passbolt-browser-extension 5.13.0 → 5.14.2

package/src/all/background_page/service/extension/onExtensionUpdateAvailableService.js

@@ -19,6 +19,8 @@ import MfaAuthenticationRequiredError from "../../error/mfaAuthenticationRequire
 import WebIntegrationPagemod from "../../pagemod/webIntegrationPagemod";
 import WorkerService from "../worker/workerService";
 import PublicWebsiteSignInPagemod from "../../pagemod/publicWebsiteSignInPagemod";
+import getActiveAccountService from "../account/getActiveAccountService";
+import BuildApiClientOptionsService from "../account/buildApiClientOptionsService";
 
 const PASSBOLT_EXTENSION_UPDATE = "passboltExtensionUpdate";
 
@@ -59,14 +61,17 @@ class OnExtensionUpdateAvailableService {
 
 /**
  * Check and process event if the user is authenticated
- * @returns {Promise<bool>}
+ * @returns {Promise<boolean>}
  */
 const isUserAuthenticated = async () => {
   const user = User.getInstance();
   // Check if user is valid
   if (user.isValid()) {
     try {
-      return await AuthenticationStatusService.isAuthenticated();
+      const account = await getActiveAccountService.get();
+      const apiClientOptions = BuildApiClientOptionsService.buildFromAccount(account);
+      const authenticationService = new AuthenticationStatusService(apiClientOptions);
+      return authenticationService.isAuthenticated();
     } catch (error) {
       if (error instanceof MfaAuthenticationRequiredError) {
         /*

package/src/all/background_page/service/extension/onExtensionUpdateAvailableService.test.js

@@ -47,7 +47,7 @@ describe("OnExtensionUpdateAvailableService", () => {
       const webIntegrationPortWrapper = new Port(webIntegrationPort);
       PortManager.registerPort(webIntegrationPortWrapper);
       // mock function
-      jest.spyOn(AuthenticationStatusService, "isAuthenticated").mockImplementation(() => false);
+      jest.spyOn(AuthenticationStatusService.prototype, "isAuthenticated").mockImplementation(() => false);
       jest.spyOn(browser.runtime, "reload");
       jest.spyOn(webIntegrationPortWrapper, "emit");
       // process
@@ -73,7 +73,7 @@ describe("OnExtensionUpdateAvailableService", () => {
       expect.assertions(2);
       // mock function
       await MockExtension.withConfiguredAccount();
-      jest.spyOn(AuthenticationStatusService, "isAuthenticated").mockImplementation(() => true);
+      jest.spyOn(AuthenticationStatusService.prototype, "isAuthenticated").mockImplementation(() => true);
       jest.spyOn(browser.runtime, "reload");
       // process
       await OnExtensionUpdateAvailableService.exec();
@@ -109,7 +109,7 @@ describe("OnExtensionUpdateAvailableService", () => {
       PortManager.registerPort(webIntegrationPortWrapper2);
       PortManager.registerPort(publicWebsiteSignInPortWrapper);
       // mock function
-      jest.spyOn(AuthenticationStatusService, "isAuthenticated").mockImplementation(() => true);
+      jest.spyOn(AuthenticationStatusService.prototype, "isAuthenticated").mockImplementation(() => true);
       jest
         .spyOn(BrowserTabService, "sendMessage")
         .mockImplementation(() => PortManager.registerPort(webIntegrationPortWrapper));
@@ -144,7 +144,7 @@ describe("OnExtensionUpdateAvailableService", () => {
       expect.assertions(1);
       // mock function
       await MockExtension.withConfiguredAccount();
-      jest.spyOn(AuthenticationStatusService, "isAuthenticated").mockImplementation(() => {
+      jest.spyOn(AuthenticationStatusService.prototype, "isAuthenticated").mockImplementation(() => {
         throw new Error("Error");
       });
       jest.spyOn(browser.runtime, "reload");
@@ -158,7 +158,7 @@ describe("OnExtensionUpdateAvailableService", () => {
       expect.assertions(2);
       // mock function
       await MockExtension.withConfiguredAccount();
-      jest.spyOn(AuthenticationStatusService, "isAuthenticated").mockImplementation(() => {
+      jest.spyOn(AuthenticationStatusService.prototype, "isAuthenticated").mockImplementation(() => {
         throw new MfaAuthenticationRequiredError();
       });
       jest.spyOn(browser.runtime, "reload");

