passbolt-browser-extension 5.13.0-alpha.1 → 5.13.0

package/.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,30 +1,38 @@
-##IMPORTANT: PLEASE READ
+---
+name: Report a bug
+about: Report a bug in the Passbolt browser extension.
+title: ""
+labels: bug
+assignees: ""
+---
 
-Only use github issues for bugs.
+<!--
+PLEASE READ
 
-We will be more than happy to help you on the community forum for:
-- feature requests: https://community.passbolt.com/c/backlog
-- issues related to an installation: https://community.passbolt.com/c/installation-issues
-- general questions: https://community.passbolt.com/c/uncategorized
+This tracker is only for browser extension bugs. For anything else:
 
-This is only a issue tracker for bugs related to the Passbolt Browser Extensions.
-For passbolt API, docker, command line interface, in short any other bugs 
-please use [the other relevant repositories](https://github.com/passbolt).
+- Security issues: https://www.passbolt.com/docs/contribute/security/vulnerability/
+- Feature requests: https://community.passbolt.com/c/backlog
+- Installation issues: https://community.passbolt.com/c/installation-issues
+- General questions: https://community.passbolt.com/c/uncategorized
 
-If you are certain this is a new Browser Extension bug please use the following format:
+If you are certain this is a browser extension bug, please fill in the format below.
+-->
 
-## ISSUE NAME
-* Passbolt Version: EXACT RELEASE VERSION OR COMMIT HASH, HERE.
-* Platform and Target:
--- Browser: NAME AND VERSION
--- Web server: NAME AND VERSION
--- etc.: OTHER RELEVANT PLATFORM INFO
+* Browser extension version: <!-- e.g. 5.13.0 -->
+* API edition & version: <!-- e.g. CE 5.12.0 -->
+* Environment
+  * Client: <!-- browser and OS, e.g. Chrome 148.1 on Ubuntu 26.04 -->
+  * Server: <!-- e.g. Debian 13, Docker latest-ce, or Passbolt Cloud -->
 
-### What you did
-EXPLAIN WHAT YOU DID, PREFERABLY WITH CODE EXAMPLES, HERE.
+### What you did?
 
-### What happened
-EXPLAIN WHAT IS ACTUALLY HAPPENING, HERE.
+<!-- Explain what you did, preferably with steps or code examples. -->
 
-### What you expected to happen
-EXPLAIN WHAT IS TO BE EXPECTED, HERE.
+### What happened?
+
+<!-- Explain what actually happened. -->
+
+### What you expected to happen?
+
+<!-- Explain what you expected instead. -->

package/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Request a feature or change
+    url: https://community.passbolt.com/c/backlog
+    about: Suggest and vote on features in the community forum.
+  - name: Get installation help
+    url: https://community.passbolt.com/c/installation-issues
+    about: Ask installation and configuration questions in the community forum.
+  - name: Ask a question
+    url: https://community.passbolt.com/c/uncategorized
+    about: Ask usage questions in the community forum.

