passbolt-browser-extension 3.0.6 → 4.6.2

package/src/all/background_page/controller/recover/generateRecoverAccountRecoveryRequestKeyController.test.js

@@ -0,0 +1,52 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import GenerateRecoverAccountRecoveryRequestKeyController from "./generateRecoverAccountRecoveryRequestKeyController";
+import {
+  initialAccountRecoverDto,
+  startAccountRecoverDto
+} from "../../model/entity/account/accountRecoverEntity.test.data";
+import AccountRecoverEntity from "../../model/entity/account/accountRecoverEntity";
+import MockExtension from "../../../../../test/mocks/mockExtension";
+import {defaultApiClientOptions} from "passbolt-styleguide/src/shared/lib/apiClient/apiClientOptions.test.data";
+
+describe("GenerateRecoverAccountRecoveryRequestKeyController", () => {
+  describe("GenerateRecoverAccountRecoveryRequestKeyController::exec", () => {
+    it("Should assert provided generate key pair dto is valid.", async() => {
+      await MockExtension.withConfiguredAccount();
+      const account = new AccountRecoverEntity(initialAccountRecoverDto());
+      const controller = new GenerateRecoverAccountRecoveryRequestKeyController(null, null, defaultApiClientOptions(), account);
+
+      expect.assertions(2);
+      const promise = controller.exec();
+      await expect(promise).rejects.toThrowError("Could not validate entity GenerateGpgKeyPairOptionsEntity.");
+      await expect(promise).rejects.toThrowEntityValidationErrorOnProperties(["passphrase", "email"]);
+    });
+
+    it("Should generate a key pair.", async() => {
+      await MockExtension.withConfiguredAccount();
+      const account = new AccountRecoverEntity(startAccountRecoverDto());
+      const controller = new GenerateRecoverAccountRecoveryRequestKeyController(null, null, defaultApiClientOptions(), account);
+
+      expect.assertions(3);
+      const generateKeyPairDto = {
+        passphrase: "passphrase"
+      };
+      await controller.exec(generateKeyPairDto);
+      expect(account.userPublicArmoredKey).not.toBeNull();
+      expect(account.userPrivateArmoredKey).not.toBeNull();
+      expect(account.userKeyFingerprint).not.toBeNull();
+    }, 20000);
+  });
+});

package/src/all/background_page/controller/recover/hasRecoverUserEnabledAccountRecoveryController.js

@@ -0,0 +1,51 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+class HasRecoverUserEnabledAccountRecoveryController {
+  /**
+   * GetRecoverLocaleController constructor.
+   * @param {Worker} worker The worker the controller is executed on.
+   * @param {string} requestId The associated request id.
+   * @param {AccountRecoverEntity} account The account being recovered.
+   */
+  constructor(worker, requestId, account) {
+    this.worker = worker;
+    this.requestId = requestId;
+    this.account = account;
+  }
+
+  /**
+   * Controller executor.
+   * @returns {Promise<void>}
+   */
+  async _exec() {
+    try {
+      const result = await this.exec();
+      this.worker.port.emit(this.requestId, 'SUCCESS', result);
+    } catch (error) {
+      console.error(error);
+      this.worker.port.emit(this.requestId, 'ERROR', error);
+    }
+  }
+
+  /**
+   * Check if the user has enabled account recovery
+   * @returns {Promise<boolean>}
+   */
+  async exec() {
+    return this.account?.user?.accountRecoveryUserSetting?.isApproved === true;
+  }
+}
+
+export default HasRecoverUserEnabledAccountRecoveryController;

package/src/all/background_page/controller/recover/hasRecoverUserEnabledAccountRecoveryController.test.js