package/src/all/background_page/service/group/findGroupsService.js

@@ -13,9 +13,10 @@
  */
 
 import GroupsCollection from "passbolt-styleguide/src/shared/models/entity/group/groupsCollection";
-import { assertBoolean, assertType } from "../../utils/assertions";
+import { assertArrayUUID, assertBoolean, assertType } from "../../utils/assertions";
 import GroupApiService from "../api/group/groupApiService";
 import User from "../../model/user";
+import ExecuteConcurrentlyService from "../execute/executeConcurrentlyService";
 
 export default class FindGroupsService {
   /**
@@ -70,4 +71,44 @@ export default class FindGroupsService {
     const contains = { groups_users: true, my_group_user: true, modifier: false };
     return await this.findAll(contains, null, true);
   }
+
+  /**
+   * Find all groups given their ids with the data tailored for the "Share" process.
+   * Each group embeds its members (groups_users with their associated user and user profile).
+   * @param {Array<string>} groupIds
+   */
+  async findAllByIdsForShare(groupIds) {
+    assertArrayUUID(groupIds);
+
+    const contains = { "groups_users.user.profile": true };
+    return await this.findAllByIds(groupIds, contains);
+  }
+
+  /**
+   * Find all groups given their ids.
+   * @param {Array<string>} groupIds
+   * @param {Object|null} [contains] optional
+   */
+  async findAllByIds(groupIds, contains) {
+    assertArrayUUID(groupIds);
+
+    // Short-circuit an empty id list: it produces no callbacks, and ExecuteConcurrentlyService
+    // never resolves when given none (its resolve() only fires from within the per-callback loop).
+    if (groupIds.length === 0) {
+      return new GroupsCollection([]);
+    }
+
+    // @todo: update to check for server capability for supporting `has-id` filter and use it instead.
+    const callbacks = groupIds.map((groupId) => {
+      return async () => {
+        const response = await this.groupApiService.get(groupId, contains);
+        return response.body;
+      };
+    });
+
+    // @todo Later (tm). The Collection should provide this capability, ensuring that validation build rules are executed and performance is guaranteed.
+    const executeConcurrentlyService = new ExecuteConcurrentlyService();
+    const groupsCollectionDto = await executeConcurrentlyService.execute(callbacks, 5);
+    return new GroupsCollection(groupsCollectionDto, { ignoreInvalidEntity: true });
+  }
 }