package/CHANGELOG.md

@@ -4,6 +4,82 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
 
+## [5.13.0] - 2026-06-11
+### Added
+PB-51594 Move findAllForActionLogController and test to the correct location
+PB-48516 Build process improvement - Webpack
+PB-51534 Update group edit call in groupApiService to contain "my_group_user" as urlOptions
+PB-51580 PCD 1.1 - Migrate SearchUsersAndGroupsController off ShareModel
+PB-51585 PCD 1.2 - Migrate resourceCreateService ShareModel usage to ShareResourceService
+PB-51586 PCD 1.3 - Move passbolt.share.get-folders to controller pattern
+PB-51587 PCD 1.4 - Clear ShareModel
+PB-51588 PCD 1.5 - Migrate MoveFolderController off FolderModel
+PB-51589 PCD 1.6 - Migrate MoveOneFolderService off FolderModel
+PB-51590 PCD 1.7 - Migrate MoveResourcesService off FolderModel + ResourceModel
+PB-51782 PCD 2.01 - Create SynchroniseKeyringController and binding
+PB-51783 PCD 2.02 - Create KeyringServiceWorkerService
+PB-51785 PCD 2.04 - Create GetOrFindGroupService
+PB-51786 PCD 2.05 - Create GetOrFindGroupController and binding
+PB-51787 PCD 2.06 - Create GetOrFindGroupsUsersService
+PB-51788 PCD 2.07 - Create GetOrFindGroupsUsersController and binding
+PB-51789 PCD 2.08 - Create GetOrFindUsersService
+PB-51790 PCD 2.09 - Create GetOrFindUsersController and binding
+PB-51791 PCD 2.10 - Add new methods getByIds, getGroupsUsersByGropuId on GroupServiceWorkerService
+PB-51999 PCD 2.10.B - Consolidate UserEntity between browser extension and styleguide
+PB-52000 PCD 2.10.C - Move GroupEntity + GroupsCollection to the styleguide
+PB-51792 PCD 2.11 - Create UserServiceWorkerService
+PB-51793 PCD 2.12 - Create PermissionServiceWorkerService
+PB-51794 PCD 2.13 - Create SearchUsersAndGroupsService
+PB-51795 PCD 2.14 - Refactor ShareService into ShareApiService
+PB-51796 PCD 2.15 - Update GroupApiService to support the new filter
+PB-51798 PCD 2.17 - Update FindAndUpdateGroupsLocalStorageService to add a method findForLocalStorageByIds
+PB-51799 PCD 2.18 - Align UserLocalStorage to add memory cache
+PB-51800 PCD 2.19 - Rename UserService to UserApiService
+PB-52047 CE/PRO upgrade
+PB-49605 Grid columns min-width
+PB-51808 PCD 2.27 - Create UserPermissionItem
+PB-51809 PCD 2.28 - Create GroupUserPermissionItem
+PB-47929 PAG - WP1.1 Add pagination support to ResourceService
+PB-47930 PAG - WP1.2 Paginate resource fetch for updating local storage in FindResourceService
+PB-52056 Add create method to SubscriptionKeyServiceWorkerService
+PB-52057 Add delete method to SubscriptionKeyServiceWorkerService
+PB-52058 Adapt EditSubscriptionKey to be customizable
+PB-52061 Adapt DisplaySubscriptionKeyTeasing to handle upgrade from app
+PB-52064 Create ConfirmDowngradeSubscriptionDialog
+PB-52062 Adapt DisplaySubscriptionKey to handle downgrading
+PB-52128 DisplaySubscriptionKey new layout
+
+### Security
+PB-51937 Fix ws GHSA-58qx-3vcg-4xpx - MEDIUM CVSS3.1
+PB-51938 Fix brace-expansion GHSA-jxxr-4gwj-5jf2 - MEDIUM CVSS3.1
+PB-52029 Fix tmp GHSA-ph9p-34f9-6g65 - HIGH CVSS4.0
+PB-51532 Include GitLab file from ci-definitions repo
+PB-51642 Fix fast-uri GHSA-q3j6-qgpj-74h6 - HIGH CVSS3.1
+PB-51643 Fix @babel/plugin-transform-modules-systemjs GHSA-fv7c-fp4j-7gwp - HIGH CVSS3.1
+PB-51940 Fix qs GHSA-q8mj-m7cp-5q26 - MEDIUM CVSS4.0
+PB-52030 Fix webpack-dev-server GHSA-79cf-xcqc-c78w - MEDIUM CVSS3.1
+PB-51698 Use correct passbolt repo names in safe-chain whitelist
+
+### Fixed
+PB-52148 CSP is blocking upload to TOTP QRCode on Firefox
+PB-50949 Fix MetadataKeysSettingsLocalStorageContext and MetadataTypesSettingsLocalStorageContext entity issue on storage changes
+PB-52047 Fix Passbolt Pro Edition wording
+PB-52156 Fix password preview button min-width
+
+### Maintenance
+PB-48560 Use NODE_ENV for webpack mode config
+PB-48564 Remove grunt-header
+PB-48528 Transpile LESS from webpack
+PB-48558 Extract translations directly from webpack
+PB-48559 Remove rimraf
+PB-49064 Remove Grunt
+PB-48516 Replace eval sourcemap by inline
+PB-48516 Prevent br tags to be added in translations.
+PB-48516 Remove duplicated translations
+PB-51793: Add PermissionServiceWorkerService and transfer Permission entity and collection on styleguide
+PB-51160 Update Firefox manifest to avoid Mozilla warnings
+PB-52155 Update github issue template
+
 ## [5.12.2] - 2026-05-19
 ### Fixed
 - PB-51648 Fix add user to group reducing set timeout

package/CONTRIBUTING.md

@@ -15,18 +15,7 @@ There are a few guidelines that we need contributors to follow so that we have a
 
