@firebase/auth 1.1.0 → 1.2.0-canary.cc77a2a19

package/dist/node-esm/{totp-04ac595e.js → totp-495080fc.js}

@@ -104,6 +104,46 @@ const ActionCodeOperation = {
     VERIFY_EMAIL: 'VERIFY_EMAIL'
 };
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function isEnterprise(grecaptcha) {
+    return (grecaptcha !== undefined &&
+        grecaptcha.enterprise !== undefined);
+}
+class RecaptchaConfig {
+    constructor(response) {
+        /**
+         * The reCAPTCHA site key.
+         */
+        this.siteKey = '';
+        /**
+         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
+         */
+        this.emailPasswordEnabled = false;
+        if (response.recaptchaKey === undefined) {
+            throw new Error('recaptchaKey undefined');
+        }
+        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
+        this.siteKey = response.recaptchaKey.split('/')[3];
+        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(enforcementState => enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
+            enforcementState.enforcementState !== 'OFF');
+    }
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -274,7 +314,9 @@ function _debugErrorMap() {
         ["missing-client-type" /* AuthErrorCode.MISSING_CLIENT_TYPE */]: 'The reCAPTCHA client type is missing when sending request to the backend.',
         ["missing-recaptcha-version" /* AuthErrorCode.MISSING_RECAPTCHA_VERSION */]: 'The reCAPTCHA version is missing when sending request to the backend.',
         ["invalid-req-type" /* AuthErrorCode.INVALID_REQ_TYPE */]: 'Invalid request parameters.',
-        ["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */]: 'The reCAPTCHA version is invalid when sending request to the backend.'
+        ["invalid-recaptcha-version" /* AuthErrorCode.INVALID_RECAPTCHA_VERSION */]: 'The reCAPTCHA version is invalid when sending request to the backend.',
+        ["unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */]: 'The password policy received from the backend uses a schema version that is not supported by this version of the Firebase SDK.',
+        ["password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */]: 'The password does not meet the requirements.'
     };
 }
 function _prodErrorMap() {
@@ -778,6 +820,7 @@ const SERVER_ERROR_MAP = {
     ["USER_NOT_FOUND" /* ServerError.USER_NOT_FOUND */]: "user-token-expired" /* AuthErrorCode.TOKEN_EXPIRED */,
     // Other errors.
     ["TOO_MANY_ATTEMPTS_TRY_LATER" /* ServerError.TOO_MANY_ATTEMPTS_TRY_LATER */]: "too-many-requests" /* AuthErrorCode.TOO_MANY_ATTEMPTS_TRY_LATER */,
+    ["PASSWORD_DOES_NOT_MEET_REQUIREMENTS" /* ServerError.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */]: "password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */,
     // Phone Auth related errors.
     ["INVALID_CODE" /* ServerError.INVALID_CODE */]: "invalid-verification-code" /* AuthErrorCode.INVALID_CODE */,
     ["INVALID_SESSION_INFO" /* ServerError.INVALID_SESSION_INFO */]: "invalid-verification-id" /* AuthErrorCode.INVALID_SESSION_INFO */,
@@ -962,6 +1005,26 @@ function _makeTaggedError(auth, code, response) {
     return error;
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+async function getRecaptchaConfig(auth, request) {
+    return _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request));
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -2080,7 +2143,7 @@ function _getClientVersion(clientPlatform, frameworks = []) {
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2022 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2094,13 +2157,74 @@ function _getClientVersion(clientPlatform, frameworks = []) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-async function getRecaptchaConfig(auth, request) {
-    return _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/recaptchaConfig" /* Endpoint.GET_RECAPTCHA_CONFIG */, _addTidIfNecessary(auth, request));
+class AuthMiddlewareQueue {
+    constructor(auth) {
+        this.auth = auth;
+        this.queue = [];
+    }
+    pushCallback(callback, onAbort) {
+        // The callback could be sync or async. Wrap it into a
+        // function that is always async.
+        const wrappedCallback = (user) => new Promise((resolve, reject) => {
+            try {
+                const result = callback(user);
+                // Either resolve with existing promise or wrap a non-promise
+                // return value into a promise.
+                resolve(result);
+            }
+            catch (e) {
+                // Sync callback throws.
+                reject(e);
+            }
+        });
+        // Attach the onAbort if present
+        wrappedCallback.onAbort = onAbort;
+        this.queue.push(wrappedCallback);
+        const index = this.queue.length - 1;
+        return () => {
+            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
+            // indexing of other elements.
+            this.queue[index] = () => Promise.resolve();
+        };
+    }
+    async runMiddleware(nextUser) {
+        if (this.auth.currentUser === nextUser) {
+            return;
+        }
+        // While running the middleware, build a temporary stack of onAbort
+        // callbacks to call if one middleware callback rejects.
