@firebase/auth 1.9.1 → 1.10.0-auth-redirect-credentials.82faa0828

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (130) hide show
  1. package/dist/auth-public.d.ts +28 -1
  2. package/dist/auth.d.ts +40 -2
  3. package/dist/browser-cjs/{index-018c7ebd.js → index-d5da52c1.js} +215 -16
  4. package/dist/browser-cjs/index-d5da52c1.js.map +1 -0
  5. package/dist/browser-cjs/index.d.ts +2 -1
  6. package/dist/browser-cjs/index.js +2 -1
  7. package/dist/browser-cjs/index.js.map +1 -1
  8. package/dist/browser-cjs/internal.js +2 -1
  9. package/dist/browser-cjs/internal.js.map +1 -1
  10. package/dist/browser-cjs/src/api/index.d.ts +1 -1
  11. package/dist/browser-cjs/src/core/auth/auth_impl.d.ts +4 -1
  12. package/dist/browser-cjs/src/core/persistence/index.d.ts +2 -1
  13. package/dist/browser-cjs/src/model/auth.d.ts +4 -1
  14. package/dist/browser-cjs/src/model/public_types.d.ts +2 -1
  15. package/dist/browser-cjs/src/platform_browser/persistence/cookie_storage.d.ts +40 -0
  16. package/dist/browser-cjs/src/platform_node/index.d.ts +1 -0
  17. package/dist/cordova/auth-cordova-public.d.ts +26 -1
  18. package/dist/cordova/auth-cordova.d.ts +29 -2
  19. package/dist/cordova/index.d.ts +2 -1
  20. package/dist/cordova/index.js +2 -2
  21. package/dist/cordova/internal.js +147 -3
  22. package/dist/cordova/internal.js.map +1 -1
  23. package/dist/cordova/{popup_redirect-e795474a.js → popup_redirect-79d5de9a.js} +71 -17
  24. package/dist/cordova/popup_redirect-79d5de9a.js.map +1 -0
  25. package/dist/cordova/src/api/index.d.ts +1 -1
  26. package/dist/cordova/src/core/auth/auth_impl.d.ts +4 -1
  27. package/dist/cordova/src/core/persistence/index.d.ts +2 -1
  28. package/dist/cordova/src/model/auth.d.ts +4 -1
  29. package/dist/cordova/src/model/public_types.d.ts +2 -1
  30. package/dist/cordova/src/platform_browser/persistence/cookie_storage.d.ts +40 -0
  31. package/dist/cordova/src/platform_node/index.d.ts +1 -0
  32. package/dist/esm2017/{index-e84cf44d.js → index-fc6bc882.js} +216 -18
  33. package/dist/esm2017/index-fc6bc882.js.map +1 -0
  34. package/dist/esm2017/index.d.ts +2 -1
  35. package/dist/esm2017/index.js +1 -1
  36. package/dist/esm2017/internal.js +2 -2
  37. package/dist/esm2017/src/api/index.d.ts +1 -1
  38. package/dist/esm2017/src/core/auth/auth_impl.d.ts +4 -1
  39. package/dist/esm2017/src/core/persistence/index.d.ts +2 -1
  40. package/dist/esm2017/src/model/auth.d.ts +4 -1
  41. package/dist/esm2017/src/model/public_types.d.ts +2 -1
  42. package/dist/esm2017/src/platform_browser/persistence/cookie_storage.d.ts +40 -0
  43. package/dist/esm2017/src/platform_node/index.d.ts +1 -0
  44. package/dist/index.d.ts +2 -1
  45. package/dist/index.webworker.js +70 -16
  46. package/dist/index.webworker.js.map +1 -1
  47. package/dist/node/index.d.ts +2 -1
  48. package/dist/node/index.js +2 -1
  49. package/dist/node/index.js.map +1 -1
  50. package/dist/node/internal.js +2 -1
  51. package/dist/node/internal.js.map +1 -1
  52. package/dist/node/src/api/index.d.ts +1 -1
  53. package/dist/node/src/core/auth/auth_impl.d.ts +4 -1
  54. package/dist/node/src/core/persistence/index.d.ts +2 -1
  55. package/dist/node/src/model/auth.d.ts +4 -1
  56. package/dist/node/src/model/public_types.d.ts +2 -1
  57. package/dist/node/src/platform_browser/persistence/cookie_storage.d.ts +40 -0
  58. package/dist/node/src/platform_node/index.d.ts +1 -0
  59. package/dist/node/{totp-06fa6909.js → totp-88cb8aaf.js} +72 -16
  60. package/dist/node/totp-88cb8aaf.js.map +1 -0
  61. package/dist/node-esm/index.d.ts +2 -1
  62. package/dist/node-esm/index.js +1 -1
  63. package/dist/node-esm/internal.js +2 -2
  64. package/dist/node-esm/internal.js.map +1 -1
  65. package/dist/node-esm/src/api/index.d.ts +1 -1
  66. package/dist/node-esm/src/core/auth/auth_impl.d.ts +4 -1
  67. package/dist/node-esm/src/core/persistence/index.d.ts +2 -1
  68. package/dist/node-esm/src/model/auth.d.ts +4 -1
  69. package/dist/node-esm/src/model/public_types.d.ts +2 -1
  70. package/dist/node-esm/src/platform_browser/persistence/cookie_storage.d.ts +40 -0
  71. package/dist/node-esm/src/platform_node/index.d.ts +1 -0
  72. package/dist/node-esm/{totp-d5ff2369.js → totp-91f8ecc7.js} +73 -18
  73. package/dist/node-esm/totp-91f8ecc7.js.map +1 -0
  74. package/dist/rn/{index-ee081591.js → index-be8638d6.js} +70 -16
