@firebase/auth 1.1.0 → 1.2.0-canary.78d2738c2

package/dist/rn/{phone-2132481b.js → phone-e617de09.js}

@@ -6,6 +6,53 @@ var app = require('@firebase/app');
 var component = require('@firebase/component');
 var logger = require('@firebase/logger');
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isV2(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.getResponse !== undefined);
+}
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+var RecaptchaConfig = /** @class */ (function () {
+    function RecaptchaConfig(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
+            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+                enforcementState.enforcementState !== 'OFF';
+        });
+    }
+    return RecaptchaConfig;
+}());
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -178,6 +225,8 @@ function _debugErrorMap() {
         _a["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is missing when sending request to the backend.',
         _a["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */] = 'Invalid request parameters.',
         _a["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */] = 'The reCAPTCHA version is invalid when sending request to the backend.',
+        _a["unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */] = 'The password policy received from the backend uses a schema version that is not supported by this version of the Firebase SDK.',
+        _a["password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */] = 'The password does not meet the requirements.',
         _a;
 }
 function _prodErrorMap() {
@@ -723,6 +772,7 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     _a$1["USER_NOT_FOUND" /* ServerError.USER_NOT_FOUND */] = "user-token-expired" /* AuthErrorCode.TOKEN_EXPIRED */,
     // Other errors.
     _a$1["TOO_MANY_ATTEMPTS_TRY_LATER" /* ServerError.TOO_MANY_ATTEMPTS_TRY_LATER */] = "too-many-requests" /* AuthErrorCode.TOO_MANY_ATTEMPTS_TRY_LATER */,
+    _a$1["PASSWORD_DOES_NOT_MEET_REQUIREMENTS" /* ServerError.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */] = "password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */,
     // Phone Auth related errors.
     _a$1["INVALID_CODE" /* ServerError.INVALID_CODE */] = "invalid-verification-code" /* AuthErrorCode.INVALID_CODE */,
     _a$1["INVALID_SESSION_INFO" /* ServerError.INVALID_SESSION_INFO */] = "invalid-verification-id" /* AuthErrorCode.INVALID_SESSION_INFO */,
@@ -948,6 +998,40 @@ function _makeTaggedError(auth, code, response) {
     return error;
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getRecaptchaParams(auth) {
+    return tslib.__awaiter(this, void 0, void 0, function () {
+        return tslib.__generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)];
+                case 1: return [2 /*return*/, ((_a.sent()).recaptchaSiteKey || '')];
+            }
+        });
+    });
+}
+function getRecaptchaConfig(auth, request) {
+    return tslib.__awaiter(this, void 0, void 0, function () {
+        return tslib.__generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+        });
+    });
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -2346,7 +2430,7 @@ function _getClientVersion(clientPlatform, frameworks) {
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2022 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2360,27 +2444,97 @@ function _getClientVersion(clientPlatform, frameworks) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function getRecaptchaParams(auth) {
-    return tslib.__awaiter(this, void 0, void 0, function () {
-        return tslib.__generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v1/recaptchaParams" /* Endpoint.GET_RECAPTCHA_PARAM */)];
-                case 1: return [2 /*return*/, ((_a.sent()).recaptchaSiteKey || '')];
-            }
-        });
-    });
-}
-function getRecaptchaConfig(auth, request) {
-    return tslib.__awaiter(this, void 0, void 0, function () {
-        return tslib.__generator(this, function (_a) {
-            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request))];
+var AuthMiddlewareQueue = /** @class */ (function () {
+    function AuthMiddlewareQueue(auth) {
+        this.auth = auth;
+        this.queue = [];
+    }
+    AuthMiddlewareQueue.prototype.pushCallback = function (callback, onAbort) {
+        var _this = this;
+        // The callback could be sync or async. Wrap it into a
+        // function that is always async.
+        var wrappedCallback = function (user) {
+            return new Promise(function (resolve, reject) {
+                try {
+                    var result = callback(user);
+                    // Either resolve with existing promise or wrap a non-promise
+                    // return value into a promise.
+                    resolve(result);
+                }
+                catch (e) {
+                    // Sync callback throws.
+                    reject(e);
+                }
+            });
+        };
+        // Attach the onAbort if present
+        wrappedCallback.onAbort = onAbort;
+        this.queue.push(wrappedCallback);
+        var index = this.queue.length - 1;
+        return function () {
+            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
+            // indexing of other elements.
