firebase-ios-sdk/FirebaseAuth/Sources/Swift/User/User.swift

// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import Foundation

@available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
extension User: NSSecureCoding {}

/// Represents a user.
///
/// Firebase Auth does not attempt to validate users
/// when loading them from the keychain. Invalidated users (such as those
/// whose passwords have been changed on another client) are automatically
/// logged out when an auth-dependent operation is attempted or when the
/// ID token is automatically refreshed.
///
/// This class is thread-safe.
@available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
@objc(FIRUser) open class User: NSObject, UserInfo {
  /// Indicates the user represents an anonymous user.
  @objc public internal(set) var isAnonymous: Bool

  /// Indicates the user represents an anonymous user.
  @objc open func anonymous() -> Bool { return isAnonymous }

  /// Indicates the email address associated with this user has been verified.
  @objc public private(set) var isEmailVerified: Bool

  /// Indicates the email address associated with this user has been verified.
  @objc open func emailVerified() -> Bool { return isEmailVerified }

  /// Profile data for each identity provider, if any.
  ///
  /// This data is cached on sign-in and updated when linking or unlinking.
  @objc open var providerData: [UserInfo] {
    return Array(providerDataRaw.values)
  }

  var providerDataRaw: [String: UserInfoImpl]

  /// Metadata associated with the Firebase user in question.
  @objc public private(set) var metadata: UserMetadata

  /// The tenant ID of the current user. `nil` if none is available.
  @objc public private(set) var tenantID: String?

  #if os(iOS)
    /// Multi factor object associated with the user.
    ///
    /// This property is available on iOS only.
    @objc public private(set) var multiFactor: MultiFactor
  #endif

  /// [Deprecated] Updates the email address for the user.
  ///
  /// On success, the cached user profile data is updated. Returns an error when
  /// [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection)
  /// is enabled.
  ///
  ///  May fail if there is already an account with this email address that was created using
  /// email and password authentication.
  ///
  /// Invoked asynchronously on the main thread in the future.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeInvalidRecipientEmail` - Indicates an invalid recipient email was
  ///   sent in the request.
  /// *  `AuthErrorCodeInvalidSender` - Indicates an invalid sender email is set in
  ///    the console for this action.
  /// *  `AuthErrorCodeInvalidMessagePayload` - Indicates an invalid email template for
  ///   sending update email.
  /// *  `AuthErrorCodeEmailAlreadyInUse` - Indicates the email is already in use by another
  ///    account.
  /// *  `AuthErrorCodeInvalidEmail` - Indicates the email address is malformed.
  /// *  `AuthErrorCodeRequiresRecentLogin` - Updating a user’s email is a security
  ///  sensitive operation that requires a recent login from the user. This error indicates
  ///  the user has not signed in recently enough. To resolve, reauthenticate the user by
  ///  calling `reauthenticate(with:)`.
  /// - Parameter email: The email address for the user.
  /// - Parameter completion: Optionally; the block invoked when the user profile change has
  /// finished.
  #if !FIREBASE_CI
    @available(
      *,
      deprecated,
      message: "`updateEmail` is deprecated and will be removed in a future release. Use sendEmailVerification(beforeUpdatingEmail:) instead."
    )
  #endif // !FIREBASE_CI
  @objc(updateEmail:completion:)
  open func updateEmail(to email: String, completion: ((Error?) -> Void)? = nil) {
    Task {
      do {
        try await auth.authWorker.updateEmail(user: self, email: email, password: nil)
        await MainActor.run {
          completion?(nil)
        }
      } catch {
        await MainActor.run {
          completion?(error)
        }
      }
    }
  }

  /// [Deprecated] Updates the email address for the user.
  ///
  /// On success, the cached user profile data is updated. Throws when
  /// [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection)
  /// is enabled.
  ///
  /// May fail if there is already an account with this email address that was created using
  /// email and password authentication.
  ///
  /// Invoked asynchronously on the main thread in the future.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeInvalidRecipientEmail` - Indicates an invalid recipient email was
  ///   sent in the request.
  /// *  `AuthErrorCodeInvalidSender` - Indicates an invalid sender email is set in
  ///    the console for this action.
  /// *  `AuthErrorCodeInvalidMessagePayload` - Indicates an invalid email template for
  ///   sending update email.
  /// *  `AuthErrorCodeEmailAlreadyInUse` - Indicates the email is already in use by another
  ///    account.
  /// *  `AuthErrorCodeInvalidEmail` - Indicates the email address is malformed.
  /// *  `AuthErrorCodeRequiresRecentLogin` - Updating a user’s email is a security
  ///  sensitive operation that requires a recent login from the user. This error indicates
  ///  the user has not signed in recently enough. To resolve, reauthenticate the user by
  ///  calling `reauthenticate(with:)`.
  /// - Parameter email: The email address for the user.
  #if !FIREBASE_CI
    @available(
      *,
      deprecated,
      message: "`updateEmail` is deprecated and will be removed in a future release. Use sendEmailVerification(beforeUpdatingEmail:) instead."
    )
  #endif // !FIREBASE_CI
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  open func updateEmail(to email: String) async throws {
    try await auth.authWorker.updateEmail(user: self, email: email, password: nil)
  }

