passbolt-browser-extension 3.0.6 → 4.6.2

package/src/all/background_page/controller/account/getAccountController.test.js

@@ -0,0 +1,91 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import GetAccountController from "./getAccountController";
+import {defaultAccountDto} from "../../model/entity/account/accountEntity.test.data";
+import AccountEntity from "../../model/entity/account/accountEntity";
+import AccountAccountRecoveryEntity from "../../model/entity/account/accountAccountRecoveryEntity";
+import {defaultAccountAccountRecoveryDto} from "../../model/entity/account/accountAccountRecoveryEntity.test.data";
+import AccountRecoverEntity from "../../model/entity/account/accountRecoverEntity";
+import {withSecurityTokenAccountRecoverDto} from "../../model/entity/account/accountRecoverEntity.test.data";
+import {withSecurityTokenAccountSetupDto} from "../../model/entity/account/accountSetupEntity.test.data";
+import AccountSetupEntity from "../../model/entity/account/accountSetupEntity";
+
+describe("GetAccountController", () => {
+  describe("GetAccountController::exec", () => {
+    const assertCommonAccountProperties = (accountDto, expectAccount) => {
+      expect(accountDto.type).toEqual(expectAccount.type);
+      expect(accountDto.domain).toEqual(expectAccount.domain);
+      expect(accountDto.user_id).toEqual(expectAccount.userId);
+      expect(accountDto.username).toEqual(expectAccount.username);
+      expect(accountDto.first_name).toEqual(expectAccount.firstName);
+      expect(accountDto.last_name).toEqual(expectAccount.lastName);
+      expect(accountDto.user_public_armored_key).toEqual(expectAccount.userPublicArmoredKey);
+      expect(accountDto.server_public_armored_key).toEqual(expectAccount.serverPublicArmoredKey);
+      expect(accountDto.security_token).toEqual(expectAccount.securityToken.toDto());
+    };
+
+    it("Should retrieve the account being used by the worker.", async() => {
+      const storedAccountDto = defaultAccountDto();
+      const storedAccount = new AccountEntity(storedAccountDto);
+      const controller = new GetAccountController(null, null, storedAccount);
+      const accountDto = await controller.exec();
+
+      expect.assertions(10);
+      assertCommonAccountProperties(accountDto, storedAccount);
+      // Ensure the controller doesn't leak sensitive information
+      expect(accountDto.user_private_armored_key).toBeUndefined();
+    });
+
+    it("Should retrieve the account being setup by the worker.", async() => {
+      const storedAccountDto = withSecurityTokenAccountSetupDto();
+      const storedAccount = new AccountSetupEntity(storedAccountDto);
+      const controller = new GetAccountController(null, null, storedAccount);
+      const accountDto = await controller.exec();
+
+      expect.assertions(11);
+      assertCommonAccountProperties(accountDto, storedAccount);
+      // Ensure the controller doesn't leak sensitive information
+      expect(accountDto.user_private_armored_key).toBeUndefined();
+      expect(accountDto.authentication_token_token).toBeUndefined();
+    });
+
+    it("Should retrieve the account being recovered by the worker.", async() => {
+      const storedAccountDto = withSecurityTokenAccountRecoverDto();
+      const storedAccount = new AccountRecoverEntity(storedAccountDto);
+      const controller = new GetAccountController(null, null, storedAccount);
+      const accountDto = await controller.exec();
+
+      expect.assertions(11);
+      assertCommonAccountProperties(accountDto, storedAccount);
+      // Ensure the controller doesn't leak sensitive information
+      expect(accountDto.user_private_armored_key).toBeUndefined();
+      expect(accountDto.authentication_token_token).toBeUndefined();
+    });
+
+    it("Should retrieve the account completing the account recovery used by the worker.", async() => {
