@firebase/auth 1.1.0 → 1.2.0-canary.78d2738c2

package/dist/index.webworker.esm5.js

@@ -176,6 +176,8 @@ function _debugErrorMap() {
         _a["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is missing when sending request to the backend.',
         _a["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */] = 'Invalid request parameters.',
         _a["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is invalid when sending request to the backend.',
+        _a["unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */] = 'The password policy received from the backend uses a schema version that is not supported by this version of the Firebase SDK.',
+        _a["password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */] = 'The password does not meet the requirements.',
         _a;
 }
 function _prodErrorMap() {
@@ -549,7 +551,7 @@ function _initializeAuthInstance(auth, deps) {
 }
 
 var name = "@firebase/auth";
-var version = "1.1.0";
+var version = "1.2.0-canary.78d2738c2";
 
 /**
  * @license
@@ -955,6 +957,7 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     _a$1["USER_NOT_FOUND" /* ServerError.USER_NOT_FOUND */] = "user-token-expired" /* AuthErrorCode.TOKEN_EXPIRED */,
     // Other errors.
     _a$1["TOO_MANY_ATTEMPTS_TRY_LATER" /* ServerError.TOO_MANY_ATTEMPTS_TRY_LATER */] = "too-many-requests" /* AuthErrorCode.TOO_MANY_ATTEMPTS_TRY_LATER */,
+    _a$1["PASSWORD_DOES_NOT_MEET_REQUIREMENTS" /* ServerError.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */] = "password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */,
     // Phone Auth related errors.
     _a$1["INVALID_CODE" /* ServerError.INVALID_CODE */] = "invalid-verification-code" /* AuthErrorCode.INVALID_CODE */,
     _a$1["INVALID_SESSION_INFO" /* ServerError.INVALID_SESSION_INFO */] = "invalid-verification-id" /* AuthErrorCode.INVALID_SESSION_INFO */,
@@ -2367,7 +2370,7 @@ var PersistenceUserManager = /** @class */ (function () {
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2022 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2381,17 +2384,97 @@ var PersistenceUserManager = /** @class */ (function () {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function getRecaptchaConfig(auth, request) {
-    return __awaiter(this, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+var AuthMiddlewareQueue = /** @class */ (function () {
+    function AuthMiddlewareQueue(auth) {
+        this.auth = auth;
+        this.queue = [];
+    }
+    AuthMiddlewareQueue.prototype.pushCallback = function (callback, onAbort) {
+        var _this = this;
+        // The callback could be sync or async. Wrap it into a
+        // function that is always async.
+        var wrappedCallback = function (user) {
+            return new Promise(function (resolve, reject) {
+                try {
+                    var result = callback(user);
+                    // Either resolve with existing promise or wrap a non-promise
+                    // return value into a promise.
+                    resolve(result);
+                }
+                catch (e) {
+                    // Sync callback throws.
+                    reject(e);
+                }
+            });
+        };
+        // Attach the onAbort if present
+        wrappedCallback.onAbort = onAbort;
+        this.queue.push(wrappedCallback);
+        var index = this.queue.length - 1;
+        return function () {
+            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
+            // indexing of other elements.
+            _this.queue[index] = function () { return Promise.resolve(); };
+        };
+    };
+    AuthMiddlewareQueue.prototype.runMiddleware = function (nextUser) {
+        return __awaiter(this, void 0, void 0, function () {
+            var onAbortStack, _i, _a, beforeStateCallback, e_1, _b, onAbortStack_1, onAbort;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        if (this.auth.currentUser === nextUser) {
+                            return [2 /*return*/];
+                        }
+                        onAbortStack = [];
+                        _c.label = 1;
+                    case 1:
+                        _c.trys.push([1, 6, , 7]);
+                        _i = 0, _a = this.queue;
+                        _c.label = 2;
+                    case 2:
+                        if (!(_i < _a.length)) return [3 /*break*/, 5];
+                        beforeStateCallback = _a[_i];
+                        return [4 /*yield*/, beforeStateCallback(nextUser)];
+                    case 3:
+                        _c.sent();
+                        // Only push the onAbort if the callback succeeds
+                        if (beforeStateCallback.onAbort) {
+                            onAbortStack.push(beforeStateCallback.onAbort);
+                        }
+                        _c.label = 4;
+                    case 4:
+                        _i++;
+                        return [3 /*break*/, 2];
+                    case 5: return [3 /*break*/, 7];
+                    case 6:
+                        e_1 = _c.sent();
+                        // Run all onAbort, with separate try/catch to ignore any errors and
+                        // continue
+                        onAbortStack.reverse();
+                        for (_b = 0, onAbortStack_1 = onAbortStack; _b < onAbortStack_1.length; _b++) {
+                            onAbort = onAbortStack_1[_b];
+                            try {
+                                onAbort();
+                            }
+                            catch (_) {
+                                /* swallow error */
+                            }
+                        }
+                        throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
+                            originalMessage: e_1 === null || e_1 === void 0 ? void 0 : e_1.message
+                        });
+                    case 7: return [2 /*return*/];
+                }
+            });
         });
-    });
-}
+    };
+    return AuthMiddlewareQueue;
+}());
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2405,36 +2488,25 @@ function getRecaptchaConfig(auth, request) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function isEnterprise(grecaptcha) {
-    return (grecaptcha !== undefined &&
-        grecaptcha.enterprise !== undefined);
-}
-var RecaptchaConfig = /** @class */ (function () {
-    function RecaptchaConfig(response) {
-        /**
-         * The reCAPTCHA site key.
-         */
-        this.siteKey = '';
-        /**
-         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
-         */
-        this.emailPasswordEnabled = false;
-        if (response.recaptchaKey === undefined) {
-            throw new Error('recaptchaKey undefined');
-        }
-        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
-        this.siteKey = response.recaptchaKey.split('/')[3];
-        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
-            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
-                enforcementState.enforcementState !== 'OFF';
+/**
+ * Fetches the password policy for the currently set tenant or the project if no tenant is set.