  /// Updates the password for the user. On success, the cached user profile data is updated.
  ///
  /// Invoked asynchronously on the main thread in the future.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeOperationNotAllowed` - Indicates the administrator disabled
  ///        sign in with the specified identity provider.
  /// * `AuthErrorCodeRequiresRecentLogin` - Updating a user’s password is a security
  ///        sensitive operation that requires a recent login from the user. This error indicates
  ///        the user has not signed in recently enough. To resolve, reauthenticate the user by
  ///        calling `reauthenticate(with:)`.
  /// * `AuthErrorCodeWeakPassword` - Indicates an attempt to set a password that is
  /// considered too weak. The `NSLocalizedFailureReasonErrorKey` field in the `userInfo`
  /// dictionary object will contain more detailed explanation that can be shown to the user.
  /// - Parameter password: The new password for the user.
  /// - Parameter completion: Optionally; the block invoked when the user profile change has
  /// finished.
  @objc(updatePassword:completion:)
  open func updatePassword(to password: String, completion: ((Error?) -> Void)? = nil) {
    Task {
      do {
        try await self.updatePassword(to: password)
        await MainActor.run {
          completion?(nil)
        }
      } catch {
        await MainActor.run {
          completion?(error)
        }
      }
    }
  }

  /// Updates the password for the user. On success, the cached user profile data is updated.
  ///
  /// Invoked asynchronously on the main thread in the future.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeOperationNotAllowed` - Indicates the administrator disabled
  ///        sign in with the specified identity provider.
  /// * `AuthErrorCodeRequiresRecentLogin` - Updating a user’s password is a security
  ///        sensitive operation that requires a recent login from the user. This error indicates
  ///        the user has not signed in recently enough. To resolve, reauthenticate the user by
  ///        calling `reauthenticate(with:)`.
  /// * `AuthErrorCodeWeakPassword` - Indicates an attempt to set a password that is
  /// considered too weak. The `NSLocalizedFailureReasonErrorKey` field in the `userInfo`
  /// dictionary object will contain more detailed explanation that can be shown to the user.
  /// - Parameter password: The new password for the user.
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  open func updatePassword(to password: String) async throws {
    guard password.count > 0 else {
      throw AuthErrorUtils.weakPasswordError(serverResponseReason: "Missing Password")
    }
    return try await auth.authWorker.updateEmail(user: self, email: nil, password: password)
  }

  #if os(iOS)
    /// Updates the phone number for the user. On success, the cached user profile data is updated.
    ///
    /// Invoked asynchronously on the main thread in the future.
    ///
    /// This method is available on iOS only.
    ///
    /// Possible error codes:
    /// * `AuthErrorCodeRequiresRecentLogin` - Updating a user’s phone number is a security
    ///    sensitive operation that requires a recent login from the user. This error indicates
    ///    the user has not signed in recently enough. To resolve, reauthenticate the user by
    ///    calling `reauthenticate(with:)`.
    /// - Parameter credential: The new phone number credential corresponding to the
    /// phone number to be added to the Firebase account, if a phone number is already linked to the
    /// account this new phone number will replace it.
    /// - Parameter completion: Optionally; the block invoked when the user profile change has
    /// finished.
    @objc(updatePhoneNumberCredential:completion:)
    open func updatePhoneNumber(_ credential: PhoneAuthCredential,
                                completion: ((Error?) -> Void)? = nil) {
      Task {
        do {
          try await self.updatePhoneNumber(credential)
          await MainActor.run {
            completion?(nil)
          }
        } catch {
          await MainActor.run {
            completion?(error)
          }
        }
      }
    }

    /// Updates the phone number for the user. On success, the cached user profile data is updated.
    ///
    /// Invoked asynchronously on the main thread in the future.
    ///
    /// This method is available on iOS only.
    ///
    /// Possible error codes:
    /// * `AuthErrorCodeRequiresRecentLogin` - Updating a user’s phone number is a security
    ///    sensitive operation that requires a recent login from the user. This error indicates
    ///    the user has not signed in recently enough. To resolve, reauthenticate the user by
    ///     calling `reauthenticate(with:)`.
    /// - Parameter phoneNumberCredential: The new phone number credential corresponding to the
    /// phone number to be added to the Firebase account, if a phone number is already linked to the
    /// account this new phone number will replace it.
    @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
    open func updatePhoneNumber(_ credential: PhoneAuthCredential) async throws {
      try await auth.authWorker.updateOrLinkPhoneNumber(user: self,
                                                        credential: credential,
                                                        isLinkOperation: false)
    }
  #endif

  /// Creates an object which may be used to change the user's profile data.
  ///
  ///  Set the properties of the returned object, then call
  ///  `UserProfileChangeRequest.commitChanges()` to perform the updates atomically.
  /// - Returns: An object which may be used to change the user's profile data atomically.
  @objc(profileChangeRequest)
  open func createProfileChangeRequest() -> UserProfileChangeRequest {
    var result: UserProfileChangeRequest!
    kAuthGlobalWorkQueue.sync {
      result = UserProfileChangeRequest(self)
    }
    return result
  }

  /// A refresh token; useful for obtaining new access tokens independently.
  ///
  ///  This property should only be used for advanced scenarios, and is not typically needed.
  @objc open var refreshToken: String? {
    var result: String?
    kAuthGlobalWorkQueue.sync {
      result = self.tokenService.refreshToken
    }
    return result
  }

  /// Reloads the user's profile data from the server.
  ///
  /// May fail with an `AuthErrorCodeRequiresRecentLogin` error code. In this case
  /// you should call `reauthenticate(with:)` before re-invoking
  /// `updateEmail(to:)`.
  /// - Parameter completion: Optionally; the block invoked when the reload has finished. Invoked
  ///   asynchronously on the main thread in the future.
  @objc open func reload(completion: ((Error?) -> Void)? = nil) {
    Task {
      do {
        try await self.reload()
        await MainActor.run {
          completion?(nil)
        }
      } catch {
        await MainActor.run {
          completion?(error)
        }
      }
    }
  }

  /// Reloads the user's profile data from the server.
  ///
  /// May fail with an `AuthErrorCodeRequiresRecentLogin` error code. In this case
  /// you should call `reauthenticate(with:)` before re-invoking
  /// `updateEmail(to:)`.
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  open func reload() async throws {
    let _ = try await auth.authWorker.getAccountInfoRefreshingCache(self)
  }

