" /* AuthErrorCode.TOO_MANY_ATTEMPTS_TRY_LATER */,
+    _a$1["PASSWORD_DOES_NOT_MEET_REQUIREMENTS" /* ServerError.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */] = "password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */,
     // Phone Auth related errors.
     _a$1["INVALID_CODE" /* ServerError.INVALID_CODE */] = "invalid-verification-code" /* AuthErrorCode.INVALID_CODE */,
     _a$1["INVALID_SESSION_INFO" /* ServerError.INVALID_SESSION_INFO */] = "invalid-verification-id" /* AuthErrorCode.INVALID_SESSION_INFO */,
@@ -1045,6 +1095,40 @@ function _makeTaggedError(auth, code, response) {
     return error;
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getRecaptchaParams(auth) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)];
+                case 1: return [2 /*return*/, ((_a.sent()).recaptchaSiteKey || '')];
+            }
+        });
+    });
+}
+function getRecaptchaConfig(auth, request) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+        });
+    });
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -2443,7 +2527,7 @@ function _getClientVersion(clientPlatform, frameworks) {
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2022 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2457,27 +2541,129 @@ function _getClientVersion(clientPlatform, frameworks) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function getRecaptchaParams(auth) {
-    return __awaiter(this, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)];
-                case 1: return [2 /*return*/, ((_a.sent()).recaptchaSiteKey || '')];
-            }
+var AuthMiddlewareQueue = /** @class */ (function () {
+    function AuthMiddlewareQueue(auth) {
+        this.auth = auth;
+        this.queue = [];
+    }
+    AuthMiddlewareQueue.prototype.pushCallback = function (callback, onAbort) {
+        var _this = this;
+        // The callback could be sync or async. Wrap it into a
+        // function that is always async.
+        var wrappedCallback = function (user) {
+            return new Promise(function (resolve, reject) {
+                try {
+                    var result = callback(user);
+                    // Either resolve with existing promise or wrap a non-promise
+                    // return value into a promise.
+                    resolve(result);
+                }
+                catch (e) {
+                    // Sync callback throws.
+                    reject(e);
+                }
+            });
+        };
+        // Attach the onAbort if present
+        wrappedCallback.onAbort = onAbort;
+        this.queue.push(wrappedCallback);
+        var index = this.queue.length - 1;
+        return function () {
+            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
+            // indexing of other elements.
+            _this.queue[index] = function () { return Promise.resolve(); };
+        };
+    };
+    AuthMiddlewareQueue.prototype.runMiddleware = function (nextUser) {
+        return __awaiter(this, void 0, void 0, function () {
+            var onAbortStack, _i, _a, beforeStateCallback, e_1, _b, onAbortStack_1, onAbort;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        if (this.auth.currentUser === nextUser) {
+                            return [2 /*return*/];
+                        }
+                        onAbortStack = [];
+                        _c.label = 1;
+                    case 1:
+                        _c.trys.push([1, 6, , 7]);
+                        _i = 0, _a = this.queue;
+                        _c.label = 2;
+                    case 2:
+                        if (!(_i < _a.length)) return [3 /*break*/, 5];
+                        beforeStateCallback = _a[_i];
+                        return [4 /*yield*/, beforeStateCallback(nextUser)];
+                    case 3:
+                        _c.sent();
+                        // Only push the onAbort if the callback succeeds
+                        if (beforeStateCallback.onAbort) {
+                            onAbortStack.push(beforeStateCallback.onAbort);
+                        }
+                        _c.label = 4;
+                    case 4:
+                        _i++;
+                        return [3 /*break*/, 2];
+                    case 5: return [3 /*break*/, 7];
+                    case 6:
+                        e_1 = _c.sent();
+                        // Run all onAbort, with separate try/catch to ignore any errors and
+                        // continue
+                        onAbortStack.reverse();
+                        for (_b = 0, onAbortStack_1 = onAbortStack; _b < onAbortStack_1.length; _b++) {
+                            onAbort = onAbortStack_1[_b];
+                            try {
+                                onAbort();
+                            }
+                            catch (_) {
+                                /* swallow error */
+                            }
+                        }
+                        throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
+                            originalMessage: e_1 === null || e_1 === void 0 ? void 0 : e_1.message
+                        });
+                    case 7: return [2 /*return*/];
+                }
+            });
         });
-    });
-}
-function getRecaptchaConfig(auth, request) {
+    };
+    return AuthMiddlewareQueue;
+}());
+
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Fetches the password policy for the currently set tenant or the project if no tenant is set.
+ *
+ * @param auth Auth object.
+ * @param request Password policy request.
+ * @returns Password policy response.
+ */
+function _getPasswordPolicy(auth, request) {
+    if (request === void 0) { request = {}; }
     return __awaiter(this, void 0, void 0, function () {
         return __generator(this, function (_a) {
-            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/passwordPolicy" /* Endpoint.GET_PASSWORD_POLICY */, _addTidIfNecessary(auth, request))];
         });
     });
 }
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2491,336 +2677,138 @@ function getRecaptchaConfig(auth, request) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function isV2(grecaptcha) {
-    return (grecaptcha !== undefined &&
-        grecaptcha.getResponse !== undefined);
-}
-function isEnterprise(grecaptcha) {
-    return (grecaptcha !== undefined &&
-        grecaptcha.enterprise !== undefined);
-}
-var RecaptchaConfig = /** @class */ (function () {
-    function RecaptchaConfig(response) {
-        /**
-         * The reCAPTCHA site key.