+      const storedAccountDto = defaultAccountAccountRecoveryDto();
+      const storedAccount = new AccountAccountRecoveryEntity(storedAccountDto);
+      const controller = new GetAccountController(null, null, storedAccount);
+      const accountDto = await controller.exec();
+
+      expect.assertions(12);
+      assertCommonAccountProperties(accountDto, storedAccount);
+      // Ensure the controller doesn't leak sensitive information
+      expect(accountDto.user_private_armored_key).toBeUndefined();
+      expect(accountDto.authentication_token_token).toBeUndefined();
+      expect(accountDto.account_recovery_request_id).toBeUndefined();
+    });
+  });
+});

package/src/all/background_page/controller/account/getAndInitializeAccountLocaleController.js

@@ -0,0 +1,70 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+import LocaleModel from "../../model/locale/localeModel";
+
+class GetAndInitializeAccountLocaleController {
+  /**
+   * Constructor
+   * @param {Worker} worker
+   * @param {string} requestId uuid
+   * @param {ApiClientOptions} apiClientOptions the api client options
+   * @param {AbstractAccountEntity} account the account associated to the worker
+   */
+  constructor(worker, requestId, apiClientOptions, account) {
+    this.worker = worker;
+    this.requestId = requestId;
+    this.account = account;
+    this.localeModel = new LocaleModel(apiClientOptions);
+  }
+
+  /**
+   * Wrapper of exec function to run it with worker.
+   *
+   * @return {Promise<void>}
+   */
+  async _exec() {
+    try {
+      const result = await this.exec();
+      this.worker.port.emit(this.requestId, "SUCCESS", result);
+    } catch (error) {
+      console.error(error);
+      this.worker.port.emit(this.requestId, 'ERROR', error);
+    }
+  }
+
+  /**
+   * Get the worker account locale.
+   * Return default organization if no locale defined.
+   * Fallback on default extension locale if nothing found.
+   *
+   * @return {Promise<LocaleEntity>}
+   */
+  async exec() {
+    let accountLocale;
+    if (this.account.locale) {
+      accountLocale = await this.localeModel.getSupportedLocale(this.account.locale);
+    }
+
+    const locale = accountLocale
+      || await this.localeModel.getOrganizationLocale()
+      || LocaleModel.DEFAULT_LOCALE;
+
+    // @todo It is not the best place to initialize the background page i18next library.
+    this.localeModel.initializeI18next(locale);
+
+    return locale;
+  }
+}
+
+export default GetAndInitializeAccountLocaleController;

package/src/all/background_page/controller/account/getAndInitializeAccountLocaleController.test.js

@@ -0,0 +1,75 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import {defaultAccountDto} from "../../model/entity/account/accountEntity.test.data";
+import AccountEntity from "../../model/entity/account/accountEntity";
+import GetAndInitializeAccountLocaleController from "./getAndInitializeAccountLocaleController";
+import {enableFetchMocks} from "jest-fetch-mock";
+import {defaultApiClientOptions} from "passbolt-styleguide/src/shared/lib/apiClient/apiClientOptions.test.data";
+import {anonymousOrganizationSettings} from "../../model/entity/organizationSettings/organizationSettingsEntity.test.data";
+import {mockApiResponse} from "../../../../../test/mocks/mockApiResponse";
+
+beforeEach(() => {
+  enableFetchMocks();
+});
+
+describe("GetAndInitializeAccountLocaleController", () => {
+  describe("GetAndInitializeAccountLocaleController::exec", () => {
+    it("Should retrieve the account locale and initialize i18next with it.", async() => {
+      const storedAccountDto = defaultAccountDto();
+      const storedAccount = new AccountEntity(storedAccountDto);
+      const controller = new GetAndInitializeAccountLocaleController(null, null, defaultApiClientOptions(), storedAccount);
+
+      // Mock API fetch organization settings