  /// Renews the user's authentication tokens by validating a fresh set of credentials supplied
  /// by the user  and returns additional identity provider data.
  ///
  /// If the user associated with the supplied credential is different from the current user,
  /// or if the validation of the supplied credentials fails; an error is returned and the current
  /// user remains signed in.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeInvalidCredential` - Indicates the supplied credential is invalid.
  ///    This could happen if it has expired or it is malformed.
  /// * `AuthErrorCodeOperationNotAllowed` - Indicates that accounts with the
  ///    identity provider represented by the credential are not enabled. Enable them in the
  ///    Auth section of the Firebase console.
  /// *  `AuthErrorCodeEmailAlreadyInUse` -  Indicates the email asserted by the credential
  ///    (e.g. the email in a Facebook access token) is already in use by an existing account,
  ///    that cannot be authenticated with this method. This error will only be thrown if the
  ///   "One account per email address" setting is enabled in the Firebase console, under Auth
  ///   settings. Please note that the error code raised in this specific situation may not be
  ///    the same on Web and Android.
  /// * `AuthErrorCodeUserDisabled` - Indicates the user's account is disabled.
  /// * `AuthErrorCodeWrongPassword` - Indicates the user attempted reauthentication with
  ///    an incorrect password, if credential is of the type `EmailPasswordAuthCredential`.
  /// * `AuthErrorCodeUserMismatch` -  Indicates that an attempt was made to
  ///    reauthenticate with a user which is not the current user.
  /// * `AuthErrorCodeInvalidEmail` - Indicates the email address is malformed.
  /// - Parameter credential: A user-supplied credential, which will be validated by the server.
  /// This can be a successful third-party identity provider sign-in, or an email address and
  /// password.
  /// - Parameter completion: Optionally; the block invoked when the re-authentication operation has
  /// finished. Invoked asynchronously on the main thread in the future.
  @objc(reauthenticateWithCredential:completion:)
  open func reauthenticate(with credential: AuthCredential,
                           completion: ((AuthDataResult?, Error?) -> Void)? = nil) {
    Task {
      do {
        let result = try await reauthenticate(with: credential)
        await MainActor.run {
          completion?(result, nil)
        }
      } catch {
        await MainActor.run {
          completion?(nil, error)
        }
      }
    }
  }

  /// Renews the user's authentication tokens by validating a fresh set of credentials supplied
  ///    by the user  and returns additional identity provider data.
  ///
  /// If the user associated with the supplied credential is different from the current user,
  /// or if the validation of the supplied credentials fails; an error is returned and the current
  /// user remains signed in.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeInvalidCredential` - Indicates the supplied credential is invalid.
  ///    This could happen if it has expired or it is malformed.
  /// * `AuthErrorCodeOperationNotAllowed` - Indicates that accounts with the
  ///    identity provider represented by the credential are not enabled. Enable them in the
  ///    Auth section of the Firebase console.
  /// *  `AuthErrorCodeEmailAlreadyInUse` -  Indicates the email asserted by the credential
  ///    (e.g. the email in a Facebook access token) is already in use by an existing account,
  ///    that cannot be authenticated with this method. This error will only be thrown if the
  ///   "One account per email address" setting is enabled in the Firebase console, under Auth
  ///   settings. Please note that the error code raised in this specific situation may not be
  ///    the same on Web and Android.
  /// * `AuthErrorCodeUserDisabled` - Indicates the user's account is disabled.
  /// * `AuthErrorCodeWrongPassword` - Indicates the user attempted reauthentication with
  ///    an incorrect password, if credential is of the type `EmailPasswordAuthCredential`.
  /// * `AuthErrorCodeUserMismatch` -  Indicates that an attempt was made to
  ///    reauthenticate with a user which is not the current user.
  /// * `AuthErrorCodeInvalidEmail` - Indicates the email address is malformed.
  /// - Parameter credential: A user-supplied credential, which will be validated by the server.
  /// This can be a successful third-party identity provider sign-in, or an email address and
  /// password.
  /// - Returns: The `AuthDataResult` after the reauthentication.
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  @discardableResult
  open func reauthenticate(with credential: AuthCredential) async throws -> AuthDataResult {
    return try await auth.authWorker.reauthenticate(with: credential)
  }

  #if os(iOS)
    /// Renews the user's authentication using the provided auth provider instance.
    ///
    /// This method is available on iOS only.
    /// - Parameter provider: An instance of an auth provider used to initiate the reauthenticate
    /// flow.
    /// - Parameter uiDelegate: Optionally an instance of a class conforming to the `AuthUIDelegate`
    ///    protocol, used for presenting the web context. If nil, a default `AuthUIDelegate`
    ///    will be used.
    /// - Parameter completion: Optionally; a block which is invoked when the reauthenticate flow
    /// finishes, or is canceled. Invoked asynchronously on the main thread in the future.
    @objc(reauthenticateWithProvider:UIDelegate:completion:)
    open func reauthenticate(with provider: FederatedAuthProvider,
                             uiDelegate: AuthUIDelegate?,
                             completion: ((AuthDataResult?, Error?) -> Void)? = nil) {
      Task {
        do {
          let result = try await reauthenticate(with: provider, uiDelegate: uiDelegate)
          await MainActor.run {
            completion?(result, nil)
          }
        } catch {
          await MainActor.run {
            completion?(nil, error)
          }
        }
      }
    }

    /// Renews the user's authentication using the provided auth provider instance.
    ///
    /// This method is available on iOS only.
    /// - Parameter provider: An instance of an auth provider used to initiate the reauthenticate
    /// flow.
    /// - Parameter uiDelegate: Optionally an instance of a class conforming to the `AuthUIDelegate`
    ///    protocol, used for presenting the web context. If nil, a default `AuthUIDelegate`
    ///    will be used.
    /// - Returns: The `AuthDataResult` after the reauthentication.
    @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
    @discardableResult
    open func reauthenticate(with provider: FederatedAuthProvider,
                             uiDelegate: AuthUIDelegate?) async throws -> AuthDataResult {
      return try await auth.authWorker.reauthenticate(with: provider, uiDelegate: uiDelegate)
    }
  #endif