-         */
-        this.siteKey = '';
-        /**
-         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
-         */
-        this.emailPasswordEnabled = false;
-        if (response.recaptchaKey === undefined) {
-            throw new Error('recaptchaKey undefined');
+// Minimum min password length enforced by the backend, even if no minimum length is set.
+var MINIMUM_MIN_PASSWORD_LENGTH = 6;
+/**
+ * Stores password policy requirements and provides password validation against the policy.
+ *
+ * @internal
+ */
+var PasswordPolicyImpl = /** @class */ (function () {
+    function PasswordPolicyImpl(response) {
+        var _a, _b, _c, _d;
+        // Only include custom strength options defined in the response.
+        var responseOptions = response.customStrengthOptions;
+        this.customStrengthOptions = {};
+        // TODO: Remove once the backend is updated to include the minimum min password length instead of undefined when there is no minimum length set.
+        this.customStrengthOptions.minPasswordLength =
+            (_a = responseOptions.minPasswordLength) !== null && _a !== void 0 ? _a : MINIMUM_MIN_PASSWORD_LENGTH;
+        if (responseOptions.maxPasswordLength) {
+            this.customStrengthOptions.maxPasswordLength =
+                responseOptions.maxPasswordLength;
+        }
+        if (responseOptions.containsLowercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsLowercaseLetter =
+                responseOptions.containsLowercaseCharacter;
+        }
+        if (responseOptions.containsUppercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsUppercaseLetter =
+                responseOptions.containsUppercaseCharacter;
+        }
+        if (responseOptions.containsNumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNumericCharacter =
+                responseOptions.containsNumericCharacter;
+        }
+        if (responseOptions.containsNonAlphanumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNonAlphanumericCharacter =
+                responseOptions.containsNonAlphanumericCharacter;
+        }
+        this.enforcementState = response.enforcementState;
+        if (this.enforcementState === 'ENFORCEMENT_STATE_UNSPECIFIED') {
+            this.enforcementState = 'OFF';
+        }
+        // Use an empty string if no non-alphanumeric characters are specified in the response.
+        this.allowedNonAlphanumericCharacters =
+            (_c = (_b = response.allowedNonAlphanumericCharacters) === null || _b === void 0 ? void 0 : _b.join('')) !== null && _c !== void 0 ? _c : '';
+        this.forceUpgradeOnSignin = (_d = response.forceUpgradeOnSignin) !== null && _d !== void 0 ? _d : false;
+        this.schemaVersion = response.schemaVersion;
+    }
+    PasswordPolicyImpl.prototype.validatePassword = function (password) {
+        var _a, _b, _c, _d, _e, _f;
+        var status = {
+            isValid: true,
+            passwordPolicy: this
+        };
+        // Check the password length and character options.
+        this.validatePasswordLengthOptions(password, status);
+        this.validatePasswordCharacterOptions(password, status);
+        // Combine the status into single isValid property.
+        status.isValid && (status.isValid = (_a = status.meetsMinPasswordLength) !== null && _a !== void 0 ? _a : true);
+        status.isValid && (status.isValid = (_b = status.meetsMaxPasswordLength) !== null && _b !== void 0 ? _b : true);
+        status.isValid && (status.isValid = (_c = status.containsLowercaseLetter) !== null && _c !== void 0 ? _c : true);
+        status.isValid && (status.isValid = (_d = status.containsUppercaseLetter) !== null && _d !== void 0 ? _d : true);
+        status.isValid && (status.isValid = (_e = status.containsNumericCharacter) !== null && _e !== void 0 ? _e : true);
+        status.isValid && (status.isValid = (_f = status.containsNonAlphanumericCharacter) !== null && _f !== void 0 ? _f : true);
+        return status;
+    };
+    /**
+     * Validates that the password meets the length options for the policy.
+     *
+     * @param password Password to validate.
+     * @param status Validation status.
+     */
+    PasswordPolicyImpl.prototype.validatePasswordLengthOptions = function (password, status) {
+        var minPasswordLength = this.customStrengthOptions.minPasswordLength;
+        var maxPasswordLength = this.customStrengthOptions.maxPasswordLength;
+        if (minPasswordLength) {
+            status.meetsMinPasswordLength = password.length >= minPasswordLength;
         }
-        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
-        this.siteKey = response.recaptchaKey.split('/')[3];
-        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
-            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
-                enforcementState.enforcementState !== 'OFF';
-        });
-    }
-    return RecaptchaConfig;
-}());
-
-/**
- * @license
- * Copyright 2020 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-function getScriptParentElement() {
-    var _a, _b;
-    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
-}
-function _loadJS(url) {
-    // TODO: consider adding timeout support & cancellation
-    return new Promise(function (resolve, reject) {
-        var el = document.createElement('script');
-        el.setAttribute('src', url);
-        el.onload = resolve;
-        el.onerror = function (e) {
-            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            error.customData = e;
-            reject(error);
-        };
-        el.type = 'text/javascript';
-        el.charset = 'UTF-8';
-        getScriptParentElement().appendChild(el);
-    });
-}
-function _generateCallbackName(prefix) {
-    return "__".concat(prefix).concat(Math.floor(Math.random() * 1000000));
-}
-
-/* eslint-disable @typescript-eslint/no-require-imports */
-var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
-var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
-var FAKE_TOKEN = 'NO_RECAPTCHA';
-var RecaptchaEnterpriseVerifier = /** @class */ (function () {
-    /**
-     *
-     * @param authExtern - The corresponding Firebase {@link Auth} instance.
