passbolt-browser-extension 3.0.6 → 4.6.2

package/src/all/background_page/model/user.js

@@ -1,41 +1,26 @@
-"use strict";
 /**
  * User model.
  *
  * @copyright (c) 2017 Passbolt SARL
  * @licence GNU Affero General Public License http://www.gnu.org/licenses/agpl-3.0.en.html
  */
-const browser = require("webextension-polyfill/dist/browser-polyfill");
-const Config = require('./config');
-const {ApiClientOptions} = require('../service/api/apiClient/apiClientOptions');
-const {UserService} = require('../service/api/user/userService');
-const {UserSettings} = require('./userSettings/userSettings');
-const __ = require('../sdk/l10n').get;
+import {Config} from "./config";
+import UserSettings from "./userSettings/userSettings";
+import {ApiClientOptions} from "passbolt-styleguide/src/shared/lib/apiClient/apiClientOptions";
+import Validator from "validator";
+import {ValidatorRule} from "../utils/validatorRules";
+import PassphraseStorageService from "../service/session_storage/passphraseStorageService";
 
 /**
  * The class that deals with users.
  */
-const User = (function () {
-
+const User = (function() {
   // see model/settings
   this.settings = new UserSettings();
 
   // the fields
   this._user = {};
 
-  /*
-   * _masterpassword be a json object with :
-   * - password: value of master password
-   * - created: timestamp when it was stored
-   * - timeout: interval function before passphrase is flushed
-   */
-  this._masterPassword = null;
-
-  /*
-   * Interval function to keep session alive
-   */
-  this._sessionKeepAliveTimeout = null;
-
   /*
    * _csrfToken The user current csrf token.
    */
@@ -49,18 +34,18 @@ const User = (function () {
    * @returns {object} The user in case of success
    * @throw Error if the user is not valid
    */
-  this.validate = function (user, fields) {
+  this.validate = function(user, fields) {
     if (typeof fields === 'undefined') {
       fields = ['id', 'username', 'firstname', 'lastname'];
     }
 
-    var errors = [];
-    for (var i in fields) {
-      var fieldName = fields[i];
+    const errors = [];
+    for (const i in fields) {
+      const fieldName = fields[i];
       try {
         this.__validate(fieldName, user[fieldName]);
       } catch (e) {
-        var fieldError = {};
+        const fieldError = {};
         fieldError[fieldName] = e.message;
         errors.push(fieldError);
       }
@@ -68,7 +53,7 @@ const User = (function () {
 