  /// Retrieves the Firebase authentication token, possibly refreshing it if it has expired.
  /// - Parameter completion: Optionally; the block invoked when the token is available. Invoked
  ///    asynchronously on the main thread in the future.
  @objc(getIDTokenWithCompletion:)
  open func getIDToken(completion: ((String?, Error?) -> Void)?) {
    // |getIDTokenForcingRefresh:completion:| is also a public API so there is no need to dispatch to
    // global work queue here.
    getIDTokenForcingRefresh(false, completion: completion)
  }

  /// Retrieves the Firebase authentication token, possibly refreshing it if it has expired.
  ///
  /// The authentication token will be refreshed (by making a network request) if it has
  /// expired, or if `forceRefresh` is `true`.
  /// - Parameter forceRefresh: Forces a token refresh. Useful if the token becomes invalid for some
  /// reason other than an expiration.
  /// - Parameter completion: Optionally; the block invoked when the token is available. Invoked
  ///    asynchronously on the main thread in the future.
  @objc(getIDTokenForcingRefresh:completion:)
  open func getIDTokenForcingRefresh(_ forceRefresh: Bool,
                                     completion: ((String?, Error?) -> Void)?) {
    Task {
      do {
        let tokenResult = try await getIDTokenResult(forcingRefresh: forceRefresh)
        await MainActor.run {
          completion?(tokenResult.token, nil)
        }
      } catch {
        await MainActor.run {
          completion?(nil, error)
        }
      }
    }
  }

  /// Retrieves the Firebase authentication token, possibly refreshing it if it has expired.
  ///
  /// The authentication token will be refreshed (by making a network request) if it has
  /// expired, or if `forceRefresh` is `true`.
  /// - Parameter forceRefresh: Forces a token refresh. Useful if the token becomes invalid for some
  /// reason other than an expiration.
  /// - Returns: The Firebase authentication token.
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  open func getIDToken(forcingRefresh forceRefresh: Bool = false) async throws -> String {
    return try await getIDTokenResult(forcingRefresh: forceRefresh).token
  }

  /// API included for compatibility with a mis-named Firebase 10 API.
  /// Use `getIDToken(forcingRefresh forceRefresh: Bool = false)` instead.
  open func idTokenForcingRefresh(_ forceRefresh: Bool) async throws -> String {
    return try await getIDToken(forcingRefresh: forceRefresh)
  }

  /// Retrieves the Firebase authentication token, possibly refreshing it if it has expired.
  /// - Parameter completion: Optionally; the block invoked when the token is available. Invoked
  ///    asynchronously on the main thread in the future.
  @objc(getIDTokenResultWithCompletion:)
  open func getIDTokenResult(completion: ((AuthTokenResult?, Error?) -> Void)?) {
    getIDTokenResult(forcingRefresh: false, completion: completion)
  }

  /// Retrieves the Firebase authentication token, possibly refreshing it if it has expired.
  ///
  /// The authentication token will be refreshed (by making a network request) if it has
  /// expired, or if `forcingRefresh` is `true`.
  /// - Parameter forcingRefresh: Forces a token refresh. Useful if the token becomes invalid for
  /// some
  /// reason other than an expiration.
  /// - Parameter completion: Optionally; the block invoked when the token is available. Invoked
  /// asynchronously on the main thread in the future.
  @objc(getIDTokenResultForcingRefresh:completion:)
  open func getIDTokenResult(forcingRefresh: Bool,
                             completion: ((AuthTokenResult?, Error?) -> Void)?) {
    Task {
      do {
        let tokenResult = try await getIDTokenResult(forcingRefresh: forcingRefresh)
        await MainActor.run {
          completion?(tokenResult, nil)
        }
      } catch {
        await MainActor.run {
          completion?(nil, error)
        }
      }
    }
  }

  /// Retrieves the Firebase authentication token, possibly refreshing it if it has expired.
  ///
  /// The authentication token will be refreshed (by making a network request) if it has
  /// expired, or if `forceRefresh` is `true`.
  /// - Parameter forceRefresh: Forces a token refresh. Useful if the token becomes invalid for some
  /// reason other than an expiration.
  /// - Returns: The Firebase authentication token.
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  open func getIDTokenResult(forcingRefresh forceRefresh: Bool = false) async throws
    -> AuthTokenResult {
    try await auth.authWorker.getIDTokenResult(user: self, forcingRefresh: forceRefresh)
  }

  /// Associates a user account from a third-party identity provider with this user and
  ///    returns additional identity provider data.
  ///
  ///    Invoked asynchronously on the main thread in the future.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeProviderAlreadyLinked` - Indicates an attempt to link a provider of a
  ///    type already linked to this account.
  /// * `AuthErrorCodeCredentialAlreadyInUse` - Indicates an attempt to link with a
  ///    credential that has already been linked with a different Firebase account.
  /// * `AuthErrorCodeOperationNotAllowed` - Indicates that accounts with the identity
  ///    provider represented by the credential are not enabled. Enable them in the Auth section
  ///    of the Firebase console.
  ///
  /// This method may also return error codes associated with `updateEmail(to:)` and
  /// `updatePassword(to:)` on `User`.
  /// - Parameter credential: The credential for the identity provider.
  /// - Parameter completion: Optionally; the block invoked when the unlinking is complete, or
  /// fails.
  @objc(linkWithCredential:completion:)
  open func link(with credential: AuthCredential,
                 completion: ((AuthDataResult?, Error?) -> Void)? = nil) {
    Task {
      do {
        let tokenResult = try await link(with: credential)
        await MainActor.run {
          completion?(tokenResult, nil)
        }
      } catch {
        await MainActor.run {
          completion?(nil, error)
        }
      }
    }
  }