+        const onAbortStack = [];
+        try {
+            for (const beforeStateCallback of this.queue) {
+                await beforeStateCallback(nextUser);
+                // Only push the onAbort if the callback succeeds
+                if (beforeStateCallback.onAbort) {
+                    onAbortStack.push(beforeStateCallback.onAbort);
+                }
+            }
+        }
+        catch (e) {
+            // Run all onAbort, with separate try/catch to ignore any errors and
+            // continue
+            onAbortStack.reverse();
+            for (const onAbort of onAbortStack) {
+                try {
+                    onAbort();
+                }
+                catch (_) {
+                    /* swallow error */
+                }
+            }
+            throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
+                originalMessage: e === null || e === void 0 ? void 0 : e.message
+            });
+        }
+    }
 }
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2114,33 +2238,20 @@ async function getRecaptchaConfig(auth, request) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function isEnterprise(grecaptcha) {
-    return (grecaptcha !== undefined &&
-        grecaptcha.enterprise !== undefined);
-}
-class RecaptchaConfig {
-    constructor(response) {
-        /**
-         * The reCAPTCHA site key.
-         */
-        this.siteKey = '';
-        /**
-         * The reCAPTCHA enablement status of the {@link EmailAuthProvider} for the current tenant.
-         */
-        this.emailPasswordEnabled = false;
-        if (response.recaptchaKey === undefined) {
-            throw new Error('recaptchaKey undefined');
-        }
-        // Example response.recaptchaKey: "projects/proj123/keys/sitekey123"
-        this.siteKey = response.recaptchaKey.split('/')[3];
-        this.emailPasswordEnabled = response.recaptchaEnforcementState.some(enforcementState => enforcementState.provider === 'EMAIL_PASSWORD_PROVIDER' &&
-            enforcementState.enforcementState !== 'OFF');
-    }
+/**
+ * Fetches the password policy for the currently set tenant or the project if no tenant is set.
+ *
+ * @param auth Auth object.
+ * @param request Password policy request.
+ * @returns Password policy response.
+ */
+async function _getPasswordPolicy(auth, request = {}) {
+    return _performApiRequest(auth, "GET" /* HttpMethod.GET */, "/v2/passwordPolicy" /* Endpoint.GET_PASSWORD_POLICY */, _addTidIfNecessary(auth, request));
 }
 
 /**
  * @license
- * Copyright 2020 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -2154,229 +2265,135 @@ class RecaptchaConfig {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function getScriptParentElement() {
-    var _a, _b;
-    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
-}
-function _loadJS(url) {
-    // TODO: consider adding timeout support & cancellation
-    return new Promise((resolve, reject) => {
-        const el = document.createElement('script');
-        el.setAttribute('src', url);
-        el.onload = resolve;
-        el.onerror = e => {
-            const error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
-            error.customData = e;
-            reject(error);
+// Minimum min password length enforced by the backend, even if no minimum length is set.
+const MINIMUM_MIN_PASSWORD_LENGTH = 6;
+/**
+ * Stores password policy requirements and provides password validation against the policy.
+ *
+ * @internal
+ */
+class PasswordPolicyImpl {
+    constructor(response) {
+        var _a, _b, _c, _d;
+        // Only include custom strength options defined in the response.
+        const responseOptions = response.customStrengthOptions;
+        this.customStrengthOptions = {};
+        // TODO: Remove once the backend is updated to include the minimum min password length instead of undefined when there is no minimum length set.
+        this.customStrengthOptions.minPasswordLength =
+            (_a = responseOptions.minPasswordLength) !== null && _a !== void 0 ? _a : MINIMUM_MIN_PASSWORD_LENGTH;
+        if (responseOptions.maxPasswordLength) {
+            this.customStrengthOptions.maxPasswordLength =
+                responseOptions.maxPasswordLength;
+        }
+        if (responseOptions.containsLowercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsLowercaseLetter =
+                responseOptions.containsLowercaseCharacter;
+        }
+        if (responseOptions.containsUppercaseCharacter !== undefined) {
+            this.customStrengthOptions.containsUppercaseLetter =
+                responseOptions.containsUppercaseCharacter;
+        }
+        if (responseOptions.containsNumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNumericCharacter =
+                responseOptions.containsNumericCharacter;
+        }
+        if (responseOptions.containsNonAlphanumericCharacter !== undefined) {
+            this.customStrengthOptions.containsNonAlphanumericCharacter =
+                responseOptions.containsNonAlphanumericCharacter;
+        }
+        this.enforcementState = response.enforcementState;
+        if (this.enforcementState === 'ENFORCEMENT_STATE_UNSPECIFIED') {
+            this.enforcementState = 'OFF';
+        }
+        // Use an empty string if no non-alphanumeric characters are specified in the response.
