Recaptcha Enterprise integration with phone auth flows

FirebaseAuth/Sources/Swift/Auth/Auth.swift

@@ -2287,7 +2287,7 @@ extension Auth: AuthInterop {
                                             action: AuthRecaptchaAction) async throws -> T
       .Response {
       let recaptchaVerifier = AuthRecaptchaVerifier.shared(auth: self)
-      if recaptchaVerifier.enablementStatus(forProvider: AuthRecaptchaProvider.password) {
+      if recaptchaVerifier.enablementStatus(forProvider: AuthRecaptchaProvider.password) != .off {
         try await recaptchaVerifier.injectRecaptchaFields(request: request,
                                                           provider: AuthRecaptchaProvider.password,
                                                           action: action)

FirebaseAuth/Sources/Swift/AuthProvider/PhoneAuthProvider.swift

@@ -107,16 +107,23 @@ import Foundation
                                 uiDelegate: AuthUIDelegate? = nil,
                                 multiFactorSession: MultiFactorSession? = nil) async throws
       -> String {
-      return try await withCheckedThrowingContinuation { continuation in
-        self.verifyPhoneNumber(phoneNumber,
-                               uiDelegate: uiDelegate,
-                               multiFactorSession: multiFactorSession) { result, error in
-          if let error {
-            continuation.resume(throwing: error)
-          } else if let result {
-            continuation.resume(returning: result)
+        guard AuthWebUtils.isCallbackSchemeRegistered(forCustomURLScheme: callbackScheme,
+                                                      urlTypes: auth.mainBundleUrlTypes) else {
+          fatalError(
+            "Please register custom URL scheme \(callbackScheme) in the app's Info.plist file."
+          )
+        }
+        do {
+          if let verificationID = try await internalVerify(phoneNumber: phoneNumber, uiDelegate: uiDelegate, multiFactorSession: multiFactorSession) {
+            return verificationID
+          } else {
+            throw AuthErrorUtils.invalidVerificationIDError(message: "Invalid verification ID")
           }
+        } catch {
+          throw error
         }
+      } catch {
+        throw error
       }
     }
 
@@ -152,16 +159,13 @@ import Foundation
     open func verifyPhoneNumber(with multiFactorInfo: PhoneMultiFactorInfo,
                                 uiDelegate: AuthUIDelegate? = nil,
                                 multiFactorSession: MultiFactorSession?) async throws -> String {
-      return try await withCheckedThrowingContinuation { continuation in
-        self.verifyPhoneNumber(with: multiFactorInfo,
-                               uiDelegate: uiDelegate,
-                               multiFactorSession: multiFactorSession) { result, error in
-          if let error {
-            continuation.resume(throwing: error)
-          } else if let result {
-            continuation.resume(returning: result)
-          }
-        }
+      do {
+        multiFactorSession?.multiFactorInfo = multiFactorInfo
+        return try await verifyPhoneNumber(multiFactorInfo.phoneNumber,
+                                           uiDelegate: uiDelegate,
+                                           multiFactorSession: multiFactorSession)
+      } catch {
+        throw error
       }
     }
 