+ *
+ * @param auth Auth object.
+ * @param request Password policy request.
+ * @returns Password policy response.
+ */
+function _getPasswordPolicy(auth, request) {
+    if (request === void 0) { request = {}; }
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/passwordPolicy" /* Endpoint.GET_PASSWORD_POLICY */, _addTidIfNecessary(auth, request))];
         });
-    }
-    return RecaptchaConfig;
-}());
+    });
+}
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2448,286 +2520,138 @@ var RecaptchaConfig = /** @class */ (function () {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function getScriptParentElement() {
-    var _a, _b;
-    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
-}
-function _loadJS(url) {
-    // TODO: consider adding timeout support & cancellation
-    return new Promise(function (resolve, reject) {
-        var el = document.createElement('script');
-        el.setAttribute('src', url);
-        el.onload = resolve;
-        el.onerror = function (e) {
-            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            error.customData = e;
-            reject(error);
+// Minimum min password length enforced by the backend, even if no minimum length is set.
+var MINIMUM_MIN_PASSWORD_LENGTH = 6;
+/**
+ * Stores password policy requirements and provides password validation against the policy.
+ *
+ * @internal
+ */
+var PasswordPolicyImpl = /** @class */ (function () {
+    function PasswordPolicyImpl(response) {
+        var _a, _b, _c, _d;
+        // Only include custom strength options defined in the response.
+        var responseOptions = response.customStrengthOptions;
+        this.customStrengthOptions = {};
+        // TODO: Remove once the backend is updated to include the minimum min password length instead of undefined when there is no minimum length set.
+        this.customStrengthOptions.minPasswordLength =
+            (_a = responseOptions.minPasswordLength) !== null && _a !== void 0 ? _a : MINIMUM_MIN_PASSWORD_LENGTH;
+        if (responseOptions.maxPasswordLength) {
+            this.customStrengthOptions.maxPasswordLength =
+                responseOptions.maxPasswordLength;
+        }
+        if (responseOptions.containsLowercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsLowercaseLetter =
+                responseOptions.containsLowercaseCharacter;
+        }
+        if (responseOptions.containsUppercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsUppercaseLetter =
+                responseOptions.containsUppercaseCharacter;
+        }
+        if (responseOptions.containsNumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNumericCharacter =
+                responseOptions.containsNumericCharacter;
+        }
+        if (responseOptions.containsNonAlphanumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNonAlphanumericCharacter =
+                responseOptions.containsNonAlphanumericCharacter;
+        }
+        this.enforcementState = response.enforcementState;
+        if (this.enforcementState === 'ENFORCEMENT_STATE_UNSPECIFIED') {
+            this.enforcementState = 'OFF';
+        }
+        // Use an empty string if no non-alphanumeric characters are specified in the response.
+        this.allowedNonAlphanumericCharacters =
+            (_c = (_b = response.allowedNonAlphanumericCharacters) === null || _b === void 0 ? void 0 : _b.join('')) !== null && _c !== void 0 ? _c : '';
+        this.forceUpgradeOnSignin = (_d = response.forceUpgradeOnSignin) !== null && _d !== void 0 ? _d : false;
+        this.schemaVersion = response.schemaVersion;
+    }
+    PasswordPolicyImpl.prototype.validatePassword = function (password) {
+        var _a, _b, _c, _d, _e, _f;
+        var status = {
+            isValid: true,
+            passwordPolicy: this
         };
-        el.type = 'text/javascript';
-        el.charset = 'UTF-8';
-        getScriptParentElement().appendChild(el);
-    });
-}
-
-/* eslint-disable @typescript-eslint/no-require-imports */
-var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
-var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
-var FAKE_TOKEN = 'NO_RECAPTCHA';
-var RecaptchaEnterpriseVerifier = /** @class */ (function () {
+        // Check the password length and character options.
+        this.validatePasswordLengthOptions(password, status);
+        this.validatePasswordCharacterOptions(password, status);
+        // Combine the status into single isValid property.
+        status.isValid && (status.isValid = (_a = status.meetsMinPasswordLength) !== null && _a !== void 0 ? _a : true);
+        status.isValid && (status.isValid = (_b = status.meetsMaxPasswordLength) !== null && _b !== void 0 ? _b : true);
+        status.isValid && (status.isValid = (_c = status.containsLowercaseLetter) !== null && _c !== void 0 ? _c : true);
+        status.isValid && (status.isValid = (_d = status.containsUppercaseLetter) !== null && _d !== void 0 ? _d : true);
+        status.isValid && (status.isValid = (_e = status.containsNumericCharacter) !== null && _e !== void 0 ? _e : true);
+        status.isValid && (status.isValid = (_f = status.containsNonAlphanumericCharacter) !== null && _f !== void 0 ? _f : true);
+        return status;
+    };
     /**
+     * Validates that the password meets the length options for the policy.
      *
-     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     * @param password Password to validate.
+     * @param status Validation status.
+     */
+    PasswordPolicyImpl.prototype.validatePasswordLengthOptions = function (password, status) {
+        var minPasswordLength = this.customStrengthOptions.minPasswordLength;
+        var maxPasswordLength = this.customStrengthOptions.maxPasswordLength;
+        if (minPasswordLength) {
+            status.meetsMinPasswordLength = password.length >= minPasswordLength;
+        }
+        if (maxPasswordLength) {
+            status.meetsMaxPasswordLength = password.length <= maxPasswordLength;
+        }
+    };
+    /**
+     * Validates that the password meets the character options for the policy.
      *
+     * @param password Password to validate.
+     * @param status Validation status.
      */
-    function RecaptchaEnterpriseVerifier(authExtern) {
-        /**
-         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
-         */
-        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
-        this.auth = _castAuth(authExtern);
-    }
+    PasswordPolicyImpl.prototype.validatePasswordCharacterOptions = function (password, status) {
+        // Assign statuses for requirements even if the password is an empty string.