package/src/all/background_page/service/group/findGroupsService.test.js

@@ -12,10 +12,12 @@
  * @since         5.7.0
  */
 
+import { v4 as uuidv4 } from "uuid";
 import User from "../../model/user";
 import AccountEntity from "../../model/entity/account/accountEntity";
 import { defaultAccountDto } from "../../model/entity/account/accountEntity.test.data";
 import GroupsCollection from "passbolt-styleguide/src/shared/models/entity/group/groupsCollection";
+import { defaultGroupDto } from "passbolt-styleguide/src/shared/models/entity/group/groupEntity.test.data";
 import BuildApiClientOptionsService from "../account/buildApiClientOptionsService";
 import FindGroupsService from "./findGroupsService";
 import MockExtension from "../../../../../test/mocks/mockExtension";
@@ -125,4 +127,84 @@ describe("FindGroupsService", () => {
       expect(result.id).toBe(groupsDtos.id);
     });
   });
+
+  describe("::findAllByIdsForShare", () => {
+    it("should delegate to findAllByIds with the contains tailored for the share process", async () => {
+      const groupIds = [uuidv4(), uuidv4()];
+      const expectedContains = { "groups_users.user.profile": true };
+      const expectedCollection = new GroupsCollection();
+      jest.spyOn(findGroupsService, "findAllByIds").mockResolvedValue(expectedCollection);
+
+      const result = await findGroupsService.findAllByIdsForShare(groupIds);
+
+      expect(findGroupsService.findAllByIds).toHaveBeenCalledWith(groupIds, expectedContains);
+      expect(result).toBe(expectedCollection);
+    });
+
+    it("should throw if the given group ids are not an array of uuids", async () => {
+      expect.assertions(3);
+      const spy = jest.spyOn(findGroupsService, "findAllByIds");
+
+      await expect(findGroupsService.findAllByIdsForShare("not-an-array")).rejects.toThrow();
+      await expect(findGroupsService.findAllByIdsForShare(["not-a-uuid"])).rejects.toThrow();
+      expect(spy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("::findAllByIds", () => {
+    it("should find all the groups given their ids", async () => {
+      const groupDtos = [
+        defaultGroupDto({ name: "Group 0" }),
+        defaultGroupDto({ name: "Group 1" }),
+        defaultGroupDto({ name: "Group 2" }),
+      ];
+      expect.assertions(4 + groupDtos.length);
+      const groupIds = groupDtos.map((groupDto) => groupDto.id);
+      const contains = { groups_users: true, my_group_user: false, modifier: false };
+      // The API returns a single group per id, wrapped in a PassboltResponseEntity like object.
+      const spy = jest
+        .spyOn(findGroupsService.groupApiService, "get")
+        .mockImplementation(async (id) => ({ body: groupDtos.find((groupDto) => groupDto.id === id) }));
+
+      const result = await findGroupsService.findAllByIds(groupIds, contains);
+
+      expect(spy).toHaveBeenCalledTimes(groupIds.length);
+      groupIds.forEach((groupId) => expect(spy).toHaveBeenCalledWith(groupId, contains));
+      expect(result).toBeInstanceOf(GroupsCollection);
+      expect(result).toHaveLength(groupIds.length);
+      expect(result.items.map((group) => group.id).sort()).toEqual([...groupIds].sort());
+    });
+
+    it("should return an empty collection without calling the API when the given group ids are empty", async () => {
+      expect.assertions(3);
+      const spy = jest.spyOn(findGroupsService.groupApiService, "get");
+
+      const result = await findGroupsService.findAllByIds([]);
+
+      expect(result).toBeInstanceOf(GroupsCollection);
+      expect(result).toHaveLength(0);
+      expect(spy).not.toHaveBeenCalled();
+    });
+
+    it("should reject if the API returns an invalid group", async () => {
+      const validGroupDto = defaultGroupDto();
+      const invalidGroupDto = defaultGroupDto({ name: 42 });
+      const groupIds = [validGroupDto.id, invalidGroupDto.id];
+      jest
+        .spyOn(findGroupsService.groupApiService, "get")
+        .mockImplementation(async (id) => ({ body: id === validGroupDto.id ? validGroupDto : invalidGroupDto }));
+
+      const collection = await findGroupsService.findAllByIds(groupIds);
+      expect(collection).toHaveLength(1);
+    });
+
+    it("should throw if the given group ids are not an array of uuids", async () => {
+      expect.assertions(3);
+      const spy = jest.spyOn(findGroupsService.groupApiService, "get");
+
+      await expect(findGroupsService.findAllByIds("not-an-array")).rejects.toThrow();
+      await expect(findGroupsService.findAllByIds(["not-a-uuid"])).rejects.toThrow();
+      expect(spy).not.toHaveBeenCalled();
+    });
+  });
 });

