passbolt-browser-extension 5.12.1 → 5.13.0

package/src/all/background_page/service/local_storage/userLocalStorage.test.js

@@ -0,0 +1,282 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+import { defaultUserDto } from "passbolt-styleguide/src/shared/models/entity/user/userEntity.test.data";
+import { defaultUsersDtos } from "passbolt-styleguide/src/shared/models/entity/user/usersCollection.test.data";
+import UsersCollection from "passbolt-styleguide/src/shared/models/entity/user/usersCollection";
+import UserEntity from "../../model/entity/user/userEntity";
+import UserLocalStorage from "./userLocalStorage";
+
+beforeEach(async () => {
+  jest.clearAllMocks();
+  await UserLocalStorage.flush();
+});
+
+describe("UserLocalStorage", () => {
+  describe("::hasCachedData", () => {
+    it("should return false if there is no cached data", () => {
+      expect.assertions(1);
+      UserLocalStorage._runtimeCachedData = null;
+      expect(UserLocalStorage.hasCachedData()).toBe(false);
+    });
+
+    it("should return false if the cached data is undefined", () => {
+      expect.assertions(1);
+      UserLocalStorage._runtimeCachedData = undefined;
+      expect(UserLocalStorage.hasCachedData()).toBe(false);
+    });
+
+    it("should return true if there is cached data", () => {
+      expect.assertions(1);
+      UserLocalStorage._runtimeCachedData = [defaultUserDto()];
+      expect(UserLocalStorage.hasCachedData()).toBe(true);
+    });
+  });
+
+  describe("::flush", () => {
+    it("flushes works with not initialized local storage.", async () => {
+      expect.assertions(2);
+      await UserLocalStorage.flush();
+      // Expect the local storage (mocked here) to not be set.
+      expect(browser.storage.local.store[UserLocalStorage.USER_LOCAL_STORAGE_KEY]).toBeUndefined();
+      // Expect the runtime cache to not be set.
+      expect(UserLocalStorage._runtimeCachedData).toBeNull();
+    });
+
+    it("flushes local storage's content.", async () => {
+      expect.assertions(2);
+      const dtos = defaultUsersDtos();
+      const collection = new UsersCollection(dtos);
+      await UserLocalStorage.set(collection);
+      await UserLocalStorage.flush();
+      // Expect the local storage (mocked here) to not be set.
+      expect(browser.storage.local.store[UserLocalStorage.USER_LOCAL_STORAGE_KEY]).toBeUndefined();
+      // Expect the runtime cache to not be set.
+      expect(UserLocalStorage._runtimeCachedData).toBeNull();
+    });
+  });
+
+  describe("::get", () => {
+    it("returns undefined if nothing is stored in the local storage.", async () => {
+      expect.assertions(1);
+      const result = await UserLocalStorage.get();
+      expect(result).toBeUndefined();
+    });
+
+    it("returns content stored in the local storage.", async () => {
+      expect.assertions(1);
+      const collectionDto = defaultUsersDtos();
+      browser.storage.local.set({ [UserLocalStorage.USER_LOCAL_STORAGE_KEY]: collectionDto });
+      const result = await UserLocalStorage.get();
+      expect(result).toEqual(collectionDto);
+    });
+
+    it("returns content stored in the runtime cache.", async () => {
+      expect.assertions(2);
+      const collectionDto = defaultUsersDtos();
+      // Force the runtime cache, to ensure it is hit even if the local storage is empty.
+      UserLocalStorage._runtimeCachedData = collectionDto;
+      const result = await UserLocalStorage.get();
+      expect(result).toEqual(collectionDto);
+      // Control the local storage was well empty.
+      expect(browser.storage.local.store[UserLocalStorage.USER_LOCAL_STORAGE_KEY]).toBeUndefined();
+    });
+  });
+
+  describe("::set", () => {
+    it("stores content in the local storage.", async () => {
+      expect.assertions(3);
+      const dtos = defaultUsersDtos();
+      const collection = new UsersCollection(dtos);