+        this.allowedNonAlphanumericCharacters =
+            (_c = (_b = response.allowedNonAlphanumericCharacters) === null || _b === void 0 ? void 0 : _b.join('')) !== null && _c !== void 0 ? _c : '';
+        this.forceUpgradeOnSignin = (_d = response.forceUpgradeOnSignin) !== null && _d !== void 0 ? _d : false;
+        this.schemaVersion = response.schemaVersion;
+    }
+    validatePassword(password) {
+        var _a, _b, _c, _d, _e, _f;
+        const status = {
+            isValid: true,
+            passwordPolicy: this
         };
-        el.type = 'text/javascript';
-        el.charset = 'UTF-8';
-        getScriptParentElement().appendChild(el);
-    });
-}
-
-/* eslint-disable @typescript-eslint/no-require-imports */
-const RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
-const RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
-const FAKE_TOKEN = 'NO_RECAPTCHA';
-class RecaptchaEnterpriseVerifier {
-    /**
-     *
-     * @param authExtern - The corresponding Firebase {@link Auth} instance.
-     *
-     */
-    constructor(authExtern) {
-        /**
-         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
-         */
-        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
-        this.auth = _castAuth(authExtern);
+        // Check the password length and character options.
+        this.validatePasswordLengthOptions(password, status);
+        this.validatePasswordCharacterOptions(password, status);
+        // Combine the status into single isValid property.
+        status.isValid && (status.isValid = (_a = status.meetsMinPasswordLength) !== null && _a !== void 0 ? _a : true);
+        status.isValid && (status.isValid = (_b = status.meetsMaxPasswordLength) !== null && _b !== void 0 ? _b : true);
+        status.isValid && (status.isValid = (_c = status.containsLowercaseLetter) !== null && _c !== void 0 ? _c : true);
+        status.isValid && (status.isValid = (_d = status.containsUppercaseLetter) !== null && _d !== void 0 ? _d : true);
+        status.isValid && (status.isValid = (_e = status.containsNumericCharacter) !== null && _e !== void 0 ? _e : true);
+        status.isValid && (status.isValid = (_f = status.containsNonAlphanumericCharacter) !== null && _f !== void 0 ? _f : true);
+        return status;
     }
     /**
-     * Executes the verification process.
+     * Validates that the password meets the length options for the policy.
      *
-     * @returns A Promise for a token that can be used to assert the validity of a request.
+     * @param password Password to validate.
+     * @param status Validation status.
      */
-    async verify(action = 'verify', forceRefresh = false) {
-        async function retrieveSiteKey(auth) {
-            if (!forceRefresh) {
-                if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
-                    return auth._agentRecaptchaConfig.siteKey;
-                }
-                if (auth.tenantId != null &&
-                    auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
-                    return auth._tenantRecaptchaConfigs[auth.tenantId].siteKey;
-                }
-            }
-            return new Promise(async (resolve, reject) => {
-                getRecaptchaConfig(auth, {
-                    clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-                    version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-                })
-                    .then(response => {
-                    if (response.recaptchaKey === undefined) {
-                        reject(new Error('recaptcha Enterprise site key undefined'));
-                    }
-                    else {
-                        const config = new RecaptchaConfig(response);
-                        if (auth.tenantId == null) {
-                            auth._agentRecaptchaConfig = config;
-                        }
-                        else {
-                            auth._tenantRecaptchaConfigs[auth.tenantId] = config;
-                        }
-                        return resolve(config.siteKey);
-                    }
-                })
-                    .catch(error => {
-                    reject(error);
-                });
-            });
+    validatePasswordLengthOptions(password, status) {
+        const minPasswordLength = this.customStrengthOptions.minPasswordLength;
+        const maxPasswordLength = this.customStrengthOptions.maxPasswordLength;
+        if (minPasswordLength) {
+            status.meetsMinPasswordLength = password.length >= minPasswordLength;
         }
-        function retrieveRecaptchaToken(siteKey, resolve, reject) {
-            const grecaptcha = window.grecaptcha;
-            if (isEnterprise(grecaptcha)) {
-                grecaptcha.enterprise.ready(() => {
-                    grecaptcha.enterprise
-                        .execute(siteKey, { action })
-                        .then(token => {
-                        resolve(token);
-                    })
-                        .catch(() => {
-                        resolve(FAKE_TOKEN);
-                    });
-                });
-            }
-            else {
-                reject(Error('No reCAPTCHA enterprise script loaded.'));
-            }
+        if (maxPasswordLength) {
+            status.meetsMaxPasswordLength = password.length <= maxPasswordLength;
         }
-        return new Promise((resolve, reject) => {
-            retrieveSiteKey(this.auth)
-                .then(siteKey => {
-                if (!forceRefresh && isEnterprise(window.grecaptcha)) {
-                    retrieveRecaptchaToken(siteKey, resolve, reject);
-                }
-                else {
-                    if (typeof window === 'undefined') {
-                        reject(new Error('RecaptchaVerifier is only supported in browser'));
-                        return;
-                    }
-                    _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
-                        .then(() => {
-                        retrieveRecaptchaToken(siteKey, resolve, reject);
-                    })
-                        .catch(error => {
-                        reject(error);
-                    });
-                }
-            })
-                .catch(error => {
-                reject(error);
-            });
-        });
     }
-}
-async function injectRecaptchaFields(auth, request, action, captchaResp = false) {
-    const verifier = new RecaptchaEnterpriseVerifier(auth);
-    let captchaResponse;
-    try {
-        captchaResponse = await verifier.verify(action);
-    }
-    catch (error) {
-        captchaResponse = await verifier.verify(action, true);
-    }
-    const newRequest = Object.assign({}, request);
-    if (!captchaResp) {
-        Object.assign(newRequest, { captchaResponse });
-    }
-    else {
-        Object.assign(newRequest, { 'captchaResp': captchaResponse });
-    }
-    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
-    Object.assign(newRequest, {
-        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-    });
-    return newRequest;
-}
-
-/**
- * @license
- * Copyright 2022 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-class AuthMiddlewareQueue {
-    constructor(auth) {
-        this.auth = auth;
-        this.queue = [];
-    }
-    pushCallback(callback, onAbort) {
-        // The callback could be sync or async. Wrap it into a
-        // function that is always async.
