@firebase/auth 1.3.2 → 1.4.0-canary.00235ba68

package/dist/cordova/{popup_redirect-a9365a6c.js → popup_redirect-599b3914.js}

@@ -990,7 +990,7 @@ function _debugErrorMap() {
         _a["invalid-emulator-scheme" /* AuthErrorCode.INVALID_EMULATOR_SCHEME */] = 'Emulator URL must start with a valid scheme (http:// or https://).',
         _a["invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */] = 'Your API key is invalid, please check you have copied it correctly.',
         _a["invalid-cert-hash" /* AuthErrorCode.INVALID_CERT_HASH */] = 'The SHA-1 certificate hash provided is invalid.',
-        _a["invalid-credential" /* AuthErrorCode.INVALID_IDP_RESPONSE */] = 'The supplied auth credential is malformed or has expired.',
+        _a["invalid-credential" /* AuthErrorCode.INVALID_CREDENTIAL */] = 'The supplied auth credential is incorrect, malformed or has expired.',
         _a["invalid-message-payload" /* AuthErrorCode.INVALID_MESSAGE_PAYLOAD */] = 'The email template corresponding to this action contains invalid characters in its message. ' +
             'Please fix by going to the Auth email templates section in the Firebase Console.',
         _a["invalid-multi-factor-session" /* AuthErrorCode.INVALID_MFA_SESSION */] = 'The request does not contain a valid proof of first factor successful sign-in.',
@@ -1167,6 +1167,7 @@ var AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
     INVALID_EMAIL: 'auth/invalid-email',
     INVALID_EMULATOR_SCHEME: 'auth/invalid-emulator-scheme',
     INVALID_IDP_RESPONSE: 'auth/invalid-credential',
+    INVALID_LOGIN_CREDENTIALS: 'auth/invalid-credential',
     INVALID_MESSAGE_PAYLOAD: 'auth/invalid-message-payload',
     INVALID_MFA_SESSION: 'auth/invalid-multi-factor-session',
     INVALID_OAUTH_CLIENT_ID: 'auth/invalid-oauth-client-id',
@@ -1632,12 +1633,15 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     _a$1["INVALID_PASSWORD" /* ServerError.INVALID_PASSWORD */] = "wrong-password" /* AuthErrorCode.INVALID_PASSWORD */,
     // This can only happen if the SDK sends a bad request.
     _a$1["MISSING_PASSWORD" /* ServerError.MISSING_PASSWORD */] = "missing-password" /* AuthErrorCode.MISSING_PASSWORD */,
+    // Thrown if Email Enumeration Protection is enabled in the project and the email or password is
+    // invalid.
+    _a$1["INVALID_LOGIN_CREDENTIALS" /* ServerError.INVALID_LOGIN_CREDENTIALS */] = "invalid-credential" /* AuthErrorCode.INVALID_CREDENTIAL */,
     // Sign up with email and password errors.
     _a$1["EMAIL_EXISTS" /* ServerError.EMAIL_EXISTS */] = "email-already-in-use" /* AuthErrorCode.EMAIL_EXISTS */,
     _a$1["PASSWORD_LOGIN_DISABLED" /* ServerError.PASSWORD_LOGIN_DISABLED */] = "operation-not-allowed" /* AuthErrorCode.OPERATION_NOT_ALLOWED */,
     // Verify assertion for sign in with credential errors:
-    _a$1["INVALID_IDP_RESPONSE" /* ServerError.INVALID_IDP_RESPONSE */] = "invalid-credential" /* AuthErrorCode.INVALID_IDP_RESPONSE */,
-    _a$1["INVALID_PENDING_TOKEN" /* ServerError.INVALID_PENDING_TOKEN */] = "invalid-credential" /* AuthErrorCode.INVALID_IDP_RESPONSE */,
+    _a$1["INVALID_IDP_RESPONSE" /* ServerError.INVALID_IDP_RESPONSE */] = "invalid-credential" /* AuthErrorCode.INVALID_CREDENTIAL */,
+    _a$1["INVALID_PENDING_TOKEN" /* ServerError.INVALID_PENDING_TOKEN */] = "invalid-credential" /* AuthErrorCode.INVALID_CREDENTIAL */,
     _a$1["FEDERATED_USER_ID_ALREADY_LINKED" /* ServerError.FEDERATED_USER_ID_ALREADY_LINKED */] = "credential-already-in-use" /* AuthErrorCode.CREDENTIAL_ALREADY_IN_USE */,
     // This can only happen if the SDK sends a bad request.
