passbolt-browser-extension 4.9.3 → 4.9.4

package/.github/workflows/release.yaml

@@ -9,9 +9,11 @@ jobs:
   build:
     name: Create release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - env:
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         name: Create Release
         run: gh release create "${GITHUB_REF#refs/*/}" -t "${GITHUB_REF#refs/*/}" --notes-file RELEASE_NOTES.md

package/.github/workflows/release_candidate.yaml

@@ -9,9 +9,11 @@ jobs:
   build:
     name: Create release candidate
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - env:
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         name: Create Release candidate
         run: gh release create "${GITHUB_REF#refs/*/}" -t "${GITHUB_REF#refs/*/}" -p --notes-file RELEASE_NOTES.md

package/CHANGELOG.md

@@ -3,6 +3,81 @@ All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
+## [4.9.4] - 2024-09-30
+### Fixed
+- PB-33927: Update the label for password expiry email notification
+- PB-34743: Fix: folder's sidebar information misses the creator and modifier information
+- PB-35351: Fix: Grid columns resizing unexpectedly
+
+### Maintenance
+- PB-34313: E2EE WP2 documentation permissions finder class
+- PB-34612: As a desktop app I should see the dotnet error message in of http error
+- PB-34632: WP2-1.1 Migrate ResourceTypeEntity to EntityV2
+- PB-34633: WP2-1.2 Migrate ResourceTypesCollection to EntityV2Collection
+- PB-34634: WP2-1.3 Migrate CommentEntity to EntityV2
+- PB-34635: WP2-1.4 Migrate CommentsCollection to EntityV2Collection
+- PB-34636: WP2-1.5 migrate external resource entity to entity v2
+- PB-34637: WP2-1.6 migrate external resources collection to entity v2 collection
+- PB-34638: WP2-1.7 migrate external folder entity to entity v2
+- PB-34639: WP2-1.8 migrate external folders collection to entity v2 collection
+- PB-34640: WP2-1.9 Migrate ExportResourcesFileEntity to EntityV2
+- PB-34641: WP2-1.10 Migrate PermissionTransferEntity to EntityV2
+- PB-34642: WP2-1.11 Migrate PermissionTransfersCollection to EntityV2Collection
+- PB-34643: WP2-1.12 Migrate GroupDeleteTransferEntity to EntityV2
+- PB-34644: WP2-1.14 Migrate GroupUserTransfersCollection to EntityV2Collection
+- PB-34645: WP2-1.15 Migrate UserDeleteTransferEntity to EntityV2
+- PB-34646: WP2-1.13 Migrate GroupUserTransferEntity to EntityV2
+- PB-34647: WP2-1.16 Migrate NeededSecretEntity to EntityV2
+- PB-34648: WP2-1.17 Migrate NeededSecretsCollection to EntityV2Collection
+- PB-34649: WP2-1.18 Migrate SecretEntity to EntityV2
+- PB-34650: WP2-1.19 Migrate SecretsCollection to EntityV2Collection
+- PB-34651: WP2-1.20 Migrate GroupUpdateDryRunResultEntity to EntityV2
+- PB-34656: WP2-1.25 Migrate ImportResourcesFileEntity to EntityV2
+- PB-34657: WP2-1.26 Migrate PlaintextEntity to EntityV2
+- PB-34658: WP2-1.27 Migrate TotpEntity to EntityV2
+- PB-34747: WP2-1.28 Remove not used sanitizeDto from GroupsUsersCollection
+- PB-35124: Migrate 'gte' and 'lte' props of schemas to 'minimum' and 'maximum'
+- PB-35125: WP2-2.6 Find resource permissions by requesting dedicated API permissions entry point
+- PB-35128: WP2-2.1 unnecessary quick a api call when displaying home page
+- PB-35161: WP2-2.2 unnecessary quick a api call for filtering resources: filter by favourite
+- PB-35170: WP2-2.5 unnecessary quick a api call for filtering resources: filter by tags
+- PB-35172: WP2-2.7 Find folder permissions by requesting dedicated API permissions entry point
+- PB-35174: WP2-4.1 Migrate Webapp resource create form in view model
+- PB-35175: WP2-4.2 Migrate Webapp resource edit form in view model
+- PB-35177: WP2-4.3 Migrate Quickaccess resource create form in view model
+- PB-35178: WP2-4.4 Migrate Quickaccess resource auto-save form in view model
+- PB-35179: WP2-4.5 Migrate Webapp edit description from sidebar form in view model ?
+- PB-35180: WP2-2.8 Copy/preview password/totp should find single secret by requesting dedicated API secrets entry point
+- PB-35182: WP2-3.1 Migrate the resource types event 'passbolt.resource-type.get-all' into a controller
+- PB-35233: WP2-5.1 PlainText entity schema should be provided by the browser extension
+- PB-35253: WP2-3.2 Migrate resource update controller logic into service
+- PB-35255: WP2-3.3 Migrate resource “update-local-storage” event logic to a dedicated controller
+- PB-35256: WP2-5.2 Unit test performance of new collection v2 and ensure no regression is introduced
+- PB-35261: WP2-2.10 Shift resources & folders and update local storage debounce...
+- PB-35261: WP2-2.10 Decouple logic of update local storage, find all and get or find all in order to prepare for resource with encrypted metadata
+- PB-35323: Ensure resource test factory does not contain any metadata at the root of the resource
+- PB-35338: WP2-2.11 Folders update local storage should handle threshold period to limit the number of API request
+- PB-35339: Review resource update service test
+- PB-35340: WP2-2.12 drop resources collection sanitise dto
+- PB-35341: WP2-2.13 Migrate findAll from ResourceModel into FindResourceService
+- PB-35342: WP2-2.14 Leverage local storage when filtering resources by group
+- PB-35344: WP2-2.15 Migrate findSuggestedResources from resource model to...
+- PB-35345: WP2-2.16 Migrate findAllForShare from resource api service to FindResources service
+- PB-35346: WP2-2.17 migrate find all for decrypt from resource api service to find resources service
+- PB-35348: WP2-2.18 Migrate findById to the FindResourcesService
+- PB-35359: WP3 Class diagram of resources types local storage HOC
+- PB-35359: WP3 Update resource class diagram to support resource edit with v5
+- PB-35359: Technical specifications: WP3 support v5 resource types with v4 UI
+- PB-35414: WP2-2.16 Create ExecuteConcurrentlyService to perform query in parallel
+
+### Security
+- PB-35129: Upgrade vulnerable library webpack
+- PB-35354: Upgrade vulnerable library path-to-regexp
+
+## [4.9.3] - 2024-09-03
+### Fixed
+- PB-35185 Administrator should be able to delete users who are sole owners of resources or sole group manager
+
 ## [4.9.2] - 2024-08-26
 ### Fixed
 - PB-33861: Resources with personal field set to null should be considered as personal resources
@@ -1764,7 +1839,9 @@ self registration settings option in the left-side bar
 - AP: User with plugin installed
 - LU: Logged in user
 
