passbolt-browser-extension 3.0.6 → 4.6.2

package/src/all/background_page/controller/sso/ssoAuthenticationController.js

@@ -0,0 +1,159 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.9.0
+ */
+import SsoDataStorage from "../../service/indexedDB_storage/ssoDataStorage";
+import DecryptSsoPassphraseService from "../../service/crypto/decryptSsoPassphraseService";
+import PopupHandlerService from "../../service/sso/popupHandlerService";
+import SsoKitServerPartModel from "../../model/sso/ssoKitServerPartModel";
+import AuthModel from "../../model/auth/authModel";
+import {QuickAccessService} from "../../service/ui/quickAccess.service";
+import SsoLoginModel from "../../model/sso/ssoLoginModel";
+import SsoSettingsModel from "../../model/sso/ssoSettingsModel";
+import SsoSettingsChangedError from "../../error/ssoSettingsChangedError";
+import QualifySsoLoginErrorService from "../../service/sso/qualifySsoLoginErrorService";
+
+class SsoAuthenticationController {
+  /**
+   * SsoAuthenticationController constructor
+   * @param {Worker} worker
+   * @param {string} requestId uuid
+   */
+  constructor(worker, requestId, apiClientOptions, account) {
+    this.worker = worker;
+    this.requestId = requestId;
+    this.account = account;
+    this.ssoKitServerPartModel = new SsoKitServerPartModel(apiClientOptions);
+    this.ssoLoginModel = new SsoLoginModel(apiClientOptions);
+    this.popupHandler = new PopupHandlerService(account.domain, worker?.tab?.id, false);
+    this.authModel = new AuthModel(apiClientOptions);
+    this.ssoSettingsModel = new SsoSettingsModel(apiClientOptions);
+  }
+
+  /**
+   * Wrapper of exec function to run it with worker.
+   *
+   * @param {boolean} isInQuickAccessMode true if the controller has been called from the quickaccess
+   * @return {Promise<void>}
+   */
+  async _exec(providerId, isInQuickAccessMode = false) {
+    try {
+      await this.exec(providerId, isInQuickAccessMode);
+      this.worker.port.emit(this.requestId, "SUCCESS");
+    } catch (error) {
+      console.error(error);
+      this.worker.port.emit(this.requestId, "ERROR", error);
+    }
+  }
+
+  /**
+   * Authenticate the user using a third-party SSO provider.
+   *
+   * @param {boolean} isInQuickAccessMode true if the controller has been called from the quickaccess
+   * @return {Promise<void>}
+   */
+  async exec(providerId, isInQuickAccessMode) {
+    const clientPartSsoKit = await SsoDataStorage.get();
+    if (!clientPartSsoKit) {
+      throw new Error("The Single Sign-On cannot proceed as there is no SSO kit registered on this browser profile.");
+    }
+    const userId = this.account.userId;
+
+    let loginUrl;
+    try {
+      loginUrl = await this.ssoLoginModel.getLoginUrl(providerId, userId);
+    } catch (e) {
+      const qualifiedError = await this.qualifyGetLoginUrlError(e, isInQuickAccessMode);
+      throw qualifiedError;
+    }
+
+    try {
+      const thirdPartyCode = await this.popupHandler.getSsoTokenFromThirdParty(loginUrl);
+      const ssoServerData = await this.ssoKitServerPartModel.getSsoKit(clientPartSsoKit.id, userId, thirdPartyCode);
+
+      const serverKey = await crypto.subtle.importKey("jwk", ssoServerData.key, 'AES-GCM', true, ["encrypt", "decrypt"]);
+
+      const passphrase = await DecryptSsoPassphraseService.decrypt(clientPartSsoKit.secret, clientPartSsoKit.nek, serverKey, clientPartSsoKit.iv1, clientPartSsoKit.iv2);
+      await this.popupHandler.closeHandler();
+      await this.authModel.login(passphrase, true);
+      if (isInQuickAccessMode) {
+        await this.ensureRedirectionInQuickaccessMode();
+      }
+    } catch (error) {
+      console.error("An error occured while attempting sign in with a third party provider:", error);
+      this.handleSpecificErrors(error);
+      throw error;
+    }
+  }
+
+  /**
+   * Opens the quickacces in detached mode to ensure the redirection after login is made.
+   * Calling this is only done when signin-in with SSO via the quickaccess.