  /// Associates a user account from a third-party identity provider with this user and
  /// returns additional identity provider data.
  ///
  /// Invoked asynchronously on the main thread in the future.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeProviderAlreadyLinked` - Indicates an attempt to link a provider of a
  ///    type already linked to this account.
  /// * `AuthErrorCodeCredentialAlreadyInUse` - Indicates an attempt to link with a
  ///    credential that has already been linked with a different Firebase account.
  /// * `AuthErrorCodeOperationNotAllowed` - Indicates that accounts with the identity
  ///    provider represented by the credential are not enabled. Enable them in the Auth section
  ///    of the Firebase console.
  ///
  /// This method may also return error codes associated with `updateEmail(to:)` and
  /// `updatePassword(to:)` on `User`.
  /// - Parameter credential: The credential for the identity provider.
  /// - Returns: An `AuthDataResult`.
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  @discardableResult
  open func link(with credential: AuthCredential) async throws -> AuthDataResult {
    return try await auth.authWorker.link(user: self, with: credential)
  }

  #if os(iOS)
    /// Link the user with the provided auth provider instance.
    ///
    /// This method is available on iOSonly.
    /// - Parameter provider: An instance of an auth provider used to initiate the link flow.
    /// - Parameter uiDelegate: Optionally an instance of a class conforming to the `AuthUIDelegate`
    /// protocol used for presenting the web context. If nil, a default `AuthUIDelegate` will be
    /// used.
    /// - Parameter completion: Optionally; a block which is invoked when the link flow finishes, or
    ///    is canceled. Invoked asynchronously on the main thread in the future.
    @objc(linkWithProvider:UIDelegate:completion:)
    open func link(with provider: FederatedAuthProvider,
                   uiDelegate: AuthUIDelegate?,
                   completion: ((AuthDataResult?, Error?) -> Void)? = nil) {
      Task {
        do {
          let tokenResult = try await link(with: provider, uiDelegate: uiDelegate)
          await MainActor.run {
            completion?(tokenResult, nil)
          }
        } catch {
          await MainActor.run {
            completion?(nil, error)
          }
        }
      }
    }

    /// Link the user with the provided auth provider instance.
    ///
    /// This method is available on iOSonly.
    /// - Parameter provider: An instance of an auth provider used to initiate the link flow.
    /// - Parameter uiDelegate: Optionally an instance of a class conforming to the `AuthUIDelegate`
    /// protocol used for presenting the web context. If nil, a default `AuthUIDelegate`
    ///    will be used.
    /// - Parameter completion: Optionally; a block which is invoked when the link flow finishes, or
    ///    is canceled. Invoked asynchronously on the main thread in the future.
    /// - Returns: An AuthDataResult.
    @discardableResult
    open func link(with provider: FederatedAuthProvider,
                   uiDelegate: AuthUIDelegate?) async throws -> AuthDataResult {
      return try await auth.authWorker.link(user: self, with: provider, uiDelegate: uiDelegate)
    }
  #endif

  /// Disassociates a user account from a third-party identity provider with this user.
  ///
  /// Invoked asynchronously on the main thread in the future.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeNoSuchProvider` - Indicates an attempt to unlink a provider
  ///    that is not linked to the account.
  /// * `AuthErrorCodeRequiresRecentLogin` - Updating email is a security sensitive
  ///    operation that requires a recent login from the user. This error indicates the user
  ///    has not signed in recently enough. To resolve, reauthenticate the user by calling
  ///    `reauthenticate(with:)`.
  /// - Parameter provider: The provider ID of the provider to unlink.
  /// - Parameter completion: Optionally; the block invoked when the unlinking is complete, or
  /// fails.
  @objc open func unlink(fromProvider provider: String,
                         completion: ((User?, Error?) -> Void)? = nil) {
    Task {
      do {
        let user = try await unlink(fromProvider: provider)
        await MainActor.run {
          completion?(user, nil)
        }
      } catch {
        await MainActor.run {
          completion?(nil, error)
        }
      }
    }
  }

  /// Disassociates a user account from a third-party identity provider with this user.
  ///
  /// Invoked asynchronously on the main thread in the future.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeNoSuchProvider` - Indicates an attempt to unlink a provider
  ///    that is not linked to the account.
  /// * `AuthErrorCodeRequiresRecentLogin` - Updating email is a security sensitive
  ///    operation that requires a recent login from the user. This error indicates the user
  ///    has not signed in recently enough. To resolve, reauthenticate the user by calling
  ///    `reauthenticate(with:)`.
  /// - Parameter provider: The provider ID of the provider to unlink.
  /// - Returns: The user.
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  open func unlink(fromProvider provider: String) async throws -> User {
    return try await auth.authWorker.unlink(user: self, fromProvider: provider)
  }

  /// Initiates email verification for the user.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeInvalidRecipientEmail` - Indicates an invalid recipient email was
  ///    sent in the request.
  /// * `AuthErrorCodeInvalidSender` - Indicates an invalid sender email is set in
  ///    the console for this action.
  /// * `AuthErrorCodeInvalidMessagePayload` - Indicates an invalid email template for
  ///    sending update email.
  /// * `AuthErrorCodeUserNotFound` - Indicates the user account was not found.
  /// - Parameter completion: Optionally; the block invoked when the request to send an email
  /// verification is complete, or fails. Invoked asynchronously on the main thread in the future.
  @objc(sendEmailVerificationWithCompletion:)
  open func __sendEmailVerification(withCompletion completion: ((Error?) -> Void)?) {
    sendEmailVerification(completion: completion)
  }