-[Unreleased]: https://github.com/passbolt/passbolt_browser_extension/compare/v4.9.2...HEAD
+[Unreleased]: https://github.com/passbolt/passbolt_browser_extension/compare/v4.9.4...HEAD
+[4.9.4]: https://github.com/passbolt/passbolt_browser_extension/compare/v4.9.3...v4.9.4
+[4.9.3]: https://github.com/passbolt/passbolt_browser_extension/compare/v4.9.2...v4.9.3
 [4.9.2]: https://github.com/passbolt/passbolt_browser_extension/compare/v4.9.1...4.9.2
 [4.9.1]: https://github.com/passbolt/passbolt_browser_extension/compare/v4.9.0...4.9.1
 [4.9.0]: https://github.com/passbolt/passbolt_browser_extension/compare/v4.8.2...4.9.0

package/RELEASE_NOTES.md

@@ -1,9 +1,76 @@
-Song: https://youtu.be/BGHlZwMYO9g?si=LhUEanqg7q9j-nxv
+Song: https://www.youtube.com/watch?v=tmZ-loZlsyI
 
-Passbolt v4.9.3 is a maintenance update that addresses issues related to the deletion of users. Specifically, it fixes problems that occurred when trying to delete a user who is either the sole owner of resources or the sole group manager. Under these conditions, the deletion process did not work as expected, and this update resolves those issues.
+Passbolt v4.9.4 is a maintenance update of preparatory work for the incoming v5 and addresses reported issues. Specifically, it cleans the codebase to ease the later encryption of the resource metadata. Plus, it fixes the unexpected resource workspace column resizing and some displayed information.
 