 ### Reporting a security Issue
 
-If you've found a security related issue in Passbolt, please don't open an issue in GitHub.
-Instead contact us at security@passbolt.com. In the spirit of responsible disclosure we ask that the reporter keep the
-issue confidential until we announce it.
-
-The passbolt team will take the following actions:
-- Try to first reproduce the issue and confirm the vulnerability.
-- Acknowledge to the reporter that we’ve received the issue and are working on a fix.
-- Get a fix/patch prepared and create associated automated tests.
-- Prepare a post describing the vulnerability, and the possible exploits.
-- Release new versions of all affected major versions.
-- Prominently feature the problem in the release announcement.
-- Provide credits in the release announcement to the reporter if they so desire.
+If you've found a security related issue in Passbolt, please don't open an issue on GitHub. Follow our responsible disclosure process: https://www.passbolt.com/docs/contribute/security/vulnerability/.
 
 ### Reporting a bug
 Please only use github for bugs or pull request.

package/README.md

@@ -5,14 +5,14 @@
 	  /_/    \__,_/____/____/_.___/\____/_/\__/
 
 	Open source password manager for teams
-	(c) 2025 Passbolt SA
+	(c) 2026 Passbolt SA
 	https://www.passbolt.com
 
 ## License
 
 Passbolt - Open source password manager for teams
 
-(c) 2025 Passbolt SA
+(c) 2026 Passbolt SA
 
 This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
 Public License (AGPL) as published by the Free Software Foundation version 3.
@@ -54,22 +54,11 @@ such as auto filling your passwords when visiting known websites.
 
 # Contributing
 
-Please check ```CONTRIBUTING.md``` for more information about how to get involved.
+Please check [CONTRIBUTING.md](CONTRIBUTING.md) for more information about how to get involved.
 
-### Reporting a security Issue
+## Reporting a security Issue
 
-If you've found a security related issue in Passbolt, please don't open an issue in GitHub.
-Instead contact us at security@passbolt.com. In the spirit of responsible disclosure we ask that the reporter keep the
-issue confidential until we announce it.
-
-The passbolt team will take the following actions:
-- Try to first reproduce the issue and confirm the vulnerability.
-- Acknowledge to the reporter that we’ve received the issue and are working on a fix.
-- Get a fix/patch prepared and create associated automated tests.
-- Prepare a post describing the vulnerability, and the possible exploits.
-- Release new versions of all affected major versions.
-- Prominently feature the problem in the release announcement.
-- Provide credits in the release announcement to the reporter if they so desire.
+If you've found a security related issue in Passbolt, please don't open an issue on GitHub. Follow our responsible disclosure process: https://www.passbolt.com/docs/contribute/security/vulnerability/.
 
 # Quick how-to for developers
 

package/SECURITY.md

@@ -0,0 +1,7 @@
+# Security Policy
+
+For general information about security at Passbolt, see https://www.passbolt.com/security
+
+## Reporting a security issue
+
+If you've found a security issue in Passbolt, please do not open a public issue. Follow our responsible disclosure process: https://www.passbolt.com/docs/contribute/security/vulnerability/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passbolt-browser-extension",
-  "version": "5.13.0-alpha.1",
+  "version": "5.13.0",
   "license": "AGPL-3.0",
   "copyright": "Copyright 2025 Passbolt SA",
   "description": "Passbolt web extension for the open source password manager for teams",
@@ -21,7 +21,7 @@
     "kdbxweb": "2.1.1",
     "openpgp": "^6.1.1",
     "papaparse": "^5.5.2",
-    "passbolt-styleguide": "^5.13.0-alpha.6",
+    "passbolt-styleguide": "^5.13.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "secrets-passbolt": "github:passbolt/secrets.js#v2.0.1",

package/src/all/background_page/controller/export/exportResourcesFileController.test.js