-        const wrappedCallback = (user) => new Promise((resolve, reject) => {
-            try {
-                const result = callback(user);
-                // Either resolve with existing promise or wrap a non-promise
-                // return value into a promise.
-                resolve(result);
-            }
-            catch (e) {
-                // Sync callback throws.
-                reject(e);
-            }
-        });
-        // Attach the onAbort if present
-        wrappedCallback.onAbort = onAbort;
-        this.queue.push(wrappedCallback);
-        const index = this.queue.length - 1;
-        return () => {
-            // Unsubscribe. Replace with no-op. Do not remove from array, or it will disturb
-            // indexing of other elements.
-            this.queue[index] = () => Promise.resolve();
-        };
+    /**
+     * Validates that the password meets the character options for the policy.
+     *
+     * @param password Password to validate.
+     * @param status Validation status.
+     */
+    validatePasswordCharacterOptions(password, status) {
+        // Assign statuses for requirements even if the password is an empty string.
+        this.updatePasswordCharacterOptionsStatuses(status, 
+        /* containsLowercaseCharacter= */ false, 
+        /* containsUppercaseCharacter= */ false, 
+        /* containsNumericCharacter= */ false, 
+        /* containsNonAlphanumericCharacter= */ false);
+        let passwordChar;
+        for (let i = 0; i < password.length; i++) {
+            passwordChar = password.charAt(i);
+            this.updatePasswordCharacterOptionsStatuses(status, 
+            /* containsLowercaseCharacter= */ passwordChar >= 'a' &&
+                passwordChar <= 'z', 
+            /* containsUppercaseCharacter= */ passwordChar >= 'A' &&
+                passwordChar <= 'Z', 
+            /* containsNumericCharacter= */ passwordChar >= '0' &&
+                passwordChar <= '9', 
+            /* containsNonAlphanumericCharacter= */ this.allowedNonAlphanumericCharacters.includes(passwordChar));
+        }
     }
-    async runMiddleware(nextUser) {
-        if (this.auth.currentUser === nextUser) {
-            return;
+    /**
+     * Updates the running validation status with the statuses for the character options.
+     * Expected to be called each time a character is processed to update each option status
+     * based on the current character.
+     *
+     * @param status Validation status.
+     * @param containsLowercaseCharacter Whether the character is a lowercase letter.
+     * @param containsUppercaseCharacter Whether the character is an uppercase letter.
+     * @param containsNumericCharacter Whether the character is a numeric character.
+     * @param containsNonAlphanumericCharacter Whether the character is a non-alphanumeric character.
+     */
+    updatePasswordCharacterOptionsStatuses(status, containsLowercaseCharacter, containsUppercaseCharacter, containsNumericCharacter, containsNonAlphanumericCharacter) {
+        if (this.customStrengthOptions.containsLowercaseLetter) {
+            status.containsLowercaseLetter || (status.containsLowercaseLetter = containsLowercaseCharacter);
         }
-        // While running the middleware, build a temporary stack of onAbort
-        // callbacks to call if one middleware callback rejects.