@@ -0,0 +1,42 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import {
+  startAccountRecoverDto,
+  startWithApprovedAccountRecoveryAccountRecoverDto
+} from "../../model/entity/account/accountRecoverEntity.test.data";
+import AccountRecoverEntity from "../../model/entity/account/accountRecoverEntity";
+import HasRecoverUserEnabledAccountRecoveryController from "./hasRecoverUserEnabledAccountRecoveryController";
+
+describe("HasRecoverUserEnabledAccountRecoveryController", () => {
+  describe("HasRecoverUserEnabledAccountRecoveryController::exec", () => {
+    it("Should return true if the user has approved the program", async() => {
+      const account = new AccountRecoverEntity(startWithApprovedAccountRecoveryAccountRecoverDto());
+      const controller = new HasRecoverUserEnabledAccountRecoveryController(null, null, account);
+
+      expect.assertions(1);
+      const hasApproved = await controller.exec();
+      expect(hasApproved).toStrictEqual(true);
+    });
+
+    it("Should return false if the user didn't subscribe to the program yet", async() => {
+      const account = new AccountRecoverEntity(startAccountRecoverDto());
+      const controller = new HasRecoverUserEnabledAccountRecoveryController(null, null, account);
+
+      expect.assertions(1);
+      const hasApproved = await controller.exec();
+      expect(hasApproved).toStrictEqual(false);
+    });
+  });
+});

package/src/all/background_page/controller/recover/importRecoverPrivateKeyController.js

@@ -0,0 +1,86 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+import {OpenpgpAssertion} from "../../utils/openpgp/openpgpAssertions";
+import GpgAuth from "../../model/gpgauth";
+import GpgKeyError from "../../error/GpgKeyError";
+import i18n from "../../sdk/i18n";
+
+class ImportRecoverPrivateKeyController {
+  /**
+   * Constructor.
+   * @param {Worker} worker The associated worker.
+   * @param {string} requestId The associated request id.
+   * @param {AccountRecoverEntity} account The account being recovered.
+   */
+  constructor(worker, requestId, account) {
+    this.worker = worker;
+    this.requestId = requestId;
+    this.account = account;
+    this.legacyAuthModel = new GpgAuth();
+  }
+
+  /**
+   * Controller executor.
+   * @param {string} armoredKey The key to import
+   * @returns {Promise<void>}
+   */
+  async _exec(armoredKey) {
+    try {
+      await this.exec(armoredKey);
+      this.worker.port.emit(this.requestId, 'SUCCESS');
+    } catch (error) {
+      console.error(error);
+      this.worker.port.emit(this.requestId, 'ERROR', error);
+    }
+  }
+
+  /**
+   * Import user key.
+   * @param {string} armoredKey The key to import
+   * @returns {Promise<void>}
+   */
+  async exec(armoredKey) {
+    const privateKey = await OpenpgpAssertion.readKeyOrFail(armoredKey);
+    OpenpgpAssertion.assertPrivateKey(privateKey);
+    await this._assertImportKeyOwnedByUser(privateKey.getFingerprint().toUpperCase());
+    this.account.userPrivateArmoredKey = privateKey.armor();
+    this.account.userPublicArmoredKey = privateKey.toPublic().armor();
+  }
+
+  /**
+   * Assert import key is owned by the user doing the recover.
+   * @todo for now the function only check that the key is recognized by the server. The API does offer yet a way to verify that a key is associated to a user id.
+   * @param {string} fingerprint The import key fingerprint
+   * @returns {Promise<void>}
+   * @throws {GpgKeyError} If the key is already used
+   * @private
+   */
+  async _assertImportKeyOwnedByUser(fingerprint) {
+    const domain = this.account.domain;
+    const serverPublicArmoredKey = this.account.serverPublicArmoredKey;
+    if (!serverPublicArmoredKey) {
+      throw new Error('The server public key should have been provided before importing a private key');
+    }
+
+    try {
+      await this.legacyAuthModel.verify(domain, serverPublicArmoredKey, fingerprint);
+    } catch (error) {
+      console.error(error);
+      // @todo Handle not controlled errors, such as timeout error...
+      throw new GpgKeyError(i18n.t('This key does not match any account.'));
+    }
+  }
+}
+
+export default ImportRecoverPrivateKeyController;

package/src/all/background_page/controller/recover/importRecoverPrivateKeyController.test.js