+   * The reason is to avoid a problem where closing the SSO popup actually closes the quickaccess,
+   * as a consequence, the port is disconnected as well.
+   * What could happen is that the port is disconnected before the `_exec` returns the "SUCCESS" and
+   * the login process stops from the styleguide point of view, makinng it broken somehow
+   * the login wouldn't redirect to ressource workspace neither redirect to MFA if required.
+   * @returns {Promise<void>}
+   */
+  async ensureRedirectionInQuickaccessMode() {
+    const queryParameters = [
+      {name: "uiMode", value: "detached"},
+      {name: "feature", value: "login"}
+    ];
+    await QuickAccessService.openInDetachedMode(queryParameters);
+  }
+
+  /**
+   * Handles error of different type coming from the SSO authentication process
+   * @param {Error} error
+   */
+  handleSpecificErrors(error) {
+    switch (error.name) {
+      case 'InvalidMasterPasswordError':
+      case 'OutdatedSsoKitError': {
+        SsoDataStorage.flush();
+        break;
+      }
+      case 'PassboltApiFetchError': {
+        const isCsrfTokenError = error?.data?.code === 403;
+        if (!isCsrfTokenError) {
+          SsoDataStorage.flush();
+        }
+      }
+    }
+  }
+
+  /**
+   * Qualifies an error happened during the fetching of the SSO provider login URL.
+   * An error happens if the SSO provider has changed since last login or if SSO is disabled
+   * @param {Error} e the error to qualify
+   * @param {boolean} isInQuickAccessMode
+   * @returns {Promise<Error>}
+   */
+  async qualifyGetLoginUrlError(e, isInQuickAccessMode) {
+    if (e.data.code !== 400) {
+      return e; //it's an unexpected state that shouldn't be handle here
+    }
+
+    if (isInQuickAccessMode) {
+      const url = `${this.account.domain}/auth/login?case=sso-login-error`;
+      await browser.tabs.create({url: url, active: true});
+      return new SsoSettingsChangedError("The quickaccess cannot proceed with the SSO login.");
+    }
+
+    const configuration = await this.ssoSettingsModel.getCurrent();
+    return QualifySsoLoginErrorService.qualifyErrorFromConfiguration(configuration);
+  }
+}
+
+export default SsoAuthenticationController;

package/src/all/background_page/controller/sso/ssoAuthenticationController.test.js

@@ -0,0 +1,342 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.9.0
+ */
+import each from "jest-each";
+import "../../../../../test/mocks/mockSsoDataStorage";
+import '../../../../../test/mocks/mockCryptoKey';
+import {enableFetchMocks} from "jest-fetch-mock";
+import {v4 as uuid} from "uuid";
+import {mockApiResponse, mockApiResponseError} from "../../../../../test/mocks/mockApiResponse";
+import SsoAuthenticationController from "./ssoAuthenticationController";
+import {defaultApiClientOptions} from "passbolt-styleguide/src/shared/lib/apiClient/apiClientOptions.test.data";
+import SsoDataStorage from "../../service/indexedDB_storage/ssoDataStorage";
+import DecryptSsoPassphraseService from "../../service/crypto/decryptSsoPassphraseService";
+import {clientSsoKit} from "../../model/entity/sso/ssoKitClientPart.test.data";
+import PassboltApiFetchError from "passbolt-styleguide/src/shared/lib/Error/PassboltApiFetchError";
+import OutdatedSsoKitError from "../../error/outdatedSsoKitError";
+import InvalidMasterPasswordError from "../../error/invalidMasterPasswordError";
+import {generateSsoKitServerData} from "../../model/entity/sso/ssoKitServerPart.test.data";
+import SsoDisabledError from "../../error/ssoDisabledError";
+import SsoProviderMismatchError from "../../error/ssoProviderMismatchError";
+import SsoSettingsChangedError from "../../error/ssoSettingsChangedError";
+import MockExtension from "../../../../../test/mocks/mockExtension";
+import User from "../../model/user";
+import {defaultAccountDto} from "../../model/entity/account/accountEntity.test.data";
+import AccountEntity from "../../model/entity/account/accountEntity";
+import {QuickAccessService} from "../../service/ui/quickAccess.service";
+