-        const onAbortStack = [];
-        try {
-            for (const beforeStateCallback of this.queue) {
-                await beforeStateCallback(nextUser);
-                // Only push the onAbort if the callback succeeds
-                if (beforeStateCallback.onAbort) {
-                    onAbortStack.push(beforeStateCallback.onAbort);
-                }
-            }
+        if (this.customStrengthOptions.containsUppercaseLetter) {
+            status.containsUppercaseLetter || (status.containsUppercaseLetter = containsUppercaseCharacter);
         }
-        catch (e) {
-            // Run all onAbort, with separate try/catch to ignore any errors and
-            // continue
-            onAbortStack.reverse();
-            for (const onAbort of onAbortStack) {
-                try {
-                    onAbort();
-                }
-                catch (_) {
-                    /* swallow error */
-                }
-            }
-            throw this.auth._errorFactory.create("login-blocked" /* AuthErrorCode.LOGIN_BLOCKED */, {
-                originalMessage: e === null || e === void 0 ? void 0 : e.message
-            });
+        if (this.customStrengthOptions.containsNumericCharacter) {
+            status.containsNumericCharacter || (status.containsNumericCharacter = containsNumericCharacter);
+        }
+        if (this.customStrengthOptions.containsNonAlphanumericCharacter) {
+            status.containsNonAlphanumericCharacter || (status.containsNonAlphanumericCharacter = containsNonAlphanumericCharacter);
         }
     }
 }
@@ -2411,6 +2428,7 @@ class AuthImpl {
         this.beforeStateQueue = new AuthMiddlewareQueue(this);
         this.redirectUser = null;
         this.isProactiveRefreshEnabled = false;
+        this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION = 1;
         // Any network calls will set this to true and prevent subsequent emulator
         // initialization
         this._canInitEmulator = true;
@@ -2421,6 +2439,8 @@ class AuthImpl {
         this._errorFactory = _DEFAULT_AUTH_ERROR_FACTORY;
         this._agentRecaptchaConfig = null;
         this._tenantRecaptchaConfigs = {};
+        this._projectPasswordPolicy = null;
+        this._tenantPasswordPolicies = {};
         // Tracks the last notified UID for state change listeners to prevent
         // repeated calls to the callbacks. Undefined means it's never been
         // called, whereas null means it's been called with a signed out user
@@ -2640,29 +2660,44 @@ class AuthImpl {
             await this.assertedPersistence.setPersistence(_getInstance(persistence));
         });
     }
-    async initializeRecaptchaConfig() {
-        const response = await getRecaptchaConfig(this, {
-            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
-            version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
-        });
-        const config = new RecaptchaConfig(response);
+    _getRecaptchaConfig() {
         if (this.tenantId == null) {
-            this._agentRecaptchaConfig = config;
+            return this._agentRecaptchaConfig;
         }
         else {
-            this._tenantRecaptchaConfigs[this.tenantId] = config;
+            return this._tenantRecaptchaConfigs[this.tenantId];
+        }
+    }
+    async validatePassword(password) {
+        if (!this._getPasswordPolicyInternal()) {
+            await this._updatePasswordPolicy();
         }
-        if (config.emailPasswordEnabled) {
-            const verifier = new RecaptchaEnterpriseVerifier(this);
-            void verifier.verify();
+        // Password policy will be defined after fetching.
+        const passwordPolicy = this._getPasswordPolicyInternal();
+        // Check that the policy schema version is supported by the SDK.
+        // TODO: Update this logic to use a max supported policy schema version once we have multiple schema versions.
+        if (passwordPolicy.schemaVersion !==
+            this.EXPECTED_PASSWORD_POLICY_SCHEMA_VERSION) {
+            return Promise.reject(this._errorFactory.create("unsupported-password-policy-schema-version" /* AuthErrorCode.UNSUPPORTED_PASSWORD_POLICY_SCHEMA_VERSION */, {}));
         }
+        return passwordPolicy.validatePassword(password);
     }
-    _getRecaptchaConfig() {
-        if (this.tenantId == null) {
-            return this._agentRecaptchaConfig;
+    _getPasswordPolicyInternal() {
+        if (this.tenantId === null) {
+            return this._projectPasswordPolicy;
         }
         else {
-            return this._tenantRecaptchaConfigs[this.tenantId];
+            return this._tenantPasswordPolicies[this.tenantId];
+        }
+    }
+    async _updatePasswordPolicy() {
+        const response = await _getPasswordPolicy(this);
+        const passwordPolicy = new PasswordPolicyImpl(response);
+        if (this.tenantId === null) {
+            this._projectPasswordPolicy = passwordPolicy;
+        }
+        else {
+            this._tenantPasswordPolicies[this.tenantId] = passwordPolicy;
         }
     }
     _getPersistence() {
@@ -2783,18 +2818,32 @@ class AuthImpl {
         const cb = typeof nextOrObserver === 'function'
             ? nextOrObserver
             : nextOrObserver.next.bind(nextOrObserver);
+        let isUnsubscribed = false;
         const promise = this._isInitialized
             ? Promise.resolve()
             : this._initializationPromise;
         _assert(promise, this, "internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
         // The callback needs to be called asynchronously per the spec.
         // eslint-disable-next-line @typescript-eslint/no-floating-promises
-        promise.then(() => cb(this.currentUser));
+        promise.then(() => {
+            if (isUnsubscribed) {
+                return;
+            }
+            cb(this.currentUser);
+        });
         if (typeof nextOrObserver === 'function') {
-            return subscription.addObserver(nextOrObserver, error, completed);
+            const unsubscribe = subscription.addObserver(nextOrObserver, error, completed);
+            return () => {
+                isUnsubscribed = true;
+                unsubscribe();
+            };
         }
         else {
-            return subscription.addObserver(nextOrObserver);
+            const unsubscribe = subscription.addObserver(nextOrObserver);
+            return () => {
+                isUnsubscribed = true;
+                unsubscribe();
+            };
         }
     }
     /**
@@ -2900,6 +2949,186 @@ class Subscription {
     }
 }
 
+/**
+ * @license
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function getScriptParentElement() {
+    var _a, _b;
+    return (_b = (_a = document.getElementsByTagName('head')) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : document;
+}
+function _loadJS(url) {
+    // TODO: consider adding timeout support & cancellation
+    return new Promise((resolve, reject) => {
+        const el = document.createElement('script');
+        el.setAttribute('src', url);
+        el.onload = resolve;
+        el.onerror = e => {
+            const error = _createError("internal-error" /* AuthErrorCode.INTERNAL_ERROR */);
+            error.customData = e;
+            reject(error);
+        };
+        el.type = 'text/javascript';
+        el.charset = 'UTF-8';
+        getScriptParentElement().appendChild(el);
+    });
+}
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+const RECAPTCHA_ENTERPRISE_URL = 'https://www.google.com/recaptcha/enterprise.js?render=';
+const RECAPTCHA_ENTERPRISE_VERIFIER_TYPE = 'recaptcha-enterprise';
+const FAKE_TOKEN = 'NO_RECAPTCHA';
+class RecaptchaEnterpriseVerifier {
+    /**
+     *
+     * @param authExtern - The corresponding Firebase {@link Auth} instance.
