@firebase/auth 1.7.1-canary.e1a7764cf → 1.7.1-passkey-preview.103ead202

package/dist/browser-cjs/{index-b554a82d.js → index-763ce1de.js}

@@ -1471,7 +1471,8 @@ async function _reloadWithoutSaving(user) {
         tenantId: coreAccount.tenantId || null,
         providerData,
         metadata: new UserMetadata(coreAccount.createdAt, coreAccount.lastLoginAt),
-        isAnonymous
+        isAnonymous,
+        enrolledPasskeys: coreAccount.passkeyInfo || []
     };
     Object.assign(user, updates);
 }
@@ -1703,6 +1704,9 @@ class UserImpl {
         this.isAnonymous = opt.isAnonymous || false;
         this.tenantId = opt.tenantId || null;
         this.providerData = opt.providerData ? [...opt.providerData] : [];
+        this.enrolledPasskeys = opt.enrolledPasskeys
+            ? [...opt.enrolledPasskeys]
+            : [];
         this.metadata = new UserMetadata(opt.createdAt || undefined, opt.lastLoginAt || undefined);
     }
     async getIdToken(forceRefresh) {
@@ -1734,6 +1738,7 @@ class UserImpl {
         this.isAnonymous = user.isAnonymous;
         this.tenantId = user.tenantId;
         this.providerData = user.providerData.map(userInfo => (Object.assign({}, userInfo)));
+        this.enrolledPasskeys = user.enrolledPasskeys.map(passkeyInfo => (Object.assign({}, passkeyInfo)));
         this.metadata._copy(user.metadata);
         this.stsTokenManager._assign(user.stsTokenManager);
     }
@@ -5741,8 +5746,7 @@ async function recachePasswordPolicy(auth) {
 /**
  * Sends a password reset email to the given email address. This method does not throw an error when
  * there's no user account with the given email address and
- * {@link https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection | Email Enumeration Protection}
- * is enabled.
+ * [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled.
  *
  * @remarks
  * To complete the password reset, call {@link confirmPasswordReset} with the code supplied in
@@ -5931,10 +5935,9 @@ async function createUserWithEmailAndPassword(auth, email, password) {
  * Asynchronously signs in using an email and password.
  *
  * @remarks
- * Fails with an error if the email address and password do not match. When
- * {@link https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection | Email Enumeration Protection}
- * is enabled, this method fails with "auth/invalid-credential" in case of an invalid
- * email/password.
+ * Fails with an error if the email address and password do not match.
+ * When [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled,
+ * this method fails with "auth/invalid-credential" in case of an invalid email/password.
  *
  * This method is not supported on {@link Auth} instances created with a
  * {@link @firebase/app#FirebaseServerApp}.
@@ -6135,9 +6138,8 @@ async function createAuthUri(auth, request) {
  */
 /**
  * Gets the list of possible sign in methods for the given email address. This method returns an
- * empty list when
- * {@link https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection | Email Enumeration Protection}
- * is enabled, irrespective of the number of authentication methods available for the given email.
+ * empty list when [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled, irrespective of the number of
+ * authentication methods available for the given email.
  *
  * @remarks
  * This is useful to differentiate methods of sign-in for the same provider, eg.
@@ -6149,8 +6151,7 @@ async function createAuthUri(auth, request) {
  * @param email - The user's email address.
  *
  * Deprecated. Migrating off of this method is recommended as a security best-practice.
- * Learn more in the Identity Platform documentation for
- * {@link https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection | Email Enumeration Protection}.
+ * Learn more in the Identity Platform documentation for [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection).
  * @public
  */
 async function fetchSignInMethodsForEmail(auth, email) {
@@ -6263,6 +6264,248 @@ async function verifyBeforeUpdateEmail(user, newEmail, actionCodeSettings) {
     }
 }
 