+      await UserLocalStorage.set(collection);
+      // Expect the local storage (mocked here) to be set.
+      expect(browser.storage.local.store[UserLocalStorage.USER_LOCAL_STORAGE_KEY]).toBeDefined();
+      // Expect the runtime cache to be set.
+      expect(UserLocalStorage._runtimeCachedData).toBeDefined();
+      // Expect the get to retrieve the set data.
+      const resultGet = await UserLocalStorage.get();
+      expect(resultGet).toHaveLength(dtos.length);
+    });
+
+    it("throws error if no data is given to store.", async () => {
+      expect.assertions(3);
+      await expect(() => UserLocalStorage.set()).rejects.toThrow(TypeError);
+      // Expect the local storage (mocked here) to not be set.
+      expect(browser.storage.local.store[UserLocalStorage.USER_LOCAL_STORAGE_KEY]).toBeUndefined();
+      // Expect the runtime cache to not be set.
+      expect(UserLocalStorage._runtimeCachedData).toBeNull();
+    });
+
+    it("throws error if invalid data is given to store.", async () => {
+      expect.assertions(3);
+      await expect(() => UserLocalStorage.set({})).rejects.toThrow(TypeError);
+      // Expect the local storage (mocked here) to not be set.
+      expect(browser.storage.local.store[UserLocalStorage.USER_LOCAL_STORAGE_KEY]).toBeUndefined();
+      // Expect the runtime cache to not be set.
+      expect(UserLocalStorage._runtimeCachedData).toBeNull();
+    });
+  });
+
+  describe("::getUserById", () => {
+    it("returns a user by its id.", async () => {
+      expect.assertions(1);
+      const collectionDto = defaultUsersDtos();
+      const firstUserDto = collectionDto[0];
+      browser.storage.local.set({ [UserLocalStorage.USER_LOCAL_STORAGE_KEY]: collectionDto });
+      const result = await UserLocalStorage.getUserById(firstUserDto.id);
+      expect(result).toEqual(firstUserDto);
+    });
+  });
+
+  describe("::addUser", () => {
+    it("adds a user to local storage.", async () => {
+      expect.assertions(2);
+      const collectionDto = defaultUsersDtos();
+      browser.storage.local.set({ [UserLocalStorage.USER_LOCAL_STORAGE_KEY]: collectionDto });
+
+      const newUserDto = defaultUserDto();
+      const newUserEntity = new UserEntity(newUserDto);
+      await UserLocalStorage.addUser(newUserEntity);
+      const result = await UserLocalStorage.getUserById(newUserDto.id);
+      expect(result).toBeDefined();
+      expect(collectionDto.length).toEqual(11);
+    });
+
+    it("throws error when parameter is not a UserEntity.", async () => {
+      expect.assertions(2);
+      const collectionDto = defaultUsersDtos();
+      browser.storage.local.set({ [UserLocalStorage.USER_LOCAL_STORAGE_KEY]: collectionDto });
+
+      await expect(UserLocalStorage.addUser()).rejects.toThrow("UserLocalStorage expects an object of type UserEntity");
+      await expect(UserLocalStorage.addUser({})).rejects.toThrow(
+        "UserLocalStorage expects an object of type UserEntity",
+      );
+    });
+  });
+
+  describe("::updateUser", () => {
+    it("updates a user in local storage.", async () => {
+      expect.assertions(3);
+      const collectionDto = defaultUsersDtos();
+      const firstUserDto = collectionDto[0];
+      const secondUserDto = collectionDto[2];
+
+      browser.storage.local.set({ [UserLocalStorage.USER_LOCAL_STORAGE_KEY]: collectionDto });
+      let result = await UserLocalStorage.getUserById(firstUserDto.id);
+      expect(result).toEqual(firstUserDto);
+
+      // Modify the first user username and update
+      firstUserDto.username = "modified@passbolt.com";
+      const userEntity = new UserEntity(firstUserDto);
+      await UserLocalStorage.updateUser(userEntity);
+
+      result = await UserLocalStorage.getUserById(firstUserDto.id);
+      expect(result.username).toEqual("modified@passbolt.com");
+