  75. package/dist/rn/index-be8638d6.js.map +1 -0
  76. package/dist/rn/index.d.ts +2 -1
  77. package/dist/rn/index.js +1 -1
  78. package/dist/rn/internal.js +146 -1
  79. package/dist/rn/internal.js.map +1 -1
  80. package/dist/rn/src/api/index.d.ts +1 -1
  81. package/dist/rn/src/core/auth/auth_impl.d.ts +4 -1
  82. package/dist/rn/src/core/persistence/index.d.ts +2 -1
  83. package/dist/rn/src/model/auth.d.ts +4 -1
  84. package/dist/rn/src/model/public_types.d.ts +2 -1
  85. package/dist/rn/src/platform_browser/persistence/cookie_storage.d.ts +40 -0
  86. package/dist/rn/src/platform_node/index.d.ts +1 -0
  87. package/dist/src/api/index.d.ts +1 -1
  88. package/dist/src/core/auth/auth_impl.d.ts +4 -1
  89. package/dist/src/core/persistence/index.d.ts +2 -1
  90. package/dist/src/model/auth.d.ts +4 -1
  91. package/dist/src/model/public_types.d.ts +2 -1
  92. package/dist/src/platform_browser/persistence/cookie_storage.d.ts +40 -0
  93. package/dist/src/platform_node/index.d.ts +1 -0
  94. package/dist/web-extension-cjs/index.d.ts +2 -1
  95. package/dist/web-extension-cjs/index.js +1 -1
  96. package/dist/web-extension-cjs/internal.js +146 -1
  97. package/dist/web-extension-cjs/internal.js.map +1 -1
  98. package/dist/web-extension-cjs/{register-c2c7670d.js → register-878ee631.js} +70 -16
  99. package/dist/web-extension-cjs/register-878ee631.js.map +1 -0
  100. package/dist/web-extension-cjs/src/api/index.d.ts +1 -1
  101. package/dist/web-extension-cjs/src/core/auth/auth_impl.d.ts +4 -1
  102. package/dist/web-extension-cjs/src/core/persistence/index.d.ts +2 -1
  103. package/dist/web-extension-cjs/src/model/auth.d.ts +4 -1
  104. package/dist/web-extension-cjs/src/model/public_types.d.ts +2 -1
  105. package/dist/web-extension-cjs/src/platform_browser/persistence/cookie_storage.d.ts +40 -0
  106. package/dist/web-extension-cjs/src/platform_node/index.d.ts +1 -0
  107. package/dist/web-extension-esm2017/auth-web-extension-public.d.ts +26 -1
  108. package/dist/web-extension-esm2017/auth-web-extension.d.ts +29 -2
  109. package/dist/web-extension-esm2017/index.d.ts +2 -1
  110. package/dist/web-extension-esm2017/index.js +2 -2
  111. package/dist/web-extension-esm2017/internal.js +147 -3
  112. package/dist/web-extension-esm2017/internal.js.map +1 -1
  113. package/dist/web-extension-esm2017/{register-31c228e4.js → register-59e2f235.js} +71 -17
  114. package/dist/web-extension-esm2017/register-59e2f235.js.map +1 -0
  115. package/dist/web-extension-esm2017/src/api/index.d.ts +1 -1
  116. package/dist/web-extension-esm2017/src/core/auth/auth_impl.d.ts +4 -1
  117. package/dist/web-extension-esm2017/src/core/persistence/index.d.ts +2 -1
  118. package/dist/web-extension-esm2017/src/model/auth.d.ts +4 -1
  119. package/dist/web-extension-esm2017/src/model/public_types.d.ts +2 -1
  120. package/dist/web-extension-esm2017/src/platform_browser/persistence/cookie_storage.d.ts +40 -0
  121. package/dist/web-extension-esm2017/src/platform_node/index.d.ts +1 -0
  122. package/package.json +8 -7
  123. package/dist/browser-cjs/index-018c7ebd.js.map +0 -1
  124. package/dist/cordova/popup_redirect-e795474a.js.map +0 -1
  125. package/dist/esm2017/index-e84cf44d.js.map +0 -1
  126. package/dist/node/totp-06fa6909.js.map +0 -1
  127. package/dist/node-esm/totp-d5ff2369.js.map +0 -1
  128. package/dist/rn/index-ee081591.js.map +0 -1
  129. package/dist/web-extension-cjs/register-c2c7670d.js.map +0 -1
  130. package/dist/web-extension-esm2017/register-31c228e4.js.map +0 -1
@@ -91,7 +91,7 @@ export declare function _addTidIfNecessary<T extends {
91
91
  export declare function _performApiRequest<T, V>(auth: Auth, method: HttpMethod, path: Endpoint, request?: T, customErrorMap?: Partial<ServerErrorMap<ServerError>>): Promise<V>;
92
92
  export declare function _performFetchWithErrorHandling<V>(auth: Auth, customErrorMap: Partial<ServerErrorMap<ServerError>>, fetchFn: () => Promise<Response>): Promise<V>;
93
93
  export declare function _performSignInRequest<T, V extends IdTokenResponse>(auth: Auth, method: HttpMethod, path: Endpoint, request?: T, customErrorMap?: Partial<ServerErrorMap<ServerError>>): Promise<V>;
94
- export declare function _getFinalTarget(auth: Auth, host: string, path: string, query: string): string;
94
+ export declare function _getFinalTarget(auth: Auth, host: string, path: string, query: string): Promise<string>;