package/src/all/background_page/service/group/groupUpdateSecretsCryptoService.js

@@ -0,0 +1,82 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+import { OpenpgpAssertion } from "../../utils/openpgp/openpgpAssertions";
+import EncryptMessageService from "../crypto/encryptMessageService";
+import DecryptMessageService from "../crypto/decryptMessageService";
+import SecretEntity from "passbolt-styleguide/src/shared/models/entity/secret/secretEntity";
+import GroupUpdateSecretsCollection from "../../model/entity/secret/groupUpdate/groupUpdateSecretsCollection";
+import i18n from "../../sdk/i18n";
+
+/**
+ * Shared decrypt/encrypt logic for the "add users to group" flow.
+ * It is called by both the MV2 path (GroupUpdateService, in the service worker / background page)
+ * and the MV3 path (AddUsersToGroupOffscreenService, in the offscreen document) so the
+ * cryptographic loop lives in a single place. The caller provides an `onProgress` callback to
+ * decide how progress is surfaced (direct progress service update vs throttled offscreen message).
+ */
+class GroupUpdateSecretsCryptoService {
+  /**
+   * Decrypt a collection of secrets.
+   * @param {openpgp.PrivateKey} privateKey The logged in user private key
+   * @param {GroupUpdateSecretsCollection} secretsCollection The collection of secrets to decrypt
+   * @param {function(string):void} [onProgress] Called after each secret with the progress message
+   * @returns {Promise<object>} Decrypted secrets organized as {[resourceId]: secretDecrypted, ...}
+   */
+  static async decryptSecrets(privateKey, secretsCollection, onProgress) {
+    const result = [];
+    const collectionLength = secretsCollection.length;
+
+    for (let i = 0; i < collectionLength; i++) {
+      const secret = secretsCollection.items[i];
+      const secretMessage = await OpenpgpAssertion.readMessageOrFail(secret.data);
+      result[secret.resourceId] = await DecryptMessageService.decrypt(secretMessage, privateKey);
+
+      await onProgress?.(i18n.t("Decrypting {{counter}}/{{total}}", { counter: i + 1, total: collectionLength }));
+    }
+
+    return result;
+  }
+
+  /**
+   * Encrypt a collection of needed secrets.
+   * @param {openpgp.PrivateKey} privateKey The logged in user private key
+   * @param {object} usersPublicKeys The users public armored keys organized as {[userId]: armoredKey, ...}
+   * @param {NeededSecretsCollection} neededSecretsCollection A collection of needed secret
+   * @param {object} decryptedSecrets The decrypted secrets organized as {[resourceId]: secretDecrypted, ...}
+   * @param {function(string):void} [onProgress] Called after each secret with the progress message
+   * @returns {Promise<GroupUpdateSecretsCollection>}
+   */
+  static async encryptSecrets(privateKey, usersPublicKeys, neededSecretsCollection, decryptedSecrets, onProgress) {
+    const groupUpdateSecrets = new GroupUpdateSecretsCollection([]);
+    const collectionLength = neededSecretsCollection.length;
+
+    for (let i = 0; i < collectionLength; i++) {
+      const neededSecret = neededSecretsCollection.items[i];
+      const user_id = neededSecret.userId;
+      const resource_id = neededSecret.resourceId;
+
+      const encryptionKey = await OpenpgpAssertion.readKeyOrFail(usersPublicKeys[user_id]);
+      const data = await EncryptMessageService.encrypt(decryptedSecrets[resource_id], encryptionKey, [privateKey]);
+
+      const secret = new SecretEntity({ resource_id, user_id, data });
+      groupUpdateSecrets.push(secret);
+
+      onProgress?.(i18n.t("Encrypting {{counter}}/{{total}}", { counter: i + 1, total: collectionLength }));
+    }
+
+    return groupUpdateSecrets;
+  }
+}
+
+export default GroupUpdateSecretsCryptoService;

package/src/all/background_page/service/group/groupUpdateSecretsCryptoService.test.js