+            _this.queue[index] = function () { return Promise.resolve(); };
+        };
+    };
+    AuthMiddlewareQueue.prototype.runMiddleware = function (nextUser) {
+        return tslib.__awaiter(this, void 0, void 0, function () {
+            var onAbortStack, _i, _a, beforeStateCallback, e_1, _b, onAbortStack_1, onAbort;
+            return tslib.__generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        if (this.auth.currentUser === nextUser) {
+                            return [2 /*return*/];
+                        }
+                        onAbortStack = [];
+                        _c.label = 1;
+                    case 1:
+                        _c.trys.push([1, 6, , 7]);
+                        _i = 0, _a = this.queue;
+                        _c.label = 2;
+                    case 2:
+                        if (!(_i < _a.length)) return [3 /*break*/, 5];
+                        beforeStateCallback = _a[_i];
+                        return [4 /*yield*/, beforeStateCallback(nextUser)];
+                    case 3:
+                        _c.sent();
+                        // Only push the onAbort if the callback succeeds
+                        if (beforeStateCallback.onAbort) {
+                            onAbortStack.push(beforeStateCallback.onAbort);
+                        }
+                        _c.label = 4;
+                    case 4:
+                        _i++;
+                        return [3 /*break*/, 2];
+                    case 5: return [3 /*break*/, 7];
+                    case 6:
+                        e_1 = _c.sent();
+                        // Run all onAbort, with separate try/catch to ignore any errors and
+                        // continue
+                        onAbortStack.reverse();
+                        for (_b = 0, onAbortStack_1 = onAbortStack; _b < onAbortStack_1.length; _b++) {
+                            onAbort = onAbortStack_1[_b];
+                            try {
+                                onAbort();
+                            }
+                            catch (_) {
+                                /* swallow error */
+                            }
+                        }
+                        throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
+                            originalMessage: e_1 === null || e_1 === void 0 ? void 0 : e_1.message
+                        });
+                    case 7: return [2 /*return*/];
+                }
+            });
         });
-    });
-}
+    };
+    return AuthMiddlewareQueue;
+}());
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2394,40 +2548,25 @@ function getRecaptchaConfig(auth, request) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function isV2(grecaptcha) {
-    return (grecaptcha !== undefined &&
-        grecaptcha.getResponse !== undefined);
-}
-function isEnterprise(grecaptcha) {
-    return (grecaptcha !== undefined &&
-        grecaptcha.enterprise !== undefined);
-}
-var RecaptchaConfig = /** @class */ (function () {
-    function RecaptchaConfig(response) {
-        /**
-         * The reCAPTCHA site key.
-         */
-        this.siteKey = '';
-        /**
-         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
-         */
-        this.emailPasswordEnabled = false;
-        if (response.recaptchaKey === undefined) {
-            throw new Error('recaptchaKey undefined');
-        }
-        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
-        this.siteKey = response.recaptchaKey.split('/')[3];
-        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(function (enforcementState) {
-            return enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
-                enforcementState.enforcementState !== 'OFF';
+/**
+ * Fetches the password policy for the currently set tenant or the project if no tenant is set.
+ *
+ * @param auth Auth object.
+ * @param request Password policy request.
+ * @returns Password policy response.
+ */
+function _getPasswordPolicy(auth, request) {
+    if (request === void 0) { request = {}; }
+    return tslib.__awaiter(this, void 0, void 0, function () {
+        return tslib.__generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/passwordPolicy" /* Endpoint.GET_PASSWORD_POLICY */, _addTidIfNecessary(auth, request))];
         });
-    }
-    return RecaptchaConfig;
-}());
+    });
+}
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2441,289 +2580,138 @@ var RecaptchaConfig = /** @class */ (function () {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function getScriptParentElement() {
-    var _a, _b;
-    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
-}
-function _loadJS(url) {
-    // TODO: consider adding timeout support & cancellation
-    return new Promise(function (resolve, reject) {
-        var el = document.createElement('script');
-        el.setAttribute('src', url);
-        el.onload = resolve;
-        el.onerror = function (e) {
-            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            error.customData = e;
-            reject(error);
+// Minimum min password length enforced by the backend, even if no minimum length is set.
+var MINIMUM_MIN_PASSWORD_LENGTH = 6;
+/**
+ * Stores password policy requirements and provides password validation against the policy.
+ *
+ * @internal
+ */
+var PasswordPolicyImpl = /** @class */ (function () {
+    function PasswordPolicyImpl(response) {
+        var _a, _b, _c, _d;
+        // Only include custom strength options defined in the response.
+        var responseOptions = response.customStrengthOptions;
+        this.customStrengthOptions = {};
+        // TODO: Remove once the backend is updated to include the minimum min password length instead of undefined when there is no minimum length set.
+        this.customStrengthOptions.minPasswordLength =
+            (_a = responseOptions.minPasswordLength) !== null && _a !== void 0 ? _a : MINIMUM_MIN_PASSWORD_LENGTH;
+        if (responseOptions.maxPasswordLength) {
+            this.customStrengthOptions.maxPasswordLength =
+                responseOptions.maxPasswordLength;
+        }
+        if (responseOptions.containsLowercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsLowercaseLetter =
+                responseOptions.containsLowercaseCharacter;
+        }
+        if (responseOptions.containsUppercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsUppercaseLetter =
+                responseOptions.containsUppercaseCharacter;
+        }
+        if (responseOptions.containsNumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNumericCharacter =
+                responseOptions.containsNumericCharacter;
+        }
+        if (responseOptions.containsNonAlphanumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNonAlphanumericCharacter =
+                responseOptions.containsNonAlphanumericCharacter;
+        }
+        this.enforcementState = response.enforcementState;
+        if (this.enforcementState === 'ENFORCEMENT_STATE_UNSPECIFIED') {
+            this.enforcementState = 'OFF';
+        }
+        // Use an empty string if no non-alphanumeric characters are specified in the response.