     if (errors.length > 0) {
       // Return exception with details in validationErrors.
-      var e = new Error(__('user could not be validated'));
+      const e = new Error('user could not be validated');
       // Add validation errors to the error object.
       e.validationErrors = errors;
       throw e;
@@ -86,52 +71,56 @@ const User = (function () {
    * @throw Error if the field is not valid
    * @private
    */
-  this.__validate = function (field, value) {
+  this.__validate = function(field, value) {
     switch (field) {
       case 'firstname':
         if (typeof value === 'undefined' || value === '') {
-          throw new Error(__('The first name cannot be empty'));
+          throw new Error('The first name cannot be empty');
         }
-        if (!Validator.isUtf8(value)) {
-          throw new Error(__('The first name should be a valid UTF8 string'))
+        if (!ValidatorRule.isUtf8(value)) {
+          throw new Error('The first name should be a valid UTF8 string');
         }
         if (!Validator.isLength(value, 0, 255)) {
-          throw new Error(__('The first name length should be maximum 255 characters.'))
+          throw new Error('The first name length should be maximum 255 characters.');
         }
         break;
       case 'lastname':
         if (typeof value === 'undefined' || value === '') {
-          throw new Error(__('The last name cannot be empty'));
+          throw new Error('The last name cannot be empty');
         }
-        if (!Validator.isUtf8(value)) {
-          throw new Error(__('The last name should be a valid UTF8 string'))
+        if (!ValidatorRule.isUtf8(value)) {
+          throw new Error('The last name should be a valid UTF8 string');
         }
         if (!Validator.isLength(value, 0, 255)) {
-          throw new Error(__('The last name length should be maximum 255 characters.'))
+          throw new Error('The last name length should be maximum 255 characters.');
         }
         break;
       case 'username':
         if (typeof value === 'undefined' || value === '') {
-          throw new Error(__('The username cannot be empty'));
+          throw new Error('The username cannot be empty');
         }
-        if (!Validator.isEmail(value)) {
-          throw new Error(__('The username should be a valid email address'))
+        /*
+         * @deprecated the username could be validated using a custom application setting.
+         * This validation will soon be removed as entities are validating content when the
+         * user is retrieved from or saved in the local storage.
+         */
+        if (!ValidatorRule.isUtf8(value)) {
+          throw new Error('The username should be a valid email address');
         }
         if (!Validator.isLength(value, 0, 255)) {
-          throw new Error(__('The username length should be maximum 255 characters.'))
+          throw new Error('The username length should be maximum 255 characters.');
         }
         break;
       case 'id':
         if (typeof value === 'undefined' || value === '') {
-          throw new Error(__('The user id cannot be empty'));
+          throw new Error('The user id cannot be empty');
         }
         if (!Validator.isUUID(value)) {
-          throw new Error(__('The user id should be a valid UUID'))
+          throw new Error('The user id should be a valid UUID');
         }
         break;
       default:
-        throw new Error(__('No validation defined for field: ' + field));
-        break;
+        throw new Error(`No validation defined for field: ${field}`);
     }
     return true;
   };
@@ -144,7 +133,7 @@ const User = (function () {
    * @return {bool}
    * @throw Error if the firsname or the lastname are not valid
    */
-  this.setName = function (firstname, lastname) {
+  this.setName = function(firstname, lastname) {
     this.__validate('firstname', firstname);
     this.__validate('lastname', lastname);
     this._user.lastname = lastname;
@@ -160,7 +149,7 @@ const User = (function () {
    * @return {bool}
    * @throw Error if the username is not valid
    */
-  this.setUsername = function (username) {
+  this.setUsername = function(username) {
     this.__validate('username', username);
     this._user.username = username;
     return (Config.write('user.username', username));
@@ -173,7 +162,7 @@ const User = (function () {
    * @return {bool}
    * @throw Error if the user id is not valid
    */
-  this.setId = function (id) {
+  this.setId = function(id) {
     this.__validate('id', id);
     this._user.id = id;
     return (Config.write('user.id', id));
@@ -186,9 +175,9 @@ const User = (function () {
    * @return {object} The user
    * @throw Error if the user information are not valid
    */
-  this.set = function (user) {
+  this.set = function(user) {
     if (typeof user === 'undefined') {
-      throw new Error(__('The user cannot be empty'));
+      throw new Error('The user cannot be empty');
     }
     this.setId(user.id);
     this.setUsername(user.username);
@@ -216,30 +205,26 @@ const User = (function () {
    * @return {object}
    * @throw Error if the user or the setting are not valid
    */
-  this.get = function (data) {
+  this.get = function(data) {
     try {
-
       if (typeof data !== 'undefined' && typeof data.user !== 'undefined') {
         this._getLocal(data.user);
-      }
-      else {
+      } else {
         this._getLocal();
       }
-      var user = this._user;
+      const user = this._user;
 
       // Get settings according to data provided.
       if (typeof data !== 'undefined' && typeof data.user !== 'undefined' && typeof data.settings !== 'undefined') {
         user.settings = this.settings.get(data.settings);
-      }
-      // If no data is provided, get everything.
-      else if (typeof data === 'undefined') {
+      } else if (typeof data === 'undefined') {
+        // If no data is provided, get everything.
         user.settings = this.settings.get();
       }
 
       return user;
-
     } catch (e) {
-      throw new Error(__('The user is not set'));
+      throw new Error('The user is not set');
     }
   };
 