+     *
+     */
+    constructor(authExtern) {
+        /**
+         * Identifies the type of application verifier (e.g. "recaptcha-enterprise").
+         */
+        this.type = RECAPTCHA_ENTERPRISE_VERIFIER_TYPE;
+        this.auth = _castAuth(authExtern);
+    }
+    /**
+     * Executes the verification process.
+     *
+     * @returns A Promise for a token that can be used to assert the validity of a request.
+     */
+    async verify(action = 'verify', forceRefresh = false) {
+        async function retrieveSiteKey(auth) {
+            if (!forceRefresh) {
+                if (auth.tenantId == null && auth._agentRecaptchaConfig != null) {
+                    return auth._agentRecaptchaConfig.siteKey;
+                }
+                if (auth.tenantId != null &&
+                    auth._tenantRecaptchaConfigs[auth.tenantId] !== undefined) {
+                    return auth._tenantRecaptchaConfigs[auth.tenantId].siteKey;
+                }
+            }
+            return new Promise(async (resolve, reject) => {
+                getRecaptchaConfig(auth, {
+                    clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+                    version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+                })
+                    .then(response => {
+                    if (response.recaptchaKey === undefined) {
+                        reject(new Error('recaptcha Enterprise site key undefined'));
+                    }
+                    else {
+                        const config = new RecaptchaConfig(response);
+                        if (auth.tenantId == null) {
+                            auth._agentRecaptchaConfig = config;
+                        }
+                        else {
+                            auth._tenantRecaptchaConfigs[auth.tenantId] = config;
+                        }
+                        return resolve(config.siteKey);
+                    }
+                })
+                    .catch(error => {
+                    reject(error);
+                });
+            });
+        }
+        function retrieveRecaptchaToken(siteKey, resolve, reject) {
+            const grecaptcha = window.grecaptcha;
+            if (isEnterprise(grecaptcha)) {
+                grecaptcha.enterprise.ready(() => {
+                    grecaptcha.enterprise
+                        .execute(siteKey, { action })
+                        .then(token => {
+                        resolve(token);
+                    })
+                        .catch(() => {
+                        resolve(FAKE_TOKEN);
+                    });
+                });
+            }
+            else {
+                reject(Error('No reCAPTCHA enterprise script loaded.'));
+            }
+        }
+        return new Promise((resolve, reject) => {
+            retrieveSiteKey(this.auth)
+                .then(siteKey => {
+                if (!forceRefresh && isEnterprise(window.grecaptcha)) {
+                    retrieveRecaptchaToken(siteKey, resolve, reject);
+                }
+                else {
+                    if (typeof window === 'undefined') {
+                        reject(new Error('RecaptchaVerifier is only supported in browser'));
+                        return;
+                    }
+                    _loadJS(RECAPTCHA_ENTERPRISE_URL + siteKey)
+                        .then(() => {
+                        retrieveRecaptchaToken(siteKey, resolve, reject);
+                    })
+                        .catch(error => {
+                        reject(error);
+                    });
+                }
+            })
+                .catch(error => {
+                reject(error);
+            });
+        });
+    }
+}
+async function injectRecaptchaFields(auth, request, action, captchaResp = false) {
+    const verifier = new RecaptchaEnterpriseVerifier(auth);
+    let captchaResponse;
+    try {
+        captchaResponse = await verifier.verify(action);
+    }
+    catch (error) {
+        captchaResponse = await verifier.verify(action, true);
+    }
+    const newRequest = Object.assign({}, request);
+    if (!captchaResp) {
+        Object.assign(newRequest, { captchaResponse });
+    }
+    else {
+        Object.assign(newRequest, { 'captchaResp': captchaResponse });
+    }
+    Object.assign(newRequest, { 'clientType': "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */ });
+    Object.assign(newRequest, {
+        'recaptchaVersion': "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+    });
+    return newRequest;
+}
+async function _initializeRecaptchaConfig(auth) {
+    const authInternal = _castAuth(auth);
+    const response = await getRecaptchaConfig(authInternal, {
+        clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */,
+        version: "RECAPTCHA_ENTERPRISE" /* RecaptchaVersion.ENTERPRISE */
+    });
+    const config = new RecaptchaConfig(response);
+    if (authInternal.tenantId == null) {
+        authInternal._agentRecaptchaConfig = config;
+    }
+    else {
+        authInternal._tenantRecaptchaConfigs[authInternal.tenantId] = config;
+    }
+    if (config.emailPasswordEnabled) {
+        const verifier = new RecaptchaEnterpriseVerifier(authInternal);
+        void verifier.verify();
+    }
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -5254,6 +5483,25 @@ function _setActionCodeSettingsOnRequest(auth, request, actionCodeSettings) {
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/**
+ * Updates the password policy cached in the {@link Auth} instance if a policy is already
+ * cached for the project or tenant.