+        this.allowedNonAlphanumericCharacters =
+            (_c = (_b = response.allowedNonAlphanumericCharacters) === null || _b === void 0 ? void 0 : _b.join('')) !== null && _c !== void 0 ? _c : '';
+        this.forceUpgradeOnSignin = (_d = response.forceUpgradeOnSignin) !== null && _d !== void 0 ? _d : false;
+        this.schemaVersion = response.schemaVersion;
+    }
+    PasswordPolicyImpl.prototype.validatePassword = function (password) {
+        var _a, _b, _c, _d, _e, _f;
+        var status = {
+            isValid: true,
+            passwordPolicy: this
         };
-        el.type = 'text/javascript';
-        el.charset = 'UTF-8';
-        getScriptParentElement().appendChild(el);
-    });
-}
-function _generateCallbackName(prefix) {
-    return "__".concat(prefix).concat(Math.floor(Math.random() * 1000000));
-}
-
-/* eslint-disable @typescript-eslint/no-require-imports */
-var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
-var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
-var FAKE_TOKEN = 'NO_RECAPTCHA';
-var RecaptchaEnterpriseVerifier = /** @class */ (function () {
+        // Check the password length and character options.
+        this.validatePasswordLengthOptions(password, status);
+        this.validatePasswordCharacterOptions(password, status);
+        // Combine the status into single isValid property.
+        status.isValid && (status.isValid = (_a = status.meetsMinPasswordLength) !== null && _a !== void 0 ? _a : true);
+        status.isValid && (status.isValid = (_b = status.meetsMaxPasswordLength) !== null && _b !== void 0 ? _b : true);
+        status.isValid && (status.isValid = (_c = status.containsLowercaseLetter) !== null && _c !== void 0 ? _c : true);
+        status.isValid && (status.isValid = (_d = status.containsUppercaseLetter) !== null && _d !== void 0 ? _d : true);
+        status.isValid && (status.isValid = (_e = status.containsNumericCharacter) !== null && _e !== void 0 ? _e : true);
+        status.isValid && (status.isValid = (_f = status.containsNonAlphanumericCharacter) !== null && _f !== void 0 ? _f : true);
+        return status;
+    };
     /**
+     * Validates that the password meets the length options for the policy.
      *
-     * @param authExtern - The corresponding Firebase {@link Auth} instance.
-     *
+     * @param password Password to validate.
+     * @param status Validation status.
      */
-    function RecaptchaEnterpriseVerifier(authExtern) {
-        /**
-         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
-         */
-        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
-        this.auth = _castAuth(authExtern);
-    }
+    PasswordPolicyImpl.prototype.validatePasswordLengthOptions = function (password, status) {
+        var minPasswordLength = this.customStrengthOptions.minPasswordLength;
+        var maxPasswordLength = this.customStrengthOptions.maxPasswordLength;
+        if (minPasswordLength) {
+            status.meetsMinPasswordLength = password.length >= minPasswordLength;
+        }
+        if (maxPasswordLength) {
+            status.meetsMaxPasswordLength = password.length <= maxPasswordLength;
+        }
+    };
     /**
-     * Executes the verification process.
+     * Validates that the password meets the character options for the policy.
      *
-     * @returns A Promise for a token that can be used to assert the validity of a request.
+     * @param password Password to validate.
+     * @param status Validation status.
      */
-    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
-        if (action === void 0) { action = 'verify'; }
-        if (forceRefresh === void 0) { forceRefresh = false; }
-        return tslib.__awaiter(this, void 0, void 0, function () {
-            function retrieveSiteKey(auth) {
-                return tslib.__awaiter(this, void 0, void 0, function () {
-                    var _this = this;
-                    return tslib.__generator(this, function (_a) {
-                        if (!forceRefresh) {
-                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
-                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
-                            }
-                            if (auth.tenantId != null &&
-                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
-                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
-                            }
-                        }
-                        return [2 /*return*/, new Promise(function (resolve, reject) { return tslib.__awaiter(_this, void 0, void 0, function () {
-                                return tslib.__generator(this, function (_a) {
-                                    getRecaptchaConfig(auth, {
-                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                                    })
-                                        .then(function (response) {
-                                        if (response.recaptchaKey === undefined) {
-                                            reject(new Error('recaptcha Enterprise site key undefined'));
-                                        }
-                                        else {
-                                            var config = new RecaptchaConfig(response);
-                                            if (auth.tenantId == null) {
-                                                auth._agentRecaptchaConfig = config;
-                                            }
-                                            else {
-                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
-                                            }
-                                            return resolve(config.siteKey);
-                                        }
-                                    })
-                                        .catch(function (error) {
-                                        reject(error);
-                                    });
-                                    return [2 /*return*/];
-                                });
-                            }); })];
-                    });
-                });
-            }
-            function retrieveRecaptchaToken(siteKey, resolve, reject) {
-                var grecaptcha = window.grecaptcha;
-                if (isEnterprise(grecaptcha)) {
-                    grecaptcha.enterprise.ready(function () {
-                        grecaptcha.enterprise
-                            .execute(siteKey, { action: action })
-                            .then(function (token) {
-                            resolve(token);
-                        })
-                            .catch(function () {
-                            resolve(FAKE_TOKEN);
-                        });
-                    });
-                }
-                else {
-                    reject(Error('No reCAPTCHA enterprise script loaded.'));
-                }
-            }
-            var _this = this;
-            return tslib.__generator(this, function (_a) {
-                return [2 /*return*/, new Promise(function (resolve, reject) {
-                        retrieveSiteKey(_this.auth)
-                            .then(function (siteKey) {
-                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
-                                retrieveRecaptchaToken(siteKey, resolve, reject);
-                            }
-                            else {
-                                if (typeof window === 'undefined') {