95
95
  export declare function _parseEnforcementState(enforcementStateStr: string): EnforcementState;
96
96
  interface PotentialResponse extends IdTokenResponse {
97
97
  email?: string;
@@ -57,6 +57,8 @@ export declare class AuthImpl implements AuthInternal, _FirebaseService {
57
57
  _tenantRecaptchaConfigs: Record<string, RecaptchaConfig>;
58
58
  _projectPasswordPolicy: PasswordPolicyInternal | null;
59
59
  _tenantPasswordPolicies: Record<string, PasswordPolicyInternal>;
60
+ _resolvePersistenceManagerAvailable: ((value: void | PromiseLike<void>) => void) | undefined;
61
+ _persistenceManagerAvailable: Promise<void>;
60
62
  readonly name: string;
61
63
  private lastNotifiedUid;
62
64
  languageCode: string | null;
@@ -82,7 +84,8 @@ export declare class AuthImpl implements AuthInternal, _FirebaseService {
82
84
  validatePassword(password: string): Promise<PasswordValidationStatus>;
83
85
  _getPasswordPolicyInternal(): PasswordPolicyInternal | null;
84
86
  _updatePasswordPolicy(): Promise<void>;
85
- _getPersistence(): string;
87
+ _getPersistenceType(): string;
88
+ _getPersistence(): PersistenceInternal;
86
89
  _updateErrorMap(errorMap: AuthErrorMap): void;
87
90
  onAuthStateChanged(nextOrObserver: NextOrObserver<User>, error?: ErrorFn, completed?: CompleteFn): Unsubscribe;
88
91
  beforeAuthStateChanged(callback: (user: User | null) => void | Promise<void>, onAbort?: () => void): Unsubscribe;
@@ -18,7 +18,8 @@ import { Persistence } from '../../model/public_types';
18
18
  export declare const enum PersistenceType {
19
19
  SESSION = "SESSION",
20
20
  LOCAL = "LOCAL",
21
- NONE = "NONE"
21
+ NONE = "NONE",
22
+ COOKIE = "COOKIE"
22
23
  }
23
24
  export type PersistedBlob = Record<string, unknown>;
24
25
  export interface Instantiator<T> {
@@ -22,6 +22,7 @@ import { UserInternal } from './user';
22
22
  import { ClientPlatform } from '../core/util/version';
23
23
  import { RecaptchaConfig } from '../platform_browser/recaptcha/recaptcha';
24
24
  import { PasswordPolicyInternal } from './password_policy';
25
+ import { PersistenceInternal } from '../core/persistence';
25
26
  export type AppName = string;
26
27
  export type ApiKey = string;
27
28
  export type AuthDomain = string;
@@ -56,6 +57,7 @@ export interface AuthInternal extends Auth {
56
57
  _canInitEmulator: boolean;
57
58
  _isInitialized: boolean;
58
59
  _initializationPromise: Promise<void> | null;
60
+ _persistenceManagerAvailable: Promise<void>;
59
61
  _updateCurrentUser(user: UserInternal | null): Promise<void>;
60
62
  _onStorageEvent(): void;
61
63
  _notifyListenersIfCurrent(user: UserInternal): void;
@@ -66,7 +68,8 @@ export interface AuthInternal extends Auth {
66
68
  _key(): string;
67
69
  _startProactiveRefresh(): void;
68
70
  _stopProactiveRefresh(): void;
69
- _getPersistence(): string;
71
+ _getPersistenceType(): string;
72
+ _getPersistence(): PersistenceInternal;
70
73
  _getRecaptchaConfig(): RecaptchaConfig | null;
71
74
  _getPasswordPolicyInternal(): PasswordPolicyInternal | null;
72
75
  _updatePasswordPolicy(): Promise<void>;
@@ -305,8 +305,9 @@ export interface Persistence {
305
305
  * - 'SESSION' is used for temporary persistence such as `sessionStorage`.
306
306
  * - 'LOCAL' is used for long term persistence such as `localStorage` or `IndexedDB`.
307
307
  * - 'NONE' is used for in-memory, or no persistence.
308
+ * - 'COOKIE' is used for cookie persistence, useful for server-side rendering.
308
309
  */
309
- readonly type: 'SESSION' | 'LOCAL' | 'NONE';
310
+ readonly type: 'SESSION' | 'LOCAL' | 'NONE' | 'COOKIE';
310
311
  }
311
312
  /**
312
313
  * Interface representing ID token result obtained from {@link User.getIdTokenResult}.
@@ -0,0 +1,40 @@
1
+ /**
2
+ * @license
3
+ * Copyright 2025 Google LLC
4
+ *
5
+ * Licensed under the Apache License, Version 2.0 (the "License");
6
+ * you may not use this file except in compliance with the License.
7
+ * You may obtain a copy of the License at
8
+ *
9
+ * http://www.apache.org/licenses/LICENSE-2.0
10
+ *
11
+ * Unless required by applicable law or agreed to in writing, software
12
+ * distributed under the License is distributed on an "AS IS" BASIS,
13
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ * See the License for the specific language governing permissions and
15
+ * limitations under the License.