+      const mockApiResult = anonymousOrganizationSettings();
+      fetch.doMockOnce(() => mockApiResponse(mockApiResult));
+
+      expect.assertions(1);
+      const locale = await controller.exec();
+      const expectedLocaleDto = {locale: "de-DE", label: "Deutsch"};
+      expect(locale.toDto()).toEqual(expectedLocaleDto);
+    });
+
+    it("Should retrieve the organization locale if no account locale defined and initialize i18next with it.", async() => {
+      const storedAccountDto = defaultAccountDto({locale: null});
+      const storedAccount = new AccountEntity(storedAccountDto);
+      const controller = new GetAndInitializeAccountLocaleController(null, null, defaultApiClientOptions(), storedAccount);
+
+      // Mock API fetch organization settings
+      const mockApiResult = anonymousOrganizationSettings();
+      fetch.doMockOnce(() => mockApiResponse(mockApiResult));
+
+      expect.assertions(1);
+      const locale = await controller.exec();
+      const expectedLocaleDto = {locale: "en-UK", label: "English"};
+      expect(locale.toDto()).toEqual(expectedLocaleDto);
+    });
+
+
+    it("Should fallback on default extension locale if nothing found.", async() => {
+      const storedAccountDto = defaultAccountDto({locale: null});
+      const storedAccount = new AccountEntity(storedAccountDto);
+      const controller = new GetAndInitializeAccountLocaleController(null, null, defaultApiClientOptions(), storedAccount);
+
+      // Mock API fetch organization settings
+      const mockApiResult = anonymousOrganizationSettings({app: {locale: null}});
+      fetch.doMockOnce(() => mockApiResponse(mockApiResult));
+
+      expect.assertions(1);
+      const locale = await controller.exec();
+      const expectedLocaleDto = {locale: "en-UK", label: "English"};
+      expect(locale.toDto()).toEqual(expectedLocaleDto);
+    });
+  });
+});

package/src/all/background_page/controller/account/updatePrivateKeyController.js

@@ -0,0 +1,127 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.3
+ */
+import AccountModel from "../../model/account/accountModel";
+import PassphraseStorageService from "../../service/session_storage/passphraseStorageService";
+import FileService from "../../service/file/fileService";
+import OrganizationSettingsModel from "../../model/organizationSettings/organizationSettingsModel";
+import SsoDataStorage from "../../service/indexedDB_storage/ssoDataStorage";
+import SsoKitServerPartModel from "../../model/sso/ssoKitServerPartModel";
+import PassboltApiFetchError from "passbolt-styleguide/src/shared/lib/Error/PassboltApiFetchError";
+import GenerateSsoKitService from "../../service/sso/generateSsoKitService";
+
+const RECOVERY_KIT_FILENAME = "passbolt-recovery-kit.asc";
+
+class UpdatePrivateKeyController {
+  /**
+   * UpdatePrivateKeyController constructor
+   * @param {Worker} worker
+   * @param {string} requestId uuid
+   * @param {ApiClientOptions} apiClientOptions the api client options
+   */
+  constructor(worker, requestId, apiClientOptions) {
+    this.worker = worker;
+    this.requestId = requestId;
+    this.accountModel = new AccountModel();
+    this.organisationSettingsModel = new OrganizationSettingsModel(apiClientOptions);
+    this.ssoKitServerPartModel = new SsoKitServerPartModel(apiClientOptions);
+  }
+
+  /**
+   * Wrapper of exec function to run it with worker.
+   *
+   * @return {Promise<void>}
+   */
+  async _exec(oldPassphrase, newPassphrase) {
+    try {
+      await this.exec(oldPassphrase, newPassphrase);
+      this.worker.port.emit(this.requestId, "SUCCESS");
+    } catch (error) {
+      console.error(error);
+      this.worker.port.emit(this.requestId, 'ERROR', error);
+    }
+  }
+
+  /**
+   * Updates the passphrase of the current user's private key and then starts a download of the new key.
+   * It also generates a new SSO kit if required.