-                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
-                                    return;
-                                }
-                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
-                                    .then(function () {
-                                    retrieveRecaptchaToken(siteKey, resolve, reject);
-                                })
-                                    .catch(function (error) {
-                                    reject(error);
-                                });
-                            }
-                        })
-                            .catch(function (error) {
-                            reject(error);
-                        });
-                    })];
-            });
-        });
-    };
-    return RecaptchaEnterpriseVerifier;
-}());
-function injectRecaptchaFields(auth, request, action, captchaResp) {
-    if (captchaResp === void 0) { captchaResp = false; }
-    return tslib.__awaiter(this, void 0, void 0, function () {
-        var verifier, captchaResponse, newRequest;
-        return tslib.__generator(this, function (_a) {
-            switch (_a.label) {
-                case 0:
-                    verifier = new RecaptchaEnterpriseVerifier(auth);
-                    _a.label = 1;
-                case 1:
-                    _a.trys.push([1, 3, , 5]);
-                    return [4 /*yield*/, verifier.verify(action)];
-                case 2:
-                    captchaResponse = _a.sent();
-                    return [3 /*break*/, 5];
-                case 3:
-                    _a.sent();
-                    return [4 /*yield*/, verifier.verify(action, true)];
-                case 4:
-                    captchaResponse = _a.sent();
-                    return [3 /*break*/, 5];
-                case 5:
-                    newRequest = tslib.__assign({}, request);
-                    if (!captchaResp) {
-                        Object.assign(newRequest, { captchaResponse: captchaResponse });
-                    }
-                    else {
-                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
-                    }
-                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
-                    Object.assign(newRequest, {
-                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                    });
-                    return [2 /*return*/, newRequest];
-            }
-        });
-    });
-}
-
-/**
- * @license
- * Copyright 2022 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-var AuthMiddlewareQueue = /** @class */ (function () {
-    function AuthMiddlewareQueue(auth) {
-        this.auth = auth;
-        this.queue = [];
-    }
-    AuthMiddlewareQueue.prototype.pushCallback = function (callback, onAbort) {
-        var _this = this;
-        // The callback could be sync or async. Wrap it into a
-        // function that is always async.
-        var wrappedCallback = function (user) {
-            return new Promise(function (resolve, reject) {
-                try {
-                    var result = callback(user);
-                    // Either resolve with existing promise or wrap a non-promise
-                    // return value into a promise.
-                    resolve(result);
-                }
-                catch (e) {
-                    // Sync callback throws.
-                    reject(e);
-                }
-            });
-        };
-        // Attach the onAbort if present
-        wrappedCallback.onAbort = onAbort;
-        this.queue.push(wrappedCallback);
-        var index = this.queue.length - 1;
-        return function () {
-            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
-            // indexing of other elements.
-            _this.queue[index] = function () { return Promise.resolve(); };
-        };
+    PasswordPolicyImpl.prototype.validatePasswordCharacterOptions = function (password, status) {
+        // Assign statuses for requirements even if the password is an empty string.
+        this.updatePasswordCharacterOptionsStatuses(status, 
+        /* containsLowercaseCharacter= */ false, 
+        /* containsUppercaseCharacter= */ false, 
+        /* containsNumericCharacter= */ false, 
+        /* containsNonAlphanumericCharacter= */ false);
+        var passwordChar;
+        for (var i = 0; i < password.length; i++) {
+            passwordChar = password.charAt(i);
+            this.updatePasswordCharacterOptionsStatuses(status, 
+            /* containsLowercaseCharacter= */ passwordChar >= 'a' &&
+                passwordChar <= 'z', 
+            /* containsUppercaseCharacter= */ passwordChar >= 'A' &&
+                passwordChar <= 'Z', 
+            /* containsNumericCharacter= */ passwordChar >= '0' &&
+                passwordChar <= '9', 
+            /* containsNonAlphanumericCharacter= */ this.allowedNonAlphanumericCharacters.includes(passwordChar));
+        }
     };
-    AuthMiddlewareQueue.prototype.runMiddleware = function (nextUser) {
-        return tslib.__awaiter(this, void 0, void 0, function () {
-            var onAbortStack, _i, _a, beforeStateCallback, e_1, _b, onAbortStack_1, onAbort;
-            return tslib.__generator(this, function (_c) {
-                switch (_c.label) {
-                    case 0:
-                        if (this.auth.currentUser === nextUser) {
-                            return [2 /*return*/];
-                        }
-                        onAbortStack = [];
-                        _c.label = 1;
-                    case 1:
-                        _c.trys.push([1, 6, , 7]);
-                        _i = 0, _a = this.queue;
-                        _c.label = 2;
-                    case 2:
-                        if (!(_i < _a.length)) return [3 /*break*/, 5];
-                        beforeStateCallback = _a[_i];
-                        return [4 /*yield*/, beforeStateCallback(nextUser)];
-                    case 3:
-                        _c.sent();
-                        // Only push the onAbort if the callback succeeds
-                        if (beforeStateCallback.onAbort) {
-                            onAbortStack.push(beforeStateCallback.onAbort);
-                        }
-                        _c.label = 4;
-                    case 4:
-                        _i++;
-                        return [3 /*break*/, 2];
-                    case 5: return [3 /*break*/, 7];
-                    case 6:
-                        e_1 = _c.sent();
-                        // Run all onAbort, with separate try/catch to ignore any errors and
-                        // continue
-                        onAbortStack.reverse();
-                        for (_b = 0, onAbortStack_1 = onAbortStack; _b < onAbortStack_1.length; _b++) {
-                            onAbort = onAbortStack_1[_b];
-                            try {
-                                onAbort();
-                            }
-                            catch (_) {
-                                /* swallow error */
-                            }
-                        }
-                        throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
-                            originalMessage: e_1 === null || e_1 === void 0 ? void 0 : e_1.message
-                        });
-                    case 7: return [2 /*return*/];
-                }
-            });
-        });
+    /**
+     * Updates the running validation status with the statuses for the character options.
