I would like to do password resets exclusively through firebase functions so I can impose stricter rules (as there is no way to change the rules through firebase auth API) and run other logic
I can update user passwords ok through functions, but clients can always call the firebase api to send a password reset email or update their password directly. Is there a way to disable these, like how you can disable client-side account creation & deletion?