-     *
-     */
-    function RecaptchaEnterpriseVerifier(authExtern) {
-        /**
-         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
-         */
-        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
-        this.auth = _castAuth(authExtern);
-    }
-    /**
-     * Executes the verification process.
-     *
-     * @returns A Promise for a token that can be used to assert the validity of a request.
-     */
-    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
-        if (action === void 0) { action = 'verify'; }
-        if (forceRefresh === void 0) { forceRefresh = false; }
-        return __awaiter(this, void 0, void 0, function () {
-            function retrieveSiteKey(auth) {
-                return __awaiter(this, void 0, void 0, function () {
-                    var _this = this;
-                    return __generator(this, function (_a) {
-                        if (!forceRefresh) {
-                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
-                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
-                            }
-                            if (auth.tenantId != null &&
-                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
-                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
-                            }
-                        }
-                        return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
-                                return __generator(this, function (_a) {
-                                    getRecaptchaConfig(auth, {
-                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                                    })
-                                        .then(function (response) {
-                                        if (response.recaptchaKey === undefined) {
-                                            reject(new Error('recaptcha Enterprise site key undefined'));
-                                        }
-                                        else {
-                                            var config = new RecaptchaConfig(response);
-                                            if (auth.tenantId == null) {
-                                                auth._agentRecaptchaConfig = config;
-                                            }
-                                            else {
-                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
-                                            }
-                                            return resolve(config.siteKey);
-                                        }
-                                    })
-                                        .catch(function (error) {
-                                        reject(error);
-                                    });
-                                    return [2 /*return*/];
-                                });
-                            }); })];
-                    });
-                });
-            }
-            function retrieveRecaptchaToken(siteKey, resolve, reject) {
-                var grecaptcha = window.grecaptcha;
-                if (isEnterprise(grecaptcha)) {
-                    grecaptcha.enterprise.ready(function () {
-                        grecaptcha.enterprise
-                            .execute(siteKey, { action: action })
-                            .then(function (token) {
-                            resolve(token);
-                        })
-                            .catch(function () {
-                            resolve(FAKE_TOKEN);
-                        });
-                    });
-                }
-                else {
-                    reject(Error('No reCAPTCHA enterprise script loaded.'));
-                }
-            }
-            var _this = this;
-            return __generator(this, function (_a) {
-                return [2 /*return*/, new Promise(function (resolve, reject) {
-                        retrieveSiteKey(_this.auth)
-                            .then(function (siteKey) {
-                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
-                                retrieveRecaptchaToken(siteKey, resolve, reject);
-                            }
-                            else {
-                                if (typeof window === 'undefined') {
-                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
-                                    return;
-                                }
-                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
-                                    .then(function () {
-                                    retrieveRecaptchaToken(siteKey, resolve, reject);
-                                })
-                                    .catch(function (error) {
-                                    reject(error);
-                                });
-                            }
-                        })
-                            .catch(function (error) {
-                            reject(error);
-                        });
-                    })];
-            });
-        });
-    };
-    return RecaptchaEnterpriseVerifier;
-}());
-function injectRecaptchaFields(auth, request, action, captchaResp) {
-    if (captchaResp === void 0) { captchaResp = false; }
-    return __awaiter(this, void 0, void 0, function () {
-        var verifier, captchaResponse, newRequest;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0:
-                    verifier = new RecaptchaEnterpriseVerifier(auth);
-                    _a.label = 1;
-                case 1:
-                    _a.trys.push([1, 3, , 5]);
-                    return [4 /*yield*/, verifier.verify(action)];
-                case 2:
-                    captchaResponse = _a.sent();
-                    return [3 /*break*/, 5];
-                case 3:
-                    _a.sent();
-                    return [4 /*yield*/, verifier.verify(action, true)];
-                case 4:
-                    captchaResponse = _a.sent();
-                    return [3 /*break*/, 5];
-                case 5:
-                    newRequest = __assign({}, request);
-                    if (!captchaResp) {
-                        Object.assign(newRequest, { captchaResponse: captchaResponse });
-                    }
-                    else {
-                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
-                    }
-                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
-                    Object.assign(newRequest, {
-                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                    });
-                    return [2 /*return*/, newRequest];
-            }
-        });
-    });
-}
-
-/**
- * @license
- * Copyright 2022 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-var AuthMiddlewareQueue = /** @class */ (function () {
-    function AuthMiddlewareQueue(auth) {
-        this.auth = auth;
-        this.queue = [];
-    }
-    AuthMiddlewareQueue.prototype.pushCallback = function (callback, onAbort) {
-        var _this = this;
-        // The callback could be sync or async. Wrap it into a
-        // function that is always async.
-        var wrappedCallback = function (user) {
-            return new Promise(function (resolve, reject) {
-                try {
-                    var result = callback(user);
-                    // Either resolve with existing promise or wrap a non-promise
-                    // return value into a promise.
-                    resolve(result);
-                }
-                catch (e) {
-                    // Sync callback throws.
-                    reject(e);
-                }
-            });
-        };
-        // Attach the onAbort if present
-        wrappedCallback.onAbort = onAbort;
-        this.queue.push(wrappedCallback);
-        var index = this.queue.length - 1;
-        return function () {
-            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
-            // indexing of other elements.