@@ -50,6 +50,7 @@ import { resourceCollectionV4ToExport } from "../../service/resource/export/expo
 import { defaultDecryptedSharedMetadataKeysDtos } from "passbolt-styleguide/src/shared/models/entity/metadata/metadataKeysCollection.test.data";
 import MetadataKeysCollection from "passbolt-styleguide/src/shared/models/entity/metadata/metadataKeysCollection";
 import GetOrFindMetadataKeysService from "../../service/metadata/getOrFindMetadataKeysService";
+import { mockPassboltResponse } from "passbolt-styleguide/test/mocks/mockApiResponse";
 
 beforeEach(async () => {
   await MockExtension.withConfiguredAccount();
@@ -112,7 +113,9 @@ describe("ExportResourcesFileController", () => {
             folder_parent_id: foldersDto[0].id,
             totp: defaultTotpDto({ secret_key: "THISISASECRET" }),
           });
-          jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => resourceCollectionV4);
+          jest
+            .spyOn(ResourceService.prototype, "findAll")
+            .mockImplementation(() => mockPassboltResponse(resourceCollectionV4));
           const result = await controller.exec(file);
 
           const blobFile = new Blob([result.file], { type: "text/csv" });
@@ -169,7 +172,9 @@ describe("ExportResourcesFileController", () => {
           });
 
           const exportResourcesFileEntity = new ExportResourcesFileEntity(file);
-          jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => resourceCollectionV4);
+          jest
+            .spyOn(ResourceService.prototype, "findAll")
+            .mockImplementation(() => mockPassboltResponse(resourceCollectionV4));
           await getKDBXContent(exportResourcesFileEntity, new ResourcesCollection(resourceCollectionV4));
 
           const result = await controller.exec(file);

package/src/all/background_page/controller/resource/findAllByIdsForDisplayPermissionsController.test.js

@@ -19,12 +19,12 @@ import { multipleResourceDtos } from "../../service/resource/findResourcesServic
 import FindAllByIdsForDisplayPermissionsController from "./findAllByIdsForDisplayPermissionsController";
 import ResourcesCollection from "../../model/entity/resource/resourcesCollection";
 import { pgpKeys } from "passbolt-styleguide/test/fixture/pgpKeys/keys";
-import ResourceService from "../../service/api/resource/resourceService";
 import { v4 as uuidv4 } from "uuid";
 import { TEST_RESOURCE_TYPE_V5_DEFAULT } from "passbolt-styleguide/src/shared/models/entity/resourceType/resourceTypeEntity.test.data";
 import { METADATA_KEY_TYPE_USER_KEY } from "../../model/entity/resource/resourceEntity";
 import { defaultResourceDto } from "passbolt-styleguide/src/shared/models/entity/resource/resourceEntity.test.data";
 import { metadata } from "passbolt-styleguide/test/fixture/encryptedMetadata/metadata";
+import { mockPassboltResponse } from "passbolt-styleguide/test/mocks/mockApiResponse";
 
 describe("FindAllByIdsForDisplayPermissionsController", () => {
   let controller, worker;
@@ -46,7 +46,9 @@ describe("FindAllByIdsForDisplayPermissionsController", () => {
 
       const resourcesDto = multipleResourceDtos();
       const resourceIds = resourcesDto.map((resource) => resource.id);
-      jest.spyOn(controller.findResourcesService.resourceService, "findAll").mockImplementation(() => resourcesDto);
+      jest
+        .spyOn(controller.findResourcesService.resourceService, "findAll")
+        .mockImplementation(() => mockPassboltResponse(resourcesDto));
       jest
         .spyOn(controller.findResourcesService.decryptMetadataService, "decryptAllFromForeignModels")
         .mockImplementation((collection) => collection);
@@ -73,7 +75,10 @@ describe("FindAllByIdsForDisplayPermissionsController", () => {
         }),
       ];
       const resourceIds = resourcesDto.map((resource) => resource.id);
-      jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => resourcesDto);
+      jest
+        .spyOn(controller.findResourcesService.resourceService, "findAll")
+        .mockImplementation(() => mockPassboltResponse(resourcesDto));
+
       jest.spyOn(controller.getPassphraseService, "getPassphrase").mockReturnValue(pgpKeys.ada.passphrase);
 
       const result = await controller.exec(resourceIds);

package/src/all/background_page/controller/resource/findAllIdsByIsSharedWithGroupController.test.js