+      // Ensure the second user hasn't been modified
+      result = await UserLocalStorage.getUserById(secondUserDto.id);
+      expect(result).toEqual(secondUserDto);
+    });
+
+    it("throws error when updating a user not in local storage.", async () => {
+      expect.assertions(1);
+      const collectionDto = defaultUsersDtos();
+      const unknownUserDto = defaultUserDto();
+
+      browser.storage.local.set({ [UserLocalStorage.USER_LOCAL_STORAGE_KEY]: collectionDto });
+      const userEntity = new UserEntity(unknownUserDto);
+      await expect(UserLocalStorage.updateUser(userEntity)).rejects.toThrow(
+        "The user could not be found in the local storage",
+      );
+    });
+
+    it("throws error when the userEntity parameter is not defined or not a UserEntity.", async () => {
+      expect.assertions(2);
+      const collectionDto = defaultUsersDtos();
+      browser.storage.local.set({ [UserLocalStorage.USER_LOCAL_STORAGE_KEY]: collectionDto });
+
+      await expect(UserLocalStorage.updateUser()).rejects.toThrow(
+        "UserLocalStorage expects an object of type UserEntity",
+      );
+      await expect(UserLocalStorage.updateUser({})).rejects.toThrow(
+        "UserLocalStorage expects an object of type UserEntity",
+      );
+    });
+  });
+
+  describe("::delete", () => {
+    it("deletes a user from local storage.", async () => {
+      expect.assertions(5);
+      const collectionDto = defaultUsersDtos();
+      const firstUserDto = collectionDto[0];
+      const secondUserDto = collectionDto[2];
+
+      browser.storage.local.set({ [UserLocalStorage.USER_LOCAL_STORAGE_KEY]: collectionDto });
+      let result = await UserLocalStorage.getUserById(firstUserDto.id);
+      expect(result).toEqual(firstUserDto);
+      expect(collectionDto.length).toEqual(10);
+
+      await UserLocalStorage.delete(firstUserDto.id);
+      result = await UserLocalStorage.getUserById(firstUserDto.id);
+      expect(result).toBeUndefined();
+      expect(collectionDto.length).toEqual(9);
+
+      // Ensure the second user hasn't been modified
+      result = await UserLocalStorage.getUserById(secondUserDto.id);
+      expect(result).toEqual(secondUserDto);
+    });
+  });
+
+  describe("::assertEntityBeforeSave", () => {
+    it("doesn't throw an error if the entity is a valid UserEntity.", () => {
+      expect.assertions(1);
+      const userDto = defaultUserDto();
+      const userEntity = new UserEntity(userDto);
+      expect(() => UserLocalStorage.assertEntityBeforeSave(userEntity)).not.toThrow();
+    });
+
+    it("throws an error if the entity is not set.", () => {
+      expect.assertions(1);
+      expect(() => UserLocalStorage.assertEntityBeforeSave()).toThrow(
+        "UserLocalStorage expects a UserEntity to be set",
+      );
+    });
+
+    it("throws an error if the entity is not a UserEntity.", () => {
+      expect.assertions(1);
+      expect(() => UserLocalStorage.assertEntityBeforeSave({})).toThrow(
+        "UserLocalStorage expects an object of type UserEntity",
+      );
+    });
+
+    it("throws an error if the entity id is not set.", () => {
+      expect.assertions(1);
+      const userDto = defaultUserDto();
+      const userEntity = new UserEntity(userDto);
+      userEntity._props.id = null;
+      expect(() => UserLocalStorage.assertEntityBeforeSave(userEntity)).toThrow(
+        "UserLocalStorage expects UserEntity id to be set",
+      );
+    });
+
+    it("throws an error if the entity profile is not set.", () => {
+      expect.assertions(1);
+      const userDto = defaultUserDto();
+      const userEntity = new UserEntity(userDto);
+      delete userEntity._profile;
+      expect(() => UserLocalStorage.assertEntityBeforeSave(userEntity)).toThrow(
+        "UserLocalStorage::set expects UserEntity profile to be set",
+      );
+    });
+  });
+});

