Merge master into release

.changeset/brave-ducks-relax.md

@@ -0,0 +1,6 @@
+---
+'@firebase/auth': minor
+'@firebase/auth-compat': minor
+---
+
+[feature] Added Firebase App Check support to Firebase Auth.

.changeset/shaggy-zebras-leave.md

@@ -0,0 +1,5 @@
+---
+'@firebase/app-check': patch
+---
+
+Catch all ReCAPTCHA errors and, if caught, prevent App Check from making a request to the exchange endpoint.

.changeset/smart-llamas-compete.md

@@ -0,0 +1,6 @@
+---
+'@firebase/auth': minor
+'firebase': minor
+---
+
+[feature] Add reCAPTCHA enterprise support.

.changeset/three-months-lie.md

@@ -0,0 +1,5 @@
+---
+"@firebase/firestore": patch
+---
+
+Fix a bug that sometimes prevented aggregations from being run when muli-tab persistence was enabled.

.github/workflows/canary-deploy.yml

@@ -18,7 +18,7 @@ jobs:
         # Canary release script requires git history and tags.
         fetch-depth: 0
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: Yarn install

.github/workflows/check-changeset.yml

@@ -21,7 +21,7 @@ jobs:
         # This makes Actions fetch all Git history so check_changeset script can diff properly.
         fetch-depth: 0
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: Yarn install

.github/workflows/check-docs.yml

@@ -14,7 +14,7 @@ jobs:
         # get all history for the diff
         fetch-depth: 0
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: Yarn install

.github/workflows/check-pkg-paths.yml

@@ -14,7 +14,7 @@ jobs:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: Yarn install

.github/workflows/deploy-config.yml

@@ -21,7 +21,7 @@ jobs:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: Yarn install

.github/workflows/e2e-test.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@master
       - name: Set up Node (14)
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@master
         with:
           node-version: 14.x
       - name: install Chrome stable

.github/workflows/format.yml

@@ -18,7 +18,7 @@ jobs:
         # get all history for the diff
         fetch-depth: 0
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: Yarn install

.github/workflows/health-metrics-pull-request.yml

@@ -23,8 +23,8 @@ jobs:
     if: github.event_name == 'push' || !(github.event.pull_request.head.repo.fork)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
         with:
           node-version: 14.x
       - uses: 'google-github-actions/auth@v0'
@@ -40,8 +40,8 @@ jobs:
     if: github.event_name == 'push' || !(github.event.pull_request.head.repo.fork)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
         with:
           node-version: 14.x
       - uses: 'google-github-actions/auth@v0'

.github/workflows/lint.yml

@@ -8,9 +8,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: yarn install

.github/workflows/prerelease-manual-deploy.yml

@@ -21,7 +21,7 @@ jobs:
             # Canary release script requires git history and tags.
             fetch-depth: 0
         - name: Set up Node (14)
-          uses: actions/setup-node@v2
+          uses: actions/setup-node@v3
           with:
             node-version: 14.x
         - name: Yarn install

.github/workflows/release-prod.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: Checkout release branch (with history)

.github/workflows/release-staging.yml

@@ -25,7 +25,7 @@ jobs:
     if: github.event.inputs.release-branch == 'release' || endsWith(github.event.inputs.release-branch, '-releasebranch')
     steps:
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: Merge master into release
@@ -132,14 +132,25 @@ jobs:
         -H "Authorization:Bearer $OSS_BOT_GITHUB_TOKEN" \
         -d "{\"event_type\":\"staging-tests\", \"client_payload\":{\"versionOrTag\":\"$VERSION_OR_TAG\"}}" \
         https://api.github.com/repos/firebase/firebase-js-sdk/dispatches
+    - name: Check for changes requiring a reference doc publish
+      id: docs-check
+      run: git diff --exit-code origin/master HEAD docs-devsite
+    - name: No diff, docs not needed
+      if: ${{ success() }}
+      run: echo "DOCS_NEEDED=false" >> $GITHUB_STATE
+    - name: Diff returned something, docs are needed
+      if: ${{ failure() }}
+      run: echo "DOCS_NEEDED=true" >> $GITHUB_STATE
     - name: Log to release tracker
       # Sends release information to cloud functions endpoint of release tracker.
+      if: ${{ always() }}
       run: |
         DATE=$(date +'%m/%d/%Y')
         BASE_VERSION=${{ steps.get-version.outputs.BASE_VERSION }}
         STAGING_VERSION=${{ steps.get-version.outputs.STAGING_VERSION }}
         OPERATOR=${{ github.actor }}
         RELEASE_TRACKER_URL=${{ secrets.RELEASE_TRACKER_URL }}
+        DOCS_NEEDED=${{ steps.docs-check.outputs.DOCS_NEEDED }}
         curl -X POST -H "Content-Type:application/json" \
-        -d "{\"version\":\"$BASE_VERSION\",\"tag\":\"$STAGING_VERSION\",\"date\":\"$DATE\",\"operator\":\"$OPERATOR\"}" \
+        -d "{\"version\":\"$BASE_VERSION\",\"tag\":\"$STAGING_VERSION\",\"date\":\"$DATE\",\"operator\":\"$OPERATOR\",\"docs_needed\":\"$DOCS_NEEDED\"}" \
         $RELEASE_TRACKER_URL/logStaging