@@ -28,6 +28,7 @@ import { METADATA_KEY_TYPE_USER_KEY } from "../../model/entity/resource/resource
 import { defaultResourceDto } from "passbolt-styleguide/src/shared/models/entity/resource/resourceEntity.test.data";
 import { metadata } from "passbolt-styleguide/test/fixture/encryptedMetadata/metadata";
 import { pgpKeys } from "passbolt-styleguide/test/fixture/pgpKeys/keys";
+import { mockPassboltResponse } from "passbolt-styleguide/test/mocks/mockApiResponse";
 
 describe("FindAllIdsByIsSharedWithGroupController", () => {
   let controller, worker, groupId;
@@ -52,7 +53,9 @@ describe("FindAllIdsByIsSharedWithGroupController", () => {
 
       const resourceCollectionDto = multipleResourceDtos();
       const expectedResult = new ResourcesCollection(resourceCollectionDto).extract("id");
-      jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => resourceCollectionDto);
+      jest
+        .spyOn(ResourceService.prototype, "findAll")
+        .mockImplementation(() => mockPassboltResponse(resourceCollectionDto));
 
       await controller._exec(groupId);
 
@@ -78,7 +81,9 @@ describe("FindAllIdsByIsSharedWithGroupController", () => {
 
       const resourceCollectionDto = multipleResourceDtos();
       const expectedResult = new ResourcesCollection(resourceCollectionDto).extract("id");
-      jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => resourceCollectionDto);
+      jest
+        .spyOn(ResourceService.prototype, "findAll")
+        .mockImplementation(() => mockPassboltResponse(resourceCollectionDto));
       jest.spyOn(FindAndUpdateResourcesLocalStorage.prototype, "findAndUpdateByIsSharedWithGroup");
 
       const resourceIds = await controller.exec(groupId);
@@ -102,7 +107,7 @@ describe("FindAllIdsByIsSharedWithGroupController", () => {
         }),
       ];
       jest.spyOn(controller.findAndUpdateResourcesLocalStorage, "findAndUpdateByIsSharedWithGroup");
-      jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => resourcesDto);
+      jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => mockPassboltResponse(resourcesDto));
       jest.spyOn(controller.getPassphraseService, "getPassphrase").mockReturnValue(pgpKeys.ada.passphrase);
 
       const result = await controller.exec(groupId);
@@ -118,7 +123,7 @@ describe("FindAllIdsByIsSharedWithGroupController", () => {
     it("Should allow a group to not include any resources", async () => {
       expect.assertions(2);
 
-      jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => []);
+      jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => mockPassboltResponse([]));
       const resourceIds = await controller.exec(groupId);
 
       expect(resourceIds.length).toEqual(0);

package/src/all/background_page/controller/resourceLocalStorage/resourceUpdateLocalStorageController.test.js

@@ -27,6 +27,7 @@ import { TEST_RESOURCE_TYPE_V5_DEFAULT } from "passbolt-styleguide/src/shared/mo
 import { METADATA_KEY_TYPE_USER_KEY } from "../../model/entity/resource/resourceEntity";
 import { v4 as uuidv4 } from "uuid";
 import { metadata } from "passbolt-styleguide/test/fixture/encryptedMetadata/metadata";
+import { mockPassboltResponse } from "passbolt-styleguide/test/mocks/mockApiResponse";
 
 describe("ResourceUpdateLocalStorageController", () => {
   let controller, worker;
@@ -73,14 +74,16 @@ describe("ResourceUpdateLocalStorageController", () => {
     it("requests the user passphrase whenever the decryption of the metadata requires it and try to load the data again", async () => {
       expect.assertions(4);
 