+const mockLogin = jest.fn();
+jest.mock("../../model/auth/authModel", () => ({
+  __esModule: true,
+  default: jest.fn(() => ({
+    login: mockLogin
+  }))
+}));
+
+const mockGetSsoTokenFromThirdParty = jest.fn();
+const mockCloseHandler = jest.fn();
+jest.mock("../../service/sso/popupHandlerService", () => ({
+  __esModule: true,
+  default: jest.fn(() => ({
+    getSsoTokenFromThirdParty: mockGetSsoTokenFromThirdParty,
+    closeHandler: mockCloseHandler
+  }))
+}));
+
+beforeEach(() => {
+  crypto.subtle.importKey.mockReset();
+  jest.clearAllMocks();
+  enableFetchMocks();
+});
+
+const scenarios = [
+  {
+    providerId: "azure",
+    loginUrlResponse: {
+      url: "https://login.microsoftonline.com"
+    }
+  },
+  {
+    providerId: "google",
+    loginUrlResponse: {
+      url: "https://accounts.google.com/o/oauth2/v2/auth"
+    }
+  }
+];
+
+each(scenarios).describe("SsoAuthenticationController", scenario => {
+  describe(`SsoAuthenticationController::exec (with provider: '${scenario.providerId}')`, () => {
+    it(`Should sign the user using a third party: ${scenario.providerId}`, async() => {
+      expect.assertions(13);
+      const ssoLocalKit = clientSsoKit();
+      SsoDataStorage.setMockedData(ssoLocalKit);
+      const ssoLoginToken = uuid();
+      const serverSsoKit = {data: generateSsoKitServerData()};
+      const deserializedKeyData = JSON.parse(Buffer.from(serverSsoKit.data, 'base64').toString());
+      const account = {userId: uuid()};
+      const severImportedKey = {algorithm: {name: "AES-GCM"}};
+      const userPassphrase = "this is the user passphrase";
+
+      mockGetSsoTokenFromThirdParty.mockImplementation(async() => ssoLoginToken);
+      mockLogin.mockImplementation(async(passphrase, rememberMe) => {
+        expect(passphrase).toBe(userPassphrase);
+        expect(rememberMe).toBe(true);
+      });
+
+      crypto.subtle.importKey.mockImplementation(async(keyFormat, keyInfo, algorithmName, isExtractable, capabilities) => {
+        expect(keyFormat).toBe("jwk");
+        expect(keyInfo).toStrictEqual(deserializedKeyData);
+        expect(algorithmName).toBe('AES-GCM');
+        expect(isExtractable).toBe(true);
+        expect(capabilities).toStrictEqual(["encrypt", "decrypt"]);
+        return severImportedKey;
+      });
+
+      jest.spyOn(DecryptSsoPassphraseService, "decrypt").mockImplementation(async(secret, nek, ek, iv1, iv2) => {
+        expect(secret).toStrictEqual(ssoLocalKit.secret);
+        expect(nek).toStrictEqual(ssoLocalKit.nek);
+        expect(ek).toStrictEqual(severImportedKey);
+        expect(iv1).toStrictEqual(ssoLocalKit.iv1);
+        expect(iv2).toStrictEqual(ssoLocalKit.iv2);
+        return userPassphrase;
+      });
+
+      fetch.doMockOnceIf(new RegExp(`/sso/${scenario.providerId}/login.json`), async req => {
+        const request = JSON.parse(await req.text());
+        expect(request).toStrictEqual({user_id: account.userId});
+        return mockApiResponse(scenario.loginUrlResponse);
+      });
+
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/${ssoLocalKit.id}/${account.userId}/${ssoLoginToken}.json`), async() => mockApiResponse(serverSsoKit));
+
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      return controller.exec(scenario.providerId);
+    });
+
+    it(`Should sign the user using a third party: ${scenario.providerId}`, async() => {
+      expect.assertions(2);
+      const ssoLocalKit = clientSsoKit();
+      SsoDataStorage.setMockedData(ssoLocalKit);
+      const ssoLoginToken = uuid();
+      const serverSsoKit = {data: generateSsoKitServerData()};
+      const account = {userId: uuid()};
+      const severImportedKey = {algorithm: {name: "AES-GCM"}};
+      const userPassphrase = "this is the user passphrase";
+
+      mockGetSsoTokenFromThirdParty.mockImplementation(async() => ssoLoginToken);
+      mockLogin.mockImplementation(async() => {});
+      crypto.subtle.importKey.mockImplementation(async() => severImportedKey);
+      jest.spyOn(DecryptSsoPassphraseService, "decrypt").mockImplementation(async() => userPassphrase);