     _a$1["MISSING_REQ_TYPE" /* ServerError.MISSING_REQ_TYPE */] = "internal-error" /* AuthErrorCode.INTERNAL_ERROR */,
@@ -1659,7 +1663,7 @@ var SERVER_ERROR_MAP = (_a$1 = {},
     // Phone Auth related errors.
     _a$1["INVALID_CODE" /* ServerError.INVALID_CODE */] = "invalid-verification-code" /* AuthErrorCode.INVALID_CODE */,
     _a$1["INVALID_SESSION_INFO" /* ServerError.INVALID_SESSION_INFO */] = "invalid-verification-id" /* AuthErrorCode.INVALID_SESSION_INFO */,
-    _a$1["INVALID_TEMPORARY_PROOF" /* ServerError.INVALID_TEMPORARY_PROOF */] = "invalid-credential" /* AuthErrorCode.INVALID_IDP_RESPONSE */,
+    _a$1["INVALID_TEMPORARY_PROOF" /* ServerError.INVALID_TEMPORARY_PROOF */] = "invalid-credential" /* AuthErrorCode.INVALID_CREDENTIAL */,
     _a$1["MISSING_SESSION_INFO" /* ServerError.MISSING_SESSION_INFO */] = "missing-verification-id" /* AuthErrorCode.MISSING_SESSION_INFO */,
     _a$1["SESSION_EXPIRED" /* ServerError.SESSION_EXPIRED */] = "code-expired" /* AuthErrorCode.CODE_EXPIRED */,
     // Other action code errors when additional settings passed.
@@ -2543,6 +2547,13 @@ function requestStsToken(auth, refreshToken) {
             }
         });
     });
+}
+function revokeToken(auth, request) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts:revokeToken" /* Endpoint.REVOKE_TOKEN */, _addTidIfNecessary(auth, request))];
+        });
+    });
 }
 
 /**
@@ -4145,6 +4156,37 @@ var AuthImpl = /** @class */ (function () {
             }
         });
     };
+    /**
+     * Revokes the given access token. Currently only supports Apple OAuth access tokens.
+     */
+    AuthImpl.prototype.revokeAccessToken = function (token) {
+        return __awaiter(this, void 0, void 0, function () {
+            var idToken, request;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!this.currentUser) return [3 /*break*/, 3];
+                        return [4 /*yield*/, this.currentUser.getIdToken()];
+                    case 1:
+                        idToken = _a.sent();
+                        request = {
+                            providerId: 'apple.com',
+                            tokenType: "ACCESS_TOKEN" /* TokenType.ACCESS_TOKEN */,
+                            token: token,
+                            idToken: idToken
+                        };
+                        if (this.tenantId != null) {
+                            request.tenantId = this.tenantId;
+                        }
+                        return [4 /*yield*/, revokeToken(this, request)];
+                    case 2:
+                        _a.sent();
+                        _a.label = 3;
+                    case 3: return [2 /*return*/];
+                }
+            });
+        });
+    };
     AuthImpl.prototype.toJSON = function () {
         var _a;
         return {
@@ -4988,6 +5030,15 @@ function updateEmailPassword(auth, request) {
         });
     });
 }
+// Used for linking an email/password account to an existing idToken. Uses the same request/response
+// format as updateEmailPassword.