16
+ */
17
+ import { Persistence } from '../../model/public_types';
18
+ import { PersistenceInternal, PersistenceType, PersistenceValue, StorageEventListener } from '../../core/persistence';
19
+ export declare class CookiePersistence implements PersistenceInternal {
20
+ static type: 'COOKIE';
21
+ readonly type = PersistenceType.COOKIE;
22
+ listenerUnsubscribes: Map<StorageEventListener, () => void>;
23
+ _getFinalTarget(originalUrl: string): URL | string;
24
+ _isAvailable(): Promise<boolean>;
25
+ _set(_key: string, _value: PersistenceValue): Promise<void>;
26
+ _get<T extends PersistenceValue>(key: string): Promise<T | null>;
27
+ _remove(key: string): Promise<void>;
28
+ _addListener(key: string, listener: StorageEventListener): void;
29
+ _removeListener(_key: string, listener: StorageEventListener): void;
30
+ }
31
+ /**
32
+ * An implementation of {@link Persistence} of type `COOKIE`, for use on the client side in
33
+ * applications leveraging hybrid rendering and middleware.
34
+ *
35
+ * @remarks This persistence method requires companion middleware to function, such as that provided
36
+ * by {@link https://firebaseopensource.com/projects/firebaseextended/reactfire/ | ReactFire} for
37
+ * NextJS.
38
+ * @beta
39
+ */
40
+ export declare const browserCookiePersistence: Persistence;
@@ -28,6 +28,7 @@ declare class FailClass {
28
28
  }
29
29
  export declare const browserLocalPersistence: import("../model/public_types").Persistence;
30
30
  export declare const browserSessionPersistence: import("../model/public_types").Persistence;
31
+ export declare const browserCookiePersistence: import("../model/public_types").Persistence;
31
32
  export declare const indexedDBLocalPersistence: import("../model/public_types").Persistence;
32
33
  export declare const browserPopupRedirectResolver: import("@firebase/app").FirebaseError;
33
34
  export declare const PhoneAuthProvider: typeof FailClass;
@@ -1,5 +1,5 @@
1
1
  import { SDK_VERSION, _isFirebaseServerApp, _getProvider, _registerComponent, registerVersion, getApp } from '@firebase/app';
2
- import { ErrorFactory, isBrowserExtension, isMobileCordova, isReactNative, FirebaseError, querystring, isCloudflareWorker, getModularInstance, base64Decode, getUA, isIE, createSubscribe, deepEqual, querystringDecode, extractQuerystring, isEmpty, getExperimentalSetting, getDefaultEmulatorHost } from '@firebase/util';
2
+ import { ErrorFactory, isBrowserExtension, isMobileCordova, isReactNative, FirebaseError, querystring, isCloudflareWorker, isCloudWorkstation, getModularInstance, base64Decode, getUA, isIE, createSubscribe, deepEqual, querystringDecode, extractQuerystring, isEmpty, getExperimentalSetting, getDefaultEmulatorHost } from '@firebase/util';
3
3
  import { Logger, LogLevel } from '@firebase/logger';
4
4
  import { __rest } from 'tslib';
5
5
  import { Component } from '@firebase/component';
@@ -869,6 +869,14 @@ const SERVER_ERROR_MAP = {
869
869
  * See the License for the specific language governing permissions and
870
870
  * limitations under the License.
871
871
  */
872
+ const CookieAuthProxiedEndpoints = [
873
+ "/v1/accounts:signInWithCustomToken" /* Endpoint.SIGN_IN_WITH_CUSTOM_TOKEN */,
874
+ "/v1/accounts:signInWithEmailLink" /* Endpoint.SIGN_IN_WITH_EMAIL_LINK */,
875
+ "/v1/accounts:signInWithIdp" /* Endpoint.SIGN_IN_WITH_IDP */,
876
+ "/v1/accounts:signInWithPassword" /* Endpoint.SIGN_IN_WITH_PASSWORD */,
877
+ "/v1/accounts:signInWithPhoneNumber" /* Endpoint.SIGN_IN_WITH_PHONE_NUMBER */,
878
+ "/v1/token" /* Endpoint.TOKEN */
879
+ ];
872
880
  const DEFAULT_API_TIMEOUT_MS = new Delay(30000, 60000);
873
881
  function _addTidIfNecessary(auth, request) {
874
882
  if (auth.tenantId && !request.tenantId) {
@@ -905,7 +913,10 @@ async function _performApiRequest(auth, method, path, request, customErrorMap =
905
913
  if (!isCloudflareWorker()) {
906
914
  fetchArgs.referrerPolicy = 'no-referrer';
907
915
  }
908
- return FetchProvider.fetch()(_getFinalTarget(auth, auth.config.apiHost, path, query), fetchArgs);
916
+ if (auth.emulatorConfig && isCloudWorkstation(auth.emulatorConfig.host)) {
917
+ fetchArgs.credentials = 'include';
918
+ }
919
+ return FetchProvider.fetch()(await _getFinalTarget(auth, auth.config.apiHost, path, query), fetchArgs);
909
920
  });
910
921
  }
911
922
  async function _performFetchWithErrorHandling(auth, customErrorMap, fetchFn) {
@@ -970,12 +981,25 @@ async function _performSignInRequest(auth, method, path, request, customErrorMap
970
981
  }
971
982
  return serverResponse;
972
983
  }
973
- function _getFinalTarget(auth, host, path, query) {
984
+ async function _getFinalTarget(auth, host, path, query) {
974
985
  const base = `${host}${path}?${query}`;
975
- if (!auth.config.emulator) {
976
- return `${auth.config.apiScheme}://${base}`;
977
- }
978
- return _emulatorUrl(auth.config, base);
986
+ const authInternal = auth;
987
+ const finalTarget = authInternal.config.emulator
988
+ ? _emulatorUrl(auth.config, base)
989
+ : `${auth.config.apiScheme}://${base}`;
990
+ // Cookie auth works by MiTMing the signIn and token endpoints from the developer's backend,
991
+ // saving the idToken and refreshToken into cookies, and then redacting the refreshToken
992
+ // from the response
993
+ if (CookieAuthProxiedEndpoints.includes(path)) {
994
+ // Persistence manager is async, we need to await it. We can't just wait for auth initialized
995
+ // here since auth initialization calls this function.