+   * @param {string} oldPassphrase
+   * @param {string} newPassphrase
+   * @returns {Promise<void>}
+   */
+  async exec(oldPassphrase, newPassphrase) {
+    if (typeof oldPassphrase !== 'string' || typeof newPassphrase !== 'string') {
+      throw new Error('The old and new passphrase have to be string');
+    }
+    const organizationSettings = await this.organisationSettingsModel.getOrFind();
+    const ssoIsEnabled = organizationSettings.isPluginEnabled("sso");
+
+    const userPrivateArmoredKey = await this.accountModel.rotatePrivateKeyPassphrase(oldPassphrase, newPassphrase);
+    if (ssoIsEnabled) {
+      await this.regenerateSsoKit(newPassphrase);
+    }
+    await this.accountModel.updatePrivateKey(userPrivateArmoredKey);
+    await PassphraseStorageService.flushPassphrase();
+    if (PassphraseStorageService.isSessionKeptUntilLogOut()) {
+      await PassphraseStorageService.set(newPassphrase);
+    }
+    await FileService.saveFile(RECOVERY_KIT_FILENAME, userPrivateArmoredKey, "text/plain", this.worker.tab.id);
+  }
+
+  /**
+   * Handles the generation of a new SSO kit.
+   * @param {string} newPassphrase
+   * @returns {Promise<void>}
+   */
+  async regenerateSsoKit(newPassphrase) {
+    let currentKit;
+    try {
+      currentKit = await SsoDataStorage.get();
+    } catch (e) {
+      console.log(e);
+      return;
+    }
+
+    if (!currentKit) {
+      return;
+    }
+
+    if (currentKit.isRegistered()) {
+      await this.deleteServerPartSsoKit(currentKit.id);
+    }
+
+    const ssoKits = await GenerateSsoKitService.generateSsoKits(newPassphrase, currentKit.provider);
+    const registeredServerPartSsoKit = await this.ssoKitServerPartModel.setupSsoKit(ssoKits.serverPart);
+    ssoKits.clientPart.id = registeredServerPartSsoKit.id;
+    await SsoDataStorage.save(ssoKits.clientPart);
+  }
+
+  /**
+   * Tries to delete the server part SSO kit id if any.
+   * If the kit doesn't exist on the server, it ignores the deletion silently.
+   * @param {uuid} ssoKitId
+   * @private
+   */
+  async deleteServerPartSsoKit(ssoKitId) {
+    try {
+      await this.ssoKitServerPartModel.deleteSsoKit(ssoKitId);
+    } catch (e) {
+      // we assume that the kit might have been remove from the server already
+      if (!(e instanceof PassboltApiFetchError && e?.data?.code === 404)) {
+        throw e;
+      }
+    }
+  }
+}
+
+export default UpdatePrivateKeyController;

package/src/all/background_page/controller/account/updatePrivateKeyController.test.js

@@ -0,0 +1,317 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.3
+ */
+import "../../../../../test/mocks/mockSsoDataStorage";
+import "../../../../../test/mocks/mockCryptoKey";
+import {v4 as uuidv4} from "uuid";
+import {pgpKeys} from "../../../../../test/fixtures/pgpKeys/keys";
+import MockExtension from "../../../../../test/mocks/mockExtension";
+import {defaultApiClientOptions} from "passbolt-styleguide/src/shared/lib/apiClient/apiClientOptions.test.data";
+import DecryptPrivateKeyService from "../../service/crypto/decryptPrivateKeyService";
+import UpdatePrivateKeyController from "./updatePrivateKeyController";
+import {OpenpgpAssertion} from "../../utils/openpgp/openpgpAssertions";
+import FileService from "../../service/file/fileService";
+import SsoDataStorage from "../../service/indexedDB_storage/ssoDataStorage";
+import {clientSsoKit} from "../../model/entity/sso/ssoKitClientPart.test.data";
+import GenerateSsoKitService from "../../service/sso/generateSsoKitService";
+import {anonymousOrganizationSettings} from "../../model/entity/organizationSettings/organizationSettingsEntity.test.data";
+import {mockApiResponse, mockApiResponseError} from "../../../../../test/mocks/mockApiResponse";