 Thank you to the community for reporting this issue.
 
-## [4.9.6] - 2024-09-03
+## [4.9.4] - 2024-09-30
 ### Fixed
-- PB-35185 Administrator should be able to delete users who are sole owners of resources or sole group manager
+- PB-33927: Update the label for password expiry email notification
+- PB-34743: Fix: folder's sidebar information misses the creator and modifier information
+- PB-35351: Fix: Grid columns resizing unexpectedly
+
+### Maintenance
+- PB-34313: E2EE WP2 documentation permissions finder class
+- PB-34612: As a desktop app I should see the dotnet error message in of http error
+- PB-34632: WP2-1.1 Migrate ResourceTypeEntity to EntityV2
+- PB-34633: WP2-1.2 Migrate ResourceTypesCollection to EntityV2Collection
+- PB-34634: WP2-1.3 Migrate CommentEntity to EntityV2
+- PB-34635: WP2-1.4 Migrate CommentsCollection to EntityV2Collection
+- PB-34636: WP2-1.5 migrate external resource entity to entity v2
+- PB-34637: WP2-1.6 migrate external resources collection to entity v2 collection
+- PB-34638: WP2-1.7 migrate external folder entity to entity v2
+- PB-34639: WP2-1.8 migrate external folders collection to entity v2 collection
+- PB-34640: WP2-1.9 Migrate ExportResourcesFileEntity to EntityV2
+- PB-34641: WP2-1.10 Migrate PermissionTransferEntity to EntityV2
+- PB-34642: WP2-1.11 Migrate PermissionTransfersCollection to EntityV2Collection
+- PB-34643: WP2-1.12 Migrate GroupDeleteTransferEntity to EntityV2
+- PB-34644: WP2-1.14 Migrate GroupUserTransfersCollection to EntityV2Collection
+- PB-34645: WP2-1.15 Migrate UserDeleteTransferEntity to EntityV2
+- PB-34646: WP2-1.13 Migrate GroupUserTransferEntity to EntityV2
+- PB-34647: WP2-1.16 Migrate NeededSecretEntity to EntityV2
+- PB-34648: WP2-1.17 Migrate NeededSecretsCollection to EntityV2Collection
+- PB-34649: WP2-1.18 Migrate SecretEntity to EntityV2
+- PB-34650: WP2-1.19 Migrate SecretsCollection to EntityV2Collection
+- PB-34651: WP2-1.20 Migrate GroupUpdateDryRunResultEntity to EntityV2
+- PB-34656: WP2-1.25 Migrate ImportResourcesFileEntity to EntityV2
+- PB-34657: WP2-1.26 Migrate PlaintextEntity to EntityV2
+- PB-34658: WP2-1.27 Migrate TotpEntity to EntityV2
+- PB-34747: WP2-1.28 Remove not used sanitizeDto from GroupsUsersCollection
+- PB-35124: Migrate 'gte' and 'lte' props of schemas to 'minimum' and 'maximum'
+- PB-35125: WP2-2.6 Find resource permissions by requesting dedicated API permissions entry point
+- PB-35128: WP2-2.1 unnecessary quick a api call when displaying home page
+- PB-35161: WP2-2.2 unnecessary quick a api call for filtering resources: filter by favourite
+- PB-35170: WP2-2.5 unnecessary quick a api call for filtering resources: filter by tags
+- PB-35172: WP2-2.7 Find folder permissions by requesting dedicated API permissions entry point
+- PB-35174: WP2-4.1 Migrate Webapp resource create form in view model
+- PB-35175: WP2-4.2 Migrate Webapp resource edit form in view model
+- PB-35177: WP2-4.3 Migrate Quickaccess resource create form in view model
+- PB-35178: WP2-4.4 Migrate Quickaccess resource auto-save form in view model
+- PB-35179: WP2-4.5 Migrate Webapp edit description from sidebar form in view model ?
+- PB-35180: WP2-2.8 Copy/preview password/totp should find single secret by requesting dedicated API secrets entry point
+- PB-35182: WP2-3.1 Migrate the resource types event 'passbolt.resource-type.get-all' into a controller
+- PB-35233: WP2-5.1 PlainText entity schema should be provided by the browser extension
+- PB-35253: WP2-3.2 Migrate resource update controller logic into service
+- PB-35255: WP2-3.3 Migrate resource “update-local-storage” event logic to a dedicated controller
+- PB-35256: WP2-5.2 Unit test performance of new collection v2 and ensure no regression is introduced
+- PB-35261: WP2-2.10 Shift resources & folders and update local storage debounce...
+- PB-35261: WP2-2.10 Decouple logic of update local storage, find all and get or find all in order to prepare for resource with encrypted metadata
+- PB-35323: Ensure resource test factory does not contain any metadata at the root of the resource
+- PB-35338: WP2-2.11 Folders update local storage should handle threshold period to limit the number of API request
+- PB-35339: Review resource update service test
+- PB-35340: WP2-2.12 drop resources collection sanitise dto
+- PB-35341: WP2-2.13 Migrate findAll from ResourceModel into FindResourceService
+- PB-35342: WP2-2.14 Leverage local storage when filtering resources by group
+- PB-35344: WP2-2.15 Migrate findSuggestedResources from resource model to...
+- PB-35345: WP2-2.16 Migrate findAllForShare from resource api service to FindResources service
+- PB-35346: WP2-2.17 migrate find all for decrypt from resource api service to find resources service
+- PB-35348: WP2-2.18 Migrate findById to the FindResourcesService
+- PB-35359: WP3 Class diagram of resources types local storage HOC
+- PB-35359: WP3 Update resource class diagram to support resource edit with v5
+- PB-35359: Technical specifications: WP3 support v5 resource types with v4 UI
+- PB-35414: WP2-2.16 Create ExecuteConcurrentlyService to perform query in parallel
+
+### Security
+- PB-35129: Upgrade vulnerable library webpack
+- PB-35354: Upgrade vulnerable library path-to-regexp