  /// Initiates email verification for the user.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeInvalidRecipientEmail` - Indicates an invalid recipient email was
  ///    sent in the request.
  /// * `AuthErrorCodeInvalidSender` - Indicates an invalid sender email is set in
  ///    the console for this action.
  /// * `AuthErrorCodeInvalidMessagePayload` - Indicates an invalid email template for
  ///    sending update email.
  /// * `AuthErrorCodeUserNotFound` - Indicates the user account was not found.
  /// - Parameter actionCodeSettings: An `ActionCodeSettings` object containing settings related to
  /// handling action codes.
  /// - Parameter completion: Optionally; the block invoked when the request to send an email
  /// verification is complete, or fails. Invoked asynchronously on the main thread in the future.
  @objc(sendEmailVerificationWithActionCodeSettings:completion:)
  open func sendEmailVerification(with actionCodeSettings: ActionCodeSettings? = nil,
                                  completion: ((Error?) -> Void)? = nil) {
    Task {
      do {
        try await sendEmailVerification(with: actionCodeSettings)
        await MainActor.run {
          completion?(nil)
        }
      } catch {
        await MainActor.run {
          completion?(error)
        }
      }
    }
  }

  /// Initiates email verification for the user.
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeInvalidRecipientEmail` - Indicates an invalid recipient email was
  ///    sent in the request.
  /// * `AuthErrorCodeInvalidSender` - Indicates an invalid sender email is set in
  ///    the console for this action.
  /// * `AuthErrorCodeInvalidMessagePayload` - Indicates an invalid email template for
  ///    sending update email.
  /// * `AuthErrorCodeUserNotFound` - Indicates the user account was not found.
  /// - Parameter actionCodeSettings: An `ActionCodeSettings` object containing settings related to
  /// handling action codes. The default value is `nil`.
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  open func sendEmailVerification(with actionCodeSettings: ActionCodeSettings? = nil) async throws {
    return try await auth.authWorker.sendEmailVerification(user: self, with: actionCodeSettings)
  }

  /// Deletes the user account (also signs out the user, if this was the current user).
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeRequiresRecentLogin` - Updating email is a security sensitive
  ///  operation that requires a recent login from the user. This error indicates the user
  /// has not signed in recently enough. To resolve, reauthenticate the user by calling
  /// `reauthenticate(with:)`.
  /// - Parameter completion: Optionally; the block invoked when the request to delete the account
  /// is complete, or fails. Invoked asynchronously on the main thread in the future.
  @objc open func delete(completion: ((Error?) -> Void)? = nil) {
    Task {
      do {
        try await delete()
        await MainActor.run {
          completion?(nil)
        }
      } catch {
        await MainActor.run {
          completion?(error)
        }
      }
    }
  }

  /// Deletes the user account (also signs out the user, if this was the current user).
  ///
  /// Possible error codes:
  /// * `AuthErrorCodeRequiresRecentLogin` - Updating email is a security sensitive
  ///  operation that requires a recent login from the user. This error indicates the user
  /// has not signed in recently enough. To resolve, reauthenticate the user by calling
  /// `reauthenticate(with:)`.
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  open func delete() async throws {
    return try await auth.authWorker.delete(user: self)
  }

  /// Send an email to verify the ownership of the account then update to the new email.
  /// - Parameter email: The email to be updated to.
  /// - Parameter completion: Optionally; the block invoked when the request to send the
  /// verification email is complete, or fails.
  @objc(sendEmailVerificationBeforeUpdatingEmail:completion:)
  open func __sendEmailVerificationBeforeUpdating(email: String, completion: ((Error?) -> Void)?) {
    sendEmailVerification(beforeUpdatingEmail: email, completion: completion)
  }

  /// Send an email to verify the ownership of the account then update to the new email.
  /// - Parameter email: The email to be updated to.
  /// - Parameter actionCodeSettings: An `ActionCodeSettings` object containing settings related to
  ///    handling action codes.
  /// - Parameter completion: Optionally; the block invoked when the request to send the
  /// verification email is complete, or fails.
  @objc open func sendEmailVerification(beforeUpdatingEmail email: String,
                                        actionCodeSettings: ActionCodeSettings? = nil,
                                        completion: ((Error?) -> Void)? = nil) {
    Task {
      do {
        try await sendEmailVerification(beforeUpdatingEmail: email,
                                        actionCodeSettings: actionCodeSettings)
        await MainActor.run {
          completion?(nil)
        }
      } catch {
        await MainActor.run {
          completion?(error)
        }
      }
    }
  }

  /// Send an email to verify the ownership of the account then update to the new email.
  /// - Parameter email: The email to be updated to.
  /// - Parameter actionCodeSettings: An `ActionCodeSettings` object containing settings related to
  ///    handling action codes.
  @available(iOS 13, tvOS 13, macOS 10.15, macCatalyst 13, watchOS 7, *)
  open func sendEmailVerification(beforeUpdatingEmail newEmail: String,
                                  actionCodeSettings: ActionCodeSettings? = nil) async throws {
    return try await auth.authWorker.sendEmailVerification(
      user: self,
      beforeUpdatingEmail: newEmail,
      actionCodeSettings: actionCodeSettings
    )
  }