+     * Expected to be called each time a character is processed to update each option status
+     * based on the current character.
+     *
+     * @param status Validation status.
+     * @param containsLowercaseCharacter Whether the character is a lowercase letter.
+     * @param containsUppercaseCharacter Whether the character is an uppercase letter.
+     * @param containsNumericCharacter Whether the character is a numeric character.
+     * @param containsNonAlphanumericCharacter Whether the character is a non-alphanumeric character.
+     */
+    PasswordPolicyImpl.prototype.updatePasswordCharacterOptionsStatuses = function (status, containsLowercaseCharacter, containsUppercaseCharacter, containsNumericCharacter, containsNonAlphanumericCharacter) {
+        if (this.customStrengthOptions.containsLowercaseLetter) {
+            status.containsLowercaseLetter || (status.containsLowercaseLetter = containsLowercaseCharacter);
+        }
+        if (this.customStrengthOptions.containsUppercaseLetter) {
+            status.containsUppercaseLetter || (status.containsUppercaseLetter = containsUppercaseCharacter);
+        }
+        if (this.customStrengthOptions.containsNumericCharacter) {
+            status.containsNumericCharacter || (status.containsNumericCharacter = containsNumericCharacter);
+        }
+        if (this.customStrengthOptions.containsNonAlphanumericCharacter) {
+            status.containsNonAlphanumericCharacter || (status.containsNonAlphanumericCharacter = containsNonAlphanumericCharacter);
+        }
     };
-    return AuthMiddlewareQueue;
+    return PasswordPolicyImpl;
 }());
 
 /**
@@ -2756,6 +2744,7 @@ var AuthImpl = /** @class */ (function () {
         this.beforeStateQueue = new AuthMiddlewareQueue(this);
         this.redirectUser = null;
         this.isProactiveRefreshEnabled = false;
+        this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION = 1;
         // Any network calls will set this to true and prevent subsequent emulator
         // initialization
         this._canInitEmulator = true;
@@ -2766,6 +2755,8 @@ var AuthImpl = /** @class */ (function () {
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
         this._agentRecaptchaConfig = null;
         this._tenantRecaptchaConfigs = {};
+        this._projectPasswordPolicy = null;
+        this._tenantPasswordPolicies = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -3095,41 +3086,66 @@ var AuthImpl = /** @class */ (function () {
             });
         }); });
     };
-    AuthImpl.prototype.initializeRecaptchaConfig = function () {
+    AuthImpl.prototype._getRecaptchaConfig = function () {
+        if (this.tenantId == null) {
+            return this._agentRecaptchaConfig;
+        }
+        else {
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    };
+    AuthImpl.prototype.validatePassword = function (password) {
         return tslib.__awaiter(this, void 0, void 0, function () {
-            var response, config, verifier;
+            var passwordPolicy;
             return tslib.__generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, getRecaptchaConfig(this, {
-                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                        })];
+                    case 0:
+                        if (!!this._getPasswordPolicyInternal()) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this._updatePasswordPolicy()];
                     case 1:
-                        response = _a.sent();
-                        config = new RecaptchaConfig(response);
-                        if (this.tenantId == null) {
-                            this._agentRecaptchaConfig = config;
-                        }
-                        else {
-                            this._tenantRecaptchaConfigs[this.tenantId] = config;
-                        }
-                        if (config.emailPasswordEnabled) {
-                            verifier = new RecaptchaEnterpriseVerifier(this);
-                            void verifier.verify();
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        passwordPolicy = this._getPasswordPolicyInternal();
+                        // Check that the policy schema version is supported by the SDK.
+                        // TODO: Update this logic to use a max supported policy schema version once we have multiple schema versions.
+                        if (passwordPolicy.schemaVersion !==
+                            this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION) {
+                            return [2 /*return*/, Promise.reject(this._errorFactory.create("unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */, {}))];
                         }
-                        return [2 /*return*/];
+                        return [2 /*return*/, passwordPolicy.validatePassword(password)];
                 }
             });
         });
     };
-    AuthImpl.prototype._getRecaptchaConfig = function () {
-        if (this.tenantId == null) {
-            return this._agentRecaptchaConfig;
+    AuthImpl.prototype._getPasswordPolicyInternal = function () {
+        if (this.tenantId === null) {
+            return this._projectPasswordPolicy;
         }
         else {
-            return this._tenantRecaptchaConfigs[this.tenantId];
+            return this._tenantPasswordPolicies[this.tenantId];
         }
     };
+    AuthImpl.prototype._updatePasswordPolicy = function () {
+        return tslib.__awaiter(this, void 0, void 0, function () {
+            var response, passwordPolicy;
+            return tslib.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, _getPasswordPolicy(this)];
+                    case 1:
+                        response = _a.sent();
+                        passwordPolicy = new PasswordPolicyImpl(response);
+                        if (this.tenantId === null) {
+                            this._projectPasswordPolicy = passwordPolicy;
+                        }
+                        else {
+                            this._tenantPasswordPolicies[this.tenantId] = passwordPolicy;
+                        }
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
     AuthImpl.prototype._getPersistence = function () {
         return this.assertedPersistence.persistence.type;
     };
@@ -3296,18 +3312,32 @@ var AuthImpl = /** @class */ (function () {
         var cb = typeof nextOrObserver === 'function'
             ? nextOrObserver
             : nextOrObserver.next.bind(nextOrObserver);
+        var isUnsubscribed = false;
         var promise = this._isInitialized
             ? Promise.resolve()
             : this._initializationPromise;
         _assert(promise, this, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
         // The callback needs to be called asynchronously per the spec.