+import {enableFetchMocks} from "jest-fetch-mock";
+import SsoKitClientPartEntity from "../../model/entity/sso/ssoKitClientPartEntity";
+import SsoKitServerPartEntity from "../../model/entity/sso/ssoKitServerPartEntity";
+import PassphraseStorageService from "../../service/session_storage/passphraseStorageService";
+import InvalidMasterPasswordError from "../../error/invalidMasterPasswordError";
+import {generateSsoKitServerData} from "../../model/entity/sso/ssoKitServerPart.test.data";
+
+const mockedSaveFile = jest.spyOn(FileService, "saveFile");
+
+beforeEach(() => {
+  enableFetchMocks();
+  jest.clearAllMocks();
+  fetch.resetMocks();
+});
+
+describe("UpdatePrivateKeyController", () => {
+  const mockOrganisationSettingCall = (ssoEnabled = false) => {
+    const organizationSettings = anonymousOrganizationSettings();
+    if (ssoEnabled) {
+      organizationSettings.passbolt.plugins.sso = {enabled: true};
+    }
+    fetch.doMockOnceIf(new RegExp('/settings.json'), () => mockApiResponse(organizationSettings, {servertime: Date.now() / 1000}));
+  };
+
+  describe("UpdatePrivateKeyController::exec", () => {
+    const data = generateSsoKitServerData({});
+    const dto = {data};
+
+    it("Should trigger the download of the recovery kit with the new passphrase.", async() => {
+      expect.assertions(4);
+
+      await MockExtension.withConfiguredAccount();
+      mockOrganisationSettingCall();
+      mockedSaveFile.mockImplementation(async(fileName, fileContent, fileContentType, workerTabId) => {
+        expect(fileName).toStrictEqual("passbolt-recovery-kit.asc");
+        expect(fileContentType).toStrictEqual("text/plain");
+        expect(workerTabId).toStrictEqual(worker.tab.id);
+
+        const key = await OpenpgpAssertion.readKeyOrFail(fileContent);
+        OpenpgpAssertion.assertEncryptedPrivateKey(key);
+
+        const decryptedPrivateKey = await DecryptPrivateKeyService.decrypt(key, newPassphrase);
+        expect(decryptedPrivateKey).toBeTruthy();
+      });
+
+      const worker = {
+        tab: {
+          id: uuidv4()
+        }
+      };
+
+      const controller = new UpdatePrivateKeyController(worker, null, defaultApiClientOptions());
+      const oldPassphrase = pgpKeys.ada.passphrase;
+      const newPassphrase = "newPassphrase";
+      await controller.exec(oldPassphrase, newPassphrase);
+    });
+
+    it("Should throw an error if no passphrase is provided.", async() => {
+      expect.assertions(2);
+      await MockExtension.withConfiguredAccount();
+      const controller = new UpdatePrivateKeyController(null, null, defaultApiClientOptions());
+
+      const nullPassphrase = null;
+      const stringPassphrase = "stringPassphrase";
+      const expectedError = new Error("The old and new passphrase have to be string");
+      try {
+        await controller.exec(nullPassphrase, stringPassphrase);
+      } catch (e) {
+        expect(e).toStrictEqual(expectedError);
+      }
+
+      try {
+        await controller.exec(stringPassphrase, nullPassphrase);
+      } catch (e) {
+        expect(e).toStrictEqual(expectedError);
+      }
+    });
+
+    it("Should throw an error if passphrases are not strings.", async() => {
+      expect.assertions(2);
+      await MockExtension.withConfiguredAccount();
+      const controller = new UpdatePrivateKeyController(null, null, defaultApiClientOptions());
+
+      const notStringPassphrase = {};
+      const stringPassphrase = "stringPassphrase";
+      const expectedError = new Error("The old and new passphrase have to be string");
+      try {
+        await controller.exec(notStringPassphrase, stringPassphrase);
+      } catch (e) {