@@ -251,9 +236,9 @@ const User = (function () {
    * @return {object}
    * @throw Exception in case a data doesn't validate before being returned
    */
-  this._getLocal = function (fields) {
+  this._getLocal = function(fields) {
     // Default data to return for user.
-    var userDefaultFields = [
+    const userDefaultFields = [
       "id",
       "username",
       "firstname",
@@ -266,15 +251,15 @@ const User = (function () {
     }
 
     // For each user data requested, try to retrieve it and validate it.
-    for (var i in fields) {
-      var varName = fields[i];
-      this._user[varName] = Config.read('user.' + varName);
+    for (const i in fields) {
+      const varName = fields[i];
+      this._user[varName] = Config.read(`user.${varName}`);
 
       try {
         this.__validate(varName, this._user[varName]);
       } catch (e) {
         this._user[varName] = {};
-        throw new Error(__('The user is not set'));
+        throw new Error('The user is not set');
       }
     }
 
@@ -286,7 +271,7 @@ const User = (function () {
    *
    * @returns {boolean}
    */
-  this.isValid = function () {
+  this.isValid = function() {
     try {
       this.get();
     } catch (e) {
@@ -295,85 +280,14 @@ const User = (function () {
     return this.settings.isValid();
   };
 
-  /**
-   * Store the master password temporarily.
-   *
-   * @param masterPassword {string} The master password to store.
-   * @param seconds {int} seconds Remember the master password for X seconds. If -1 given,
-   * store the master password until the end of the session.
-   */
-  this.storeMasterPasswordTemporarily = function (masterPassword, seconds) {
-    this.flushMasterPassword();
-    this._masterPassword = {
-      "password": masterPassword,
-      "created": Math.round(new Date().getTime() / 1000.0),
-      "timeout": null
-    };
-
-    // If the seconds parameters is not equal to -1, set a timeout to flush the master passphrase at the end
-    // of the defined period. If it is set to -1 it will be flushed based on the passbolt.auth.after-logout
-    // event or when the browser is closed.
-    if (seconds !== -1) {
-      this._masterPassword.timeout = setTimeout(() => {
-        this.flushMasterPassword();
-      }, seconds * 1000);
-    }
-    if (this._sessionKeepAliveTimeout === null) {
-      this.setKeepAliveTimeout();
-    }
-  };
-
-  /**
-   * Flush the master password if any stored during a previous session
-   * Also stop keeping the session alive if needed
-   */
-  this.flushMasterPassword = function () {
-    if (this._masterPassword && this._masterPassword.timeout) {
-      clearTimeout(this._masterPassword.timeout);
-    }
-    if (this._sessionKeepAliveTimeout) {
-      clearTimeout(this._sessionKeepAliveTimeout);
-    }
-    this._sessionKeepAliveTimeout = null;
-    this._masterPassword = null;
-  };
-
-  /**
-   * @return void
-   */
-  this.setKeepAliveTimeout = function () {
-    this._sessionKeepAliveTimeout = setTimeout( () => {
-      this.keepAlive();
-    }, 15 * 60 * 1000); // check every 15 minutes
-  };
-
-  /**
-   * Keep session alive if user's system is active for last 15 min
-   * @returns void
-   */
-  this.keepAlive = function() {
-    const idleInterval = 15 * 60; // detection interval in sec: 15 minutes
-    browser.idle.queryState(idleInterval).then( async (idleState) => {
-      if (idleState === 'active' && this._masterPassword !== null) {
-        const apiClientOptions = await this.getApiClientOptions();
-        const userService = new UserService(apiClientOptions)
-        await userService.keepSessionAlive();
-      }
-      this.setKeepAliveTimeout();
-    });
-  };
-
   /**
    * Retrieve and the store the user csrf token.
-   * @return {void}
+   * @return {Promise<void>}
    */
-  this.retrieveAndStoreCsrfToken = async function () {
-    // Don't use the getApiClientOptions. It will create a loop as it calls this method to retrieve the csrf token.
-    const apiClientOptions = (new ApiClientOptions())
-      .setBaseUrl(this.settings.getDomain());
-    const userService = new UserService(apiClientOptions)
-    const csrfToken = await userService.findCsrfToken();
-    this.setCsrfToken(csrfToken);
+  this.retrieveAndStoreCsrfToken = async function() {
+    const url = this.settings.getDomain().slice(-1) === "/" ? this.settings.getDomain() : `${this.settings.getDomain()}/`;
+    const csrfToken = await browser.cookies.get({name: "csrfToken", url: url});
+    this.setCsrfToken(csrfToken?.value);
   };
 