         // eslint-disable-next-line @typescript-eslint/no-floating-promises
-        promise.then(function () { return cb(_this.currentUser); });
+        promise.then(function () {
+            if (isUnsubscribed) {
+                return;
+            }
+            cb(_this.currentUser);
+        });
         if (typeof nextOrObserver === 'function') {
-            return subscription.addObserver(nextOrObserver, error, completed);
+            var unsubscribe_2 = subscription.addObserver(nextOrObserver, error, completed);
+            return function () {
+                isUnsubscribed = true;
+                unsubscribe_2();
+            };
         }
         else {
-            return subscription.addObserver(nextOrObserver);
+            var unsubscribe_3 = subscription.addObserver(nextOrObserver);
+            return function () {
+                isUnsubscribed = true;
+                unsubscribe_3();
+            };
         }
     };
     /**
@@ -3405,54 +3435,280 @@ var AuthImpl = /** @class */ (function () {
     AuthImpl.prototype._getAppCheckToken = function () {
         var _a;
         return tslib.__awaiter(this, void 0, void 0, function () {
-            var appCheckTokenResult;
-            return tslib.__generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0: return [4 /*yield*/, ((_a = this.appCheckServiceProvider
-                            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken())];
-                    case 1:
-                        appCheckTokenResult = _b.sent();
-                        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
-                            // Context: appCheck.getToken() will never throw even if an error happened.
-                            // In the error case, a dummy token will be returned along with an error field describing
-                            // the error. In general, we shouldn't care about the error condition and just use
-                            // the token (actual or dummy) to send requests.
-                            _logWarn("Error while retrieving App Check token: ".concat(appCheckTokenResult.error));
+            var appCheckTokenResult;
+            return tslib.__generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, ((_a = this.appCheckServiceProvider
+                            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken())];
+                    case 1:
+                        appCheckTokenResult = _b.sent();
+                        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
+                            // Context: appCheck.getToken() will never throw even if an error happened.
+                            // In the error case, a dummy token will be returned along with an error field describing
+                            // the error. In general, we shouldn't care about the error condition and just use
+                            // the token (actual or dummy) to send requests.
+                            _logWarn("Error while retrieving App Check token: ".concat(appCheckTokenResult.error));
+                        }
+                        return [2 /*return*/, appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token];
+                }
+            });
+        });
+    };
+    return AuthImpl;
+}());
+/**
+ * Method to be used to cast down to our private implmentation of Auth.
+ * It will also handle unwrapping from the compat type if necessary
+ *
+ * @param auth Auth object passed in from developer
+ */
+function _castAuth(auth) {
+    return util.getModularInstance(auth);
+}
+/** Helper class to wrap subscriber logic */
+var Subscription = /** @class */ (function () {
+    function Subscription(auth) {
+        var _this = this;
+        this.auth = auth;
+        this.observer = null;
+        this.addObserver = util.createSubscribe(function (observer) { return (_this.observer = observer); });
+    }
+    Object.defineProperty(Subscription.prototype, "next", {
+        get: function () {
+            _assert(this.observer, this.auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            return this.observer.next.bind(this.observer);
+        },
+        enumerable: false,
+        configurable: true
+    });
+    return Subscription;
+}());
+
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise(function (resolve, reject) {
+        var el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = function (e) {
+            var error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+function _generateCallbackName(prefix) {
+    return "__".concat(prefix).concat(Math.floor(Math.random() * 1000000));
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+var RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+var RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+var FAKE_TOKEN = 'NO_RECAPTCHA';
+var RecaptchaEnterpriseVerifier = /** @class */ (function () {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    function RecaptchaEnterpriseVerifier(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    RecaptchaEnterpriseVerifier.prototype.verify = function (action, forceRefresh) {
+        if (action === void 0) { action = 'verify'; }
+        if (forceRefresh === void 0) { forceRefresh = false; }
+        return tslib.__awaiter(this, void 0, void 0, function () {
+            function retrieveSiteKey(auth) {
+                return tslib.__awaiter(this, void 0, void 0, function () {
+                    var _this = this;
+                    return tslib.__generator(this, function (_a) {
+                        if (!forceRefresh) {
+                            if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                                return [2 /*return*/, auth._agentRecaptchaConfig.siteKey];
+                            }
+                            if (auth.tenantId != null &&
+                                auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                                return [2 /*return*/, auth._tenantRecaptchaConfigs[auth.tenantId].siteKey];
+                            }
                         }
-                        return [2 /*return*/, appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token];
+                        return [2 /*return*/, new Promise(function (resolve, reject) { return tslib.__awaiter(_this, void 0, void 0, function () {
+                                return tslib.__generator(this, function (_a) {
+                                    getRecaptchaConfig(auth, {
+                                        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                                        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                                    })
+                                        .then(function (response) {
+                                        if (response.recaptchaKey === undefined) {
+                                            reject(new Error('recaptcha Enterprise site key undefined'));
+                                        }
+                                        else {