+        this.updatePasswordCharacterOptionsStatuses(status, 
+        /* containsLowercaseCharacter= */ false, 
+        /* containsUppercaseCharacter= */ false, 
+        /* containsNumericCharacter= */ false, 
+        /* containsNonAlphanumericCharacter= */ false);
+        var passwordChar;
+        for (var i = 0; i < password.length; i++) {
+            passwordChar = password.charAt(i);
+            this.updatePasswordCharacterOptionsStatuses(status, 
+            /* containsLowercaseCharacter= */ passwordChar >= 'a' &&
+                passwordChar <= 'z', 
+            /* containsUppercaseCharacter= */ passwordChar >= 'A' &&
+                passwordChar <= 'Z', 
+            /* containsNumericCharacter= */ passwordChar >= '0' &&
+                passwordChar <= '9', 
+            /* containsNonAlphanumericCharacter= */ this.allowedNonAlphanumericCharacters.includes(passwordChar));
+        }
+    };
     /**
-     * Executes the verification process.
+     * Updates the running validation status with the statuses for the character options.
+     * Expected to be called each time a character is processed to update each option status
+     * based on the current character.
      *
-     * @returns A Promise for a token that can be used to assert the validity of a request.
+     * @param status Validation status.
+     * @param containsLowercaseCharacter Whether the character is a lowercase letter.
+     * @param containsUppercaseCharacter Whether the character is an uppercase letter.
+     * @param containsNumericCharacter Whether the character is a numeric character.
+     * @param containsNonAlphanumericCharacter Whether the character is a non-alphanumeric character.
      */
-    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
-        if (action === void 0) { action = 'verify'; }
-        if (forceRefresh === void 0) { forceRefresh = false; }
-        return __awaiter(this, void 0, void 0, function () {
-            function retrieveSiteKey(auth) {
-                return __awaiter(this, void 0, void 0, function () {
-                    var _this = this;
-                    return __generator(this, function (_a) {
-                        if (!forceRefresh) {
-                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
-                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
-                            }
-                            if (auth.tenantId != null &&
-                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
-                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
-                            }
-                        }
-                        return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
-                                return __generator(this, function (_a) {
-                                    getRecaptchaConfig(auth, {
-                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                                    })
-                                        .then(function (response) {
-                                        if (response.recaptchaKey === undefined) {
-                                            reject(new Error('recaptcha Enterprise site key undefined'));
-                                        }
-                                        else {
-                                            var config = new RecaptchaConfig(response);
-                                            if (auth.tenantId == null) {
-                                                auth._agentRecaptchaConfig = config;
-                                            }
-                                            else {
-                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
-                                            }
-                                            return resolve(config.siteKey);
-                                        }
-                                    })
-                                        .catch(function (error) {
-                                        reject(error);
-                                    });
-                                    return [2 /*return*/];
-                                });
-                            }); })];
-                    });
-                });
-            }
-            function retrieveRecaptchaToken(siteKey, resolve, reject) {
-                var grecaptcha = window.grecaptcha;
-                if (isEnterprise(grecaptcha)) {
-                    grecaptcha.enterprise.ready(function () {
-                        grecaptcha.enterprise
-                            .execute(siteKey, { action: action })
-                            .then(function (token) {
-                            resolve(token);
-                        })
-                            .catch(function () {
-                            resolve(FAKE_TOKEN);
-                        });
-                    });
-                }
-                else {
-                    reject(Error('No reCAPTCHA enterprise script loaded.'));
-                }
-            }
-            var _this = this;
-            return __generator(this, function (_a) {
-                return [2 /*return*/, new Promise(function (resolve, reject) {
-                        retrieveSiteKey(_this.auth)
-                            .then(function (siteKey) {
-                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
-                                retrieveRecaptchaToken(siteKey, resolve, reject);
-                            }
-                            else {
-                                if (typeof window === 'undefined') {
-                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
-                                    return;
-                                }
-                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
-                                    .then(function () {
-                                    retrieveRecaptchaToken(siteKey, resolve, reject);
-                                })
-                                    .catch(function (error) {
-                                    reject(error);
-                                });
-                            }
-                        })
-                            .catch(function (error) {
-                            reject(error);
-                        });
-                    })];
-            });
-        });
-    };
-    return RecaptchaEnterpriseVerifier;
-}());
-function injectRecaptchaFields(auth, request, action, captchaResp) {
-    if (captchaResp === void 0) { captchaResp = false; }
-    return __awaiter(this, void 0, void 0, function () {
-        var verifier, captchaResponse, newRequest;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0:
-                    verifier = new RecaptchaEnterpriseVerifier(auth);
-                    _a.label = 1;
-                case 1:
-                    _a.trys.push([1, 3, , 5]);
-                    return [4 /*yield*/, verifier.verify(action)];
-                case 2:
-                    captchaResponse = _a.sent();
-                    return [3 /*break*/, 5];
-                case 3:
-                    _a.sent();
-                    return [4 /*yield*/, verifier.verify(action, true)];
-                case 4:
-                    captchaResponse = _a.sent();
-                    return [3 /*break*/, 5];
-                case 5:
-                    newRequest = __assign({}, request);
-                    if (!captchaResp) {
-                        Object.assign(newRequest, { captchaResponse: captchaResponse });
-                    }
-                    else {
-                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
-                    }
-                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
-                    Object.assign(newRequest, {
-                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                    });
-                    return [2 /*return*/, newRequest];
-            }
-        });
-    });
-}
-
-/**
- * @license
- * Copyright 2022 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-var AuthMiddlewareQueue = /** @class */ (function () {
-    function AuthMiddlewareQueue(auth) {
-        this.auth = auth;
-        this.queue = [];
-    }
-    AuthMiddlewareQueue.prototype.pushCallback = function (callback, onAbort) {
-        var _this = this;
-        // The callback could be sync or async. Wrap it into a
-        // function that is always async.
-        var wrappedCallback = function (user) {
-            return new Promise(function (resolve, reject) {
-                try {
-                    var result = callback(user);
-                    // Either resolve with existing promise or wrap a non-promise
-                    // return value into a promise.
-                    resolve(result);
-                }
-                catch (e) {
-                    // Sync callback throws.