+function linkEmailPassword(auth, request) {
+    return __awaiter(this, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            return [2 /*return*/, _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v1/accounts:signUp" /* Endpoint.SIGN_UP */, request)];
+        });
+    });
+}
 function applyActionCode$1(auth, request) {
     return __awaiter(this, void 0, void 0, function () {
         return __generator(this, function (_a) {
@@ -5196,15 +5247,18 @@ var EmailAuthCredential = /** @class */ (function (_super) {
     /** @internal */
     EmailAuthCredential.prototype._linkToIdToken = function (auth, idToken) {
         return __awaiter(this, void 0, void 0, function () {
+            var request;
             return __generator(this, function (_a) {
                 switch (this.signInMethod) {
                     case "password" /* SignInMethod.EMAIL_PASSWORD */:
-                        return [2 /*return*/, updateEmailPassword(auth, {
-                                idToken: idToken,
-                                returnSecureToken: true,
-                                email: this._email,
-                                password: this._password
-                            })];
+                        request = {
+                            idToken: idToken,
+                            returnSecureToken: true,
+                            email: this._email,
+                            password: this._password,
+                            clientType: "CLIENT_TYPE_WEB" /* RecaptchaClientType.WEB */
+                        };
+                        return [2 /*return*/, handleRecaptchaFlow(auth, request, "signUpPassword" /* RecaptchaActionName.SIGN_UP_PASSWORD */, linkEmailPassword)];
                     case "emailLink" /* SignInMethod.EMAIL_LINK */:
                         return [2 /*return*/, signInWithEmailLinkForLinking(auth, {
                                 idToken: idToken,
@@ -7374,7 +7428,9 @@ function recachePasswordPolicy(auth) {
     });
 }
 /**
- * Sends a password reset email to the given email address.
+ * Sends a password reset email to the given email address. This method does not throw an error when
+ * there's no user account with the given email address and
+ * [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled.
  *
  * @remarks
  * To complete the password reset, call {@link confirmPasswordReset} with the code supplied in
@@ -7615,6 +7671,8 @@ function createUserWithEmailAndPassword(auth, email, password) {
  *
  * @remarks
  * Fails with an error if the email address and password do not match.
+ * When [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled,
+ * this method fails with "auth/invalid-credential" in case of an invalid email/password.
  *
  * Note: The user's password is NOT the password used to access the user's email account. The
  * email address serves as a unique identifier for the user, and the password is used to access
@@ -7823,7 +7881,9 @@ function createAuthUri(auth, request) {
  * limitations under the License.
  */
 /**
- * Gets the list of possible sign in methods for the given email address.
+ * Gets the list of possible sign in methods for the given email address. This method returns an
+ * empty list when [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled, irrespective of the number of
+ * authentication methods available for the given email.
  *
  * @remarks
  * This is useful to differentiate methods of sign-in for the same provider, eg.
@@ -7834,6 +7894,8 @@ function createAuthUri(auth, request) {
  * @param auth - The {@link Auth} instance.
  * @param email - The user's email address.
  *
+ * Deprecated. Migrating off of this method is recommended as a security best-practice.
+ * Learn more in the Identity Platform documentation for [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection).
  * @public
  */
 function fetchSignInMethodsForEmail(auth, email) {
@@ -8088,6 +8150,9 @@ function updateProfile(user, _a) {
  * @param user - The user.
  * @param newEmail - The new email address.
  *
+ * Throws "auth/operation-not-allowed" error when [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled.
+ * Deprecated - Use {@link verifyBeforeUpdateEmail} instead.
+ *
  * @public
  */
 function updateEmail(user, newEmail) {
@@ -8465,6 +8530,18 @@ function updateCurrentUser(auth, user) {
 function signOut(auth) {
     return getModularInstance(auth).signOut();
 }
+/**
+ * Revokes the given access token. Currently only supports Apple OAuth access tokens.
+ *
+ * @param auth - The {@link Auth} instance.
+ * @param token - The Apple OAuth access token.