package/src/all/background_page/service/metadata/createMetadataKeyService.test.js

@@ -21,7 +21,7 @@ import { OpenpgpAssertion } from "../../utils/openpgp/openpgpAssertions";
 import { pgpKeys } from "passbolt-styleguide/test/fixture/pgpKeys/keys";
 import MetadataKeyEntity from "passbolt-styleguide/src/shared/models/entity/metadata/metadataKeyEntity";
 import ExternalGpgKeyPairEntity from "passbolt-styleguide/src/shared/models/entity/gpgkey/external/externalGpgKeyPairEntity";
-import UsersCollection from "../../model/entity/user/usersCollection";
+import UsersCollection from "passbolt-styleguide/src/shared/models/entity/user/usersCollection";
 import { users } from "passbolt-styleguide/src/shared/models/entity/user/userEntity.test.data";
 import MetadataKeysSettingsEntity from "passbolt-styleguide/src/shared/models/entity/metadata/metadataKeysSettingsEntity";
 import { defaultMetadataKeysSettingsDto } from "passbolt-styleguide/src/shared/models/entity/metadata/metadataKeysSettingsEntity.test.data";

package/src/all/background_page/service/metadata/saveMetadataSettingsService.test.js

@@ -23,7 +23,7 @@ import {
 } from "passbolt-styleguide/src/shared/models/entity/metadata/metadataTypesSettingsEntity.test.data";
 import { defaultMetadataKeysSettingsDto } from "passbolt-styleguide/src/shared/models/entity/metadata/metadataKeysSettingsEntity.test.data";
 import MetadataKeysSettingsEntity from "passbolt-styleguide/src/shared/models/entity/metadata/metadataKeysSettingsEntity";
-import UsersCollection from "../../model/entity/user/usersCollection";
+import UsersCollection from "passbolt-styleguide/src/shared/models/entity/user/usersCollection";
 import {
   defaultMetadataKeyDto,
   metadataKeyWithSignedMetadataPrivateKeyDataDto,

package/src/all/background_page/service/metadata/shareMetadataKeyPrivateService.test.js

@@ -25,7 +25,7 @@ import {
   usersWithoutMissingMetadataKeysDto,
 } from "./shareMetadataKeyPrivateService.test.data";
 import RoleEntity from "passbolt-styleguide/src/shared/models/entity/role/roleEntity";
-import UsersCollection from "../../model/entity/user/usersCollection";
+import UsersCollection from "passbolt-styleguide/src/shared/models/entity/user/usersCollection";
 import MetadataKeysCollection from "passbolt-styleguide/src/shared/models/entity/metadata/metadataKeysCollection";
 import { OpenpgpAssertion } from "../../utils/openpgp/openpgpAssertions";
 import Keyring from "../../model/keyring";

package/src/all/background_page/service/migrateMetadata/migrateMetadataResourcesService.js

@@ -18,7 +18,7 @@ import EncryptMetadataService from "../metadata/encryptMetadataService";
 import { V4_TO_V5_RESOURCE_TYPE_MAPPING } from "passbolt-styleguide/src/shared/models/entity/resourceType/resourceTypeSchemasDefinition";
 import ResourceEntity from "../../model/entity/resource/resourceEntity";
 import i18n from "../../sdk/i18n";
-import PermissionEntity from "../../model/entity/permission/permissionEntity";
+import PermissionEntity from "passbolt-styleguide/src/shared/models/entity/permission/permissionEntity";
 
 const MAX_PROCESS_REPLAY = 3;
 

package/src/all/background_page/service/move/calculatePermissionsChangesForMoveService.js