-                    reject(e);
-                }
-            });
-        };
-        // Attach the onAbort if present
-        wrappedCallback.onAbort = onAbort;
-        this.queue.push(wrappedCallback);
-        var index = this.queue.length - 1;
-        return function () {
-            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
-            // indexing of other elements.
-            _this.queue[index] = function () { return Promise.resolve(); };
-        };
-    };
-    AuthMiddlewareQueue.prototype.runMiddleware = function (nextUser) {
-        return __awaiter(this, void 0, void 0, function () {
-            var onAbortStack, _i, _a, beforeStateCallback, e_1, _b, onAbortStack_1, onAbort;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
-                    case 0:
-                        if (this.auth.currentUser === nextUser) {
-                            return [2 /*return*/];
-                        }
-                        onAbortStack = [];
-                        _c.label = 1;
-                    case 1:
-                        _c.trys.push([1, 6, , 7]);
-                        _i = 0, _a = this.queue;
-                        _c.label = 2;
-                    case 2:
-                        if (!(_i < _a.length)) return [3 /*break*/, 5];
-                        beforeStateCallback = _a[_i];
-                        return [4 /*yield*/, beforeStateCallback(nextUser)];
-                    case 3:
-                        _c.sent();
-                        // Only push the onAbort if the callback succeeds
-                        if (beforeStateCallback.onAbort) {
-                            onAbortStack.push(beforeStateCallback.onAbort);
-                        }
-                        _c.label = 4;
-                    case 4:
-                        _i++;
-                        return [3 /*break*/, 2];
-                    case 5: return [3 /*break*/, 7];
-                    case 6:
-                        e_1 = _c.sent();
-                        // Run all onAbort, with separate try/catch to ignore any errors and
-                        // continue
-                        onAbortStack.reverse();
-                        for (_b = 0, onAbortStack_1 = onAbortStack; _b < onAbortStack_1.length; _b++) {
-                            onAbort = onAbortStack_1[_b];
-                            try {
-                                onAbort();
-                            }
-                            catch (_) {
-                                /* swallow error */
-                            }
-                        }
-                        throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
-                            originalMessage: e_1 === null || e_1 === void 0 ? void 0 : e_1.message
-                        });
-                    case 7: return [2 /*return*/];
-                }
-            });
-        });
+    PasswordPolicyImpl.prototype.updatePasswordCharacterOptionsStatuses = function (status, containsLowercaseCharacter, containsUppercaseCharacter, containsNumericCharacter, containsNonAlphanumericCharacter) {
+        if (this.customStrengthOptions.containsLowercaseLetter) {
+            status.containsLowercaseLetter || (status.containsLowercaseLetter = containsLowercaseCharacter);
+        }
+        if (this.customStrengthOptions.containsUppercaseLetter) {
+            status.containsUppercaseLetter || (status.containsUppercaseLetter = containsUppercaseCharacter);
+        }
+        if (this.customStrengthOptions.containsNumericCharacter) {
+            status.containsNumericCharacter || (status.containsNumericCharacter = containsNumericCharacter);
+        }
+        if (this.customStrengthOptions.containsNonAlphanumericCharacter) {
+            status.containsNonAlphanumericCharacter || (status.containsNonAlphanumericCharacter = containsNonAlphanumericCharacter);
+        }
     };
-    return AuthMiddlewareQueue;
+    return PasswordPolicyImpl;
 }());
 
 /**
@@ -2760,6 +2684,7 @@ var AuthImpl = /** @class */ (function () {
         this.beforeStateQueue = new AuthMiddlewareQueue(this);
         this.redirectUser = null;
         this.isProactiveRefreshEnabled = false;
+        this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION = 1;
         // Any network calls will set this to true and prevent subsequent emulator
         // initialization
         this._canInitEmulator = true;
@@ -2770,6 +2695,8 @@ var AuthImpl = /** @class */ (function () {
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
         this._agentRecaptchaConfig = null;
         this._tenantRecaptchaConfigs = {};
+        this._projectPasswordPolicy = null;
+        this._tenantPasswordPolicies = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -3099,41 +3026,66 @@ var AuthImpl = /** @class */ (function () {
             });
         }); });
     };
-    AuthImpl.prototype.initializeRecaptchaConfig = function () {
+    AuthImpl.prototype._getRecaptchaConfig = function () {
+        if (this.tenantId == null) {
+            return this._agentRecaptchaConfig;
+        }
+        else {
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    };
+    AuthImpl.prototype.validatePassword = function (password) {
         return __awaiter(this, void 0, void 0, function () {
-            var response, config, verifier;
+            var passwordPolicy;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, getRecaptchaConfig(this, {
-                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                        })];
+                    case 0:
+                        if (!!this._getPasswordPolicyInternal()) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this._updatePasswordPolicy()];
                     case 1:
-                        response = _a.sent();
-                        config = new RecaptchaConfig(response);
-                        if (this.tenantId == null) {
-                            this._agentRecaptchaConfig = config;
-                        }
-                        else {
-                            this._tenantRecaptchaConfigs[this.tenantId] = config;
-                        }
-                        if (config.emailPasswordEnabled) {
-                            verifier = new RecaptchaEnterpriseVerifier(this);
-                            void verifier.verify();
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        passwordPolicy = this._getPasswordPolicyInternal();
+                        // Check that the policy schema version is supported by the SDK.
+                        // TODO: Update this logic to use a max supported policy schema version once we have multiple schema versions.