+                                            var config = new RecaptchaConfig(response);
+                                            if (auth.tenantId == null) {
+                                                auth._agentRecaptchaConfig = config;
+                                            }
+                                            else {
+                                                auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                                            }
+                                            return resolve(config.siteKey);
+                                        }
+                                    })
+                                        .catch(function (error) {
+                                        reject(error);
+                                    });
+                                    return [2 /*return*/];
+                                });
+                            }); })];
+                    });
+                });
+            }
+            function retrieveRecaptchaToken(siteKey, resolve, reject) {
+                var grecaptcha = window.grecaptcha;
+                if (isEnterprise(grecaptcha)) {
+                    grecaptcha.enterprise.ready(function () {
+                        grecaptcha.enterprise
+                            .execute(siteKey, { action: action })
+                            .then(function (token) {
+                            resolve(token);
+                        })
+                            .catch(function () {
+                            resolve(FAKE_TOKEN);
+                        });
+                    });
+                }
+                else {
+                    reject(Error('No reCAPTCHA enterprise script loaded.'));
                 }
+            }
+            var _this = this;
+            return tslib.__generator(this, function (_a) {
+                return [2 /*return*/, new Promise(function (resolve, reject) {
+                        retrieveSiteKey(_this.auth)
+                            .then(function (siteKey) {
+                            if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                                retrieveRecaptchaToken(siteKey, resolve, reject);
+                            }
+                            else {
+                                if (typeof window === 'undefined') {
+                                    reject(new Error('RecaptchaVerifier is only supported in browser'));
+                                    return;
+                                }
+                                _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                                    .then(function () {
+                                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                                })
+                                    .catch(function (error) {
+                                    reject(error);
+                                });
+                            }
+                        })
+                            .catch(function (error) {
+                            reject(error);
+                        });
+                    })];
             });
         });
     };
-    return AuthImpl;
+    return RecaptchaEnterpriseVerifier;
 }());
-/**
- * Method to be used to cast down to our private implmentation of Auth.
- * It will also handle unwrapping from the compat type if necessary
- *
- * @param auth Auth object passed in from developer
- */
-function _castAuth(auth) {
-    return util.getModularInstance(auth);
+function injectRecaptchaFields(auth, request, action, captchaResp) {
+    if (captchaResp === void 0) { captchaResp = false; }
+    return tslib.__awaiter(this, void 0, void 0, function () {
+        var verifier, captchaResponse, newRequest;
+        return tslib.__generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    verifier = new RecaptchaEnterpriseVerifier(auth);
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 5]);
+                    return [4 /*yield*/, verifier.verify(action)];
+                case 2:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, verifier.verify(action, true)];
+                case 4:
+                    captchaResponse = _a.sent();
+                    return [3 /*break*/, 5];
+                case 5:
+                    newRequest = tslib.__assign({}, request);
+                    if (!captchaResp) {
+                        Object.assign(newRequest, { captchaResponse: captchaResponse });
+                    }
+                    else {
+                        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+                    }
+                    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+                    Object.assign(newRequest, {
+                        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                    });
+                    return [2 /*return*/, newRequest];
+            }
+        });
+    });
 }
-/** Helper class to wrap subscriber logic */
-var Subscription = /** @class */ (function () {
-    function Subscription(auth) {
-        var _this = this;
-        this.auth = auth;
-        this.observer = null;
-        this.addObserver = util.createSubscribe(function (observer) { return (_this.observer = observer); });
-    }
-    Object.defineProperty(Subscription.prototype, "next", {
-        get: function () {
-            _assert(this.observer, this.auth, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            return this.observer.next.bind(this.observer);
-        },
-        enumerable: false,
-        configurable: true
+function _initializeRecaptchaConfig(auth) {
+    return tslib.__awaiter(this, void 0, void 0, function () {
+        var authInternal, response, config, verifier;
+        return tslib.__generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    authInternal = _castAuth(auth);
+                    return [4 /*yield*/, getRecaptchaConfig(authInternal, {
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                        })];
+                case 1:
+                    response = _a.sent();
+                    config = new RecaptchaConfig(response);
+                    if (authInternal.tenantId == null) {
+                        authInternal._agentRecaptchaConfig = config;
+                    }
+                    else {
+                        authInternal._tenantRecaptchaConfigs[authInternal.tenantId] = config;
+                    }
+                    if (config.emailPasswordEnabled) {
+                        verifier = new RecaptchaEnterpriseVerifier(authInternal);
+                        void verifier.verify();
+                    }
+                    return [2 /*return*/];
+            }
+        });
     });
-    return Subscription;
-}());
+}
 
 /**
  * @license
@@ -6112,6 +6368,36 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/**
+ * Updates the password policy cached in the {@link Auth} instance if a policy is already
+ * cached for the project or tenant.