@@ -0,0 +1,148 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+import {enableFetchMocks} from "jest-fetch-mock";
+import ImportRecoverPrivateKeyController from "./importRecoverPrivateKeyController";
+import GetGpgKeyInfoService from "../../service/crypto/getGpgKeyInfoService";
+import GpgKeyError from "../../error/GpgKeyError";
+import {pgpKeys} from "../../../../../test/fixtures/pgpKeys/keys";
+import MockExtension from "../../../../../test/mocks/mockExtension";
+import {
+  initialAccountRecoverDto,
+  withServerKeyAccountRecoverDto
+} from "../../model/entity/account/accountRecoverEntity.test.data";
+import AccountRecoverEntity from "../../model/entity/account/accountRecoverEntity";
+import {OpenpgpAssertion} from "../../utils/openpgp/openpgpAssertions";
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  enableFetchMocks();
+});
+
+/*
+ * global.crypto.getRandomValues is used by Uuid.get() method to generate random bytes.
+ * Here it is overridden to have control over the generated value and predict what GpgAuthToken
+ * will generate as a challenge to verify the identity of the server.
+ *
+ * In order to make sure that we don't brake future unit test that involved global.crypto, the
+ * global lib is cached before the override and then after the unit test set is done, we put the
+ * orginal crypto back where it should be.
+ */
+jest.spyOn(global.crypto, "getRandomValues").mockImplementation(size => size);
+
+describe("ImportRecoverPrivateKeyController", () => {
+  describe("ImportRecoverPrivateKeyController::exec", () => {
+    it("Should throw an exception if the passed DTO is not valid.", async() => {
+      const account = new AccountRecoverEntity(withServerKeyAccountRecoverDto());
+      const controller = new ImportRecoverPrivateKeyController(null, null, account);
+
+      const scenarios = [
+        {dto: null, expectedError: Error},
+        {dto: undefined, expectedError: Error},
+
+        {dto: true, expectedError: Error},
+        {dto: 1, expectedError: Error},
+        {dto: "", expectedError: Error},
+
+        {dto: {}, expectedError: Error},
+        {dto: pgpKeys.ada.public, expectedError: Error},
+      ];
+
+      expect.assertions(scenarios.length);
+
+      for (let i = 0; i < scenarios.length; i++) {
+        const scenario = scenarios[i];
+        try {
+          await controller.exec(scenario.dto);
+        } catch (e) {
+          expect(e).toBeInstanceOf(scenario.expectedError);
+        }
+      }
+    });
+
+    it("Should throw an exception if the setupEntity is not initialized properly.", async() => {
+      expect.assertions(1);
+      const account = new AccountRecoverEntity(initialAccountRecoverDto());
+      const controller = new ImportRecoverPrivateKeyController(null, null, account);
+      try {
+        await controller.exec(pgpKeys.ada.private);
+      } catch (e) {
+        expect(e).toStrictEqual(new Error('The server public key should have been provided before importing a private key'));
+      }
+    });
+
+    it("Should throw an exception if the process of verification fails.", async() => {
+      expect.assertions(1);
+      await MockExtension.withConfiguredAccount();
+
+      const mockedResponse = {
+        status: 200,
+        headers: {
+          'content-type': 'application/json',
+          'x-gpgauth-version': '1.3.0',
+          'x-gpgauth-error': true
+        }
+      };
+      fetch.mockResponseOnce({}, mockedResponse);
+
+      const account = new AccountRecoverEntity(withServerKeyAccountRecoverDto());
+      const controller = new ImportRecoverPrivateKeyController(null, null, account);
+      try {
+        await controller.exec(pgpKeys.ada.private);
+      } catch (e) {
+        expect(e).toStrictEqual(new GpgKeyError('This key does not match any account.'));
+      }
+    });
+
+    it("Should set the private key and public of the setup entity.", async() => {
+      expect.assertions(9);
+      await MockExtension.withConfiguredAccount();
+
+      const mockedResponse = {
+        status: 200,
+        headers: {
+          'content-type': 'application/json',
+          'x-gpgauth-version': '1.3.0',
+          'x-gpgauth-authenticated': false,
+          'x-gpgauth-progress': 'stage0',
+          'x-gpgauth-verify-response': "gpgauthv1.3.0|36|AAAAAAAA-AAAA-3AAA-aAAA-AAAAAAAAAAAA|gpgauthv1.3.0"
+        }
+      };
+      fetch.mockResponseOnce({}, mockedResponse);
+      const expectedKeyData = pgpKeys.ada;
+      const account = new AccountRecoverEntity(withServerKeyAccountRecoverDto());
+      const controller = new ImportRecoverPrivateKeyController(null, null, account);
+
+      await controller.exec(expectedKeyData.private);
+
+      const accountPrivateKey = await OpenpgpAssertion.readKeyOrFail(account.userPrivateArmoredKey);
+      const accountPublicKey = await OpenpgpAssertion.readKeyOrFail(account.userPublicArmoredKey);
+      const publicKeyInfo = await GetGpgKeyInfoService.getKeyInfo(accountPublicKey);
+      const privateKeyInfo = await GetGpgKeyInfoService.getKeyInfo(accountPrivateKey);
+
+      expect(privateKeyInfo.fingerprint).toBe(expectedKeyData.fingerprint);
+      expect(publicKeyInfo.fingerprint).toBe(expectedKeyData.fingerprint);
+
+      expect(publicKeyInfo.private).toBe(false);
+      expect(privateKeyInfo.private).toBe(true);
+
+      expect(publicKeyInfo.length).toBe(expectedKeyData.length);
+      expect(privateKeyInfo.length).toBe(expectedKeyData.length);
+
+      expect(publicKeyInfo.userIds).toStrictEqual(expectedKeyData.user_ids);
+      expect(privateKeyInfo.userIds).toStrictEqual(expectedKeyData.user_ids);
+
+      expect(fetch).toHaveBeenCalledTimes(1);
+    }, 10000);
+  });
+});