package/doc/error-management-verify-key-server.md

@@ -0,0 +1,47 @@
+```mermaid
+%%{init: {'theme':'neutral'}}%%
+graph TB
+classDef condition stroke:#f96
+classDef requirement stroke:#b30900
+START(( ))
+
+API_VSK[Verify server key<br>from API]
+THROW_ERROR[Raise the original error]
+IS_SK_VALID{{Is the server key valid?}}:::condition
+CHECK_ERROR[Verify the error]
+IS_HTTP_ERROR_500{{Is http error 500 or empty?}}:::condition
+IS_HTTP_ERROR_NO_CONTENT{{Is an http error without content?}}:::condition
+IS_NO_ASSOCIATED_USER{{Is an not associated user error?}}:::condition
+REMOVE_BEXT_IFRAME[Call BEXT to remove the iframe]
+CAN_PARSE_KEY{{Can parse the key?}}:::condition
+IS_KEY_CHANGED{{Is server key changed?}}:::condition
+IS_KEY_EXPIRED{{Is server key expired?}}:::condition
+SET_CANNOT_PARSE_KEY_MESSAGE[Set error message: </br> The server key cannot be parsed.]
+SET_KEY_HAS_CHANGED_MESSAGE[Set error message: </br> The server key has changed.]
+SET_KEY_IS_EXPIRED_MESSAGE[Set error message: </br> The server key is expired.]
+SET_GENERIC_ERROR_MESSAGE[Set error message: </br> Server internal error. Check with your administrator.]
+
+START --> API_VSK
+API_VSK -..-> IS_SK_VALID
+IS_SK_VALID --> |yes|END((( )))
+IS_SK_VALID --> |NO|CHECK_ERROR
+CHECK_ERROR --> IS_HTTP_ERROR_500
+IS_HTTP_ERROR_500 --> |yes|THROW_ERROR
+IS_HTTP_ERROR_500 --> |No|IS_HTTP_ERROR_NO_CONTENT
+IS_HTTP_ERROR_NO_CONTENT --> |yes|THROW_ERROR
+THROW_ERROR --> ENDWITHERROR((( )))
+IS_HTTP_ERROR_NO_CONTENT --> |no|IS_NO_ASSOCIATED_USER
+IS_NO_ASSOCIATED_USER--> |yes|REMOVE_BEXT_IFRAME
+REMOVE_BEXT_IFRAME --> ENDBYCALLINGBEXT((( )))
+IS_NO_ASSOCIATED_USER--> |no|CAN_PARSE_KEY
+CAN_PARSE_KEY--> |no|SET_CANNOT_PARSE_KEY_MESSAGE
+SET_CANNOT_PARSE_KEY_MESSAGE --> ENDCUSTOMMESSAGEERROR((( )))
+CAN_PARSE_KEY--> |yes|IS_KEY_CHANGED
+IS_KEY_CHANGED--> |yes|SET_KEY_HAS_CHANGED_MESSAGE
+SET_KEY_HAS_CHANGED_MESSAGE--> ENDCUSTOMMESSAGEERROR((( )))
+IS_KEY_CHANGED--> |no|IS_KEY_EXPIRED
+IS_KEY_EXPIRED--> |yes|SET_KEY_IS_EXPIRED_MESSAGE
+SET_KEY_IS_EXPIRED_MESSAGE --> ENDCUSTOMMESSAGEERROR((( )))
+IS_KEY_EXPIRED--> |no|SET_GENERIC_ERROR_MESSAGE
+SET_GENERIC_ERROR_MESSAGE--> ENDCUSTOMMESSAGEERROR((( )))
+```