+                        if (passwordPolicy.schemaVersion !==
+                            this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION) {
+                            return [2 /*return*/, Promise.reject(this._errorFactory.create("unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */, {}))];
                         }
-                        return [2 /*return*/];
+                        return [2 /*return*/, passwordPolicy.validatePassword(password)];
                 }
             });
         });
     };
-    AuthImpl.prototype._getRecaptchaConfig = function () {
-        if (this.tenantId == null) {
-            return this._agentRecaptchaConfig;
+    AuthImpl.prototype._getPasswordPolicyInternal = function () {
+        if (this.tenantId === null) {
+            return this._projectPasswordPolicy;
         }
         else {
-            return this._tenantRecaptchaConfigs[this.tenantId];
+            return this._tenantPasswordPolicies[this.tenantId];
         }
     };
+    AuthImpl.prototype._updatePasswordPolicy = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var response, passwordPolicy;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, _getPasswordPolicy(this)];
+                    case 1:
+                        response = _a.sent();
+                        passwordPolicy = new PasswordPolicyImpl(response);
+                        if (this.tenantId === null) {
+                            this._projectPasswordPolicy = passwordPolicy;
+                        }
+                        else {
+                            this._tenantPasswordPolicies[this.tenantId] = passwordPolicy;
+                        }
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
     AuthImpl.prototype._getPersistence = function () {
         return this.assertedPersistence.persistence.type;
     };
@@ -3300,18 +3252,32 @@ var AuthImpl = /** @class */ (function () {
         var cb = typeof nextOrObserver === 'function'
             ? nextOrObserver
             : nextOrObserver.next.bind(nextOrObserver);
+        var isUnsubscribed = false;
         var promise = this._isInitialized
             ? Promise.resolve()
             : this._initializationPromise;
         _assert(promise, this, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
         // The callback needs to be called asynchronously per the spec.
         // eslint-disable-next-line @typescript-eslint/no-floating-promises
-        promise.then(function () { return cb(_this.currentUser); });
+        promise.then(function () {
+            if (isUnsubscribed) {
+                return;
+            }
+            cb(_this.currentUser);
+        });
         if (typeof nextOrObserver === 'function') {
-            return subscription.addObserver(nextOrObserver, error, completed);
+            var unsubscribe_2 = subscription.addObserver(nextOrObserver, error, completed);
+            return function () {
+                isUnsubscribed = true;
+                unsubscribe_2();
+            };
         }
         else {
-            return subscription.addObserver(nextOrObserver);
+            var unsubscribe_3 = subscription.addObserver(nextOrObserver);
+            return function () {
+                isUnsubscribed = true;
+                unsubscribe_3();
+            };
         }
     };
     /**
@@ -4469,160 +4435,450 @@ var IndexedDBLocalPersistence = /** @class */ (function () {
             });
         });
     };
-    IndexedDBLocalPersistence.prototype.notifyListeners = function (key, newValue) {
-        this.localCache[key] = newValue;
-        var listeners = this.listeners[key];
-        if (listeners) {
-            for (var _i = 0, _a = Array.from(listeners); _i < _a.length; _i++) {
-                var listener = _a[_i];
-                listener(newValue);
+    IndexedDBLocalPersistence.prototype.notifyListeners = function (key, newValue) {
+        this.localCache[key] = newValue;
+        var listeners = this.listeners[key];
+        if (listeners) {
+            for (var _i = 0, _a = Array.from(listeners); _i < _a.length; _i++) {
+                var listener = _a[_i];
+                listener(newValue);
+            }
+        }
+    };
+    IndexedDBLocalPersistence.prototype.startPolling = function () {
+        var _this = this;
+        this.stopPolling();
+        this.pollTimer = setInterval(function () { return __awaiter(_this, void 0, void 0, function () { return __generator(this, function (_a) {
+            return [2 /*return*/, this._poll()];
+        }); }); }, _POLLING_INTERVAL_MS);
+    };
+    IndexedDBLocalPersistence.prototype.stopPolling = function () {
+        if (this.pollTimer) {
+            clearInterval(this.pollTimer);
+            this.pollTimer = null;
+        }
+    };
+    IndexedDBLocalPersistence.prototype._addListener = function (key, listener) {
+        if (Object.keys(this.listeners).length === 0) {
+            this.startPolling();
+        }
+        if (!this.listeners[key]) {
+            this.listeners[key] = new Set();
+            // Populate the cache to avoid spuriously triggering on first poll.
+            void this._get(key); // This can happen in the background async and we can return immediately.
+        }
+        this.listeners[key].add(listener);
+    };
+    IndexedDBLocalPersistence.prototype._removeListener = function (key, listener) {
+        if (this.listeners[key]) {
+            this.listeners[key].delete(listener);
+            if (this.listeners[key].size === 0) {
+                delete this.listeners[key];
+            }
+        }
+        if (Object.keys(this.listeners).length === 0) {
+            this.stopPolling();
+        }
+    };
+    IndexedDBLocalPersistence.type = 'LOCAL';
+    return IndexedDBLocalPersistence;
+}());
+/**
+ * An implementation of {@link Persistence} of type `LOCAL` using `indexedDB`
+ * for the underlying storage.
+ *
+ * @public
+ */
+var indexedDBLocalPersistence = IndexedDBLocalPersistence;
+
+/**
+ * @license
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * An enum of factors that may be used for multifactor authentication.
+ *
+ * @public
+ */
+var FactorId = {
+    /** Phone as second factor */
+    PHONE: 'phone',
+    TOTP: 'totp'
+};
+/**
+ * Enumeration of supported providers.
+ *
+ * @public
+ */
+var ProviderId = {
+    /** Facebook provider ID */
+    FACEBOOK: 'facebook.com',
+    /** GitHub provider ID */
+    GITHUB: 'github.com',
+    /** Google provider ID */
+    GOOGLE: 'google.com',
+    /** Password provider */
+    PASSWORD: 'password',
+    /** Phone provider */
+    PHONE: 'phone',
+    /** Twitter provider ID */
+    TWITTER: 'twitter.com'
+};
+/**
+ * Enumeration of supported sign-in methods.
+ *
+ * @public
+ */
+var SignInMethod = {
+    /** Email link sign in method */
+    EMAIL_LINK: 'emailLink',
+    /** Email/password sign in method */
+    EMAIL_PASSWORD: 'password',
+    /** Facebook sign in method */
+    FACEBOOK: 'facebook.com',
+    /** GitHub sign in method */
+    GITHUB: 'github.com',
+    /** Google sign in method */
+    GOOGLE: 'google.com',
+    /** Phone sign in method */
+    PHONE: 'phone',
+    /** Twitter sign in method */
+    TWITTER: 'twitter.com'
+};
+/**
+ * Enumeration of supported operation types.