-            _this.queue[index] = function () { return Promise.resolve(); };
-        };
-    };
-    AuthMiddlewareQueue.prototype.runMiddleware = function (nextUser) {
-        return __awaiter(this, void 0, void 0, function () {
-            var onAbortStack, _i, _a, beforeStateCallback, e_1, _b, onAbortStack_1, onAbort;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
-                    case 0:
-                        if (this.auth.currentUser === nextUser) {
-                            return [2 /*return*/];
-                        }
-                        onAbortStack = [];
-                        _c.label = 1;
-                    case 1:
-                        _c.trys.push([1, 6, , 7]);
-                        _i = 0, _a = this.queue;
-                        _c.label = 2;
-                    case 2:
-                        if (!(_i < _a.length)) return [3 /*break*/, 5];
-                        beforeStateCallback = _a[_i];
-                        return [4 /*yield*/, beforeStateCallback(nextUser)];
-                    case 3:
-                        _c.sent();
-                        // Only push the onAbort if the callback succeeds
-                        if (beforeStateCallback.onAbort) {
-                            onAbortStack.push(beforeStateCallback.onAbort);
-                        }
-                        _c.label = 4;
-                    case 4:
-                        _i++;
-                        return [3 /*break*/, 2];
-                    case 5: return [3 /*break*/, 7];
-                    case 6:
-                        e_1 = _c.sent();
-                        // Run all onAbort, with separate try/catch to ignore any errors and
-                        // continue
-                        onAbortStack.reverse();
-                        for (_b = 0, onAbortStack_1 = onAbortStack; _b < onAbortStack_1.length; _b++) {
-                            onAbort = onAbortStack_1[_b];
-                            try {
-                                onAbort();
-                            }
-                            catch (_) {
-                                /* swallow error */
-                            }
-                        }
-                        throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
-                            originalMessage: e_1 === null || e_1 === void 0 ? void 0 : e_1.message
-                        });
-                    case 7: return [2 /*return*/];
-                }
-            });
-        });
-    };
-    return AuthMiddlewareQueue;
+        if (maxPasswordLength) {
+            status.meetsMaxPasswordLength = password.length <= maxPasswordLength;
+        }
+    };
+    /**
+     * Validates that the password meets the character options for the policy.
+     *
+     * @param password Password to validate.
+     * @param status Validation status.
+     */
+    PasswordPolicyImpl.prototype.validatePasswordCharacterOptions = function (password, status) {
+        // Assign statuses for requirements even if the password is an empty string.
+        this.updatePasswordCharacterOptionsStatuses(status, 
+        /* containsLowercaseCharacter= */ false, 
+        /* containsUppercaseCharacter= */ false, 
+        /* containsNumericCharacter= */ false, 
+        /* containsNonAlphanumericCharacter= */ false);
+        var passwordChar;
+        for (var i = 0; i < password.length; i++) {
+            passwordChar = password.charAt(i);
+            this.updatePasswordCharacterOptionsStatuses(status, 
+            /* containsLowercaseCharacter= */ passwordChar >= 'a' &&
+                passwordChar <= 'z', 
+            /* containsUppercaseCharacter= */ passwordChar >= 'A' &&
+                passwordChar <= 'Z', 
+            /* containsNumericCharacter= */ passwordChar >= '0' &&
+                passwordChar <= '9', 
+            /* containsNonAlphanumericCharacter= */ this.allowedNonAlphanumericCharacters.includes(passwordChar));
+        }
+    };
+    /**
+     * Updates the running validation status with the statuses for the character options.
+     * Expected to be called each time a character is processed to update each option status
+     * based on the current character.
+     *
+     * @param status Validation status.
+     * @param containsLowercaseCharacter Whether the character is a lowercase letter.
+     * @param containsUppercaseCharacter Whether the character is an uppercase letter.
+     * @param containsNumericCharacter Whether the character is a numeric character.
+     * @param containsNonAlphanumericCharacter Whether the character is a non-alphanumeric character.