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function publicKeyCredentialToJSON(pubKeyCred) {
+    // Convert ArrayBuffer to Base64
+    function bufferToBase64(buffer) {
+        const byteArray = Array.from(new Uint8Array(buffer));
+        return btoa(String.fromCharCode.apply(null, byteArray));
+    }
+    const clientDataJSON = bufferToBase64(pubKeyCred.response.clientDataJSON);
+    let result = {};
+    // Handle Attestation Response (Registration)
+    if (pubKeyCred.response instanceof AuthenticatorAttestationResponse) {
+        const attestationObject = bufferToBase64(pubKeyCred.response.attestationObject);
+        result = {
+            id: pubKeyCred.id,
+            type: pubKeyCred.type,
+            rawId: bufferToBase64(pubKeyCred.rawId),
+            response: {
+                clientDataJSON,
+                attestationObject
+            }
+        };
+    }
+    // Handle Assertion Response (Authentication)
+    if (pubKeyCred.response instanceof AuthenticatorAssertionResponse) {
+        const authenticatorData = bufferToBase64(pubKeyCred.response.authenticatorData);
+        const signature = bufferToBase64(pubKeyCred.response.signature);
+        const userHandle = pubKeyCred.response.userHandle
+            ? bufferToBase64(pubKeyCred.response.userHandle)
+            : undefined;
+        result = {
+            id: pubKeyCred.id,
+            type: pubKeyCred.type,
+            rawId: bufferToBase64(pubKeyCred.rawId),
+            response: {
+                clientDataJSON,
+                authenticatorData,
+                signature,
+                userHandle
+            }
+        };
+    }
+    return result;
+}
+async function startPasskeyEnrollment(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/passkeyEnrollment:start" /* Endpoint.START_PASSKEY_ENROLLMENT */, _addTidIfNecessary(auth, request));
+}
+async function finalizePasskeyEnrollment(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/passkeyEnrollment:finalize" /* Endpoint.FINALIZE_PASSKEY_ENROLLMENT */, _addTidIfNecessary(auth, request));
+}
+async function startPasskeySignIn(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/passkeySignIn:start" /* Endpoint.START_PASSKEY_SIGNIN */, _addTidIfNecessary(auth, request));
+}
+async function finalizePasskeySignIn(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/passkeySignIn:finalize" /* Endpoint.FINALIZE_PASSKEY_SIGNIN */, _addTidIfNecessary(auth, request));
+}
+async function passkeyUnenroll(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v1/accounts:update" /* Endpoint.SET_ACCOUNT_INFO */, request);
+}
+
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const DEFAULT_PASSKEY_ACCOUNT_NAME = 'Unnamed account (Web)';
+const PASSKEY_LOOK_UP_ERROR_MESSAGE = 'The operation either timed out or was not allowed.';
+/**
+ * Signs in a user with a passkey. Use enrollPasskey to enroll a passkey credential for the current user.
+ * @param auth - The Firebase Auth instance.
+ * @param name - The user's name for passkey.
+ * @param manualSignUp - When false, automatically creates an anonymous user if a passkey credential does not exist. Defaults to false.
+ * @returns A promise that resolves with a `UserCredential` object.
+ */
+async function signInWithPasskey(auth, name, manualSignUp = false) {
+    const authInternal = _castAuth(auth);
+    // Start Passkey Sign in
+    const startSignInRequest = {};
+    const startSignInResponse = await startPasskeySignIn(authInternal, startSignInRequest);
+    const options = getPasskeyCredentialRequestOptions(startSignInResponse, name);
+    // Get the credential
+    let credential;
+    try {
+        credential = (await navigator.credentials.get({
+            publicKey: options
+        }));
+        const finalizeSignInRequest = {
+            authenticatorAuthenticationResponse: publicKeyCredentialToJSON(credential),
+            name,
+            displayName: name
+        };
+        const finalizeSignInResponse = await finalizePasskeySignIn(authInternal, finalizeSignInRequest);
+        const operationType = "signIn" /* OperationType.SIGN_IN */;
+        const userCredential = await UserCredentialImpl._fromIdTokenResponse(authInternal, operationType, finalizeSignInResponse);
+        await auth.updateCurrentUser(userCredential.user);
+        return userCredential;
+    }
+    catch (error) {
+        if (error.message.includes(PASSKEY_LOOK_UP_ERROR_MESSAGE) &&
+            !manualSignUp) {
+            // If the user is not signed up, sign them up anonymously
+            const userCredential = await signInAnonymously(authInternal);
+            const user = userCredential.user;
+            return enrollPasskey(user, name);
+        }
+        return Promise.reject(error);
+    }
+}
+/**
+ * Enrolls a passkey for the user account.
+ * @param user - The user to enroll the passkey for.
+ * @param name - The name associated with the passkey.
+ * @returns A promise that resolves with a `UserCredential` object.
+ * @public
+ */
+async function enrollPasskey(user, name) {
+    const userInternal = util.getModularInstance(user);
+    const authInternal = _castAuth(userInternal.auth);
+    if (name === '') {
+        name = DEFAULT_PASSKEY_ACCOUNT_NAME;
+    }
+    // Start Passkey Enrollment
+    const idToken = await userInternal.getIdToken();
+    const startEnrollmentRequest = {
+        idToken
+    };
+    const startEnrollmentResponse = await startPasskeyEnrollment(authInternal, startEnrollmentRequest);
+    // Create the crendential
+    try {
+        const options = getPasskeyCredentialCreationOptions(startEnrollmentResponse, name);
+        const credential = (await navigator.credentials.create({
+            publicKey: options
+        }));
+        const idToken = await userInternal.getIdToken();
+        const finalizeEnrollmentRequest = {
+            idToken,
+            authenticatorRegistrationResponse: publicKeyCredentialToJSON(credential),
+            name,
+            displayName: name
+        };
+        const finalizeEnrollmentResponse = await finalizePasskeyEnrollment(authInternal, finalizeEnrollmentRequest);
+        // The passkey provider is linked with the user's current providers.
+        const operationType = "link" /* OperationType.LINK */;
+        const userCredential = await UserCredentialImpl._fromIdTokenResponse(userInternal.auth, operationType, finalizeEnrollmentResponse);
+        return userCredential;
+    }
+    catch (err) {
+        return Promise.reject(err);
+    }
+}
+/**
+ * Unenrolls the passkey corresponding to the specified credentialId.
+ * @param user - The user to unenroll the passkey for.
+ * @param credentialId - The ID of the passkey to unenroll.
+ * @returns A promise that resolves when the passkey is successfully unenrolled.
+ * @public
+ */
+async function unenrollPasskey(user, credentialId) {
+    const userInternal = util.getModularInstance(user);
+    const authInternal = _castAuth(userInternal.auth);
+    const idToken = await userInternal.getIdToken();
+    const request = {
+        idToken,
+        deletePasskey: [credentialId]
+    };
+    await passkeyUnenroll(authInternal, request);
+}
+// Converts an array of credential IDs of `excludeCredentials` field to an array of `PublicKeyCredentialDescriptor` objects.
+function convertExcludeCredentials(options) {
+    function base64ToBuffer(base64) {
+        const binaryStr = atob(base64);
+        const len = binaryStr.length;
+        const bytes = new Uint8Array(len);
+        for (let i = 0; i < len; i++) {
+            bytes[i] = binaryStr.charCodeAt(i);
+        }
+        return bytes.buffer;
+    }
+    if ('excludeCredentials' in options && options.excludeCredentials) {
+        for (const cred of options.excludeCredentials) {
+            if (typeof cred.id === 'string') {
+                // Assuming Base64 encoded strings
+                cred.id = base64ToBuffer(cred.id);
+            }
+        }
+    }
+}
+function getPasskeyCredentialCreationOptions(response, name = '') {
+    const options = response.credentialCreationOptions;
+    if (name === '') {
+        name = 'Unnamed account (Web)';
+    }
+    options.user.name = name;
+    options.user.displayName = name;
+    const userId = options.user.id;
+    options.user.id = Uint8Array.from(atob(userId), c => c.charCodeAt(0));
+    const rpId = window.location.hostname;
+    options.rp.id = rpId;
+    options.rp.name = rpId;
+    const challengeBase64 = options.challenge;
+    options.challenge = Uint8Array.from(atob(challengeBase64), c => c.charCodeAt(0));
+    convertExcludeCredentials(options);
+    return options;
+}
+function getPasskeyCredentialRequestOptions(response, name = '') {
+    const options = response.credentialRequestOptions;
+    if (name === '') {
+        name = 'Unnamed account (Web)';
+    }
+    const rpId = window.location.hostname;
+    options.rpId = rpId;
+    const challengeBase64 = options.challenge;
+    options.challenge = Uint8Array.from(atob(challengeBase64), c => c.charCodeAt(0));
+    convertExcludeCredentials(options);
+    return options;
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -6347,9 +6590,7 @@ async function updateProfile(user, { displayName, photoURL: photoUrl }) {
  * @param user - The user.
  * @param newEmail - The new email address.
  *
- * Throws "auth/operation-not-allowed" error when
- * {@link https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection | Email Enumeration Protection}
- * is enabled.
+ * Throws "auth/operation-not-allowed" error when [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection) is enabled.
  * Deprecated - Use {@link verifyBeforeUpdateEmail} instead.
  *
  * @public
@@ -10470,7 +10711,7 @@ function _isEmptyString(input) {
 }
 