package/src/all/background_page/controller/recover/requestAccountRecoveryController.js

@@ -0,0 +1,74 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import AccountRecoveryModel from "../../model/accountRecovery/accountRecoveryModel";
+import AccountModel from "../../model/account/accountModel";
+import AccountLocalStorage from "../../service/local_storage/accountLocalStorage";
+import AccountRecoveryRequestService from "../../service/api/accountRecovery/accountRecoveryRequestService";
+import AccountRecoveryRequestCreateEntity from "../../model/entity/accountRecovery/accountRecoveryRequestCreateEntity";
+import AccountRecoverEntity from "../../model/entity/account/accountRecoverEntity";
+import AccountAccountRecoveryEntity from "../../model/entity/account/accountAccountRecoveryEntity";
+
+
+class RequestAccountRecoveryController {
+  /**
+   * Constructor.
+   * @param {Worker} worker The associated worker.
+   * @param {ApiClientOptions} apiClientOptions The api client options.
+   * @param {string} requestId The associated request id.
+   * @param {AccountRecoverEntity} account The account being recovered.
+   */
+  constructor(worker, apiClientOptions, requestId, account) {
+    this.worker = worker;
+    this.requestId = requestId;
+    this.account = account;
+    this.accountModel = new AccountModel(apiClientOptions);
+    this.accountRecoveryModel = new AccountRecoveryModel(apiClientOptions);
+    this.accountRecoveryRequestService = new AccountRecoveryRequestService(apiClientOptions);
+  }
+
+  /**
+   * Controller executor.
+   * @returns {Promise<void>}
+   */
+  async _exec() {
+    try {
+      await this.exec();
+      this.worker.port.emit(this.requestId, 'SUCCESS');
+    } catch (error) {
+      console.error(error);
+      this.worker.port.emit(this.requestId, 'ERROR', error);
+    }
+  }
+
+  /**
+   * Create account recovery
+   * @returns {Promise<void>}
+   */
+  async exec() {
+    const accountRecoveryRequestDto = this.account.toAccountRecoveryRequestDto();
+    const accountRecoverRequestCreate = new AccountRecoveryRequestCreateEntity(accountRecoveryRequestDto);
+    const accountRecoveryRequest = await this.accountRecoveryRequestService.create(accountRecoverRequestCreate);
+
+    const accountAccountRecoveryDto = this.account.toDto(AccountRecoverEntity.ALL_CONTAIN_OPTIONS);
+    accountAccountRecoveryDto.account_recovery_request_id = accountRecoveryRequest.id;
+    const accountAccountRecovery = new AccountAccountRecoveryEntity(accountAccountRecoveryDto);
+
+    // Delete any existing account recovery request temporary accounts, as the API will anyway cancel other on going requests.
+    await AccountLocalStorage.deleteByUserIdAndType(accountAccountRecovery.userId, AccountAccountRecoveryEntity.TYPE_ACCOUNT_ACCOUNT_RECOVERY);
+    await AccountLocalStorage.add(accountAccountRecovery);
+  }
+}
+
+export default RequestAccountRecoveryController;