+     */
+    PasswordPolicyImpl.prototype.updatePasswordCharacterOptionsStatuses = function (status, containsLowercaseCharacter, containsUppercaseCharacter, containsNumericCharacter, containsNonAlphanumericCharacter) {
+        if (this.customStrengthOptions.containsLowercaseLetter) {
+            status.containsLowercaseLetter || (status.containsLowercaseLetter = containsLowercaseCharacter);
+        }
+        if (this.customStrengthOptions.containsUppercaseLetter) {
+            status.containsUppercaseLetter || (status.containsUppercaseLetter = containsUppercaseCharacter);
+        }
+        if (this.customStrengthOptions.containsNumericCharacter) {
+            status.containsNumericCharacter || (status.containsNumericCharacter = containsNumericCharacter);
+        }
+        if (this.customStrengthOptions.containsNonAlphanumericCharacter) {
+            status.containsNonAlphanumericCharacter || (status.containsNonAlphanumericCharacter = containsNonAlphanumericCharacter);
+        }
+    };
+    return PasswordPolicyImpl;
 }());
 
 /**
@@ -2853,6 +2841,7 @@ var AuthImpl = /** @class */ (function () {
         this.beforeStateQueue = new AuthMiddlewareQueue(this);
         this.redirectUser = null;
         this.isProactiveRefreshEnabled = false;
+        this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION = 1;
         // Any network calls will set this to true and prevent subsequent emulator
         // initialization
         this._canInitEmulator = true;
@@ -2863,6 +2852,8 @@ var AuthImpl = /** @class */ (function () {
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
         this._agentRecaptchaConfig = null;
         this._tenantRecaptchaConfigs = {};
+        this._projectPasswordPolicy = null;
+        this._tenantPasswordPolicies = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -3192,41 +3183,66 @@ var AuthImpl = /** @class */ (function () {
             });
         }); });
     };
-    AuthImpl.prototype.initializeRecaptchaConfig = function () {
+    AuthImpl.prototype._getRecaptchaConfig = function () {
+        if (this.tenantId == null) {
+            return this._agentRecaptchaConfig;
+        }
+        else {
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    };
+    AuthImpl.prototype.validatePassword = function (password) {
         return __awaiter(this, void 0, void 0, function () {
-            var response, config, verifier;
+            var passwordPolicy;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, getRecaptchaConfig(this, {
-                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                        })];
+                    case 0:
+                        if (!!this._getPasswordPolicyInternal()) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this._updatePasswordPolicy()];
                     case 1:
-                        response = _a.sent();
-                        config = new RecaptchaConfig(response);
-                        if (this.tenantId == null) {
-                            this._agentRecaptchaConfig = config;
-                        }
-                        else {
-                            this._tenantRecaptchaConfigs[this.tenantId] = config;
-                        }
-                        if (config.emailPasswordEnabled) {
-                            verifier = new RecaptchaEnterpriseVerifier(this);
-                            void verifier.verify();
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        passwordPolicy = this._getPasswordPolicyInternal();
+                        // Check that the policy schema version is supported by the SDK.
+                        // TODO: Update this logic to use a max supported policy schema version once we have multiple schema versions.
+                        if (passwordPolicy.schemaVersion !==
+                            this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION) {
+                            return [2 /*return*/, Promise.reject(this._errorFactory.create("unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */, {}))];
                         }
-                        return [2 /*return*/];
+                        return [2 /*return*/, passwordPolicy.validatePassword(password)];
                 }
             });
         });
     };
-    AuthImpl.prototype._getRecaptchaConfig = function () {
-        if (this.tenantId == null) {
-            return this._agentRecaptchaConfig;
+    AuthImpl.prototype._getPasswordPolicyInternal = function () {
+        if (this.tenantId === null) {
+            return this._projectPasswordPolicy;
         }
         else {
-            return this._tenantRecaptchaConfigs[this.tenantId];
+            return this._tenantPasswordPolicies[this.tenantId];
         }
     };
+    AuthImpl.prototype._updatePasswordPolicy = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var response, passwordPolicy;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, _getPasswordPolicy(this)];
+                    case 1:
+                        response = _a.sent();
+                        passwordPolicy = new PasswordPolicyImpl(response);
+                        if (this.tenantId === null) {
+                            this._projectPasswordPolicy = passwordPolicy;
+                        }
+                        else {
+                            this._tenantPasswordPolicies[this.tenantId] = passwordPolicy;
+                        }
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
     AuthImpl.prototype._getPersistence = function () {
         return this.assertedPersistence.persistence.type;
     };
@@ -3393,18 +3409,32 @@ var AuthImpl = /** @class */ (function () {
         var cb = typeof nextOrObserver === 'function'
             ? nextOrObserver
             : nextOrObserver.next.bind(nextOrObserver);
+        var isUnsubscribed = false;
         var promise = this._isInitialized
             ? Promise.resolve()
             : this._initializationPromise;
         _assert(promise, this, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
         // The callback needs to be called asynchronously per the spec.
         // eslint-disable-next-line @typescript-eslint/no-floating-promises
-        promise.then(function () { return cb(_this.currentUser); });
+        promise.then(function () {
+            if (isUnsubscribed) {
+                return;
+            }
+            cb(_this.currentUser);
+        });
         if (typeof nextOrObserver === 'function') {
-            return subscription.addObserver(nextOrObserver, error, completed);
+            var unsubscribe_2 = subscription.addObserver(nextOrObserver, error, completed);
+            return function () {
+                isUnsubscribed = true;
+                unsubscribe_2();
+            };
         }
         else {
-            return subscription.addObserver(nextOrObserver);
+            var unsubscribe_3 = subscription.addObserver(nextOrObserver);
+            return function () {
+                isUnsubscribed = true;
+                unsubscribe_3();
+            };
         }
     };
     /**
@@ -3502,54 +3532,280 @@ var AuthImpl = /** @class */ (function () {
     AuthImpl.prototype._getAppCheckToken = function () {
         var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var appCheckTokenResult;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, ((_a = this.appCheckServiceProvider
-                            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken())];
-                    case 1:
-                        appCheckTokenResult = _b.sent();
-                        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
-                            // Context: appCheck.getToken() will never throw even if an error happened.
-                            // In the error case, a dummy token will be returned along with an error field describing
-                            // the error. In general, we shouldn't care about the error condition and just use
-                            // the token (actual or dummy) to send requests.
-                            _logWarn("Error while retrieving App Check token: ".concat(appCheckTokenResult.error));
+            var appCheckTokenResult;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, ((_a = this.appCheckServiceProvider
+                            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken())];
+                    case 1:
+                        appCheckTokenResult = _b.sent();
+                        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
+                            // Context: appCheck.getToken() will never throw even if an error happened.