+      fetch.doMockOnceIf(new RegExp(`/sso/${scenario.providerId}/login.json`), async() => mockApiResponse(scenario.loginUrlResponse));
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/${ssoLocalKit.id}/${account.userId}/${ssoLoginToken}.json`), async() => mockApiResponse(serverSsoKit));
+
+      const spyOnOpenInDetachedMode = jest.spyOn(QuickAccessService, "openInDetachedMode").mockImplementation(() => {});
+
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      await controller.exec(scenario.providerId, true);
+
+      const expectedQuickAccessCallParameters =  [
+        {name: "uiMode", value: "detached"},
+        {name: "feature", value: "login"}
+      ];
+
+      expect(spyOnOpenInDetachedMode).toHaveBeenCalledTimes(1);
+      expect(spyOnOpenInDetachedMode).toHaveBeenCalledWith(expectedQuickAccessCallParameters);
+    });
+  });
+
+  describe(`SsoAuthenticationController::exec should throw a qualified error when the login URL can't be fetch (with provider: '${scenario.providerId}')`, () => {
+    it("Should throw an SsoDisabledError.", async() => {
+      expect.assertions(2);
+      const ssoKit = clientSsoKit();
+      SsoDataStorage.setMockedData(ssoKit);
+
+      const account = {userId: uuid()};
+      fetch.doMockOnceIf(new RegExp(`/sso/${scenario.providerId}/login.json`), async() => mockApiResponseError(400));
+      fetch.doMockOnceIf(new RegExp(`/sso/settings/current.json`), async() => mockApiResponse({provider: null}));
+
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      try {
+        await controller.exec(scenario.providerId);
+      } catch (e) {
+        expect(e).toBeInstanceOf(SsoDisabledError);
+        expect(SsoDataStorage.flush).not.toHaveBeenCalled();
+      }
+    });
+
+    it("Should throw an SsoProviderMismatchError.", async() => {
+      expect.assertions(2);
+      const ssoKit = clientSsoKit({provider: scenario.providerId});
+      const configuredProvider = scenario.providerId === "azure" ? "google" : "azure";
+      SsoDataStorage.setMockedData(ssoKit);
+
+      const account = {userId: uuid()};
+      fetch.doMockOnceIf(new RegExp(`/sso/${scenario.providerId}/login.json`), async() => mockApiResponseError(400));
+      fetch.doMockOnceIf(new RegExp(`/sso/settings/current.json`), async() => mockApiResponse({provider: configuredProvider}));
+
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      try {
+        await controller.exec(scenario.providerId);
+      } catch (e) {
+        expect(e).toBeInstanceOf(SsoProviderMismatchError);
+        expect(SsoDataStorage.flush).not.toHaveBeenCalled();
+      }
+    });
+
+    it("Should throw an SsoSettingsChangedError.", async() => {
+      expect.assertions(3);
+      await MockExtension.withConfiguredAccount();
+      const ssoLocalKit = clientSsoKit();
+      SsoDataStorage.setMockedData(ssoLocalKit);
+
+      const expectedUrl = `${User.getInstance().settings.getDomain()}/auth/login?case=sso-login-error`;
+      const account = new AccountEntity(defaultAccountDto());
+
+      jest.spyOn(browser.tabs, 'create').mockImplementation(tabInfo => {
+        expect(tabInfo.url).toBe(expectedUrl);
+        expect(tabInfo.active).toBe(true);
+      });
+
+      fetch.doMockOnceIf(new RegExp(`/sso/${scenario.providerId}/login.json`), async() => mockApiResponseError(400));
+
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      try {
+        await controller.exec(scenario.providerId, true);
+      } catch (e) {
+        expect(e).toBeInstanceOf(SsoSettingsChangedError);
+      }
+    });
+  });
+
+  describe(`SsoAuthenticationController::exec should throw an error when something wrong happens (with provider: '${scenario.providerId}')`, () => {
+    it("Should throw an error when client sso kit can't be find.", async() => {
+      expect.assertions(2);
+      const account = {userId: uuid()};
+      SsoDataStorage.setMockedData(null);
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      try {