package/doc/folders-find-class.md

@@ -0,0 +1,77 @@
+```mermaid
+%%{init: {'theme':'neutral'}}%%
+classDiagram
+    namespace Event {
+        class UpdateFoldersLocalStoragePortMessage{
+            +name: "passbolt.folders.update-local-storage"
+        }
+    }
+
+    namespace FoldersController {
+        class UpdateAllFoldersLocalStorageController{
+            +exec() Promise
+        }
+    }
+
+    namespace FoldersService{
+        class GetOrFindFoldersService{
+            <<Service>>
+            +getOrFindAll() Promise~FolderssCollection~
+        }
+
+        class FindAndUpdateFoldersLocalStorageService{
+            <<Service>>
+            +findAndUpdateAll(FindAndUpdateLocalStorageOptions options) Promise~FoldersCollection~
+        }
+
+        class FindAndUpdateLocalStorageOptions {
+            updatePeriodThreshold: number
+        }
+
+        class FindFoldersService{
+            <<Service>>
+            +findAll(object contains, object filters) Promise~FoldersCollection~
+            +findAllForLocalStorage() Promise~FoldersCollection~
+        }
+    }
+
+    namespace ApiService{
+        class AbstractService {
+            <<Abstract>>
+        }
+
+        class FolderService {
+            <<Service>>
+            +get FOLDER_NAME() string
+            +getSupportedContainOptions() array$
+            +getSupportedFilterOptions() array$
+            +findAll(object contains, object filters, object orders) Promise~array~
+        }
+    }
+
+    namespace LocalStorageService{
+        class FoldersLocalStorageService {
+            <<Service>>
+            $hasCachedData() boolean
+            $flush() Promise
+            $get() Promise~array~
+            $set(FoldersCollection collection) Promise
+            $getFolderById(uuid id) Promise~object~
+            $addFolder(FolderEntity entity) Promise
+            $addFolders(FoldersCollection collection) Promise
+            $updateFolder(FolderEntity entity) Promise
+            $delete(uuid id) Promise
+            get $DEFAULT_CONTAIN() object
+            $assertEntityBeforeSave(FolderEntity entity)
+        }
+    }
+
+    UpdateFoldersLocalStoragePortMessage*--UpdateAllFoldersLocalStorageController
+    UpdateAllFoldersLocalStorageController*--FindAndUpdateFoldersLocalStorageService
+    FindAndUpdateFoldersLocalStorageService*--FoldersLocalStorageService
+    GetOrFindFoldersService*--FoldersLocalStorageService
+    GetOrFindFoldersService*--FindAndUpdateFoldersLocalStorageService
+    FindAndUpdateFoldersLocalStorageService*--FindFoldersService
+    FindFoldersService*--FolderService
+    AbstractService<|--FolderService
+```