+ *
+ * @remarks
+ * We only fetch the password policy if the password did not meet policy requirements and
+ * there is an existing policy cached. A developer must call validatePassword at least
+ * once for the cache to be automatically updated.
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @private
+ */
+function recachePasswordPolicy(auth) {
+    return tslib.__awaiter(this, void 0, void 0, function () {
+        var authInternal;
+        return tslib.__generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    authInternal = _castAuth(auth);
+                    if (!authInternal._getPasswordPolicyInternal()) return [3 /*break*/, 2];
+                    return [4 /*yield*/, authInternal._updatePasswordPolicy()];
+                case 1:
+                    _a.sent();
+                    _a.label = 2;
+                case 2: return [2 /*return*/];
+            }
+        });
+    });
+}
 /**
  * Sends a password reset email to the given email address.
  *
@@ -6215,12 +6501,22 @@ function sendPasswordResetEmail(auth, email, actionCodeSettings) {
  */
 function confirmPasswordReset(auth, oobCode, newPassword) {
     return tslib.__awaiter(this, void 0, void 0, function () {
+        var _this = this;
         return tslib.__generator(this, function (_a) {
             switch (_a.label) {
                 case 0: return [4 /*yield*/, resetPassword(util.getModularInstance(auth), {
                         oobCode: oobCode,
                         newPassword: newPassword
-                    })];
+                    })
+                        .catch(function (error) { return tslib.__awaiter(_this, void 0, void 0, function () {
+                        return tslib.__generator(this, function (_a) {
+                            if (error.code ===
+                                "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                                void recachePasswordPolicy(auth);
+                            }
+                            throw error;
+                        });
+                    }); })];
                 case 1:
                     _a.sent();
                     return [2 /*return*/];
@@ -6376,13 +6672,16 @@ function createUserWithEmailAndPassword(auth, email, password) {
                                 case 1:
                                     requestWithRecaptcha = _a.sent();
                                     return [2 /*return*/, signUp(authInternal, requestWithRecaptcha)];
-                                case 2: return [2 /*return*/, Promise.reject(error)];
+                                case 2: throw error;
                             }
                         });
                     }); });
                     _b.label = 3;
                 case 3: return [4 /*yield*/, signUpResponse.catch(function (error) {
-                        return Promise.reject(error);
+                        if (error.code === "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                            void recachePasswordPolicy(auth);
+                        }
+                        throw error;
                     })];
                 case 4:
                     response = _b.sent();
@@ -6414,7 +6713,15 @@ function createUserWithEmailAndPassword(auth, email, password) {
  * @public
  */
 function signInWithEmailAndPassword(auth, email, password) {
-    return signInWithCredential(util.getModularInstance(auth), EmailAuthProvider.credential(email, password));
+    var _this = this;
+    return signInWithCredential(util.getModularInstance(auth), EmailAuthProvider.credential(email, password)).catch(function (error) { return tslib.__awaiter(_this, void 0, void 0, function () {
+        return tslib.__generator(this, function (_a) {
+            if (error.code === "auth/".concat("password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */)) {
+                void recachePasswordPolicy(auth);
+            }
+            throw error;
+        });
+    }); });
 }
 
 /**
@@ -7152,8 +7459,39 @@ function setPersistence(auth, persistence) {
  * @public
  */
 function initializeRecaptchaConfig(auth) {
-    var authInternal = _castAuth(auth);
-    return authInternal.initializeRecaptchaConfig();
+    return _initializeRecaptchaConfig(auth);
+}
+/**
+ * Validates the password against the password policy configured for the project or tenant.
+ *
+ * @remarks
+ * If no tenant ID is set on the `Auth` instance, then this method will use the password
+ * policy configured for the project. Otherwise, this method will use the policy configured
+ * for the tenant. If a password policy has not been configured, then the default policy
+ * configured for all projects will be used.
+ *
+ * If an auth flow fails because a submitted password does not meet the password policy
+ * requirements and this method has previously been called, then this method will use the
+ * most recent policy available when called again.
+ *
+ * @example
+ * ```javascript
+ * validatePassword(auth, 'some-password');
+ * ```
+ *
+ * @param auth The {@link Auth} instance.
+ * @param password The password to validate.
+ *
+ * @public
+ */
+function validatePassword(auth, password) {
+    return tslib.__awaiter(this, void 0, void 0, function () {
+        var authInternal;
+        return tslib.__generator(this, function (_a) {
+            authInternal = _castAuth(auth);
+            return [2 /*return*/, authInternal.validatePassword(password)];
+        });
+    });
 }
 /**
  * Adds an observer for changes to the signed-in user's ID token.
@@ -7575,7 +7913,7 @@ function multiFactor(user) {
 }
 
 var name = "@firebase/auth";
-var version = "1.1.0";
+var version = "1.2.0-canary.78d2738c2";
 
 /**
  * @license
@@ -9056,6 +9394,7 @@ exports.updatePassword = updatePassword;
 exports.updatePhoneNumber = updatePhoneNumber;
 exports.updateProfile = updateProfile;
 exports.useDeviceLanguage = useDeviceLanguage;
+exports.validatePassword = validatePassword;
 exports.verifyBeforeUpdateEmail = verifyBeforeUpdateEmail;
 exports.verifyPasswordResetCode = verifyPasswordResetCode;
-//# sourceMappingURL=phone-2132481b.js.map
+//# sourceMappingURL=phone-e617de09.js.map