+        await controller.exec(scenario.providerId);
+      } catch (e) {
+        expect(e).toStrictEqual(new Error('The Single Sign-On cannot proceed as there is no SSO kit registered on this browser profile.'));
+        expect(SsoDataStorage.flush).not.toHaveBeenCalled();
+      }
+    });
+
+    it("Should throw an error when server sso kit can't be find.", async() => {
+      expect.assertions(2);
+      const ssoKit = clientSsoKit();
+      const ssoToken = uuid();
+      const account = {userId: uuid()};
+      SsoDataStorage.setMockedData(ssoKit);
+
+      mockGetSsoTokenFromThirdParty.mockImplementation(async() => ssoToken);
+      fetch.doMockOnceIf(new RegExp(`/sso/${scenario.providerId}/login.json`), async() => mockApiResponse(scenario.loginUrlResponse));
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/${ssoKit.id}/${account.userId}/${ssoToken}.json`), async() => mockApiResponseError(404));
+
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      try {
+        await controller.exec(scenario.providerId);
+      } catch (e) {
+        expect(e).toBeInstanceOf(PassboltApiFetchError);
+        expect(SsoDataStorage.flush).toHaveBeenCalledTimes(1);
+      }
+    });
+
+    it("Should throw an error when the passphrase can't be decrypted.", async() => {
+      expect.assertions(2);
+      const ssoToken = uuid();
+      const ssoLocalKit = clientSsoKit();
+      const serverSsoKit = {data: generateSsoKitServerData({})};
+      const account = {userId: uuid()};
+      SsoDataStorage.setMockedData(ssoLocalKit);
+
+      jest.spyOn(DecryptSsoPassphraseService, "decrypt").mockImplementation(async() => { throw new OutdatedSsoKitError(); });
+
+      mockGetSsoTokenFromThirdParty.mockImplementation(async() => ssoToken);
+      fetch.doMockOnceIf(new RegExp(`/sso/${scenario.providerId}/login.json`), async() => mockApiResponse(scenario.loginUrlResponse));
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/${ssoLocalKit.id}/${account.userId}/${ssoToken}.json`), async() => mockApiResponse(serverSsoKit));
+
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      try {
+        await controller.exec(scenario.providerId);
+      } catch (e) {
+        expect(e).toBeInstanceOf(OutdatedSsoKitError);
+        expect(SsoDataStorage.flush).toHaveBeenCalledTimes(1);
+      }
+    });
+
+    it("Should throw an error when the passphrase can't be decrypted.", async() => {
+      expect.assertions(2);
+      const ssoToken = uuid();
+      const ssoLocalKit = clientSsoKit();
+      const serverSsoKit = {data: generateSsoKitServerData({})};
+      const account = {userId: uuid()};
+      SsoDataStorage.setMockedData(ssoLocalKit);
+
+      jest.spyOn(DecryptSsoPassphraseService, "decrypt").mockImplementation(async() => { throw new Error(); });
+
+      mockGetSsoTokenFromThirdParty.mockImplementation(async() => ssoToken);
+      fetch.doMockOnceIf(new RegExp(`/sso/${scenario.providerId}/login.json`), async() => mockApiResponse(scenario.loginUrlResponse));
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/${ssoLocalKit.id}/${account.userId}/${ssoToken}.json`), async() => mockApiResponse(serverSsoKit));
+
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      try {
+        await controller.exec(scenario.providerId);
+      } catch (e) {
+        expect(e).toBeInstanceOf(Error);
+        expect(SsoDataStorage.flush).not.toHaveBeenCalled();
+      }
+    });
+
+    it("Should throw an error when the passphrase doesn't match the user's private key.", async() => {
+      expect.assertions(2);
+      const ssoToken = uuid();
+      const serverSsoKit = {data: generateSsoKitServerData({})};
+      const account = {userId: uuid()};
+      const ssoLocalKit = clientSsoKit();
+      SsoDataStorage.setMockedData(ssoLocalKit);
+
+      jest.spyOn(DecryptSsoPassphraseService, "decrypt").mockImplementation(async() => "passphrase");
+
+      mockGetSsoTokenFromThirdParty.mockImplementation(async() => ssoToken);
+      mockLogin.mockImplementation(async() => { throw new InvalidMasterPasswordError(); });