+ *
+ * @remarks
+ * We only fetch the password policy if the password did not meet policy requirements and
+ * there is an existing policy cached. A developer must call validatePassword at least
+ * once for the cache to be automatically updated.
+ *
+ * @param auth - The {@link Auth} instance.
+ *
+ * @private
+ */
+async function recachePasswordPolicy(auth) {
+    const authInternal = _castAuth(auth);
+    if (authInternal._getPasswordPolicyInternal()) {
+        await authInternal._updatePasswordPolicy();
+    }
+}
 /**
  * Sends a password reset email to the given email address.
  *
@@ -5334,6 +5582,13 @@ async function confirmPasswordReset(auth, oobCode, newPassword) {
     await resetPassword(getModularInstance(auth), {
         oobCode,
         newPassword
+    })
+        .catch(async (error) => {
+        if (error.code ===
+            `auth/${"password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */}`) {
+            void recachePasswordPolicy(auth);
+        }
+        throw error;
     });
     // Do not return the email.
 }
@@ -5452,13 +5707,14 @@ async function createUserWithEmailAndPassword(auth, email, password) {
                 const requestWithRecaptcha = await injectRecaptchaFields(authInternal, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */);
                 return signUp(authInternal, requestWithRecaptcha);
             }
-            else {
-                return Promise.reject(error);
-            }
+            throw error;
         });
     }
     const response = await signUpResponse.catch(error => {
-        return Promise.reject(error);
+        if (error.code === `auth/${"password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */}`) {
+            void recachePasswordPolicy(auth);
+        }
+        throw error;
     });
     const userCredential = await UserCredentialImpl._fromIdTokenResponse(authInternal, "signIn" /* OperationType.SIGN_IN */, response);
     await authInternal._updateCurrentUser(userCredential.user);
@@ -5481,7 +5737,12 @@ async function createUserWithEmailAndPassword(auth, email, password) {
  * @public
  */
 function signInWithEmailAndPassword(auth, email, password) {
-    return signInWithCredential(getModularInstance(auth), EmailAuthProvider.credential(email, password));
+    return signInWithCredential(getModularInstance(auth), EmailAuthProvider.credential(email, password)).catch(async (error) => {
+        if (error.code === `auth/${"password-does-not-meet-requirements" /* AuthErrorCode.PASSWORD_DOES_NOT_MEET_REQUIREMENTS */}`) {
+            void recachePasswordPolicy(auth);
+        }
+        throw error;
+    });
 }
 
 /**
@@ -6096,8 +6357,34 @@ function setPersistence(auth, persistence) {
  * @public
  */
 function initializeRecaptchaConfig(auth) {
+    return _initializeRecaptchaConfig(auth);
+}
+/**
+ * Validates the password against the password policy configured for the project or tenant.
+ *
+ * @remarks
+ * If no tenant ID is set on the `Auth` instance, then this method will use the password
+ * policy configured for the project. Otherwise, this method will use the policy configured
+ * for the tenant. If a password policy has not been configured, then the default policy
+ * configured for all projects will be used.
+ *
+ * If an auth flow fails because a submitted password does not meet the password policy
+ * requirements and this method has previously been called, then this method will use the
+ * most recent policy available when called again.
+ *
+ * @example
+ * ```javascript
+ * validatePassword(auth, 'some-password');
+ * ```
+ *
+ * @param auth The {@link Auth} instance.
+ * @param password The password to validate.
+ *
+ * @public
+ */
+async function validatePassword(auth, password) {
     const authInternal = _castAuth(auth);
-    return authInternal.initializeRecaptchaConfig();
+    return authInternal.validatePassword(password);
 }
 /**
  * Adds an observer for changes to the signed-in user's ID token.