package/doc/permissions-find-all-by-aco-foreign-key-class.md

@@ -0,0 +1,34 @@
+```mermaid
+%%{init: {'theme':'neutral'}}%%
+classDiagram
+    note for PortMessage "Permissions message listeners."
+    class PortMessage{
+        +name: "passbolt.permissions.find-aco-permissions-for-display"
+    }
+
+    class FindAcoPermissionsForDisplayController{
+        +exec(uuid acoForeignKey) PermissionsCollection
+    }
+
+    class FindPermissionsService{
+        +findAllByAcoForeignKeyForDisplay(uuid acoForeignKey) PermissionsCollection
+    }
+
+    note for PermissionService "/service/api/permission"
+    class PermissionService {
+        <<Service>>
+        +get RESOURCE_NAME() string
+        +getSupportedContainOptions() array$
+        +findAllByAcoForeignKey(uuid acoForeignKey, object contains) object
+    }
+
+    note for AbstractService "Abstract API service."
+    class AbstractService {
+        <<Abstract>>
+    }
+
+    AbstractService<|--PermissionService
+    FindPermissionsService*--PermissionService
+    FindAcoPermissionsForDisplayController*--FindPermissionsService
+    PortMessage*--FindAcoPermissionsForDisplayController
+```

package/doc/resource-find-all-decrypt-metadata-sequence.md

@@ -0,0 +1,51 @@
+```mermaid
+%%{init: {'theme':'neutra'}}%%
+sequenceDiagram
+
+%% Retrieve resources from LS
+DecryptMetadataSvc-->>+ResourceLocalStorage: get()
+ResourceLocalStorage-->>-DecryptMetadataSvc: resourcesFromLS
+
+%% Reuse metadata from LS whenever possible
+loop Foreach found resource
+    DecryptMetadataSvc-->>+resourcesFromLS~ResourcesCollection~: getFirst("id", resource.id)
+    resourcesFromLS~ResourcesCollection~-->>-DecryptMetadataSvc: resourceFromLS
+    DecryptMetadataSvc-->>+resource~ResourceEntity~: isModifiedAfter(resourceFromLS.modified)
+    resource~ResourceEntity~-->>-DecryptMetadataSvc: isMetaFromLSExpired
+    alt !isMetaFromLSExpired
+        DecryptMetadataSvc-->>resource~ResourceEntity~: set metadata(resourceFromLS.metadataClear)
+    end
+end
+
+%% Decrypt metadata with session key whenever possible
+DecryptMetadataSvc-->>+GetOrFindSessionKeysService: getOrFindAllByForeignIds(resources.ids)
+GetOrFindSessionKeysService-->>-DecryptMetadataSvc: sessionsKeys
+loop Foreach found resource not yet decrypted
+    DecryptMetadataSvc-->>+sessionKeys~SessionKeysCollection~: getFirst("foreign_id", resource.id)
+    sessionKeys~SessionKeysCollection~-->>-DecryptMetadataSvc: sessionKey
+    alt !sessionKey
+        DecryptMetadataSvc-->>+DecryptMessageService: decryptWithSessionKey(resource.metadata, sessionKey)
+        DecryptMessageService-->>-DecryptMetadataSvc: metadataClear
+        DecryptMetadataSvc-->>resource~ResourceEntity~: set metadata(metadataClear)
+    end
+end
+
+%% Decrypt with meta key whenever possible
+DecryptMetadataSvc-->>+GetOrFindMetadataKeysService: getOrFindAllByIds(resources.metadataKeysIds)
+GetOrFindMetadataKeysService-->>-DecryptMetadataSvc: metadataKeys
+loop Foreach found resource not yet decrypted
+    DecryptMetadataSvc-->>+metadataKeys~MetadataKeysCollection~: getFirst("id", resource.metadata_key_id)
+    metadataKeys~MetadataKeysCollection~-->>-DecryptMetadataSvc: metadataKey
+    alt !metadataKey
+        DecryptMetadataSvc-->>+DecryptMessageService: decrypt(resource.metadata, metadataKey)
+        DecryptMessageService-->>-DecryptMetadataSvc: metadataClear
+        DecryptMetadataSvc-->>resource~ResourceEntity~: set metadata(metadataClear)
+    end
+end
+
+loop Foreach found resource not yet decrypted
+    DecryptMetadataSvc-->>+DecryptMessageService: decrypt(resource.metadata, account.privateKey)
+    DecryptMessageService-->>-DecryptMetadataSvc: metadataClear
+    DecryptMetadataSvc-->>resource~ResourceEntity~: set metadata(metadataClear)
+end
+```