+ *
+ * @public
+ */
+var OperationType = {
+    /** Operation involving linking an additional provider to an already signed-in user. */
+    LINK: 'link',
+    /** Operation involving using a provider to reauthenticate an already signed-in user. */
+    REAUTHENTICATE: 'reauthenticate',
+    /** Operation involving signing in a user. */
+    SIGN_IN: 'signIn'
+};
+/**
+ * An enumeration of the possible email action types.
+ *
+ * @public
+ */
+var ActionCodeOperation = {
+    /** The email link sign-in action. */
+    EMAIL_SIGNIN: 'EMAIL_SIGNIN',
+    /** The password reset action. */
+    PASSWORD_RESET: 'PASSWORD_RESET',
+    /** The email revocation action. */
+    RECOVER_EMAIL: 'RECOVER_EMAIL',
+    /** The revert second factor addition email action. */
+    REVERT_SECOND_FACTOR_ADDITION: 'REVERT_SECOND_FACTOR_ADDITION',
+    /** The revert second factor addition email action. */
+    VERIFY_AND_CHANGE_EMAIL: 'VERIFY_AND_CHANGE_EMAIL',
+    /** The email verification action. */
+    VERIFY_EMAIL: 'VERIFY_EMAIL'
+};
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+var RecaptchaConfig = /** @class */ (function () {
+    function RecaptchaConfig(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
+            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+                enforcementState.enforcementState !== 'OFF';
+        });
+    }
+    return RecaptchaConfig;
+}());
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getRecaptchaConfig(auth, request) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+        });
+    });
+}
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise(function (resolve, reject) {
+        var el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = function (e) {
+            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+var FAKE_TOKEN = 'NO_RECAPTCHA';
+var RecaptchaEnterpriseVerifier = /** @class */ (function () {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    function RecaptchaEnterpriseVerifier(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
+        if (action === void 0) { action = 'verify'; }
+        if (forceRefresh === void 0) { forceRefresh = false; }
+        return __awaiter(this, void 0, void 0, function () {
+            function retrieveSiteKey(auth) {
+                return __awaiter(this, void 0, void 0, function () {
+                    var _this = this;
+                    return __generator(this, function (_a) {
+                        if (!forceRefresh) {
+                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
+                            }
+                            if (auth.tenantId != null &&
+                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
+                            }
+                        }
+                        return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    getRecaptchaConfig(auth, {
+                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                                    })
+                                        .then(function (response) {
+                                        if (response.recaptchaKey === undefined) {
+                                            reject(new Error('recaptcha Enterprise site key undefined'));
+                                        }
+                                        else {
+                                            var config = new RecaptchaConfig(response);
+                                            if (auth.tenantId == null) {
+                                                auth._agentRecaptchaConfig = config;
+                                            }
+                                            else {
+                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                                            }
+                                            return resolve(config.siteKey);
+                                        }
+                                    })
+                                        .catch(function (error) {
+                                        reject(error);
+                                    });
+                                    return [2 /*return*/];
+                                });
+                            }); })];
+                    });
+                });
+            }
+            function retrieveRecaptchaToken(siteKey, resolve, reject) {
+                var grecaptcha = window.grecaptcha;
+                if (isEnterprise(grecaptcha)) {
+                    grecaptcha.enterprise.ready(function () {
+                        grecaptcha.enterprise
+                            .execute(siteKey, { action: action })
+                            .then(function (token) {
+                            resolve(token);
+                        })
+                            .catch(function () {
+                            resolve(FAKE_TOKEN);
+                        });
+                    });
+                }
+                else {
+                    reject(Error('No reCAPTCHA enterprise script loaded.'));
+                }
+            }
+            var _this = this;
+            return __generator(this, function (_a) {
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        retrieveSiteKey(_this.auth)
+                            .then(function (siteKey) {
+                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                                retrieveRecaptchaToken(siteKey, resolve, reject);
+                            }
+                            else {
+                                if (typeof window === 'undefined') {
+                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
+                                    return;
+                                }
+                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                                    .then(function () {
+                                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                                })
+                                    .catch(function (error) {
+                                    reject(error);
+                                });
+                            }
+                        })
+                            .catch(function (error) {
+                            reject(error);
+                        });
+                    })];
+            });
+        });
+    };
+    return RecaptchaEnterpriseVerifier;
+}());
+function injectRecaptchaFields(auth, request, action, captchaResp) {
+    if (captchaResp === void 0) { captchaResp = false; }
+    return __awaiter(this, void 0, void 0, function () {
+        var verifier, captchaResponse, newRequest;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    verifier = new RecaptchaEnterpriseVerifier(auth);
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 5]);
+                    return [4 /*yield*/, verifier.verify(action)];
+                case 2:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, verifier.verify(action, true)];
+                case 4:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 5:
+                    newRequest = __assign({}, request);
+                    if (!captchaResp) {
+                        Object.assign(newRequest, { captchaResponse: captchaResponse });
+                    }
+                    else {
+                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+                    }
+                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+                    Object.assign(newRequest, {
+                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                    });
+                    return [2 /*return*/, newRequest];
             }
-        }
-    };
-    IndexedDBLocalPersistence.prototype.startPolling = function () {
-        var _this = this;
-        this.stopPolling();
-        this.pollTimer = setInterval(function () { return __awaiter(_this, void 0, void 0, function () { return __generator(this, function (_a) {
-            return [2 /*return*/, this._poll()];
-        }); }); }, _POLLING_INTERVAL_MS);
-    };
-    IndexedDBLocalPersistence.prototype.stopPolling = function () {
-        if (this.pollTimer) {
-            clearInterval(this.pollTimer);
-            this.pollTimer = null;
-        }
-    };
-    IndexedDBLocalPersistence.prototype._addListener = function (key, listener) {
-        if (Object.keys(this.listeners).length === 0) {
-            this.startPolling();
-        }
-        if (!this.listeners[key]) {
-            this.listeners[key] = new Set();
-            // Populate the cache to avoid spuriously triggering on first poll.