@@ -6428,7 +6715,7 @@ function multiFactor(user) {
 }
 
 var name = "@firebase/auth";
-var version = "1.1.0";
+var version = "1.2.0-canary.cc77a2a19";
 
 /**
  * @license
@@ -6837,5 +7124,5 @@ function _isEmptyString(input) {
     return typeof input === 'undefined' || (input === null || input === void 0 ? void 0 : input.length) === 0;
 }
 
-export { signInWithCredential as $, ActionCodeOperation as A, signOut as B, deleteUser as C, debugErrorMap as D, prodErrorMap as E, FactorId as F, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as G, initializeAuth as H, connectAuthEmulator as I, AuthCredential as J, EmailAuthCredential as K, OAuthCredential as L, PhoneAuthCredential as M, inMemoryPersistence as N, OperationType as O, PhoneAuthProvider as P, EmailAuthProvider as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, FacebookAuthProvider as U, GoogleAuthProvider as V, GithubAuthProvider as W, OAuthProvider as X, SAMLAuthProvider as Y, TwitterAuthProvider as Z, signInAnonymously as _, browserSessionPersistence as a, linkWithCredential as a0, reauthenticateWithCredential as a1, signInWithCustomToken as a2, sendPasswordResetEmail as a3, confirmPasswordReset as a4, applyActionCode as a5, checkActionCode as a6, verifyPasswordResetCode as a7, createUserWithEmailAndPassword as a8, signInWithEmailAndPassword as a9, _persistenceKeyName as aA, _castAuth as aB, FederatedAuthProvider as aC, BaseOAuthProvider as aD, _emulatorUrl as aE, _performApiRequest as aF, _isIOS as aG, _isAndroid as aH, _isIOS7Or8 as aI, _createError as aJ, _isIframe as aK, _isMobileBrowser as aL, _isIE10 as aM, _isSafari as aN, UserImpl as aO, AuthImpl as aP, _getClientVersion as aQ, FetchProvider as aR, SAMLAuthCredential as aS, sendSignInLinkToEmail as aa, isSignInWithEmailLink as ab, signInWithEmailLink as ac, fetchSignInMethodsForEmail as ad, sendEmailVerification as ae, verifyBeforeUpdateEmail as af, ActionCodeURL as ag, parseActionCodeURL as ah, updateProfile as ai, updateEmail as aj, updatePassword as ak, getIdToken as al, getIdTokenResult as am, unlink as an, getAdditionalUserInfo as ao, reload as ap, getMultiFactorResolver as aq, multiFactor as ar, _getInstance as as, _assert as at, _signInWithCredential as au, _reauthenticate as av, _link as aw, signInWithIdp as ax, _fail as ay, debugAssert as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, initializeRecaptchaConfig as t, updatePhoneNumber as u, onIdTokenChanged as v, beforeAuthStateChanged as w, onAuthStateChanged as x, useDeviceLanguage as y, updateCurrentUser as z };
-//# sourceMappingURL=totp-04ac595e.js.map
+export { signInAnonymously as $, ActionCodeOperation as A, updateCurrentUser as B, signOut as C, deleteUser as D, debugErrorMap as E, FactorId as F, prodErrorMap as G, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as H, initializeAuth as I, connectAuthEmulator as J, AuthCredential as K, EmailAuthCredential as L, OAuthCredential as M, PhoneAuthCredential as N, OperationType as O, PhoneAuthProvider as P, inMemoryPersistence as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, EmailAuthProvider as U, FacebookAuthProvider as V, GoogleAuthProvider as W, GithubAuthProvider as X, OAuthProvider as Y, SAMLAuthProvider as Z, TwitterAuthProvider as _, browserSessionPersistence as a, signInWithCredential as a0, linkWithCredential as a1, reauthenticateWithCredential as a2, signInWithCustomToken as a3, sendPasswordResetEmail as a4, confirmPasswordReset as a5, applyActionCode as a6, checkActionCode as a7, verifyPasswordResetCode as a8, createUserWithEmailAndPassword as a9, debugAssert as aA, _persistenceKeyName as aB, _castAuth as aC, FederatedAuthProvider as aD, BaseOAuthProvider as aE, _emulatorUrl as aF, _performApiRequest as aG, _isIOS as aH, _isAndroid as aI, _isIOS7Or8 as aJ, _createError as aK, _isIframe as aL, _isMobileBrowser as aM, _isIE10 as aN, _isSafari as aO, UserImpl as aP, AuthImpl as aQ, _getClientVersion as aR, FetchProvider as aS, SAMLAuthCredential as aT, signInWithEmailAndPassword as aa, sendSignInLinkToEmail as ab, isSignInWithEmailLink as ac, signInWithEmailLink as ad, fetchSignInMethodsForEmail as ae, sendEmailVerification as af, verifyBeforeUpdateEmail as ag, ActionCodeURL as ah, parseActionCodeURL as ai, updateProfile as aj, updateEmail as ak, updatePassword as al, getIdToken as am, getIdTokenResult as an, unlink as ao, getAdditionalUserInfo as ap, reload as aq, getMultiFactorResolver as ar, multiFactor as as, _getInstance as at, _assert as au, _signInWithCredential as av, _reauthenticate as aw, _link as ax, signInWithIdp as ay, _fail as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, initializeRecaptchaConfig as t, updatePhoneNumber as u, validatePassword as v, onIdTokenChanged as w, beforeAuthStateChanged as x, onAuthStateChanged as y, useDeviceLanguage as z };
+//# sourceMappingURL=totp-495080fc.js.map