package/doc/resources-find-and-decrypt-metadata-flow.md

@@ -0,0 +1,49 @@
+```mermaid
+%%{init: {'theme':'neutral'}}%%
+graph TB
+classDef condition stroke:#f96
+classDef requirement stroke:#b30900
+START(( ))
+API_RS[Find Resources<br>from API]
+LS_API_RST[Get Resources Types<br>from LS or API]:::requirement
+IS_RST_SUP{{is type supported?}}:::condition
+LS_RS[Get Resources<br>from LS]:::requirement
+V4_MARSH[Marshall Meta]
+SS_LS_SESS_KEYS[Get Session Keys<br>from SS or LS]:::requirement
+V4_MARSH[Marshall Meta]
+DEC_META_SESS_KEY[Decrypt Meta <br>with Session Key]
+DEC_META_USER_KEY[Decrypt Meta <br>with User Key]
+SS_API_META_KEY[Get Meta Keys<br>from SS or API]:::requirement
+DEC_META_META_KEY[Decrypt Meta <br>with Meta Key]
+GET_PASSPHRASE[Get user passphrase]:::requirement
+UPDATE_SESS_KEY[Update Session Key]
+EHD_META_DECRYPTED((( )))
+IS_META_UPDATED{{is Meta modified?}}:::condition
+IS_META_ENCRYPTED{{is Meta encrypted?}}:::condition
+IS_SESS_KEY_FOUND{{is Session Key<br>found & valid?}}:::condition
+IS_RS_PERSO{{Is Rs personal}}:::condition
+START --> API_RS
+LS_API_RST -..-> IS_RST_SUP
+API_RS --> IS_RST_SUP
+IS_RST_SUP --> |no, filter out<br>resource|END_FILTER_OUT((( )))
+LS_RS -..-> IS_META_UPDATED
+IS_RST_SUP --> |yes|IS_META_UPDATED
+IS_META_UPDATED --> |no, keep LS<br>Meta|END_META_NOT_UPDATED((( )))
+IS_META_UPDATED --> |yes|IS_META_ENCRYPTED
+IS_META_ENCRYPTED --> |no|V4_MARSH
+V4_MARSH --> END_V4_MARSH((( )))
+IS_META_ENCRYPTED --> |yes|IS_SESS_KEY_FOUND
+GET_PASSPHRASE -..-> SS_LS_SESS_KEYS
+SS_LS_SESS_KEYS -..-> IS_SESS_KEY_FOUND
+IS_SESS_KEY_FOUND --> |yes|DEC_META_SESS_KEY
+DEC_META_SESS_KEY --> EHD_META_DECRYPTED
+IS_SESS_KEY_FOUND --> |no|IS_RS_PERSO
+IS_RS_PERSO --> |yes|DEC_META_USER_KEY
+IS_RS_PERSO --> |no|DEC_META_META_KEY
+GET_PASSPHRASE -..-> DEC_META_USER_KEY
+DEC_META_USER_KEY --> UPDATE_SESS_KEY
+GET_PASSPHRASE -..-> SS_API_META_KEY
+SS_API_META_KEY -..-> DEC_META_META_KEY
+DEC_META_META_KEY --> UPDATE_SESS_KEY
+UPDATE_SESS_KEY --> EHD_META_DECRYPTED
+```