   /**
@@ -381,7 +295,7 @@ const User = (function () {
    *
    * @return {string}
    */
-  this.getCsrfToken = function () {
+  this.getCsrfToken = function() {
     return this._csrfToken;
   };
 
@@ -402,80 +316,53 @@ const User = (function () {
    *
    * @param {string} csrfToken The csrf token to set
    */
-  this.setCsrfToken = function (csrfToken) {
+  this.setCsrfToken = function(csrfToken) {
     this._csrfToken = csrfToken;
   };
 
   /**
-   * Return API Client options such as Domain and CSRF token
-   * @param {object?} options (optional)
-   * - requireCsrfToken {bool}: Should the csrf token should be set, default true
+   * Return API Client options such as Domain.
    * @return {ApiClientOptions} apiClientOptions
    */
-  this.getApiClientOptions = async function(options) {
-    options = Object.assign({
-      requireCsrfToken: true,
-    }, options);
-
-    const apiClientOptions = (new ApiClientOptions())
+  this.getApiClientOptions = async function() {
+    return new ApiClientOptions()
       .setBaseUrl(this.settings.getDomain());
-
-    if (options.requireCsrfToken) {
-      apiClientOptions.setCsrfToken(await this.getOrFetchCsrfToken());
-    }
-
-    return apiClientOptions;
   };
 
   /**
-   * Check if the master password is stored.
-   * @return {boolean}
+   * Update the security token
+   * @param token {{code: string, color: string, textColor: string}} The security token
    */
-  this.isMasterPasswordStored = function () {
-    return this._masterPassword !== null;
+  this.updateSecurityToken = async function(token) {
+    this.settings.setSecurityToken(token);
   };
-
-  /**
-   * Retrieve master password from memory, in case it was stored temporarily
-   * by the user.
-   * @returns {Promise}
-   */
-  this.getStoredMasterPassword = function () {
-    return new Promise((resolve, reject) => {
-      if (this.isMasterPasswordStored()) {
-        resolve(this._masterPassword.password);
-      } else {
-        reject(new Error(__('No master password stored.')));
-      }
-    });
-  };
-
 });
 
-var UserSingleton = (function () {
-  var instance;
+const UserSingleton = (function() {
+  let instance;
 
   function createInstance() {
     return new User();
   }
 
   return {
-    getInstance: function () {
+    getInstance: function() {
       if (!instance) {
         instance = createInstance();
       }
       return instance;
     },
 
-    init : function () {
-      // Observe when the user session is terminated.
-      // - Flush the temporary stored master password
-      window.addEventListener("passbolt.auth.after-logout", () => {
-        const user = UserSingleton.getInstance();
-        user.flushMasterPassword();
-      });
+    init: function() {
+      /*
+       * Observe when the user session is terminated.
+       * - Flush the temporary stored master password
+       */
+      self.addEventListener("passbolt.auth.after-logout", async() =>
+        await PassphraseStorageService.flush()
+      );
     }
   };
 })();
 
-exports.User = UserSingleton;
+export default UserSingleton;

package/src/all/background_page/model/userPassphrasePolicies/userPassphrasePoliciesModel.js