+ *
+ * @public
+ */
+function revokeAccessToken(auth, token) {
+    var authInternal = _castAuth(auth);
+    return authInternal.revokeAccessToken(token);
+}
 /**
  * Deletes and signs out the user.
  *
@@ -8794,7 +8871,7 @@ function multiFactor(user) {
 }
 
 var name = "@firebase/auth";
-var version = "1.3.2";
+var version = "1.4.0-canary.00235ba68";
 
 /**
  * @license
@@ -10997,5 +11074,5 @@ function generateNoEvent() {
     };
 }
 
-export { sendSignInLinkToEmail as $, ActionCodeOperation as A, inMemoryPersistence as B, EmailAuthProvider as C, FacebookAuthProvider as D, EmailAuthCredential as E, FactorId as F, GoogleAuthProvider as G, GithubAuthProvider as H, OAuthProvider as I, SAMLAuthProvider as J, signInAnonymously as K, signInWithCredential as L, linkWithCredential as M, reauthenticateWithCredential as N, OperationType as O, ProviderId as P, signInWithCustomToken as Q, sendPasswordResetEmail as R, SignInMethod as S, TwitterAuthProvider as T, confirmPasswordReset as U, applyActionCode as V, checkActionCode as W, verifyPasswordResetCode as X, createUserWithEmailAndPassword as Y, signInWithEmailAndPassword as Z, _signInWithRedirect as _, _reauthenticateWithRedirect as a, _getClientVersion as a$, isSignInWithEmailLink as a0, signInWithEmailLink as a1, fetchSignInMethodsForEmail as a2, sendEmailVerification as a3, verifyBeforeUpdateEmail as a4, ActionCodeURL as a5, parseActionCodeURL as a6, updateProfile as a7, updateEmail as a8, updatePassword as a9, AbstractPopupRedirectOperation as aA, _assertInstanceOf as aB, _withDefaultResolver as aC, FederatedAuthProvider as aD, _fail as aE, _getProjectConfig as aF, _getCurrentUrl as aG, _emulatorUrl as aH, _isChromeIOS as aI, _isFirefox as aJ, _isIOSStandalone as aK, _getRedirectUrl as aL, _setWindowLocation as aM, _isMobileBrowser as aN, _isSafari as aO, _isIOS as aP, _getRedirectResult as aQ, _overrideRedirectResult as aR, AuthEventManager as aS, debugFail as aT, finalizeEnrollPhoneMfa as aU, finalizeEnrollTotpMfa as aV, startEnrollTotpMfa as aW, _persistenceKeyName as aX, UserImpl as aY, _getInstance as aZ, AuthImpl as a_, getIdToken as aa, getIdTokenResult as ab, unlink as ac, getAdditionalUserInfo as ad, reload as ae, getMultiFactorResolver as af, multiFactor as ag, _performApiRequest as ah, _addTidIfNecessary as ai, _assert as aj, Delay as ak, _window as al, isV2 as am, _createError as an, _loadJS as ao, _generateCallbackName as ap, getRecaptchaParams as aq, _isHttpOrHttps as ar, _isWorker as as, _castAuth as at, _assertLinkedStatus as au, sendPhoneVerificationCode as av, startEnrollPhoneMfa as aw, _link$1 as ax, debugAssert as ay, _generateEventId as az, _linkWithRedirect as b, FetchProvider as b0, SAMLAuthCredential as b1, signInWithRedirect as b2, linkWithRedirect as b3, reauthenticateWithRedirect as b4, indexedDBLocalPersistence as c, cordovaPopupRedirectResolver as d, browserLocalPersistence as e, browserSessionPersistence as f, getRedirectResult as g, initializeRecaptchaConfig as h, initializeAuth as i, beforeAuthStateChanged as j, onAuthStateChanged as k, updateCurrentUser as l, signOut as m, deleteUser as n, onIdTokenChanged as o, debugErrorMap as p, prodErrorMap as q, registerAuth as r, setPersistence as s, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as t, useDeviceLanguage as u, validatePassword as v, connectAuthEmulator as w, AuthCredential as x, OAuthCredential as y, PhoneAuthCredential as z };