  // MARK: Internal implementations below

  func rawAccessToken() -> String {
    return tokenService.accessToken
  }

  func accessTokenExpirationDate() -> Date? {
    return tokenService.accessTokenExpirationDate
  }

  init(withTokenService tokenService: SecureTokenService) {
    providerDataRaw = [:]
    taskQueue = AuthSerialTaskQueue()
    self.tokenService = tokenService
    isAnonymous = false
    isEmailVerified = false
    metadata = UserMetadata(withCreationDate: nil, lastSignInDate: nil)
    tenantID = nil
    #if os(iOS)
      multiFactor = MultiFactor(withMFAEnrollments: [])
    #endif
    uid = ""
    hasEmailPasswordCredential = false
    requestConfiguration = AuthRequestConfiguration(apiKey: "", appID: "")
  }

  class func retrieveUser(withAuth auth: Auth,
                          accessToken: String?,
                          accessTokenExpirationDate: Date?,
                          refreshToken: String?,
                          anonymous: Bool) async throws -> User {
    guard let accessToken = accessToken,
          let refreshToken = refreshToken else {
      fatalError("Internal FirebaseAuth Error: nil token")
    }
    let tokenService = SecureTokenService(withRequestConfiguration: auth.requestConfiguration,
                                          accessToken: accessToken,
                                          accessTokenExpirationDate: accessTokenExpirationDate,
                                          refreshToken: refreshToken)
    let user = User(withTokenService: tokenService)
    user.auth = auth
    user.tenantID = auth.tenantID
    user.requestConfiguration = auth.requestConfiguration
    let accessToken2 = try await user.internalGetToken()
    let getAccountInfoRequest = GetAccountInfoRequest(
      accessToken: accessToken2,
      requestConfiguration: user.requestConfiguration
    )
    let response = try await AuthBackend.call(with: getAccountInfoRequest)
    user.isAnonymous = anonymous
    user.update(withGetAccountInfoResponse: response)
    return user
  }

  @objc open var providerID: String {
    return "Firebase"
  }

  /// The provider's user ID for the user.
  @objc open var uid: String

  /// The name of the user.
  @objc open var displayName: String?

  /// The URL of the user's profile photo.
  @objc open var photoURL: URL?

  /// The user's email address.
  @objc open var email: String?

  /// A phone number associated with the user.
  ///
  /// This property is only available for users authenticated via phone number auth.
  @objc open var phoneNumber: String?

  /// Whether or not the user can be authenticated by using Firebase email and password.
  var hasEmailPasswordCredential: Bool

  /// Used to serialize the update profile calls.
  private var taskQueue: AuthSerialTaskQueue

  /// A strong reference to a requestConfiguration instance associated with this user instance.
  var requestConfiguration: AuthRequestConfiguration

  /// A secure token service associated with this user. For performing token exchanges and
  ///   refreshing access tokens.
  var tokenService: SecureTokenService

  private weak var _auth: Auth?

  /// A weak reference to an `Auth` instance associated with this instance.
  weak var auth: Auth! {
    set {
      _auth = newValue
      guard let requestConfiguration = auth?.requestConfiguration else {
        fatalError("Firebase Auth Internal Error: nil requestConfiguration when initializing User")
      }
      tokenService.requestConfiguration = requestConfiguration
      self.requestConfiguration = requestConfiguration
    }
    get { return _auth }
  }

  // MARK: Private functions

  /// Sets a new token service for the `User` instance.
  ///
  /// The method makes sure the token service has access and refresh token and the new tokens
  /// are saved in the keychain before calling back.
  /// - Parameter tokenService: The new token service object.
  /// - Parameter callback: The block to be called in the global auth working queue once finished.
  func setTokenService(tokenService: SecureTokenService,
                       callback: @escaping (Error?) -> Void) {
    tokenService.fetchAccessToken(forcingRefresh: false) { token, error, tokenUpdated in
      if let error {
        callback(error)
        return
      }
      self.tokenService = tokenService
      if let error = self.updateKeychain() {
        callback(error)
        return
      }
      callback(nil)
    }
  }

  /// Sets a new token service for the `User` instance.
  ///
  /// The method makes sure the token service has access and refresh token and the new tokens
  /// are saved in the keychain before calling back.
  /// - Parameter tokenService: The new token service object.
  func setTokenService(tokenService: SecureTokenService) async throws {
    self.tokenService = tokenService
    if let error = updateKeychain() {
      throw error
    }
  }

  func update(withGetAccountInfoResponse response: GetAccountInfoResponse) {
    guard let user = response.users?.first else {
      // Silent fallthrough in ObjC code.
      AuthLog.logWarning(code: "I-AUT000016", message: "Missing user in GetAccountInfoResponse")
      return
    }
    uid = user.localID ?? ""
    email = user.email
    isEmailVerified = user.emailVerified
    displayName = user.displayName
    photoURL = user.photoURL
    phoneNumber = user.phoneNumber
    hasEmailPasswordCredential = user.passwordHash != nil && user.passwordHash!.count > 0
    metadata = UserMetadata(withCreationDate: user.creationDate,
                            lastSignInDate: user.lastLoginDate)
    var providerData: [String: UserInfoImpl] = [:]
    if let providerUserInfos = user.providerUserInfo {
      for providerUserInfo in providerUserInfos {
        let userInfo = UserInfoImpl.userInfo(
          withGetAccountInfoResponseProviderUserInfo: providerUserInfo
        )
        if let providerID = providerUserInfo.providerID {
          providerData[providerID] = userInfo
        }
      }
    }
    providerDataRaw = providerData
    #if os(iOS)
      if let enrollments = user.mfaEnrollments {
        multiFactor = MultiFactor(withMFAEnrollments: enrollments)
      }
      multiFactor.user = self
    #endif
  }

  /// Signs out this user if the user or the token is invalid.
  /// - Parameter error: The error from the server.
  func signOutIfTokenIsInvalid(withError error: Error) {
    let code = (error as NSError).code
    if code == AuthErrorCode.userNotFound.rawValue ||
      code == AuthErrorCode.userDisabled.rawValue ||
      code == AuthErrorCode.invalidUserToken.rawValue ||
      code == AuthErrorCode.userTokenExpired.rawValue {
      AuthLog.logNotice(code: "I-AUT000016",
                        message: "Invalid user token detected, user is automatically signed out.")
      try? auth?.signOutByForce(withUserID: uid)
    }
  }

  func internalGetToken(forceRefresh: Bool = false) async throws -> String {
    do {
      let (token, tokenUpdated) = try await tokenService.fetchAccessToken(
        user: self,
        forcingRefresh: forceRefresh
      )
      if tokenUpdated {
        if let error = updateKeychain() {
          throw error
        }
      }
      return token!
    } catch {
      signOutIfTokenIsInvalid(withError: error)
      throw error
    }
  }