+                            // In the error case, a dummy token will be returned along with an error field describing
+                            // the error. In general, we shouldn't care about the error condition and just use
+                            // the token (actual or dummy) to send requests.
+                            _logWarn("Error while retrieving App Check token: ".concat(appCheckTokenResult.error));
+                        }
+                        return [2 /*return*/, appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token];
+                }
+            });
+        });
+    };
+    return AuthImpl;
+}());
+/**
+ * Method to be used to cast down to our private implmentation of Auth.
+ * It will also handle unwrapping from the compat type if necessary
+ *
+ * @param auth Auth object passed in from developer
+ */
+function _castAuth(auth) {
+    return getModularInstance(auth);
+}
+/** Helper class to wrap subscriber logic */
+var Subscription = /** @class */ (function () {
+    function Subscription(auth) {
+        var _this = this;
+        this.auth = auth;
+        this.observer = null;
+        this.addObserver = createSubscribe(function (observer) { return (_this.observer = observer); });
+    }
+    Object.defineProperty(Subscription.prototype, "next", {
+        get: function () {
+            _assert(this.observer, this.auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            return this.observer.next.bind(this.observer);
+        },
+        enumerable: false,
+        configurable: true
+    });
+    return Subscription;
+}());
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise(function (resolve, reject) {
+        var el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = function (e) {
+            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+function _generateCallbackName(prefix) {
+    return "__".concat(prefix).concat(Math.floor(Math.random() * 1000000));
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+var FAKE_TOKEN = 'NO_RECAPTCHA';
+var RecaptchaEnterpriseVerifier = /** @class */ (function () {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    function RecaptchaEnterpriseVerifier(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
+        if (action === void 0) { action = 'verify'; }
+        if (forceRefresh === void 0) { forceRefresh = false; }
+        return __awaiter(this, void 0, void 0, function () {
+            function retrieveSiteKey(auth) {
+                return __awaiter(this, void 0, void 0, function () {
+                    var _this = this;
+                    return __generator(this, function (_a) {
+                        if (!forceRefresh) {
+                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
+                            }
+                            if (auth.tenantId != null &&
+                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
+                            }
                         }
-                        return [2 /*return*/, appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token];
+                        return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    getRecaptchaConfig(auth, {
+                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                                    })
+                                        .then(function (response) {
+                                        if (response.recaptchaKey === undefined) {
+                                            reject(new Error('recaptcha Enterprise site key undefined'));
+                                        }
+                                        else {
+                                            var config = new RecaptchaConfig(response);
+                                            if (auth.tenantId == null) {
+                                                auth._agentRecaptchaConfig = config;
+                                            }
+                                            else {
+                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                                            }
+                                            return resolve(config.siteKey);
+                                        }
+                                    })
+                                        .catch(function (error) {
+                                        reject(error);
+                                    });
+                                    return [2 /*return*/];
+                                });
+                            }); })];
+                    });
+                });
+            }
+            function retrieveRecaptchaToken(siteKey, resolve, reject) {
+                var grecaptcha = window.grecaptcha;
+                if (isEnterprise(grecaptcha)) {
+                    grecaptcha.enterprise.ready(function () {
+                        grecaptcha.enterprise
+                            .execute(siteKey, { action: action })
+                            .then(function (token) {
+                            resolve(token);
+                        })
+                            .catch(function () {
+                            resolve(FAKE_TOKEN);
+                        });
+                    });
                 }
+                else {
+                    reject(Error('No reCAPTCHA enterprise script loaded.'));
+                }
+            }
+            var _this = this;
+            return __generator(this, function (_a) {
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        retrieveSiteKey(_this.auth)
+                            .then(function (siteKey) {
+                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                                retrieveRecaptchaToken(siteKey, resolve, reject);
+                            }
+                            else {
+                                if (typeof window === 'undefined') {
+                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
+                                    return;
+                                }
+                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                                    .then(function () {
+                                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                                })
+                                    .catch(function (error) {
+                                    reject(error);
+                                });
+                            }
+                        })
+                            .catch(function (error) {
+                            reject(error);
+                        });
+                    })];
             });
         });
     };
-    return AuthImpl;
+    return RecaptchaEnterpriseVerifier;
 }());
-/**
- * Method to be used to cast down to our private implmentation of Auth.