+        expect(e).toStrictEqual(expectedError);
+      }
+
+      try {
+        await controller.exec(stringPassphrase, notStringPassphrase);
+      } catch (e) {
+        expect(e).toStrictEqual(expectedError);
+      }
+    });
+
+    it("Should update the local SSO kit if one already exists.", async() => {
+      expect.assertions(2);
+      const newPassphrase = "newPassphrase";
+      const ssoKit = clientSsoKit();
+      const newSsoKitId = uuidv4();
+      const newSsoKit = new SsoKitClientPartEntity(clientSsoKit({id: newSsoKitId}));
+      const worker = {
+        tab: {
+          id: uuidv4()
+        }
+      };
+
+      await MockExtension.withConfiguredAccount();
+      SsoDataStorage.setMockedData(ssoKit);
+
+      expect.assertions(3);
+
+      mockOrganisationSettingCall(true);
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/${ssoKit.id}.json`), () => mockApiResponse({}));
+      fetch.doMockOnceIf(new RegExp('/sso/keys.json'), () => mockApiResponse({id: newSsoKitId, data: data}));
+
+      jest.spyOn(GenerateSsoKitService, "generateSsoKits").mockImplementation((passphrase, providerId) => {
+        expect(passphrase).toBe(newPassphrase);
+        expect(providerId).toBe(ssoKit.provider);
+
+        return {
+          serverPart: new SsoKitServerPartEntity(dto),
+          clientPart: newSsoKit,
+        };
+      });
+
+      SsoDataStorage.save.mockImplementation(kit => {
+        expect(kit).toBe(newSsoKit);
+      });
+
+      mockedSaveFile.mockImplementation(async() => {});
+
+      const controller = new UpdatePrivateKeyController(worker, null, defaultApiClientOptions());
+      const oldPassphrase = pgpKeys.ada.passphrase;
+      await controller.exec(oldPassphrase, newPassphrase);
+    });
+
+    it("Should not create a local SSO kit if none exists.", async() => {
+      expect.assertions(2);
+      const worker = {
+        tab: {
+          id: uuidv4()
+        }
+      };
+
+      await MockExtension.withConfiguredAccount();
+      SsoDataStorage.setMockedData(null);
+
+      expect.assertions(2);
+      mockOrganisationSettingCall(true);
+
+      const shouldNotHaveBeenCalledError = new Error("This API request should not have been made");
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/[a-fA-F0-9-].*\.json`), () => { throw shouldNotHaveBeenCalledError; });
+      fetch.doMockOnceIf(new RegExp('/sso/keys.json'), () => { throw shouldNotHaveBeenCalledError; });
+
+      jest.spyOn(GenerateSsoKitService, "generateSsoKits");
+
+      mockedSaveFile.mockImplementation(() => {});
+
+      const controller = new UpdatePrivateKeyController(worker, null, defaultApiClientOptions());
+      await controller.exec(pgpKeys.ada.passphrase, "newPassphrase");
+
+      expect(GenerateSsoKitService.generateSsoKits).not.toHaveBeenCalled();
+      expect(SsoDataStorage.save).not.toHaveBeenCalled();
+    });
+
+    it("Should not update the passsphrase if the kit can't be send to the server.", async() => {
+      mockOrganisationSettingCall(true);
+      const newPassphrase = "newPassphrase";
+      const ssoKit = clientSsoKit();
+      const newSsoKitId = uuidv4();
+      const newSsoKit = new SsoKitClientPartEntity(clientSsoKit({id: newSsoKitId}));
+      const worker = {
+        tab: {
+          id: uuidv4()
+        }
+      };
+
+      await MockExtension.withConfiguredAccount();
+      SsoDataStorage.setMockedData(ssoKit);
+
+      expect.assertions(3);
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/${ssoKit.id}.json`), () => mockApiResponse({}));
+
+      const expectedError = new Error("Something went wrong");
+      fetch.doMockOnceIf(new RegExp('/sso/keys.json'), () => { throw expectedError; });
+