996
+ await authInternal._persistenceManagerAvailable;
997
+ if (authInternal._getPersistenceType() === "COOKIE" /* PersistenceType.COOKIE */) {
998
+ const cookiePersistence = authInternal._getPersistence();
999
+ return cookiePersistence._getFinalTarget(finalTarget).toString();
1000
+ }
1001
+ }
1002
+ return finalTarget;
979
1003
  }
980
1004
  function _parseEnforcementState(enforcementStateStr) {
981
1005
  switch (enforcementStateStr) {
@@ -1551,7 +1575,7 @@ async function requestStsToken(auth, refreshToken) {
1551
1575
  'refresh_token': refreshToken
1552
1576
  }).slice(1);
1553
1577
  const { tokenApiHost, apiKey } = auth.config;
1554
- const url = _getFinalTarget(auth, tokenApiHost, "/v1/token" /* Endpoint.TOKEN */, `key=${apiKey}`);
1578
+ const url = await _getFinalTarget(auth, tokenApiHost, "/v1/token" /* Endpoint.TOKEN */, `key=${apiKey}`);
1555
1579
  const headers = await auth._getAdditionalHeaders();
1556
1580
  headers["Content-Type" /* HttpHeader.CONTENT_TYPE */] = 'application/x-www-form-urlencoded';
1557
1581
  return FetchProvider.fetch()(url, {
@@ -2042,7 +2066,17 @@ class PersistenceUserManager {
2042
2066
  }
2043
2067
  async getCurrentUser() {
2044
2068
  const blob = await this.persistence._get(this.fullUserKey);
2045
- return blob ? UserImpl._fromJSON(this.auth, blob) : null;
2069
+ if (!blob) {
2070
+ return null;
2071
+ }
2072
+ if (typeof blob === 'string') {
2073
+ const response = await getAccountInfo(this.auth, { idToken: blob }).catch(() => undefined);
2074
+ if (!response) {
2075
+ return null;
2076
+ }
2077
+ return UserImpl._fromGetAccountInfoResponse(this.auth, response, blob);
2078
+ }
2079
+ return UserImpl._fromJSON(this.auth, blob);
2046
2080
  }
2047
2081
  removeCurrentUser() {
2048
2082
  return this.persistence._remove(this.fullUserKey);
@@ -2089,7 +2123,19 @@ class PersistenceUserManager {
2089
2123
  try {
2090
2124
  const blob = await persistence._get(key);
2091
2125
  if (blob) {
2092
- const user = UserImpl._fromJSON(auth, blob); // throws for unparsable blob (wrong format)
2126
+ let user;
2127
+ if (typeof blob === 'string') {
2128
+ const response = await getAccountInfo(auth, {
2129
+ idToken: blob
2130
+ }).catch(() => undefined);
2131
+ if (!response) {
2132
+ break;
2133
+ }
2134
+ user = await UserImpl._fromGetAccountInfoResponse(auth, response, blob);
2135
+ }
2136
+ else {
2137
+ user = UserImpl._fromJSON(auth, blob); // throws for unparsable blob (wrong format)
2138
+ }
2093
2139
  if (persistence !== selectedPersistence) {
2094
2140
  userToMigrate = user;
2095
2141
  }
@@ -2587,6 +2633,7 @@ class AuthImpl {
2587
2633
  this._tenantRecaptchaConfigs = {};
2588
2634
  this._projectPasswordPolicy = null;
2589
2635
  this._tenantPasswordPolicies = {};
2636
+ this._resolvePersistenceManagerAvailable = undefined;
2590
2637
  // Tracks the last notified UID for state change listeners to prevent
2591
2638
  // repeated calls to the callbacks. Undefined means it's never been
2592
2639
  // called, whereas null means it's been called with a signed out user
@@ -2597,6 +2644,9 @@ class AuthImpl {
2597
2644
  this.frameworks = [];
2598
2645
  this.name = app.name;
2599
2646
  this.clientVersion = config.sdkClientVersion;
2647
+ // TODO(jamesdaniels) explore less hacky way to do this, cookie authentication needs
2648
+ // persistenceMananger to be available. see _getFinalTarget for more context
2649
+ this._persistenceManagerAvailable = new Promise(resolve => (this._resolvePersistenceManagerAvailable = resolve));
2600
2650
  }
2601
2651
  _initializeWithPersistence(persistenceHierarchy, popupRedirectResolver) {
2602
2652
  if (popupRedirectResolver) {
@@ -2605,17 +2655,18 @@ class AuthImpl {
2605
2655
  // Have to check for app deletion throughout initialization (after each
2606
2656
  // promise resolution)
2607
2657
  this._initializationPromise = this.queue(async () => {
2608
- var _a, _b;
2658
+ var _a, _b, _c;
2609
2659
  if (this._deleted) {
2610
2660
  return;
2611
2661
  }
2612
2662
  this.persistenceManager = await PersistenceUserManager.create(this, persistenceHierarchy);
2663
+ (_a = this._resolvePersistenceManagerAvailable) === null || _a === void 0 ? void 0 : _a.call(this);
2613
2664
  if (this._deleted) {
2614
2665
  return;
2615
2666
  }
2616
2667
  // Initialize the resolver early if necessary (only applicable to web:
2617
2668
  // this will cause the iframe to load immediately in certain cases)
2618