@@ -184,21 +188,58 @@ import Foundation
     private func internalVerify(phoneNumber: String,
                                 uiDelegate: AuthUIDelegate?,
                                 multiFactorSession: MultiFactorSession? = nil) async throws
-      -> String? {
-      guard phoneNumber.count > 0 else {
-        throw AuthErrorUtils.missingPhoneNumberError(message: nil)
-      }
-      guard let manager = auth.notificationManager else {
-        throw AuthErrorUtils.notificationNotForwardedError()
-      }
-      guard await manager.checkNotificationForwarding() else {
-        throw AuthErrorUtils.notificationNotForwardedError()
-      }
+  -> String? {
+    guard phoneNumber.count > 0 else {
+      throw AuthErrorUtils.missingPhoneNumberError(message: nil)
+    }
+    guard let manager = auth.notificationManager else {
+      throw AuthErrorUtils.notificationNotForwardedError()
+    }
+    guard await manager.checkNotificationForwarding() else {
+      throw AuthErrorUtils.notificationNotForwardedError()
+    }
+    let recaptchaVerifier = AuthRecaptchaVerifier.shared(auth: auth)
+    try await recaptchaVerifier.retrieveRecaptchaConfig(forceRefresh: true)
+    let enablement = recaptchaVerifier.enablementStatus(forProvider: .phone)
+    if(enablement == .off) {
       return try await verifyClAndSendVerificationCode(toPhoneNumber: phoneNumber,
                                                        retryOnInvalidAppCredential: true,
                                                        multiFactorSession: multiFactorSession,
                                                        uiDelegate: uiDelegate)
+    } else {
+      do {
+        if(enablement == .audit) {
+          return try await verifyClAndSendVerificationCodeWithRecaptcha(toPhoneNumber: phoneNumber, retryOnInvalidAppCredential: true, multiFactorSession: multiFactorSession, uiDelegate: uiDelegate)
+        } else {
+          return try await verifyClAndSendVerificationCodeWithRecaptcha(toPhoneNumber: phoneNumber, retryOnInvalidAppCredential: false, multiFactorSession: multiFactorSession, uiDelegate: uiDelegate)
+        }
+      } catch {
+        throw error
+      }
     }
+  }
+
+  private func verifyClAndSendVerificationCodeWithRecaptcha(toPhoneNumber phoneNumber: String,
+                                               retryOnInvalidAppCredential: Bool,
+                                               uiDelegate: AuthUIDelegate?) async throws
+  -> String? {
+    let recaptchaVerifier = AuthRecaptchaVerifier.shared(auth: auth)
+    let request = SendVerificationCodeRequest(phoneNumber: phoneNumber,
+                                              codeIdentity: CodeIdentity.empty,
+                                              requestConfiguration: auth
+      .requestConfiguration)
+    do {
+      try await recaptchaVerifier.injectRecaptchaFields(request: request, provider: .phone, action: .sendVerificationCode)
+      let response = try await AuthBackend.call(with: request)
+      return response.verificationID
+    } catch {
+      return try await handleVerifyErrorWithRetry(error: error,
+                                                  phoneNumber: phoneNumber,
+                                                  retryOnInvalidAppCredential: retryOnInvalidAppCredential,
+                                                  multiFactorSession: nil,
+                                                  uiDelegate: uiDelegate)
+    }
+  }
 
     /// Starts the flow to verify the client via silent push notification.
     /// - Parameter retryOnInvalidAppCredential: Whether of not the flow should be retried if an
@@ -215,7 +256,6 @@ import Foundation
                                                 codeIdentity: codeIdentity,
                                                 requestConfiguration: auth
                                                   .requestConfiguration)
-
       do {
         let response = try await AuthBackend.call(with: request)
         return response.verificationID
@@ -228,6 +268,63 @@ import Foundation
       }
     }
 