+      jest.spyOn(GenerateSsoKitService, "generateSsoKits").mockImplementation(() => ({
+        serverPart: new SsoKitServerPartEntity(dto),
+        clientPart: newSsoKit,
+      }));
+      jest.spyOn(PassphraseStorageService, "flushPassphrase");
+
+      mockedSaveFile.mockImplementation(async() => {});
+
+      const controller = new UpdatePrivateKeyController(worker, null, defaultApiClientOptions());
+      const oldPassphrase = pgpKeys.ada.passphrase;
+      try {
+        await controller.exec(oldPassphrase, newPassphrase);
+      } catch (_) { }
+
+      expect(SsoDataStorage.save).not.toHaveBeenCalled();
+      expect(PassphraseStorageService.flushPassphrase).not.toHaveBeenCalled();
+      expect(mockedSaveFile).not.toHaveBeenCalled();
+    });
+
+    it("Should ignore the sso kit deletion on server side if it gets a 404.", async() => {
+      const newPassphrase = "newPassphrase";
+      const ssoKit = clientSsoKit();
+      const newSsoKitId = uuidv4();
+      const newSsoKit = new SsoKitClientPartEntity(clientSsoKit({id: newSsoKitId}));
+      const worker = {
+        tab: {
+          id: uuidv4()
+        }
+      };
+
+      await MockExtension.withConfiguredAccount();
+      SsoDataStorage.setMockedData(ssoKit);
+
+      expect.assertions(1);
+
+      mockOrganisationSettingCall(true);
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/${ssoKit.id}.json`), () => mockApiResponseError(404));
+      fetch.doMockOnceIf(new RegExp('/sso/keys.json'), () => mockApiResponse({id: newSsoKitId, data: data}));
+
+      jest.spyOn(GenerateSsoKitService, "generateSsoKits").mockImplementation(() => ({
+        serverPart: new SsoKitServerPartEntity(dto),
+        clientPart: newSsoKit,
+      }));
+
+      SsoDataStorage.save.mockImplementation(kit => {
+        expect(kit).toBe(newSsoKit);
+      });
+
+      mockedSaveFile.mockImplementation(async() => {});
+
+      const controller = new UpdatePrivateKeyController(worker, null, defaultApiClientOptions());
+      const oldPassphrase = pgpKeys.ada.passphrase;
+      await controller.exec(oldPassphrase, newPassphrase);
+    });
+
+    it("Should not generate another SSO kit if the passphrase can't be rotated.", async() => {
+      const newPassphrase = "newPassphrase";
+      const ssoKit = clientSsoKit();
+      const newSsoKitId = uuidv4();
+      const newSsoKit = new SsoKitClientPartEntity(clientSsoKit({id: newSsoKitId}));
+      const worker = {
+        tab: {
+          id: uuidv4()
+        }
+      };
+
+      await MockExtension.withConfiguredAccount();
+      SsoDataStorage.setMockedData(ssoKit);
+
+      expect.assertions(4);
+
+      mockOrganisationSettingCall(true);
+
+      const shouldNotHaveBeenCalledError = new Error("This API request should not have been made");
+      fetch.doMockOnceIf(new RegExp(`/sso/keys/[a-fA-F0-9-].*\.json`), () => { throw shouldNotHaveBeenCalledError; });
+      fetch.doMockOnceIf(new RegExp('/sso/keys.json'), () => { throw shouldNotHaveBeenCalledError; });
+
+      jest.spyOn(GenerateSsoKitService, "generateSsoKits");
+
+      SsoDataStorage.save.mockImplementation(kit => {
+        expect(kit).toBe(newSsoKit);
+      });
+
+      mockedSaveFile.mockImplementation(async() => {});
+
+      const controller = new UpdatePrivateKeyController(worker, null, defaultApiClientOptions());
+      try {
+        await controller.exec("wrong passphrase", newPassphrase);
+      } catch (e) {
+        expect(e).toBeInstanceOf(InvalidMasterPasswordError);
+      }
+
+      expect(GenerateSsoKitService.generateSsoKits).not.toHaveBeenCalled();
+      expect(SsoDataStorage.save).not.toHaveBeenCalled();
+      expect(mockedSaveFile).not.toHaveBeenCalled();
+    });
+  });
+});