- if ((_a = this._popupRedirectResolver) === null || _a === void 0 ? void 0 : _a._shouldInitProactively) {
2669
+ if ((_b = this._popupRedirectResolver) === null || _b === void 0 ? void 0 : _b._shouldInitProactively) {
2619
2670
  // If this fails, don't halt auth loading
2620
2671
  try {
2621
2672
  await this._popupRedirectResolver._initialize(this);
@@ -2625,7 +2676,7 @@ class AuthImpl {
2625
2676
  }
2626
2677
  }
2627
2678
  await this.initializeCurrentUser(popupRedirectResolver);
2628
- this.lastNotifiedUid = ((_b = this.currentUser) === null || _b === void 0 ? void 0 : _b.uid) || null;
2679
+ this.lastNotifiedUid = ((_c = this.currentUser) === null || _c === void 0 ? void 0 : _c.uid) || null;
2629
2680
  if (this._deleted) {
2630
2681
  return;
2631
2682
  }
@@ -2879,9 +2930,12 @@ class AuthImpl {
2879
2930
  this._tenantPasswordPolicies[this.tenantId] = passwordPolicy;
2880
2931
  }
2881
2932
  }
2882
- _getPersistence() {
2933
+ _getPersistenceType() {
2883
2934
  return this.assertedPersistence.persistence.type;
2884
2935
  }
2936
+ _getPersistence() {
2937
+ return this.assertedPersistence.persistence;
2938
+ }
2885
2939
  _updateErrorMap(errorMap) {
2886
2940
  this._errorFactory = new ErrorFactory('auth', 'Firebase', errorMap());
2887
2941
  }
@@ -4446,7 +4500,7 @@ class ActionCodeURL {
4446
4500
  this.operation = operation;
4447
4501
  this.code = code;
4448
4502
  this.continueUrl = (_d = searchParams["continueUrl" /* QueryField.CONTINUE_URL */]) !== null && _d !== void 0 ? _d : null;
4449
- this.languageCode = (_e = searchParams["languageCode" /* QueryField.LANGUAGE_CODE */]) !== null && _e !== void 0 ? _e : null;
4503
+ this.languageCode = (_e = searchParams["lang" /* QueryField.LANGUAGE_CODE */]) !== null && _e !== void 0 ? _e : null;
4450
4504
  this.tenantId = (_f = searchParams["tenantId" /* QueryField.TENANT_ID */]) !== null && _f !== void 0 ? _f : null;
4451
4505
  }
4452
4506
  /**
@@ -7469,6 +7523,150 @@ BrowserLocalPersistence.type = 'LOCAL';
7469
7523
  */
7470
7524
  const browserLocalPersistence = BrowserLocalPersistence;
7471
7525
 
7526
+ /**
7527
+ * @license
7528
+ * Copyright 2025 Google LLC
7529
+ *
7530
+ * Licensed under the Apache License, Version 2.0 (the "License");
7531
+ * you may not use this file except in compliance with the License.
7532
+ * You may obtain a copy of the License at
7533
+ *
7534
+ * http://www.apache.org/licenses/LICENSE-2.0
7535
+ *
7536
+ * Unless required by applicable law or agreed to in writing, software
7537
+ * distributed under the License is distributed on an "AS IS" BASIS,
7538
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
7539
+ * See the License for the specific language governing permissions and
7540
+ * limitations under the License.
7541
+ */
7542
+ const POLLING_INTERVAL_MS = 1000;
7543
+ // Pull a cookie value from document.cookie
7544
+ function getDocumentCookie(name) {
7545
+ var _a, _b;
7546
+ const escapedName = name.replace(/[\\^$.*+?()[\]{}|]/g, '\\$&');
7547
+ const matcher = RegExp(`${escapedName}=([^;]+)`);
7548
+ return (_b = (_a = document.cookie.match(matcher)) === null || _a === void 0 ? void 0 : _a[1]) !== null && _b !== void 0 ? _b : null;
7549
+ }
7550
+ // Produce a sanitized cookie name from the persistence key
7551
+ function getCookieName(key) {
7552
+ // __HOST- doesn't work in localhost https://issues.chromium.org/issues/40196122 but it has
7553
+ // desirable security properties, so lets use a different cookie name while in dev-mode.
7554
+ // Already checked isSecureContext in _isAvailable, so if it's http we're hitting local.
7555
+ const isDevMode = window.location.protocol === 'http:';
7556
+ return `${isDevMode ? '__dev_' : '__HOST-'}FIREBASE_${key.split(':')[3]}`;
7557
+ }
7558
+ class CookiePersistence {
7559
+ constructor() {
7560
+ this.type = "COOKIE" /* PersistenceType.COOKIE */;
7561
+ this.listenerUnsubscribes = new Map();
7562
+ }
7563
+ // used to get the URL to the backend to proxy to
7564
+ _getFinalTarget(originalUrl) {
7565
+ if (typeof window === undefined) {
7566
+ return originalUrl;
7567
+ }
7568
+ const url = new URL(`${window.location.origin}/__cookies__`);
7569
+ url.searchParams.set('finalTarget', originalUrl);
7570
+ return url;
7571
+ }
7572
+ // To be a usable persistence method in a chain browserCookiePersistence ensures that
7573
+ // prerequisites have been met, namely that we're in a secureContext, navigator and document are
7574
+ // available and cookies are enabled. Not all UAs support these method, so fallback accordingly.