@@ -0,0 +1,57 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         4.3.0
+ */
+
+import UserPassphrasePoliciesService from "../../service/api/userPassphrasePolicies/userPassphrasePoliciesService";
+import {assertType} from "../../utils/assertions";
+import UserPassphrasePoliciesEntity from "passbolt-styleguide/src/shared/models/entity/userPassphrasePolicies/userPassphrasePoliciesEntity";
+
+class UserPassphrasePoliciesModel {
+  /**
+   * Constructor
+   *
+   * @param {ApiClientOptions} apiClientOptions
+   * @public
+   */
+  constructor(apiClientOptions) {
+    this.userPassphrasePoliciesService = new UserPassphrasePoliciesService(apiClientOptions);
+  }
+
+  /**
+   * Find the current user passphrase policies from the API.
+   * @returns {Promise<UserPassphrasePoliciesEntity>}
+   */
+  async findOrDefault() {
+    let userPassphrasePoliciesDto = null;
+    try {
+      userPassphrasePoliciesDto = await this.userPassphrasePoliciesService.find();
+      return UserPassphrasePoliciesEntity.createFromDefault(userPassphrasePoliciesDto);
+    } catch (error) {
+      console.error(error);
+    }
+    return UserPassphrasePoliciesEntity.createFromDefault();
+  }
+
+  /**
+   * Saves a user passphrase policies on the API.
+   * @param {UserPassphrasePoliciesEntity} userPassphrasePoliciesEntity the entity to register
+   * @returns {Promise<UserPassphrasePoliciesEntity>}
+   */
+  async save(userPassphrasePoliciesEntity) {
+    assertType(userPassphrasePoliciesEntity, UserPassphrasePoliciesEntity, 'The given entity is not a UserPassphrasePoliciesEntity');
+    const userPassphrasePoliciesDto = await this.userPassphrasePoliciesService.create(userPassphrasePoliciesEntity);
+    return UserPassphrasePoliciesEntity.createFromDefault(userPassphrasePoliciesDto);
+  }
+}
+
+export default UserPassphrasePoliciesModel;

package/src/all/background_page/model/userPassphrasePolicies/userPassphrasePoliciesModel.test.js