-//# sourceMappingURL=popup_redirect-a9365a6c.js.map
+export { signInWithEmailAndPassword as $, ActionCodeOperation as A, PhoneAuthCredential as B, inMemoryPersistence as C, EmailAuthProvider as D, EmailAuthCredential as E, FactorId as F, FacebookAuthProvider as G, GoogleAuthProvider as H, GithubAuthProvider as I, OAuthProvider as J, SAMLAuthProvider as K, signInAnonymously as L, signInWithCredential as M, linkWithCredential as N, OperationType as O, ProviderId as P, reauthenticateWithCredential as Q, signInWithCustomToken as R, SignInMethod as S, TwitterAuthProvider as T, sendPasswordResetEmail as U, confirmPasswordReset as V, applyActionCode as W, checkActionCode as X, verifyPasswordResetCode as Y, createUserWithEmailAndPassword as Z, _signInWithRedirect as _, _reauthenticateWithRedirect as a, AuthImpl as a$, sendSignInLinkToEmail as a0, isSignInWithEmailLink as a1, signInWithEmailLink as a2, fetchSignInMethodsForEmail as a3, sendEmailVerification as a4, verifyBeforeUpdateEmail as a5, ActionCodeURL as a6, parseActionCodeURL as a7, updateProfile as a8, updateEmail as a9, _generateEventId as aA, AbstractPopupRedirectOperation as aB, _assertInstanceOf as aC, _withDefaultResolver as aD, FederatedAuthProvider as aE, _fail as aF, _getProjectConfig as aG, _getCurrentUrl as aH, _emulatorUrl as aI, _isChromeIOS as aJ, _isFirefox as aK, _isIOSStandalone as aL, _getRedirectUrl as aM, _setWindowLocation as aN, _isMobileBrowser as aO, _isSafari as aP, _isIOS as aQ, _getRedirectResult as aR, _overrideRedirectResult as aS, AuthEventManager as aT, debugFail as aU, finalizeEnrollPhoneMfa as aV, finalizeEnrollTotpMfa as aW, startEnrollTotpMfa as aX, _persistenceKeyName as aY, UserImpl as aZ, _getInstance as a_, updatePassword as aa, getIdToken as ab, getIdTokenResult as ac, unlink as ad, getAdditionalUserInfo as ae, reload as af, getMultiFactorResolver as ag, multiFactor as ah, _performApiRequest as ai, _addTidIfNecessary as aj, _assert as ak, Delay as al, _window as am, isV2 as an, _createError as ao, _loadJS as ap, _generateCallbackName as aq, getRecaptchaParams as ar, _isHttpOrHttps as as, _isWorker as at, _castAuth as au, _assertLinkedStatus as av, sendPhoneVerificationCode as aw, startEnrollPhoneMfa as ax, _link$1 as ay, debugAssert as az, _linkWithRedirect as b, _getClientVersion as b0, FetchProvider as b1, SAMLAuthCredential as b2, signInWithRedirect as b3, linkWithRedirect as b4, reauthenticateWithRedirect as b5, indexedDBLocalPersistence as c, cordovaPopupRedirectResolver as d, browserLocalPersistence as e, browserSessionPersistence as f, getRedirectResult as g, initializeRecaptchaConfig as h, initializeAuth as i, beforeAuthStateChanged as j, onAuthStateChanged as k, updateCurrentUser as l, signOut as m, revokeAccessToken as n, onIdTokenChanged as o, deleteUser as p, debugErrorMap as q, registerAuth as r, setPersistence as s, prodErrorMap as t, useDeviceLanguage as u, validatePassword as v, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as w, connectAuthEmulator as x, AuthCredential as y, OAuthCredential as z };
+//# sourceMappingURL=popup_redirect-599b3914.js.map