-            void this._get(key); // This can happen in the background async and we can return immediately.
-        }
-        this.listeners[key].add(listener);
-    };
-    IndexedDBLocalPersistence.prototype._removeListener = function (key, listener) {
-        if (this.listeners[key]) {
-            this.listeners[key].delete(listener);
-            if (this.listeners[key].size === 0) {
-                delete this.listeners[key];
+        });
+    });
+}
+function _initializeRecaptchaConfig(auth) {
+    return __awaiter(this, void 0, void 0, function () {
+        var authInternal, response, config, verifier;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    authInternal = _castAuth(auth);
+                    return [4 /*yield*/, getRecaptchaConfig(authInternal, {
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                        })];
+                case 1:
+                    response = _a.sent();
+                    config = new RecaptchaConfig(response);
+                    if (authInternal.tenantId == null) {
+                        authInternal._agentRecaptchaConfig = config;
+                    }
+                    else {
+                        authInternal._tenantRecaptchaConfigs[authInternal.tenantId] = config;
+                    }
+                    if (config.emailPasswordEnabled) {
+                        verifier = new RecaptchaEnterpriseVerifier(authInternal);
+                        void verifier.verify();
+                    }
+                    return [2 /*return*/];
             }
-        }
-        if (Object.keys(this.listeners).length === 0) {
-            this.stopPolling();
-        }
-    };
-    IndexedDBLocalPersistence.type = 'LOCAL';
-    return IndexedDBLocalPersistence;
-}());
-/**
- * An implementation of {@link Persistence} of type `LOCAL` using `indexedDB`
- * for the underlying storage.
- *
- * @public
- */
-var indexedDBLocalPersistence = IndexedDBLocalPersistence;
-
-/**
- * @license
- * Copyright 2021 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * An enum of factors that may be used for multifactor authentication.
- *
- * @public
- */
-var FactorId = {
-    /** Phone as second factor */
-    PHONE: 'phone',
-    TOTP: 'totp'
-};
-/**
- * Enumeration of supported providers.
- *
- * @public
- */
-var ProviderId = {
-    /** Facebook provider ID */
-    FACEBOOK: 'facebook.com',
-    /** GitHub provider ID */
-    GITHUB: 'github.com',
-    /** Google provider ID */
-    GOOGLE: 'google.com',
-    /** Password provider */
-    PASSWORD: 'password',
-    /** Phone provider */
-    PHONE: 'phone',
-    /** Twitter provider ID */
-    TWITTER: 'twitter.com'
-};
-/**
- * Enumeration of supported sign-in methods.
- *
- * @public
- */
-var SignInMethod = {
-    /** Email link sign in method */
-    EMAIL_LINK: 'emailLink',
-    /** Email/password sign in method */
-    EMAIL_PASSWORD: 'password',
-    /** Facebook sign in method */
-    FACEBOOK: 'facebook.com',
-    /** GitHub sign in method */
-    GITHUB: 'github.com',
-    /** Google sign in method */
-    GOOGLE: 'google.com',
-    /** Phone sign in method */
-    PHONE: 'phone',
-    /** Twitter sign in method */
-    TWITTER: 'twitter.com'
-};
-/**
- * Enumeration of supported operation types.
- *
- * @public
- */
-var OperationType = {
-    /** Operation involving linking an additional provider to an already signed-in user. */
-    LINK: 'link',
-    /** Operation involving using a provider to reauthenticate an already signed-in user. */
-    REAUTHENTICATE: 'reauthenticate',
-    /** Operation involving signing in a user. */
-    SIGN_IN: 'signIn'
-};
-/**
- * An enumeration of the possible email action types.
- *
- * @public
- */
-var ActionCodeOperation = {
-    /** The email link sign-in action. */
-    EMAIL_SIGNIN: 'EMAIL_SIGNIN',
-    /** The password reset action. */
-    PASSWORD_RESET: 'PASSWORD_RESET',
-    /** The email revocation action. */
-    RECOVER_EMAIL: 'RECOVER_EMAIL',
-    /** The revert second factor addition email action. */
-    REVERT_SECOND_FACTOR_ADDITION: 'REVERT_SECOND_FACTOR_ADDITION',
-    /** The revert second factor addition email action. */
-    VERIFY_AND_CHANGE_EMAIL: 'VERIFY_AND_CHANGE_EMAIL',
-    /** The email verification action. */
-    VERIFY_EMAIL: 'VERIFY_EMAIL'
-};
+        });
+    });
+}
 
 /**
  * Changes the {@link Auth} instance to communicate with the Firebase Auth Emulator, instead of production
@@ -7207,6 +7463,36 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/**
+ * Updates the password policy cached in the {@link Auth} instance if a policy is already
+ * cached for the project or tenant.
+ *
+ * @remarks
+ * We only fetch the password policy if the password did not meet policy requirements and
+ * there is an existing policy cached. A developer must call validatePassword at least
+ * once for the cache to be automatically updated.
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @private
+ */
+function recachePasswordPolicy(auth) {
+    return __awaiter(this, void 0, void 0, function () {
+        var authInternal;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    authInternal = _castAuth(auth);
+                    if (!authInternal._getPasswordPolicyInternal()) return [3 /*break*/, 2];
+                    return [4 /*yield*/, authInternal._updatePasswordPolicy()];
+                case 1:
+                    _a.sent();
+                    _a.label = 2;
+                case 2: return [2 /*return*/];
+            }
+        });
+    });
+}
 /**
  * Sends a password reset email to the given email address.