package/src/all/background_page/controller/recover/requestAccountRecoveryController.test.js

@@ -0,0 +1,66 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import {enableFetchMocks} from "jest-fetch-mock";
+import RequestAccountRecoveryController from "./requestAccountRecoveryController";
+import AccountLocalStorage from "../../service/local_storage/accountLocalStorage";
+import {defaultApiClientOptions} from "passbolt-styleguide/src/shared/lib/apiClient/apiClientOptions.test.data";
+import {mockApiResponse} from "../../../../../test/mocks/mockApiResponse";
+import {pendingAccountRecoveryRequestDto} from "../../model/entity/accountRecovery/accountRecoveryRequestEntity.test.data";
+import AccountRecoverEntity from "../../model/entity/account/accountRecoverEntity";
+import {withSecurityTokenAccountRecoverDto} from "../../model/entity/account/accountRecoverEntity.test.data";
+import AccountAccountRecoveryEntity from "../../model/entity/account/accountAccountRecoveryEntity";
+
+beforeEach(() => {
+  enableFetchMocks();
+});
+
+describe("RequestAccountRecoveryController", () => {
+  describe("RequestAccountRecoveryController::exec", () => {
+    it("Should initiate an account recovery from the recover journey.", async() => {
+      const account = new AccountRecoverEntity(withSecurityTokenAccountRecoverDto());
+      const controller = new RequestAccountRecoveryController(null, defaultApiClientOptions(), null, account);
+
+      // Mock the API response.
+      const mockApiResponseDto = pendingAccountRecoveryRequestDto();
+      const mockApiFetch = fetch.doMockOnce(() => mockApiResponse(mockApiResponseDto));
+
+      await controller.exec();
+
+      expect.assertions(3);
+      // Expect the API to have been called.
+      expect(mockApiFetch).toHaveBeenCalled();
+      // Expect the temporary account created in the local storage.
+      const accountForAccountRecovery = await AccountLocalStorage.getAccountByUserIdAndType(account.userId, AccountAccountRecoveryEntity.TYPE_ACCOUNT_ACCOUNT_RECOVERY);
+      expect(accountForAccountRecovery).not.toBeUndefined();
+      // Expect the account being recovered to contain the expected information.
+      const expectedAccountDto = {
+        type: AccountAccountRecoveryEntity.TYPE_ACCOUNT_ACCOUNT_RECOVERY,
+        domain: account.domain,
+        user_id: account.userId,
+        user_key_fingerprint: account.userKeyFingerprint,
+        user_public_armored_key: account.userPublicArmoredKey,
+        server_public_armored_key: account.serverPublicArmoredKey,
+        username: account.username,
+        first_name: account.firstName,
+        last_name: account.lastName,
+        user_private_armored_key: account.userPrivateArmoredKey,
+        authentication_token_token: account.authenticationTokenToken,
+        security_token: account.securityToken.toDto(),
+        account_recovery_request_id: mockApiResponseDto.id
+      };
+      expect(accountForAccountRecovery).toEqual(expectedAccountDto);
+    });
+  });
+});