@@ -0,0 +1,113 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+import PermissionChangesCollection from "../../model/entity/permission/change/permissionChangesCollection";
+import PermissionEntity from "passbolt-styleguide/src/shared/models/entity/permission/permissionEntity";
+import PermissionsCollection from "passbolt-styleguide/src/shared/models/entity/permission/permissionsCollection";
+
+class CalculatePermissionsChangesForMoveService {
+  /**
+   * Calculate permission changes when a folder moves from parentFolder to destFolder.
+   * From current permissions, remove the parent folder permissions, add the destination permissions.
+   * From this new set of permissions and the original permissions, calculate the needed changes.
+   *
+   * NOTE: This function requires permissions to be set for all objects.
+   *
+   * @param {FolderEntity} folderEntity
+   * @param {(FolderEntity|null)} parentFolder
+   * @param {(FolderEntity|null)} destFolder
+   * @returns {PermissionChangesCollection}
+   */
+  static forFolder(folderEntity, parentFolder, destFolder) {
+    return CalculatePermissionsChangesForMoveService._calculate(
+      folderEntity,
+      parentFolder,
+      destFolder,
+      PermissionEntity.ACO_FOLDER,
+    );
+  }
+
+  /**
+   * Calculate permission changes when a resource moves from parentFolder to destFolder.
+   * From current permissions, remove the parent folder permissions, add the destination permissions.
+   * From this new set of permissions and the original permissions, calculate the needed changes.
+   *
+   * NOTE: This function requires permissions to be set for all objects.
+   *
+   * @param {ResourceEntity} resource
+   * @param {(FolderEntity|null)} parentFolder
+   * @param {(FolderEntity|null)} destFolder
+   * @returns {PermissionChangesCollection}
+   */
+  static forResource(resource, parentFolder, destFolder) {
+    return CalculatePermissionsChangesForMoveService._calculate(
+      resource,
+      parentFolder,
+      destFolder,
+      PermissionEntity.ACO_RESOURCE,
+    );
+  }
+
+  /**
+   * Shared permission-change calculation for `forFolder` and `forResource`.
+   * Removes the parent folder permissions from the entity, adds the destination folder permissions,
+   * and returns the changes against the entity's original permissions. When moving to the root,
+   * the highest permission on the entity is preserved.
+   *
+   * @param {FolderEntity|ResourceEntity} entity The folder or resource being moved.
+   * @param {(FolderEntity|null)} parentFolder The current parent folder, or null if moving from the root.
+   * @param {(FolderEntity|null)} destFolder The destination folder, or null if moving to the root.
+   * @param {string} aco One of `PermissionEntity.ACO_FOLDER` or `PermissionEntity.ACO_RESOURCE`; not exposed on the public callers, which hardcode the value matching the entity type.
+   * @returns {PermissionChangesCollection}
+   * @private
+   */
+  static _calculate(entity, parentFolder, destFolder, aco) {
+    let remainingPermissions = new PermissionsCollection([], { assertAtLeastOneOwner: false });
+
+    // Remove permissions from parent if any
+    if (parentFolder) {
+      if (!entity.permissions || !parentFolder.permissions) {
+        throw new TypeError("CalculatePermissionsChangesForMoveService requires permissions to be set.");
+      }
+      remainingPermissions = PermissionsCollection.diff(entity.permissions, parentFolder.permissions, false);
+    }
+    // Add destination permissions
+    let permissionsFromParent = new PermissionsCollection([], { assertAtLeastOneOwner: false });
+    if (destFolder) {
+      if (!destFolder.permissions) {
+        throw new TypeError("CalculatePermissionsChangesForMoveService requires destination permissions to be set.");
+      }
+      permissionsFromParent = destFolder.permissions.cloneForAco(aco, entity.id, false);
+    }
+
+    const newPermissions = PermissionsCollection.sum(remainingPermissions, permissionsFromParent, false);
+    if (!destFolder) {
+      /*
+       * If the move is toward the root, reuse highest permission.
+       */
+      newPermissions.addOrReplace(
+        new PermissionEntity({
+          aco: aco,
+          aco_foreign_key: entity.id,
+          aro: entity.permission.aro,
+          aro_foreign_key: entity.permission.aroForeignKey,
+          type: PermissionEntity.PERMISSION_OWNER,
+        }),
+      );
+    }
+    newPermissions.assertAtLeastOneOwner();
+    return PermissionChangesCollection.calculateChanges(entity.permissions, newPermissions);
+  }
+}
+
+export default CalculatePermissionsChangesForMoveService;

package/src/all/background_page/service/move/calculatePermissionsChangesForMoveService.test.data.js