+    /// Starts the flow to verify the client via silent push notification.
+    /// - Parameter retryOnInvalidAppCredential: Whether of not the flow should be retried if an
+    /// AuthErrorCodeInvalidAppCredential error is returned from the backend.
+    /// - Parameter phoneNumber: The phone number to be verified.
+  private func verifyClAndSendVerificationCodeWithRecaptcha(toPhoneNumber phoneNumber: String,
+                                               retryOnInvalidAppCredential: Bool,
+                                               multiFactorSession session: MultiFactorSession?,
+                                               uiDelegate: AuthUIDelegate?) async throws
+  -> String? {
+//    if let settings = auth.settings,
+//       settings.isAppVerificationDisabledForTesting {
+//      let request = SendVerificationCodeRequest(
+//        phoneNumber: phoneNumber,
+//        codeIdentity: CodeIdentity.empty,
+//        requestConfiguration: auth.requestConfiguration
+//      )
+//      let response = try await AuthBackend.call(with: request)
+//      return response.verificationID
+//    }
+    guard let session else {
+      return try await verifyClAndSendVerificationCodeWithRecaptcha(
+        toPhoneNumber: phoneNumber,
+        retryOnInvalidAppCredential: retryOnInvalidAppCredential,
+        uiDelegate: uiDelegate
+      )
+    }
+    let startMFARequestInfo = AuthProtoStartMFAPhoneRequestInfo(phoneNumber: phoneNumber,
+                                                                codeIdentity: CodeIdentity.empty)
+    let recaptchaVerifier = AuthRecaptchaVerifier.shared(auth: auth)
+    do {
+      if let idToken = session.idToken {
+        let request = StartMFAEnrollmentRequest(idToken: idToken,
+                                                enrollmentInfo: startMFARequestInfo,
+                                                requestConfiguration: auth.requestConfiguration)
+        try await recaptchaVerifier.injectRecaptchaFields(request: request, provider: .phone, action: .startMfaEnrollment)
+        let response = try await AuthBackend.call(with: request)
+        return response.phoneSessionInfo?.sessionInfo
+      } else {
+        let request = StartMFASignInRequest(MFAPendingCredential: session.mfaPendingCredential,
+                                            MFAEnrollmentID: session.multiFactorInfo?.uid,
+                                            signInInfo: startMFARequestInfo,
+                                            requestConfiguration: auth.requestConfiguration)
+        try await recaptchaVerifier.injectRecaptchaFields(request: request, provider: .phone, action: .startMfaSignin)
+        let response = try await AuthBackend.call(with: request)
+        return response.responseInfo?.sessionInfo
+      }
+    } catch {
+      return try await handleVerifyErrorWithRetry(
+        error: error,
+        phoneNumber: phoneNumber,
+        retryOnInvalidAppCredential: retryOnInvalidAppCredential,
+        multiFactorSession: session,
+        uiDelegate: uiDelegate
+      )
+    }
+  }
+
     /// Starts the flow to verify the client via silent push notification.
     /// - Parameter retryOnInvalidAppCredential: Whether of not the flow should be retried if an
     /// AuthErrorCodeInvalidAppCredential error is returned from the backend.
@@ -244,7 +341,6 @@ import Foundation
           codeIdentity: CodeIdentity.empty,
           requestConfiguration: auth.requestConfiguration
         )
-
         let response = try await AuthBackend.call(with: request)
         return response.verificationID
       }

FirebaseAuth/Sources/Swift/Backend/RPC/SendVerificationTokenRequest.swift

@@ -29,6 +29,15 @@ private let kSecretKey = "iosSecret"
 /// The key for the reCAPTCHAToken parameter in the request.
 private let kreCAPTCHATokenKey = "recaptchaToken"
 
+/// The key for the "clientType" value in the request.
+private let kClientType = "clientType"
+
+/// The key for the "captchaResponse" value in the request.
+private let kCaptchaResponseKey = "captchaResponse"
+
+/// The key for the "recaptchaVersion" value in the request.
+private let kRecaptchaVersion = "recaptchaVersion"
+
 /// The key for the tenant id value in the request.
 private let kTenantIDKey = "tenantId"
 
@@ -50,6 +59,12 @@ class SendVerificationCodeRequest: IdentityToolkitRequest, AuthRPCRequest {
   /// verification code.
   let codeIdentity: CodeIdentity
 
+  /// Response to the captcha.
+  var captchaResponse: String?
+
+  /// The reCAPTCHA version.
+  var recaptchaVersion: String?
+
   init(phoneNumber: String, codeIdentity: CodeIdentity,
        requestConfiguration: AuthRequestConfiguration) {
     self.phoneNumber = phoneNumber
@@ -71,10 +86,21 @@ class SendVerificationCodeRequest: IdentityToolkitRequest, AuthRPCRequest {
       postBody[kreCAPTCHATokenKey] = reCAPTCHAToken
     case .empty: break
     }
-
+    if let captchaResponse {
+      postBody[kCaptchaResponseKey] = captchaResponse
+    }
+    if let recaptchaVersion {
+      postBody[kRecaptchaVersion] = recaptchaVersion
+    }
     if let tenantID {
       postBody[kTenantIDKey] = tenantID
     }
+    postBody[kClientType] = clientType
     return postBody
   }
+
+  func injectRecaptchaFields(recaptchaResponse: String?, recaptchaVersion: String) {
+    captchaResponse = recaptchaResponse
+    self.recaptchaVersion = recaptchaVersion
+  }
 }