.github/workflows/test-all.yml

@@ -19,9 +19,9 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get install google-chrome-stable
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Set up Node (16)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 16.x
     - name: Bump Node memory limit

.github/workflows/test-changed-auth.yml

@@ -14,8 +14,8 @@ jobs:
     steps:
       # install Chrome first, so the correct version of webdriver can be installed by chromedriver when setting up the repo
       - name: install Chrome stable
-        # Install Chrome version 110.0.5481.177-1 as test starts to fail on version 111.0.5563.64-1.
-        # We will retry to use the latest, once Chrome releases stable version 112 (April 4 ETA).
+        # Install Chrome version 110.0.5481.177-1 as test starts to fail on version 111.
+        # We will retry to use the latest, once version 112 becomes stable.
         run: |
           sudo apt-get update
           sudo apt-get install wget
@@ -27,7 +27,7 @@ jobs:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
       - name: Set up Node (14)
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v3
         with:
           node-version: 14.x
       - name: Bump Node memory limit
@@ -58,7 +58,7 @@ jobs:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
       - name: Set up Node (14)
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v3
         with:
           node-version: 14.x
       - name: Bump Node memory limit

.github/workflows/test-changed-fcm-integration.yml

@@ -23,7 +23,7 @@ jobs:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: Bump Node memory limit

.github/workflows/test-changed-firestore-integration.yml

@@ -14,7 +14,7 @@ jobs:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: install Chrome stable

.github/workflows/test-changed-firestore.yml

@@ -14,7 +14,7 @@ jobs:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
       - name: Set up Node (14)
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v3
         with:
           node-version: 14.x
       - name: install Chrome stable
@@ -50,7 +50,7 @@ jobs:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
       - name: Set up Node (14)
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v3
         with:
           node-version: 14.x
       - name: Bump Node memory limit

.github/workflows/test-changed-misc.yml

@@ -14,7 +14,7 @@ jobs:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
     - name: Set up Node (16)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 16.x
     - name: install Chrome stable

.github/workflows/test-changed.yml

@@ -14,7 +14,7 @@ jobs:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
       - name: Set up Node (14)
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v3
         with:
           node-version: 14.x
       - name: install Chrome stable
@@ -45,7 +45,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up Node (14)
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v3
         with:
           node-version: 14.x
       - name: install Firefox stable

.github/workflows/test-firebase-integration.yml

@@ -14,7 +14,7 @@ jobs:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: install Chrome stable

.github/workflows/update-api-reports.yml

@@ -14,10 +14,10 @@ jobs:
       uses: actions/checkout@master
       with:
         # checkout HEAD commit instead of merge commit
-        ref: ${{ github.event.pull_request.head.sha }}
+        ref: ${{ github.event.pull_request.head.ref }}
         token: ${{ github.token }}
     - name: Set up Node (14)
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v3
       with:
         node-version: 14.x
     - name: Yarn install

common/api-review/auth.api.md

@@ -226,6 +226,14 @@ export const AuthErrorCodes: {
     readonly WEAK_PASSWORD: "auth/weak-password";
     readonly WEB_STORAGE_UNSUPPORTED: "auth/web-storage-unsupported";
     readonly ALREADY_INITIALIZED: "auth/already-initialized";
+    readonly RECAPTCHA_NOT_ENABLED: "auth/recaptcha-not-enabled";
+    readonly MISSING_RECAPTCHA_TOKEN: "auth/missing-recaptcha-token";
+    readonly INVALID_RECAPTCHA_TOKEN: "auth/invalid-recaptcha-token";
+    readonly INVALID_RECAPTCHA_ACTION: "auth/invalid-recaptcha-action";
+    readonly MISSING_CLIENT_TYPE: "auth/missing-client-type";
+    readonly MISSING_RECAPTCHA_VERSION: "auth/missing-recaptcha-version";
+    readonly INVALID_RECAPTCHA_VERSION: "auth/invalid-recaptcha-version";
+    readonly INVALID_REQ_TYPE: "auth/invalid-req-type";
 };
 
 // @public
@@ -422,6 +430,9 @@ export const indexedDBLocalPersistence: Persistence;
 // @public
 export function initializeAuth(app: FirebaseApp, deps?: Dependencies): Auth;
 
+// @public
+export function initializeRecaptchaConfig(auth: Auth): Promise<void>;
+
 // @public
 export const inMemoryPersistence: Persistence;
 
@@ -754,7 +765,7 @@ export interface TotpMultiFactorAssertion extends MultiFactorAssertion {
 export class TotpMultiFactorGenerator {
     static assertionForEnrollment(secret: TotpSecret, oneTimePassword: string): TotpMultiFactorAssertion;
     static assertionForSignIn(enrollmentId: string, oneTimePassword: string): TotpMultiFactorAssertion;
-    static FACTOR_ID: "totp";
+    static FACTOR_ID: 'totp';
     static generateSecret(session: MultiFactorSession): Promise<TotpSecret>;
 }