@@ -0,0 +1,38 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+import { v4 as uuidv4 } from "uuid";
+import FolderEntity from "../../model/entity/folder/folderEntity";
+import ResourceEntity from "../../model/entity/resource/resourceEntity";
+import { defaultFolderDto } from "passbolt-styleguide/src/shared/models/entity/folder/folderEntity.test.data";
+import { defaultResourceDto } from "passbolt-styleguide/src/shared/models/entity/resource/resourceEntity.test.data";
+
+/**
+ * Build a FolderEntity whose ACL is the given `permissions` list.
+ * Each permission's `aco_foreign_key` is auto-bound to the folder id.
+ */
+export const buildFolder = (permissions) => {
+  const id = uuidv4();
+  const bound = permissions.map((p) => ({ ...p, aco_foreign_key: id }));
+  return new FolderEntity(defaultFolderDto({ id, permission: bound[0], permissions: bound }));
+};
+
+/**
+ * Build a ResourceEntity whose ACL is the given `permissions` list.
+ * Each permission's `aco_foreign_key` is auto-bound to the resource id.
+ */
+export const buildResource = (permissions) => {
+  const id = uuidv4();
+  const bound = permissions.map((p) => ({ ...p, aco_foreign_key: id }));
+  return new ResourceEntity(defaultResourceDto({ id, permission: bound[0], permissions: bound }));
+};

package/src/all/background_page/service/move/calculatePermissionsChangesForMoveService.test.js