-      jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => [
+      const resources = [
         defaultResourceDto({
           resource_type_id: TEST_RESOURCE_TYPE_V5_DEFAULT,
           metadata_key_type: METADATA_KEY_TYPE_USER_KEY,
           metadata_key_id: uuidv4(),
           metadata: metadata.withAdaKey.encryptedMetadata[0],
         }),
-      ]);
+      ];
+
+      jest.spyOn(ResourceService.prototype, "findAll").mockImplementation(() => mockPassboltResponse(resources));
       jest.spyOn(ResourceTypeService.prototype, "findAll").mockImplementation(() => resourceTypesCollectionDto());
       jest.spyOn(GetPassphraseService.prototype, "requestPassphrase").mockImplementation(() => pgpKeys.ada.passphrase);
       jest.spyOn(PassphraseStorageService, "set").mockImplementation(() => {});

package/src/all/background_page/controller/subscription/createSubscriptionKeyController.js

@@ -0,0 +1,63 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+
+import UpdateSubscriptionEntity from "../../model/entity/subscription/update/updateSubscriptionEntity";
+import PostLogoutService from "../../service/auth/postLogoutService";
+import CreateSubscriptionKeyService from "../../service/subscription/createSubscriptionKeyService";
+
+export default class CreateSubscriptionKeyController {
+  /**
+   * @constructor
+   * @param {Worker} worker
+   * @param {string} requestId
+   * @param {ApiClientOptions} apiClientOptions
+   */
+  constructor(worker, requestId, apiClientOptions) {
+    this.worker = worker;
+    this.requestId = requestId;
+
+    this.createSubscriptionService = new CreateSubscriptionKeyService(apiClientOptions);
+  }
+
+  /**
+   * Controller executor
+   * @returns {Promise<void>}
+   */
+  async _exec() {
+    try {
+      const result = await this.exec.apply(this, arguments);
+      this.worker.port.emit(this.requestId, "SUCCESS", result);
+    } catch (error) {
+      console.error(error);
+      this.worker.port.emit(this.requestId, "ERROR", error);
+    }
+  }
+
+  /**
+   * Create the subscription key (upgrade CE to PRO).
+   * @param {{ data: string }} subscriptionKeyDto The new subscription key
+   * @returns {Promise<SubscriptionEntity>} The subscription key
+   * @throws {Error} Throws an error when encountering any network error
+   * @throws {ValidationError} Throws an error if subscriptionKeyDto format is incorrect
+   * @throws {PassboltSubscriptionError} Throws `PassboltSubscriptionError` when subscription is already expired or user limit reached
+   */
+  async exec(subscriptionKeyDto) {
+    const subscriptionKeyEntity = new UpdateSubscriptionEntity(subscriptionKeyDto);
+    const subscriptionEntity = await this.createSubscriptionService.create(subscriptionKeyEntity);
+
+    await PostLogoutService.exec();
+
+    return subscriptionEntity;
+  }
+}

package/src/all/background_page/controller/subscription/createSubscriptionKeyController.test.js

@@ -0,0 +1,56 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+
+import SubscriptionEntity from "passbolt-styleguide/src/shared/models/entity/subscription/subscriptionEntity";
+import { defaultApiClientOptions } from "passbolt-styleguide/src/shared/lib/apiClient/apiClientOptions.test.data";
+import { mockSubscriptionUpdated } from "passbolt-styleguide/src/react-extension/components/Administration/DisplaySubscriptionKey/DisplaySubscriptionKey.test.data";
+
+import CreateSubscriptionKeyController from "./createSubscriptionKeyController";
+import PostLogoutService from "../../service/auth/postLogoutService";
+
+describe("CreateSubscriptionKeyController", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe("::exec", () => {
+    it("should create the subscription key and log the user out", async () => {
+      expect.assertions(3);
+
+      const controller = new CreateSubscriptionKeyController(null, null, defaultApiClientOptions());
+      jest
+        .spyOn(controller.createSubscriptionService, "create")
+        .mockResolvedValue(new SubscriptionEntity(mockSubscriptionUpdated));
+      jest.spyOn(PostLogoutService, "exec").mockImplementation(async () => {});
+
+      const result = await controller.exec({ data: mockSubscriptionUpdated.data });
+
+      expect(result).toEqual(new SubscriptionEntity(mockSubscriptionUpdated));
+      expect(controller.createSubscriptionService.create).toHaveBeenCalledTimes(1);
+      expect(PostLogoutService.exec).toHaveBeenCalledTimes(1);
+    });
+
+    it("should not catch errors", async () => {
+      expect.assertions(2);
+
+      const expectedError = new Error("Something went wrong!");
+      const controller = new CreateSubscriptionKeyController(null, null, defaultApiClientOptions());
+      jest.spyOn(controller.createSubscriptionService, "create").mockRejectedValue(expectedError);
+      jest.spyOn(PostLogoutService, "exec").mockImplementation(async () => {});
+
+      await expect(controller.exec({ data: mockSubscriptionUpdated.data })).rejects.toStrictEqual(expectedError);
+      expect(PostLogoutService.exec).not.toHaveBeenCalled();
+    });
+  });
+});