package/src/all/background_page/controller/recover/startRecoverController.js

@@ -0,0 +1,114 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import {OpenpgpAssertion} from "../../utils/openpgp/openpgpAssertions";
+import AuthModel from "../../model/auth/authModel";
+import SetupModel from "../../model/setup/setupModel";
+import AccountRecoveryUserSettingEntity from "../../model/entity/accountRecovery/accountRecoveryUserSettingEntity";
+import WorkerService from "../../service/worker/workerService";
+
+class StartRecoverController {
+  /**
+   * Constructor.
+   * @param {Worker} worker The associated worker.
+   * @param {string} requestId The associated request id.
+   * @param {ApiClientOptions} apiClientOptions The api client options.
+   * @param {AccountRecoverEntity} account The account being recovered.
+   * @param {object} runtimeMemory the runtime memory that stores the data during the process
+   */
+  constructor(worker, requestId, apiClientOptions, account, runtimeMemory) {
+    this.worker = worker;
+    this.requestId = requestId;
+    this.account = account;
+    this.authModel = new AuthModel(apiClientOptions);
+    this.setupModel = new SetupModel(apiClientOptions);
+    this.runtimeMemory = runtimeMemory;
+  }
+
+  /**
+   * Controller executor.
+   * @returns {Promise<void>}
+   */
+  async _exec() {
+    try {
+      await this.exec();
+      this.worker.port.emit(this.requestId, 'SUCCESS');
+    } catch (error) {
+      console.error(error);
+      this.worker.port.emit(this.requestId, 'ERROR', error);
+    }
+  }
+
+  /**
+   * Import user key.
+   * @returns {Promise<AccountEntity>}
+   */
+  async exec() {
+    try {
+      await this._findAndSetAccountServerPublicKey();
+      const {user, userPassphrasePolicies} = await this.setupModel.startRecover(this.account.userId, this.account.authenticationTokenToken);
+      this.runtimeMemory.userPassphrasePolicies = userPassphrasePolicies;
+      this._setAccountUserMeta(user);
+    } catch (error) {
+      await this._handleUnexpectedError(error);
+    }
+  }
+
+  /**
+   * Find and set the account server public key.
+   * @returns {Promise<void>}
+   * @private
+   */
+  async _findAndSetAccountServerPublicKey() {
+    const serverKeyDto = await this.authModel.getServerKey();
+    const serverKey = await OpenpgpAssertion.readKeyOrFail(serverKeyDto.armored_key);
+    OpenpgpAssertion.assertPublicKey(serverKey);
+    // associate the server public key to the current account.
+    this.account.serverPublicArmoredKey = serverKey.armor();
+  }
+
+  /**
+   * Find and set account user meta.
+   * @param {object} user the data relatives to the current user recovering its account.
+   * @private
+   */
+  _setAccountUserMeta(user) {
+    // Extract the user meta data and associate them to the current temporary account.
+    this.account.username = user?.username;
+    this.account.firstName = user?.profile?.firstName;
+    this.account.lastName = user?.profile?.lastName;
+    if (user?.locale) {
+      this.account.locale = user.locale;
+    }
+    if (user?.accountRecoveryUserSetting?.status === AccountRecoveryUserSettingEntity.STATUS_APPROVED) {
+      this.account.hasApprovedAccountRecoveryUserSetting = true;
+    }
+    // As of v3.6.0 the user is stored only to know if account recovery was enabled for this account.
+    this.account.user = user;
+  }
+
+  /**
+   * Handle unexpected error.
+   * Close the iframe and let the application served by the API handle the user.
+   * @param {Error} error The error.
+   * @private
+   */
+  async _handleUnexpectedError(error) {
+    (await WorkerService.get('RecoverBootstrap', this.worker.tab.id)).port.emit('passbolt.recover-bootstrap.remove-iframe');
+    console.error(error);
+    throw error;
+  }
+}
+
+export default StartRecoverController;