- * It will also handle unwrapping from the compat type if necessary
- *
- * @param auth Auth object passed in from developer
- */
-function _castAuth(auth) {
-    return getModularInstance(auth);
+function injectRecaptchaFields(auth, request, action, captchaResp) {
+    if (captchaResp === void 0) { captchaResp = false; }
+    return __awaiter(this, void 0, void 0, function () {
+        var verifier, captchaResponse, newRequest;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    verifier = new RecaptchaEnterpriseVerifier(auth);
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 5]);
+                    return [4 /*yield*/, verifier.verify(action)];
+                case 2:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, verifier.verify(action, true)];
+                case 4:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 5:
+                    newRequest = __assign({}, request);
+                    if (!captchaResp) {
+                        Object.assign(newRequest, { captchaResponse: captchaResponse });
+                    }
+                    else {
+                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+                    }
+                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+                    Object.assign(newRequest, {
+                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                    });
+                    return [2 /*return*/, newRequest];
+            }
+        });
+    });
 }
-/** Helper class to wrap subscriber logic */
-var Subscription = /** @class */ (function () {
-    function Subscription(auth) {
-        var _this = this;
-        this.auth = auth;
-        this.observer = null;
-        this.addObserver = createSubscribe(function (observer) { return (_this.observer = observer); });
-    }
-    Object.defineProperty(Subscription.prototype, "next", {
-        get: function () {
-            _assert(this.observer, this.auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            return this.observer.next.bind(this.observer);
-        },
-        enumerable: false,
-        configurable: true
+function _initializeRecaptchaConfig(auth) {
+    return __awaiter(this, void 0, void 0, function () {
+        var authInternal, response, config, verifier;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    authInternal = _castAuth(auth);
+                    return [4 /*yield*/, getRecaptchaConfig(authInternal, {
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                        })];
+                case 1:
+                    response = _a.sent();
+                    config = new RecaptchaConfig(response);
+                    if (authInternal.tenantId == null) {
+                        authInternal._agentRecaptchaConfig = config;
+                    }
+                    else {
+                        authInternal._tenantRecaptchaConfigs[authInternal.tenantId] = config;
+                    }
+                    if (config.emailPasswordEnabled) {
+                        verifier = new RecaptchaEnterpriseVerifier(authInternal);
+                        void verifier.verify();
+                    }
+                    return [2 /*return*/];
+            }
+        });
     });
-    return Subscription;
-}());
+}
 
 /**
  * @license
@@ -6209,6 +6465,36 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/**
+ * Updates the password policy cached in the {@link Auth} instance if a policy is already
+ * cached for the project or tenant.
+ *
+ * @remarks
+ * We only fetch the password policy if the password did not meet policy requirements and
+ * there is an existing policy cached. A developer must call validatePassword at least
+ * once for the cache to be automatically updated.
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @private
+ */
+function recachePasswordPolicy(auth) {
+    return __awaiter(this, void 0, void 0, function () {
+        var authInternal;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    authInternal = _castAuth(auth);
+                    if (!authInternal._getPasswordPolicyInternal()) return [3 /*break*/, 2];
+                    return [4 /*yield*/, authInternal._updatePasswordPolicy()];
+                case 1:
+                    _a.sent();
+                    _a.label = 2;
+                case 2: return [2 /*return*/];
+            }
+        });
+    });
+}
 /**
  * Sends a password reset email to the given email address.
  *
@@ -6312,12 +6598,22 @@ function sendPasswordResetEmail(auth, email, actionCodeSettings) {
  */
 function confirmPasswordReset(auth, oobCode, newPassword) {
     return __awaiter(this, void 0, void 0, function () {
+        var _this = this;
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0: return [4 /*yield*/, resetPassword(getModularInstance(auth), {
                         oobCode: oobCode,
                         newPassword: newPassword
-                    })];
+                    })
+                        .catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            if (error.code ===
+                                "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                                void recachePasswordPolicy(auth);
+                            }
+                            throw error;
+                        });
+                    }); })];
                 case 1:
                     _a.sent();
                     return [2 /*return*/];
@@ -6473,13 +6769,16 @@ function createUserWithEmailAndPassword(auth, email, password) {
                                 case 1:
                                     requestWithRecaptcha = _a.sent();
                                     return [2 /*return*/, signUp(authInternal, requestWithRecaptcha)];
-                                case 2: return [2 /*return*/, Promise.reject(error)];
+                                case 2: throw error;
                             }
                         });
                     }); });
                     _b.label = 3;
                 case 3: return [4 /*yield*/, signUpResponse.catch(function (error) {
-                        return Promise.reject(error);
+                        if (error.code === "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                            void recachePasswordPolicy(auth);
+                        }
+                        throw error;
                     })];
                 case 4:
                     response = _b.sent();
@@ -6511,7 +6810,15 @@ function createUserWithEmailAndPassword(auth, email, password) {
  * @public
  */
 function signInWithEmailAndPassword(auth, email, password) {
-    return signInWithCredential(getModularInstance(auth), EmailAuthProvider.credential(email, password));
+    var _this = this;
+    return signInWithCredential(getModularInstance(auth), EmailAuthProvider.credential(email, password)).catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            if (error.code === "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                void recachePasswordPolicy(auth);
+            }
+            throw error;
+        });
+    }); });
 }
 
 /**
@@ -7249,8 +7556,39 @@ function setPersistence(auth, persistence) {
  * @public
  */
 function initializeRecaptchaConfig(auth) {
-    var authInternal = _castAuth(auth);
-    return authInternal.initializeRecaptchaConfig();
+    return _initializeRecaptchaConfig(auth);
+}
+/**
+ * Validates the password against the password policy configured for the project or tenant.
+ *
+ * @remarks
+ * If no tenant ID is set on the `Auth` instance, then this method will use the password
+ * policy configured for the project. Otherwise, this method will use the policy configured
+ * for the tenant. If a password policy has not been configured, then the default policy
+ * configured for all projects will be used.
+ *
+ * If an auth flow fails because a submitted password does not meet the password policy
+ * requirements and this method has previously been called, then this method will use the
+ * most recent policy available when called again.
+ *
+ * @example
+ * ```javascript
+ * validatePassword(auth, 'some-password');
+ * ```
+ *
+ * @param auth The {@link Auth} instance.
+ * @param password The password to validate.
+ *
+ * @public
+ */
+function validatePassword(auth, password) {
+    return __awaiter(this, void 0, void 0, function () {
+        var authInternal;
+        return __generator(this, function (_a) {
+            authInternal = _castAuth(auth);
+            return [2 /*return*/, authInternal.validatePassword(password)];
+        });
+    });
 }
 /**
  * Adds an observer for changes to the signed-in user's ID token.