7575
+ async _isAvailable() {
7576
+ var _a;
7577
+ if (typeof isSecureContext === 'boolean' && !isSecureContext) {
7578
+ return false;
7579
+ }
7580
+ if (typeof navigator === 'undefined' || typeof document === 'undefined') {
7581
+ return false;
7582
+ }
7583
+ return (_a = navigator.cookieEnabled) !== null && _a !== void 0 ? _a : true;
7584
+ }
7585
+ // Set should be a noop as we expect middleware to handle this
7586
+ async _set(_key, _value) {
7587
+ return;
7588
+ }
7589
+ // Attempt to get the cookie from cookieStore, fallback to document.cookie
7590
+ async _get(key) {
7591
+ if (!this._isAvailable()) {
7592
+ return null;
7593
+ }
7594
+ const name = getCookieName(key);
7595
+ if (window.cookieStore) {
7596
+ const cookie = await window.cookieStore.get(name);
7597
+ return cookie === null || cookie === void 0 ? void 0 : cookie.value;
7598
+ }
7599
+ return getDocumentCookie(name);
7600
+ }
7601
+ // Log out by overriding the idToken with a sentinel value of ""
7602
+ async _remove(key) {
7603
+ if (!this._isAvailable()) {
7604
+ return;
7605
+ }
7606
+ // To make sure we don't hit signout over and over again, only do this operation if we need to
7607
+ // with the logout sentinel value of "" this can cause race conditions. Unnecessary set-cookie
7608
+ // headers will reduce CDN hit rates too.
7609
+ const existingValue = await this._get(key);
7610
+ if (!existingValue) {
7611
+ return;
7612
+ }
7613
+ const name = getCookieName(key);
7614
+ document.cookie = `${name}=;Max-Age=34560000;Partitioned;Secure;SameSite=Strict;Path=/;Priority=High`;
7615
+ await fetch(`/__cookies__`, { method: 'DELETE' }).catch(() => undefined);
7616
+ }
7617
+ // Listen for cookie changes, both cookieStore and fallback to polling document.cookie
7618
+ _addListener(key, listener) {
7619
+ if (!this._isAvailable()) {
7620
+ return;
7621
+ }
7622
+ const name = getCookieName(key);
7623
+ if (window.cookieStore) {
7624
+ const cb = ((event) => {
7625
+ const changedCookie = event.changed.find(change => change.name === name);
7626
+ if (changedCookie) {
7627
+ listener(changedCookie.value);
7628
+ }
7629
+ const deletedCookie = event.deleted.find(change => change.name === name);
7630
+ if (deletedCookie) {
7631
+ listener(null);
7632
+ }
7633
+ });
7634
+ const unsubscribe = () => window.cookieStore.removeEventListener('change', cb);
7635
+ this.listenerUnsubscribes.set(listener, unsubscribe);
7636
+ return window.cookieStore.addEventListener('change', cb);
7637
+ }
7638
+ let lastValue = getDocumentCookie(name);
7639
+ const interval = setInterval(() => {
7640
+ const currentValue = getDocumentCookie(name);
7641
+ if (currentValue !== lastValue) {
7642
+ listener(currentValue);
7643
+ lastValue = currentValue;
7644
+ }
7645
+ }, POLLING_INTERVAL_MS);
7646
+ const unsubscribe = () => clearInterval(interval);
7647
+ this.listenerUnsubscribes.set(listener, unsubscribe);
7648
+ }
7649
+ _removeListener(_key, listener) {
7650
+ const unsubscribe = this.listenerUnsubscribes.get(listener);
7651
+ if (!unsubscribe) {
7652
+ return;
7653
+ }
7654
+ unsubscribe();
7655
+ this.listenerUnsubscribes.delete(listener);
7656
+ }
7657
+ }
7658
+ CookiePersistence.type = 'COOKIE';
7659
+ /**
7660
+ * An implementation of {@link Persistence} of type `COOKIE`, for use on the client side in
7661
+ * applications leveraging hybrid rendering and middleware.
7662
+ *
7663
+ * @remarks This persistence method requires companion middleware to function, such as that provided
7664
+ * by {@link https://firebaseopensource.com/projects/firebaseextended/reactfire/ | ReactFire} for
7665
+ * NextJS.