package/src/all/background_page/controller/subscription/deleteSubscriptionKeyController.js

@@ -0,0 +1,55 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+
+import PostLogoutService from "../../service/auth/postLogoutService";
+import DeleteSubscriptionKeyService from "../../service/subscription/deleteSubscriptionKeyService";
+
+export default class DeleteSubscriptionKeyController {
+  /**
+   * @constructor
+   * @param {Worker} worker
+   * @param {string} requestId
+   * @param {ApiClientOptions} apiClientOptions
+   */
+  constructor(worker, requestId, apiClientOptions) {
+    this.worker = worker;
+    this.requestId = requestId;
+
+    this.deleteSubscriptionService = new DeleteSubscriptionKeyService(apiClientOptions);
+  }
+
+  /**
+   * Controller executor
+   * @returns Promise<void>
+   */
+  async _exec() {
+    try {
+      const result = await this.exec.apply(this, arguments);
+      this.worker.port.emit(this.requestId, "SUCCESS", result);
+    } catch (error) {
+      console.error(error);
+      this.worker.port.emit(this.requestId, "ERROR", error);
+    }
+  }
+
+  /**
+   * Delete the subscription key (downgrade PRO to CE).
+   * @returns {Promise<void>}
+   * @throws {Error} Throws an error when encountering any network or server error
+   */
+  async exec() {
+    await this.deleteSubscriptionService.delete();
+    await PostLogoutService.exec();
+  }
+}

package/src/all/background_page/controller/subscription/deleteSubscriptionKeyController.test.js

@@ -0,0 +1,50 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+
+import { defaultApiClientOptions } from "passbolt-styleguide/src/shared/lib/apiClient/apiClientOptions.test.data";
+
+import DeleteSubscriptionKeyController from "./deleteSubscriptionKeyController";
+import PostLogoutService from "../../service/auth/postLogoutService";
+
+describe("DeleteSubscriptionKeyController", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe("::exec", () => {
+    it("should delete the subscription key and log the user out", async () => {
+      expect.assertions(3);
+
+      const controller = new DeleteSubscriptionKeyController(null, null, defaultApiClientOptions());
+      jest.spyOn(controller.deleteSubscriptionService, "delete").mockResolvedValue(undefined);
+      jest.spyOn(PostLogoutService, "exec").mockImplementation(async () => {});
+
+      await expect(controller.exec()).resolves.toBeUndefined();
+      expect(controller.deleteSubscriptionService.delete).toHaveBeenCalledTimes(1);
+      expect(PostLogoutService.exec).toHaveBeenCalledTimes(1);
+    });
+
+    it("should not catch errors", async () => {
+      expect.assertions(2);
+
+      const expectedError = new Error("Something went wrong!");
+      const controller = new DeleteSubscriptionKeyController(null, null, defaultApiClientOptions());
+      jest.spyOn(controller.deleteSubscriptionService, "delete").mockRejectedValue(expectedError);
+      jest.spyOn(PostLogoutService, "exec").mockImplementation(async () => {});
+
+      await expect(controller.exec()).rejects.toStrictEqual(expectedError);
+      expect(PostLogoutService.exec).not.toHaveBeenCalled();
+    });
+  });
+});