@@ -0,0 +1,136 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         4.3.0
+ */
+
+import {enableFetchMocks} from "jest-fetch-mock";
+import AccountEntity from "../entity/account/accountEntity";
+import BuildApiClientOptionsService from "../../service/account/buildApiClientOptionsService";
+import {defaultAccountDto} from "../entity/account/accountEntity.test.data";
+import {mockApiResponse, mockApiResponseError} from "../../../../../test/mocks/mockApiResponse";
+import UserPassphrasePoliciesModel from "./userPassphrasePoliciesModel";
+import UserPassphrasePoliciesEntity from "passbolt-styleguide/src/shared/models/entity/userPassphrasePolicies/userPassphrasePoliciesEntity";
+import {defaultUserPassphrasePoliciesDto, userPassphrasePoliciesDtoFromApi} from "passbolt-styleguide/src/shared/models/entity/userPassphrasePolicies/userPassphrasePoliciesEntity.test.data";
+import PassboltApiFetchError from "passbolt-styleguide/src/shared/lib/Error/PassboltApiFetchError";
+import PassboltServiceUnavailableError from "passbolt-styleguide/src/shared/lib/Error/PassboltServiceUnavailableError";
+import PasswordPoliciesEntity from "../entity/passwordPolicies/passwordPoliciesEntity";
+
+describe("UserPassphrasePolicies model", () => {
+  let apiClientOptions;
+  beforeEach(async() => {
+    enableFetchMocks();
+    fetch.resetMocks();
+    jest.spyOn(browser.cookies, "get").mockImplementationOnce(() => ({value: "csrf-token"}));
+
+    const account = new AccountEntity(defaultAccountDto());
+    apiClientOptions = await BuildApiClientOptionsService.buildFromAccount(account);
+  });
+
+  describe('::findOrDefault', () => {
+    it("should return the value stored on the API", async() => {
+      expect.assertions(1);
+      const expectedDto = defaultUserPassphrasePoliciesDto({
+        entropy_minimum: 112
+      });
+      const expectedEntity = new UserPassphrasePoliciesEntity(expectedDto);
+      fetch.doMockOnceIf(/user-passphrase-policies\/settings\.json/, () => mockApiResponse(expectedDto));
+
+      const model = new UserPassphrasePoliciesModel(apiClientOptions);
+      const result = await model.findOrDefault();
+
+      expect(result).toStrictEqual(expectedEntity);
+    });
+
+    it("should return a default entity if the API returns an HTTP error", async() => {
+      expect.assertions(1);
+      const expectedEntity = UserPassphrasePoliciesEntity.createFromDefault();
+      fetch.doMockOnceIf(/user-passphrase-policies\/settings\.json/, () => mockApiResponseError(404, "Endpoint is not existing"));
+
+      const model = new UserPassphrasePoliciesModel(apiClientOptions);
+      const result = await model.findOrDefault();
+
+      expect(result).toStrictEqual(expectedEntity);
+    });
+
+    it("should return a default entity if something goes wrong on the API", async() => {
+      expect.assertions(1);
+      const expectedEntity = UserPassphrasePoliciesEntity.createFromDefault();
+      fetch.doMockOnceIf(/user-passphrase-policies\/settings\.json/, () => { throw new Error("Something went wrong"); });
+
+      const model = new UserPassphrasePoliciesModel(apiClientOptions);
+      const result = await model.findOrDefault();
+
+      expect(result).toStrictEqual(expectedEntity);
+    });
+  });
+
+  describe('::save', () => {
+    it("should save the entity and return the stored value from the API", async() => {
+      expect.assertions(2);
+      const baseData = {
+        entropy_minimum: 112,
+        external_dictionary_check: false
+      };
+      const dtoToSave = defaultUserPassphrasePoliciesDto(baseData);
+      const entityToSave = new UserPassphrasePoliciesEntity(dtoToSave);
+
+      const expectedDto = userPassphrasePoliciesDtoFromApi(baseData);
+      const expectedEntity = new UserPassphrasePoliciesEntity(expectedDto);
+
+      fetch.doMockOnceIf(/user-passphrase-policies\/settings\.json/, async request => {
+        const body = JSON.parse(await request.text());
+        expect(body).toStrictEqual(dtoToSave);
+        return mockApiResponse(expectedDto);
+      });
+
+      const model = new UserPassphrasePoliciesModel(apiClientOptions);
+      const result = await model.save(entityToSave);
+
+      expect(result).toStrictEqual(expectedEntity);
+    });
+
+    it("should throw an Error if the data to save is invalid", async() => {
+      expect.assertions(1);
+
+      const model = new UserPassphrasePoliciesModel(apiClientOptions);
+      const entity = PasswordPoliciesEntity.createFromDefault();
+      const expectedError = new Error('The given entity is not a UserPassphrasePoliciesEntity');
+      expect(() => model.save(entity)).rejects.toThrow(expectedError);
+    });
+
+    it("should throw an Error if the API returns an HTTP error", async() => {
+      expect.assertions(1);
+      fetch.doMockOnceIf(/user-passphrase-policies\/settings\.json/, () => mockApiResponseError(500, "Endpoint is not existing"));
+
+      const model = new UserPassphrasePoliciesModel(apiClientOptions);
+      const entity = new UserPassphrasePoliciesEntity(defaultUserPassphrasePoliciesDto());
+      try {
+        await model.save(entity);
+      } catch (e) {
+        expect(e).toBeInstanceOf(PassboltApiFetchError);
+      }
+    });
+
+    it("should throw an Error if something goes wrong when request the API", async() => {
+      expect.assertions(1);
+      fetch.doMockOnceIf(/user-passphrase-policies\/settings\.json/, () => { throw new Error("Something went wrong"); });
+
+      const model = new UserPassphrasePoliciesModel(apiClientOptions);
+      const entity = new UserPassphrasePoliciesEntity(defaultUserPassphrasePoliciesDto());
+      try {
+        await model.save(entity);
+      } catch (e) {
+        expect(e).toBeInstanceOf(PassboltServiceUnavailableError);
+      }
+    });
+  });
+});