7666
+ * @beta
7667
+ */
7668
+ const browserCookiePersistence = CookiePersistence;
7669
+
7472
7670
  /**
7473
7671
  * @license
7474
7672
  * Copyright 2020 Google LLC
@@ -10679,7 +10877,7 @@ function _isEmptyString(input) {
10679
10877
  }
10680
10878
 
10681
10879
  var name = "@firebase/auth";
10682
- var version = "1.9.1";
10880
+ var version = "1.10.0-auth-redirect-credentials.82faa0828";
10683
10881
 
10684
10882
  /**
10685
10883
  * @license
@@ -10933,5 +11131,5 @@ _setExternalJSProvider({
10933
11131
  });
10934
11132
  registerAuth("Browser" /* ClientPlatform.BROWSER */);
10935
11133
 
10936
- export { TwitterAuthProvider as $, ActionCodeOperation as A, updateCurrentUser as B, signOut as C, revokeAccessToken as D, deleteUser as E, FactorId as F, debugErrorMap as G, prodErrorMap as H, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as I, initializeAuth as J, connectAuthEmulator as K, AuthCredential as L, EmailAuthCredential as M, OAuthCredential as N, OperationType as O, PhoneAuthProvider as P, PhoneAuthCredential as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, inMemoryPersistence as U, EmailAuthProvider as V, FacebookAuthProvider as W, GoogleAuthProvider as X, GithubAuthProvider as Y, OAuthProvider as Z, SAMLAuthProvider as _, browserSessionPersistence as a, signInAnonymously as a0, signInWithCredential as a1, linkWithCredential as a2, reauthenticateWithCredential as a3, signInWithCustomToken as a4, sendPasswordResetEmail as a5, confirmPasswordReset as a6, applyActionCode as a7, checkActionCode as a8, verifyPasswordResetCode as a9, _isIOS7Or8 as aA, _createError as aB, _assert as aC, AuthEventManager as aD, _getInstance as aE, _persistenceKeyName as aF, _getRedirectResult as aG, _overrideRedirectResult as aH, _clearRedirectOutcomes as aI, _castAuth as aJ, UserImpl as aK, AuthImpl as aL, _getClientVersion as aM, _generateEventId as aN, AuthPopup as aO, FetchProvider as aP, SAMLAuthCredential as aQ, createUserWithEmailAndPassword as aa, signInWithEmailAndPassword as ab, sendSignInLinkToEmail as ac, isSignInWithEmailLink as ad, signInWithEmailLink as ae, fetchSignInMethodsForEmail as af, sendEmailVerification as ag, verifyBeforeUpdateEmail as ah, ActionCodeURL as ai, parseActionCodeURL as aj, updateProfile as ak, updateEmail as al, updatePassword as am, getIdToken as an, getIdTokenResult as ao, unlink as ap, getAdditionalUserInfo as aq, reload as ar, getMultiFactorResolver as as, multiFactor as at, debugAssert as au, _isIOS as av, _isAndroid as aw, _fail as ax, _getRedirectUrl as ay, _getProjectConfig as az, browserLocalPersistence as b, signInWithPopup as c, linkWithPopup as d, reauthenticateWithPopup as e, signInWithRedirect as f, linkWithRedirect as g, reauthenticateWithRedirect as h, indexedDBLocalPersistence as i, getRedirectResult as j, browserPopupRedirectResolver as k, linkWithPhoneNumber as l, PhoneMultiFactorGenerator as m, TotpSecret as n, getAuth as o, ProviderId as p, setPersistence as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, initializeRecaptchaConfig as t, updatePhoneNumber as u, validatePassword as v, onIdTokenChanged as w, beforeAuthStateChanged as x, onAuthStateChanged as y, useDeviceLanguage as z };
10937
- //# sourceMappingURL=index-e84cf44d.js.map
11134
+ export { SAMLAuthProvider as $, ActionCodeOperation as A, useDeviceLanguage as B, updateCurrentUser as C, signOut as D, revokeAccessToken as E, FactorId as F, deleteUser as G, debugErrorMap as H, prodErrorMap as I, AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY as J, initializeAuth as K, connectAuthEmulator as L, AuthCredential as M, EmailAuthCredential as N, OperationType as O, PhoneAuthProvider as P, OAuthCredential as Q, RecaptchaVerifier as R, SignInMethod as S, TotpMultiFactorGenerator as T, PhoneAuthCredential as U, inMemoryPersistence as V, EmailAuthProvider as W, FacebookAuthProvider as X, GoogleAuthProvider as Y, GithubAuthProvider as Z, OAuthProvider as _, browserCookiePersistence as a, TwitterAuthProvider as a0, signInAnonymously as a1, signInWithCredential as a2, linkWithCredential as a3, reauthenticateWithCredential as a4, signInWithCustomToken as a5, sendPasswordResetEmail as a6, confirmPasswordReset as a7, applyActionCode as a8, checkActionCode as a9, _getProjectConfig as aA, _isIOS7Or8 as aB, _createError as aC, _assert as aD, AuthEventManager as aE, _getInstance as aF, _persistenceKeyName as aG, _getRedirectResult as aH, _overrideRedirectResult as aI, _clearRedirectOutcomes as aJ, _castAuth as aK, UserImpl as aL, AuthImpl as aM, _getClientVersion as aN, _generateEventId as aO, AuthPopup as aP, FetchProvider as aQ, SAMLAuthCredential as aR, verifyPasswordResetCode as aa, createUserWithEmailAndPassword as ab, signInWithEmailAndPassword as ac, sendSignInLinkToEmail as ad, isSignInWithEmailLink as ae, signInWithEmailLink as af, fetchSignInMethodsForEmail as ag, sendEmailVerification as ah, verifyBeforeUpdateEmail as ai, ActionCodeURL as aj, parseActionCodeURL as ak, updateProfile as al, updateEmail as am, updatePassword as an, getIdToken as ao, getIdTokenResult as ap, unlink as aq, getAdditionalUserInfo as ar, reload as as, getMultiFactorResolver as at, multiFactor as au, debugAssert as av, _isIOS as aw, _isAndroid as ax, _fail as ay, _getRedirectUrl as az, browserLocalPersistence as b, browserSessionPersistence as c, signInWithPopup as d, linkWithPopup as e, reauthenticateWithPopup as f, signInWithRedirect as g, linkWithRedirect as h, indexedDBLocalPersistence as i, reauthenticateWithRedirect as j, getRedirectResult as k, linkWithPhoneNumber as l, browserPopupRedirectResolver as m, PhoneMultiFactorGenerator as n, TotpSecret as o, getAuth as p, ProviderId as q, reauthenticateWithPhoneNumber as r, signInWithPhoneNumber as s, setPersistence as t, updatePhoneNumber as u, initializeRecaptchaConfig as v, validatePassword as w, onIdTokenChanged as x, beforeAuthStateChanged as y, onAuthStateChanged as z };
11135
+ //# sourceMappingURL=index-fc6bc882.js.map