@@ -11876,7 +12214,7 @@ function _isEmptyString(input) {
 }
 
 var name = "@firebase/auth";
-var version = "1.1.0";
+var version = "1.2.0-canary.78d2738c2";
 
 /**
  * @license
@@ -12128,5 +12466,5 @@ function getAuth(app) {
 }
 registerAuth("Browser" /* ClientPlatform.BROWSER */);
 
-export { signInWithCredential as $, ActionCodeOperation as A, signOut as B, deleteUser as C, debugErrorMap as D, prodErrorMap as E, FactorId as F, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as G, initializeAuth as H, connectAuthEmulator as I, AuthCredential as J, EmailAuthCredential as K, OAuthCredential as L, PhoneAuthCredential as M, inMemoryPersistence as N, OperationType as O, PhoneAuthProvider as P, EmailAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, FacebookAuthProvider as U, GoogleAuthProvider as V, GithubAuthProvider as W, OAuthProvider as X, SAMLAuthProvider as Y, TwitterAuthProvider as Z, signInAnonymously as _, browserSessionPersistence as a, linkWithCredential as a0, reauthenticateWithCredential as a1, signInWithCustomToken as a2, sendPasswordResetEmail as a3, confirmPasswordReset as a4, applyActionCode as a5, checkActionCode as a6, verifyPasswordResetCode as a7, createUserWithEmailAndPassword as a8, signInWithEmailAndPassword as a9, _createError as aA, AuthEventManager as aB, _getInstance as aC, _persistenceKeyName as aD, _clearRedirectOutcomes as aE, _getRedirectResult as aF, _overrideRedirectResult as aG, _castAuth as aH, UserImpl as aI, AuthImpl as aJ, _getClientVersion as aK, _generateEventId as aL, AuthPopup as aM, FetchProvider as aN, SAMLAuthCredential as aO, sendSignInLinkToEmail as aa, isSignInWithEmailLink as ab, signInWithEmailLink as ac, fetchSignInMethodsForEmail as ad, sendEmailVerification as ae, verifyBeforeUpdateEmail as af, ActionCodeURL as ag, parseActionCodeURL as ah, updateProfile as ai, updateEmail as aj, updatePassword as ak, getIdToken as al, getIdTokenResult as am, unlink as an, getAdditionalUserInfo as ao, reload as ap, getMultiFactorResolver as aq, multiFactor as ar, _isIOS as as, _isAndroid as at, _fail as au, _getRedirectUrl as av, debugAssert as aw, _getProjectConfig as ax, _isIOS7Or8 as ay, _assert as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, initializeRecaptchaConfig as t, updatePhoneNumber as u, onIdTokenChanged as v, beforeAuthStateChanged as w, onAuthStateChanged as x, useDeviceLanguage as y, updateCurrentUser as z };
-//# sourceMappingURL=index-be7bff78.js.map
+export { signInAnonymously as $, ActionCodeOperation as A, updateCurrentUser as B, signOut as C, deleteUser as D, debugErrorMap as E, FactorId as F, prodErrorMap as G, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as H, initializeAuth as I, connectAuthEmulator as J, AuthCredential as K, EmailAuthCredential as L, OAuthCredential as M, PhoneAuthCredential as N, OperationType as O, PhoneAuthProvider as P, inMemoryPersistence as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, EmailAuthProvider as U, FacebookAuthProvider as V, GoogleAuthProvider as W, GithubAuthProvider as X, OAuthProvider as Y, SAMLAuthProvider as Z, TwitterAuthProvider as _, browserSessionPersistence as a, signInWithCredential as a0, linkWithCredential as a1, reauthenticateWithCredential as a2, signInWithCustomToken as a3, sendPasswordResetEmail as a4, confirmPasswordReset as a5, applyActionCode as a6, checkActionCode as a7, verifyPasswordResetCode as a8, createUserWithEmailAndPassword as a9, _assert as aA, _createError as aB, AuthEventManager as aC, _getInstance as aD, _persistenceKeyName as aE, _clearRedirectOutcomes as aF, _getRedirectResult as aG, _overrideRedirectResult as aH, _castAuth as aI, UserImpl as aJ, AuthImpl as aK, _getClientVersion as aL, _generateEventId as aM, AuthPopup as aN, FetchProvider as aO, SAMLAuthCredential as aP, signInWithEmailAndPassword as aa, sendSignInLinkToEmail as ab, isSignInWithEmailLink as ac, signInWithEmailLink as ad, fetchSignInMethodsForEmail as ae, sendEmailVerification as af, verifyBeforeUpdateEmail as ag, ActionCodeURL as ah, parseActionCodeURL as ai, updateProfile as aj, updateEmail as ak, updatePassword as al, getIdToken as am, getIdTokenResult as an, unlink as ao, getAdditionalUserInfo as ap, reload as aq, getMultiFactorResolver as ar, multiFactor as as, _isIOS as at, _isAndroid as au, _fail as av, _getRedirectUrl as aw, debugAssert as ax, _getProjectConfig as ay, _isIOS7Or8 as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, initializeRecaptchaConfig as t, updatePhoneNumber as u, validatePassword as v, onIdTokenChanged as w, beforeAuthStateChanged as x, onAuthStateChanged as y, useDeviceLanguage as z };
+//# sourceMappingURL=index-e3004618.js.map