+      fetch.doMockOnceIf(new RegExp(`/sso/${scenario.providerId}/login.json`), async() => mockApiResponse(scenario.loginUrlResponse));
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/${ssoLocalKit.id}/${account.userId}/${ssoToken}.json`), async() => mockApiResponse(serverSsoKit));
+
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      try {
+        await controller.exec(scenario.providerId);
+      } catch (e) {
+        expect(e).toBeInstanceOf(InvalidMasterPasswordError);
+        expect(SsoDataStorage.flush).toHaveBeenCalledTimes(1);
+      }
+    });
+
+    it("Should throw an error if CSRF token is not valid but shouldn't remove the local SSO kit.", async() => {
+      expect.assertions(2);
+      const account = {userId: uuid()};
+      SsoDataStorage.setMockedData(clientSsoKit());
+
+      jest.spyOn(DecryptSsoPassphraseService, "decrypt").mockImplementation(async() => "passphrase");
+      fetch.doMockOnceIf(new RegExp(`/sso/${scenario.providerId}/login.json`), async() => mockApiResponseError(403, "Wrong CSRF token"));
+
+      const controller = new SsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      try {
+        await controller.exec(scenario.providerId);
+      } catch (e) {
+        expect(e).toBeInstanceOf(PassboltApiFetchError);
+        expect(SsoDataStorage.flush).not.toHaveBeenCalled();
+      }
+    });
+  });
+});

package/src/all/background_page/controller/sso/testSsoAuthenticationController.js

@@ -0,0 +1,72 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.9.0
+ */
+import PopupHandlerService from "../../service/sso/popupHandlerService";
+import SsoDryRunModel from "../../model/sso/ssoDryRunModel";
+import SsoSettingsModel from "../../model/sso/ssoSettingsModel";
+import {assertUuid} from "../../utils/assertions";
+
+class TestSsoAuthenticationController {
+  /**
+   * TestSsoAuthenticationController constructor
+   * @param {Worker} worker
+   * @param {string} requestId uuid
+   */
+  constructor(worker, requestId, apiClientOptions, account) {
+    this.worker = worker;
+    this.requestId = requestId;
+    this.ssoSettingsModel = new SsoSettingsModel(apiClientOptions);
+    this.ssoDryRunModel = new SsoDryRunModel(apiClientOptions);
+    this.popupHandler = new PopupHandlerService(account.domain, worker?.tab?.id, true);
+  }
+
+  /**
+   * Wrapper of exec function to run it with worker.
+   *
+   * @param {uuid} draftSsoSettingsId the draft sso settings id
+   * @return {Promise<void>}
+   */
+  async _exec(draftSsoSettingsId) {
+    try {
+      const ssoToken = await this.exec(draftSsoSettingsId);
+      this.worker.port.emit(this.requestId, "SUCCESS", ssoToken);
+    } catch (error) {
+      console.error(error);
+      this.worker.port.emit(this.requestId, "ERROR", error);
+    }
+  }
+
+  /**
+   * Run a dry-run login and returns a token from the API if everything is fine.
+   * The token can be used to change the status of the sso settings to `active`
+   *
+   * @param {uuid} draftSsoSettingsId the draft sso settings id
+   * @return {Promise<string>}
+   */
+  async exec(draftSsoSettingsId) {
+    assertUuid(draftSsoSettingsId, "The SSO settings id should be a valid uuid.");
+
+    try {
+      const ssoSettings = await this.ssoSettingsModel.getById(draftSsoSettingsId);
+      const thirdPartySignInUrl = await this.ssoDryRunModel.getUrl(ssoSettings.provider, ssoSettings.id);
+      const ssoToken = await this.popupHandler.getSsoTokenFromThirdParty(thirdPartySignInUrl);
+      await this.popupHandler.closeHandler();
+      return ssoToken;
+    } catch (error) {
+      console.error("An error occured while attempting sign in with a third party provider:", error);
+      throw error;
+    }
+  }
+}
+
+export default TestSsoAuthenticationController;

package/src/all/background_page/controller/sso/testSsoAuthenticationController.test.js

@@ -0,0 +1,109 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.9.0
+ */
+import {enableFetchMocks} from "jest-fetch-mock";
+import {v4 as uuid} from "uuid";