  /// Updates the keychain for user token or info changes.
  /// - Returns: An `Error` on failure.
  func updateKeychain() -> Error? {
    return auth?.updateKeychain(withUser: self)
  }

  // MARK: NSSecureCoding

  private let kUserIDCodingKey = "userID"
  private let kHasEmailPasswordCredentialCodingKey = "hasEmailPassword"
  private let kAnonymousCodingKey = "anonymous"
  private let kEmailCodingKey = "email"
  private let kPhoneNumberCodingKey = "phoneNumber"
  private let kEmailVerifiedCodingKey = "emailVerified"
  private let kDisplayNameCodingKey = "displayName"
  private let kPhotoURLCodingKey = "photoURL"
  private let kProviderDataKey = "providerData"
  private let kAPIKeyCodingKey = "APIKey"
  private let kFirebaseAppIDCodingKey = "firebaseAppID"
  private let kTokenServiceCodingKey = "tokenService"
  private let kMetadataCodingKey = "metadata"
  private let kMultiFactorCodingKey = "multiFactor"
  private let kTenantIDCodingKey = "tenantID"

  public static var supportsSecureCoding: Bool {
    return true
  }

  public func encode(with coder: NSCoder) {
    coder.encode(uid, forKey: kUserIDCodingKey)
    coder.encode(isAnonymous, forKey: kAnonymousCodingKey)
    coder.encode(hasEmailPasswordCredential, forKey: kHasEmailPasswordCredentialCodingKey)
    coder.encode(providerDataRaw, forKey: kProviderDataKey)
    coder.encode(email, forKey: kEmailCodingKey)
    coder.encode(phoneNumber, forKey: kPhoneNumberCodingKey)
    coder.encode(isEmailVerified, forKey: kEmailVerifiedCodingKey)
    coder.encode(photoURL, forKey: kPhotoURLCodingKey)
    coder.encode(displayName, forKey: kDisplayNameCodingKey)
    coder.encode(metadata, forKey: kMetadataCodingKey)
    coder.encode(tenantID, forKey: kTenantIDCodingKey)
    if let auth {
      coder.encode(auth.requestConfiguration.apiKey, forKey: kAPIKeyCodingKey)
      coder.encode(auth.requestConfiguration.appID, forKey: kFirebaseAppIDCodingKey)
    }
    coder.encode(tokenService, forKey: kTokenServiceCodingKey)
    #if os(iOS)
      coder.encode(multiFactor, forKey: kMultiFactorCodingKey)
    #endif
  }

  public required init?(coder: NSCoder) {
    guard let userID = coder.decodeObject(of: NSString.self, forKey: kUserIDCodingKey) as? String,
          let apiKey = coder.decodeObject(of: NSString.self, forKey: kAPIKeyCodingKey) as? String,
          let appID = coder.decodeObject(
            of: NSString.self,
            forKey: kFirebaseAppIDCodingKey
          ) as? String,
          let tokenService = coder.decodeObject(of: SecureTokenService.self,
                                                forKey: kTokenServiceCodingKey) else {
      return nil
    }
    let anonymous = coder.decodeBool(forKey: kAnonymousCodingKey)
    let hasEmailPasswordCredential = coder.decodeBool(forKey: kHasEmailPasswordCredentialCodingKey)
    let displayName = coder.decodeObject(
      of: NSString.self,
      forKey: kDisplayNameCodingKey
    ) as? String
    let photoURL = coder.decodeObject(of: NSURL.self, forKey: kPhotoURLCodingKey) as? URL
    let email = coder.decodeObject(of: NSString.self, forKey: kEmailCodingKey) as? String
    let phoneNumber = coder.decodeObject(
      of: NSString.self,
      forKey: kPhoneNumberCodingKey
    ) as? String
    let emailVerified = coder.decodeBool(forKey: kEmailVerifiedCodingKey)
    let classes = [NSDictionary.self, NSString.self, UserInfoImpl.self]
    let providerData = coder.decodeObject(of: classes, forKey: kProviderDataKey)
      as? [String: UserInfoImpl]
    let metadata = coder.decodeObject(of: UserMetadata.self, forKey: kMetadataCodingKey)
    let tenantID = coder.decodeObject(of: NSString.self, forKey: kTenantIDCodingKey) as? String
    #if os(iOS)
      let multiFactor = coder.decodeObject(of: MultiFactor.self, forKey: kMultiFactorCodingKey)
    #endif
    self.tokenService = tokenService
    uid = userID
    isAnonymous = anonymous
    self.hasEmailPasswordCredential = hasEmailPasswordCredential
    self.email = email
    isEmailVerified = emailVerified
    self.displayName = displayName
    self.photoURL = photoURL
    providerDataRaw = providerData ?? [:]
    self.phoneNumber = phoneNumber
    self.metadata = metadata ?? UserMetadata(withCreationDate: nil, lastSignInDate: nil)
    self.tenantID = tenantID
    // The `heartbeatLogger` and `appCheck` will be set later via a property update.
    requestConfiguration = AuthRequestConfiguration(apiKey: apiKey, appID: appID)
    taskQueue = AuthSerialTaskQueue()
    #if os(iOS)
      self.multiFactor = multiFactor ?? MultiFactor()
      super.init()
      multiFactor?.user = self
    #endif
  }
}