  *
@@ -7310,12 +7596,22 @@ function sendPasswordResetEmail(auth, email, actionCodeSettings) {
  */
 function confirmPasswordReset(auth, oobCode, newPassword) {
     return __awaiter(this, void 0, void 0, function () {
+        var _this = this;
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0: return [4 /*yield*/, resetPassword(getModularInstance(auth), {
                         oobCode: oobCode,
                         newPassword: newPassword
-                    })];
+                    })
+                        .catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            if (error.code ===
+                                "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                                void recachePasswordPolicy(auth);
+                            }
+                            throw error;
+                        });
+                    }); })];
                 case 1:
                     _a.sent();
                     return [2 /*return*/];
@@ -7471,13 +7767,16 @@ function createUserWithEmailAndPassword(auth, email, password) {
                                 case 1:
                                     requestWithRecaptcha = _a.sent();
                                     return [2 /*return*/, signUp(authInternal, requestWithRecaptcha)];
-                                case 2: return [2 /*return*/, Promise.reject(error)];
+                                case 2: throw error;
                             }
                         });
                     }); });
                     _b.label = 3;
                 case 3: return [4 /*yield*/, signUpResponse.catch(function (error) {
-                        return Promise.reject(error);
+                        if (error.code === "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                            void recachePasswordPolicy(auth);
+                        }
+                        throw error;
                     })];
                 case 4:
                     response = _b.sent();
@@ -7509,7 +7808,15 @@ function createUserWithEmailAndPassword(auth, email, password) {
  * @public
  */
 function signInWithEmailAndPassword(auth, email, password) {
-    return signInWithCredential(getModularInstance(auth), EmailAuthProvider.credential(email, password));
+    var _this = this;
+    return signInWithCredential(getModularInstance(auth), EmailAuthProvider.credential(email, password)).catch(function (error) { return __awaiter(_this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            if (error.code === "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                void recachePasswordPolicy(auth);
+            }
+            throw error;
+        });
+    }); });
 }
 
 /**
@@ -8247,8 +8554,39 @@ function setPersistence(auth, persistence) {
  * @public
  */
 function initializeRecaptchaConfig(auth) {
-    var authInternal = _castAuth(auth);
-    return authInternal.initializeRecaptchaConfig();
+    return _initializeRecaptchaConfig(auth);
+}
+/**
+ * Validates the password against the password policy configured for the project or tenant.
+ *
+ * @remarks
+ * If no tenant ID is set on the `Auth` instance, then this method will use the password
+ * policy configured for the project. Otherwise, this method will use the policy configured
+ * for the tenant. If a password policy has not been configured, then the default policy
+ * configured for all projects will be used.
+ *
+ * If an auth flow fails because a submitted password does not meet the password policy
+ * requirements and this method has previously been called, then this method will use the
+ * most recent policy available when called again.
+ *
+ * @example
+ * ```javascript
+ * validatePassword(auth, 'some-password');
+ * ```
+ *
+ * @param auth The {@link Auth} instance.
+ * @param password The password to validate.
+ *
+ * @public
+ */
+function validatePassword(auth, password) {
+    return __awaiter(this, void 0, void 0, function () {
+        var authInternal;
+        return __generator(this, function (_a) {
+            authInternal = _castAuth(auth);
+            return [2 /*return*/, authInternal.validatePassword(password)];
+        });
+    });
 }
 /**
  * Adds an observer for changes to the signed-in user's ID token.
@@ -8691,5 +9029,5 @@ function getAuth(app) {
     return auth;
 }
 
-export { ActionCodeOperation, ActionCodeURL, AuthCredential, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as AuthErrorCodes, EmailAuthCredential, EmailAuthProvider, FacebookAuthProvider, FactorId, GithubAuthProvider, GoogleAuthProvider, OAuthCredential, OAuthProvider, OperationType, PhoneAuthCredential, ProviderId, SAMLAuthProvider, SignInMethod, TwitterAuthProvider, applyActionCode, beforeAuthStateChanged, checkActionCode, confirmPasswordReset, connectAuthEmulator, createUserWithEmailAndPassword, debugErrorMap, deleteUser, fetchSignInMethodsForEmail, getAdditionalUserInfo, getAuth, getIdToken, getIdTokenResult, getMultiFactorResolver, inMemoryPersistence, indexedDBLocalPersistence, initializeAuth, initializeRecaptchaConfig, isSignInWithEmailLink, linkWithCredential, multiFactor, onAuthStateChanged, onIdTokenChanged, parseActionCodeURL, prodErrorMap, reauthenticateWithCredential, reload, sendEmailVerification, sendPasswordResetEmail, sendSignInLinkToEmail, setPersistence, signInAnonymously, signInWithCredential, signInWithCustomToken, signInWithEmailAndPassword, signInWithEmailLink, signOut, unlink, updateCurrentUser, updateEmail, updatePassword, updateProfile, useDeviceLanguage, verifyBeforeUpdateEmail, verifyPasswordResetCode };
+export { ActionCodeOperation, ActionCodeURL, AuthCredential, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as AuthErrorCodes, EmailAuthCredential, EmailAuthProvider, FacebookAuthProvider, FactorId, GithubAuthProvider, GoogleAuthProvider, OAuthCredential, OAuthProvider, OperationType, PhoneAuthCredential, ProviderId, SAMLAuthProvider, SignInMethod, TwitterAuthProvider, applyActionCode, beforeAuthStateChanged, checkActionCode, confirmPasswordReset, connectAuthEmulator, createUserWithEmailAndPassword, debugErrorMap, deleteUser, fetchSignInMethodsForEmail, getAdditionalUserInfo, getAuth, getIdToken, getIdTokenResult, getMultiFactorResolver, inMemoryPersistence, indexedDBLocalPersistence, initializeAuth, initializeRecaptchaConfig, isSignInWithEmailLink, linkWithCredential, multiFactor, onAuthStateChanged, onIdTokenChanged, parseActionCodeURL, prodErrorMap, reauthenticateWithCredential, reload, sendEmailVerification, sendPasswordResetEmail, sendSignInLinkToEmail, setPersistence, signInAnonymously, signInWithCredential, signInWithCustomToken, signInWithEmailAndPassword, signInWithEmailLink, signOut, unlink, updateCurrentUser, updateEmail, updatePassword, updateProfile, useDeviceLanguage, validatePassword, verifyBeforeUpdateEmail, verifyPasswordResetCode };
 //# sourceMappingURL=index.webworker.esm5.js.map