 var name = "@firebase/auth";
-var version = "1.7.1-canary.e1a7764cf";
+var version = "1.7.1-passkey-preview.103ead202";
 
 /**
  * @license
@@ -10781,6 +11022,7 @@ exports.createUserWithEmailAndPassword = createUserWithEmailAndPassword;
 exports.debugAssert = debugAssert;
 exports.debugErrorMap = debugErrorMap;
 exports.deleteUser = deleteUser;
+exports.enrollPasskey = enrollPasskey;
 exports.fetchSignInMethodsForEmail = fetchSignInMethodsForEmail;
 exports.getAdditionalUserInfo = getAdditionalUserInfo;
 exports.getAuth = getAuth;
@@ -10817,10 +11059,12 @@ exports.signInWithCredential = signInWithCredential;
 exports.signInWithCustomToken = signInWithCustomToken;
 exports.signInWithEmailAndPassword = signInWithEmailAndPassword;
 exports.signInWithEmailLink = signInWithEmailLink;
+exports.signInWithPasskey = signInWithPasskey;
 exports.signInWithPhoneNumber = signInWithPhoneNumber;
 exports.signInWithPopup = signInWithPopup;
 exports.signInWithRedirect = signInWithRedirect;
 exports.signOut = signOut;
+exports.unenrollPasskey = unenrollPasskey;
 exports.unlink = unlink;
 exports.updateCurrentUser = updateCurrentUser;
 exports.updateEmail = updateEmail;
@@ -10831,4 +11075,4 @@ exports.useDeviceLanguage = useDeviceLanguage;
 exports.validatePassword = validatePassword;
 exports.verifyBeforeUpdateEmail = verifyBeforeUpdateEmail;
 exports.verifyPasswordResetCode = verifyPasswordResetCode;
-//# sourceMappingURL=index-b554a82d.js.map
+//# sourceMappingURL=index-763ce1de.js.map