@@ -0,0 +1,158 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+import CalculatePermissionsChangesForMoveService from "./calculatePermissionsChangesForMoveService";
+import FolderEntity from "../../model/entity/folder/folderEntity";
+import ResourceEntity from "../../model/entity/resource/resourceEntity";
+import PermissionEntity from "passbolt-styleguide/src/shared/models/entity/permission/permissionEntity";
+import { defaultFolderDto } from "passbolt-styleguide/src/shared/models/entity/folder/folderEntity.test.data";
+import { defaultResourceDto } from "passbolt-styleguide/src/shared/models/entity/resource/resourceEntity.test.data";
+import {
+  ownerFolderPermissionDto,
+  ownerPermissionDto,
+  readFolderPermissionDto,
+  readPermissionDto,
+} from "passbolt-styleguide/src/shared/models/entity/permission/permissionEntity.test.data";
+import { v4 as uuidv4 } from "uuid";
+import { buildFolder, buildResource } from "./calculatePermissionsChangesForMoveService.test.data";
+
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+describe("CalculatePermissionsChangesForMoveService", () => {
+  const owner = uuidv4();
+  const extra = uuidv4();
+
+  describe("::forFolder", () => {
+    it("should emit no changes when moving between folders with identical ACLs", () => {
+      expect.assertions(1);
+      const folder = buildFolder([ownerFolderPermissionDto({ aro_foreign_key: owner })]);
+      const parent = buildFolder([ownerFolderPermissionDto({ aro_foreign_key: owner })]);
+      const dest = buildFolder([ownerFolderPermissionDto({ aro_foreign_key: owner })]);
+
+      const changes = CalculatePermissionsChangesForMoveService.forFolder(folder, parent, dest);
+
+      expect(changes.length).toBe(0);
+    });
+
+    it("should emit a change when destination has an additional aro", () => {
+      expect.assertions(3);
+      const folder = buildFolder([ownerFolderPermissionDto({ aro_foreign_key: owner })]);
+      const parent = buildFolder([ownerFolderPermissionDto({ aro_foreign_key: owner })]);
+      const dest = buildFolder([
+        ownerFolderPermissionDto({ aro_foreign_key: owner }),
+        readFolderPermissionDto({ aro_foreign_key: extra }),
+      ]);
+
+      const changes = CalculatePermissionsChangesForMoveService.forFolder(folder, parent, dest);
+
+      expect(changes.length).toBe(1);
+      expect(changes.items[0].aroForeignKey).toBe(extra);
+      expect(changes.items[0].aco).toBe(PermissionEntity.ACO_FOLDER);
+    });
+
+    it("should reuse the highest user permission on move to root", () => {
+      expect.assertions(2);
+      const folder = buildFolder([
+        ownerFolderPermissionDto({ aro_foreign_key: owner }),
+        readFolderPermissionDto({ aro_foreign_key: extra }),
+      ]);
+      const parent = buildFolder([
+        ownerFolderPermissionDto({ aro_foreign_key: owner }),
+        readFolderPermissionDto({ aro_foreign_key: extra }),
+      ]);
+
+      const changes = CalculatePermissionsChangesForMoveService.forFolder(folder, parent, null);
+
+      expect(changes.length).toBe(1);
+      expect(changes.items[0].aroForeignKey).toBe(extra);
+    });
+
+    it("should throw when source permissions are missing", () => {
+      expect.assertions(1);
+      const folder = new FolderEntity(defaultFolderDto());
+      const parent = new FolderEntity(defaultFolderDto());
+
+      expect(() => CalculatePermissionsChangesForMoveService.forFolder(folder, parent, null)).toThrow(
+        new TypeError("CalculatePermissionsChangesForMoveService requires permissions to be set."),
+      );
+    });
+
+    it("should throw when destination permissions are missing", () => {
+      expect.assertions(1);
+      const folder = buildFolder([ownerFolderPermissionDto({ aro_foreign_key: owner })]);
+      const dest = new FolderEntity(defaultFolderDto());
+
+      expect(() => CalculatePermissionsChangesForMoveService.forFolder(folder, null, dest)).toThrow(
+        new TypeError("CalculatePermissionsChangesForMoveService requires destination permissions to be set."),
+      );
+    });
+  });
+
+  describe("::forResource", () => {
+    it("should emit ACO_RESOURCE changes when destination has an additional aro", () => {
+      expect.assertions(3);
+      const resource = buildResource([ownerPermissionDto({ aro_foreign_key: owner })]);
+      const parent = buildFolder([ownerFolderPermissionDto({ aro_foreign_key: owner })]);
+      const dest = buildFolder([
+        ownerFolderPermissionDto({ aro_foreign_key: owner }),
+        readFolderPermissionDto({ aro_foreign_key: extra }),
+      ]);
+
+      const changes = CalculatePermissionsChangesForMoveService.forResource(resource, parent, dest);
+
+      expect(changes.length).toBe(1);
+      expect(changes.items[0].aroForeignKey).toBe(extra);
+      expect(changes.items[0].aco).toBe(PermissionEntity.ACO_RESOURCE);
+    });
+
+    it("should reuse the highest permission with ACO_RESOURCE on move to root", () => {
+      expect.assertions(3);
+      const resource = buildResource([
+        ownerPermissionDto({ aro_foreign_key: owner }),
+        readPermissionDto({ aro_foreign_key: extra }),
+      ]);
+      const parent = buildFolder([
+        ownerFolderPermissionDto({ aro_foreign_key: owner }),
+        readFolderPermissionDto({ aro_foreign_key: extra }),
+      ]);
+
+      const changes = CalculatePermissionsChangesForMoveService.forResource(resource, parent, null);
+
+      expect(changes.length).toBe(1);
+      expect(changes.items[0].aroForeignKey).toBe(extra);
+      expect(changes.items[0].aco).toBe(PermissionEntity.ACO_RESOURCE);
+    });
+
+    it("should throw when source permissions are missing", () => {
+      expect.assertions(1);
+      const resource = new ResourceEntity(defaultResourceDto());
+      const parent = new FolderEntity(defaultFolderDto());
+
+      expect(() => CalculatePermissionsChangesForMoveService.forResource(resource, parent, null)).toThrow(
+        new TypeError("CalculatePermissionsChangesForMoveService requires permissions to be set."),
+      );
+    });
+
+    it("should throw when destination permissions are missing", () => {
+      expect.assertions(1);
+      const resource = buildResource([ownerPermissionDto({ aro_foreign_key: owner })]);
+      const dest = new FolderEntity(defaultFolderDto());
+
+      expect(() => CalculatePermissionsChangesForMoveService.forResource(resource, null, dest)).toThrow(
+        new TypeError("CalculatePermissionsChangesForMoveService requires destination permissions to be set."),
+      );
+    });
+  });
+});