+import {mockApiResponse, mockApiResponseError} from "../../../../../test/mocks/mockApiResponse";
+import {withAzureSsoSettings} from "./saveSsoSettingsAsDraftController.test.data";
+import {defaultApiClientOptions} from "passbolt-styleguide/src/shared/lib/apiClient/apiClientOptions.test.data";
+import TestSsoAuthenticationController from "./testSsoAuthenticationController";
+import PassboltApiFetchError from "passbolt-styleguide/src/shared/lib/Error/PassboltApiFetchError";
+import SsoLoginUrlEntity from "../../model/entity/sso/ssoLoginUrlEntity";
+import AzureSsoSettingsEntity from "passbolt-styleguide/src/shared/models/entity/ssoSettings/AzureSsoSettingsEntity";
+
+const mock_getSsoTokenFromThirdParty = jest.fn();
+const mock_closeHandler = jest.fn();
+
+jest.mock("../../service/sso/popupHandlerService", () => ({
+  __esModule: true,
+  default: jest.fn(() => ({
+    getSsoTokenFromThirdParty: mock_getSsoTokenFromThirdParty,
+    closeHandler: mock_closeHandler
+  }))
+}));
+
+beforeEach(() => {
+  enableFetchMocks();
+  jest.clearAllMocks();
+});
+
+describe("TestSsoAuthenticationController", () => {
+  const urlToHit = {url: "https://login.microsoftonline.us"};
+  const account = {domain: urlToHit.url};
+
+  describe("TestSsoAuthenticationController::exec", () => {
+    it("Should save the given settings as a draft.", async() => {
+      expect.assertions(5);
+
+      const ssoLoginSuccessToken = uuid();
+      const settingsId = uuid();
+      const settings = withAzureSsoSettings({id: settingsId});
+
+      fetch.doMockOnceIf(new RegExp(`/sso/settings/${settingsId}.json`), async() => mockApiResponse(settings));
+      fetch.doMockOnceIf(new RegExp(`/sso/${settings.provider}/login/dry-run.json`), async req => {
+        const body = JSON.parse(await req.text());
+        expect(body).toStrictEqual({
+          sso_settings_id: settingsId
+        });
+
+        return mockApiResponse(urlToHit);
+      });
+
+      mock_getSsoTokenFromThirdParty.mockImplementation(async() => ssoLoginSuccessToken);
+
+      const controller = new TestSsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+      const resultingToken = await controller.exec(settingsId);
+
+      expect(mock_getSsoTokenFromThirdParty).toHaveBeenCalledTimes(1);
+      expect(mock_getSsoTokenFromThirdParty).toHaveBeenCalledWith(new SsoLoginUrlEntity(urlToHit, AzureSsoSettingsEntity.PROVIDER_ID));
+      expect(mock_closeHandler).toHaveBeenCalledTimes(1);
+      expect(resultingToken).toBe(ssoLoginSuccessToken);
+    });
+  });
+
+  it("Should throw an error if something wrong happens during the rertieval of the draft settings.", async() => {
+    expect.assertions(2);
+
+    const settingsId = uuid();
+    const expectedError = new PassboltApiFetchError("Something wrong happened!");
+
+    fetch.doMockOnceIf(new RegExp(`/sso/settings/${settingsId}.json`), () => mockApiResponseError(500, expectedError.message));
+
+    const controller = new TestSsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+    try {
+      await controller.exec(settingsId);
+    } catch (e) {
+      expect(e).toStrictEqual(expectedError);
+      expect(mock_closeHandler).not.toHaveBeenCalled();
+    }
+  });
+
+  it("Should throw an error if something wrong happens during the dry run SSO login.", async() => {
+    expect.assertions(2);
+
+    const settingsId = uuid();
+    const settings = withAzureSsoSettings({id: settingsId});
+    const expectedError = new PassboltApiFetchError("Something wrong happened!");
+
+    fetch.doMockOnceIf(new RegExp(`/sso/settings/${settingsId}.json`), async() => mockApiResponse(settings));
+    fetch.doMockOnceIf(new RegExp(`/sso/${settings.provider}/login/dry-run.json`), () => mockApiResponseError(500, expectedError.message));
+
+    const controller = new TestSsoAuthenticationController(null, null, defaultApiClientOptions(), account);
+    try {
+      await controller.exec(settingsId);
+    } catch (e) {
+      expect(e).toStrictEqual(expectedError);
+      expect(mock_closeHandler).not.toHaveBeenCalled();
+    }
+  });
+});