@@ -0,0 +1,102 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+import { v4 as uuidv4 } from "uuid";
+import { pgpKeys } from "passbolt-styleguide/test/fixture/pgpKeys/keys";
+import { plaintextSecretPasswordAndDescriptionDto } from "passbolt-styleguide/src/shared/models/entity/plaintextSecret/plaintextSecretEntity.test.data";
+import GroupUpdateSecretsCryptoService from "./groupUpdateSecretsCryptoService";
+import { OpenpgpAssertion } from "../../utils/openpgp/openpgpAssertions";
+import EncryptMessageService from "../crypto/encryptMessageService";
+import DecryptMessageService from "../crypto/decryptMessageService";
+import GroupUpdateSecretsCollection from "../../model/entity/secret/groupUpdate/groupUpdateSecretsCollection";
+import NeededSecretsCollection from "../../model/entity/secret/needed/neededSecretsCollection";
+import { defaultResourcesSecretsDtos } from "../../model/entity/secret/groupUpdate/groupUpdateSecretsCollection.test.data";
+
+describe("GroupUpdateSecretsCryptoService", () => {
+  describe("::decryptSecrets", () => {
+    it("should decrypt the secrets and report progress for each one", async () => {
+      expect.assertions(3);
+
+      const originalDecryptedSecret = plaintextSecretPasswordAndDescriptionDto();
+      const adaPublicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.public);
+      const secretsDtos = defaultResourcesSecretsDtos(1);
+      secretsDtos[0].data = await EncryptMessageService.encrypt(JSON.stringify(originalDecryptedSecret), adaPublicKey);
+      const secrets = new GroupUpdateSecretsCollection(secretsDtos, { validate: false });
+      const privateKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const onProgress = jest.fn();
+
+      const result = await GroupUpdateSecretsCryptoService.decryptSecrets(privateKey, secrets, onProgress);
+
+      expect(JSON.parse(result[secretsDtos[0].resource_id])).toStrictEqual(originalDecryptedSecret);
+      expect(onProgress).toHaveBeenCalledTimes(1);
+      expect(onProgress).toHaveBeenCalledWith("Decrypting 1/1");
+    });
+  });
+
+  describe("::encryptSecrets", () => {
+    it("should encrypt the needed secrets for the recipient and report progress for each one", async () => {
+      expect.assertions(4);
+
+      const originalDecryptedSecret = plaintextSecretPasswordAndDescriptionDto();
+      const userId = uuidv4();
+      const resourceId = uuidv4();
+      const decryptedSecrets = { [resourceId]: JSON.stringify(originalDecryptedSecret) };
+      const neededSecrets = new NeededSecretsCollection([{ user_id: userId, resource_id: resourceId }], {
+        validate: false,
+      });
+      const usersPublicKeys = { [userId]: pgpKeys.betty.public };
+      const privateKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+      const onProgress = jest.fn();
+
+      const result = await GroupUpdateSecretsCryptoService.encryptSecrets(
+        privateKey,
+        usersPublicKeys,
+        neededSecrets,
+        decryptedSecrets,
+        onProgress,
+      );
+
+      const decryptedData = await DecryptMessageService.decrypt(
+        await OpenpgpAssertion.readMessageOrFail(result.items[0].data),
+        await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted),
+      );
+
+      expect(JSON.parse(decryptedData)).toStrictEqual(originalDecryptedSecret);
+      expect(result.items[0].userId).toEqual(userId);
+      expect(onProgress).toHaveBeenCalledTimes(1);
+      expect(onProgress).toHaveBeenCalledWith("Encrypting 1/1");
+    });
+
+    it("should not throw when no progress callback is provided", async () => {
+      expect.assertions(1);
+
+      const userId = uuidv4();
+      const resourceId = uuidv4();
+      const decryptedSecrets = { [resourceId]: JSON.stringify(plaintextSecretPasswordAndDescriptionDto()) };
+      const neededSecrets = new NeededSecretsCollection([{ user_id: userId, resource_id: resourceId }], {
+        validate: false,
+      });
+      const usersPublicKeys = { [userId]: pgpKeys.betty.public };
+      const privateKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.private_decrypted);
+
+      const result = await GroupUpdateSecretsCryptoService.encryptSecrets(
+        privateKey,
+        usersPublicKeys,
+        neededSecrets,
+        decryptedSecrets,
+      );
+
+      expect(result.items).toHaveLength(1);
+    });
+  });
+});

package/src/all/background_page/service/group/groupUpdateService.js

@@ -11,21 +11,19 @@
  * @link          https://www.passbolt.com Passbolt(tm)
  * @since         4.10.1
  */
-import { OpenpgpAssertion } from "../../utils/openpgp/openpgpAssertions";
 import Keyring from "../../model/keyring";
-import EncryptMessageService from "../../service/crypto/encryptMessageService";
-import DecryptMessageService from "../../service/crypto/decryptMessageService";
 import GroupModel from "../../model/group/groupModel";
 import GroupEntity from "passbolt-styleguide/src/shared/models/entity/group/groupEntity";
 import GroupUpdateEntity from "../../model/entity/group/update/groupUpdateEntity";
 import i18n from "../../sdk/i18n";
-import SecretEntity from "passbolt-styleguide/src/shared/models/entity/secret/secretEntity";
 import GroupUpdateSecretsCollection from "../../model/entity/secret/groupUpdate/groupUpdateSecretsCollection";
 import DecryptPrivateKeyService from "../crypto/decryptPrivateKeyService";
 import { assertString, assertType } from "../../utils/assertions";
 import GroupUpdatesCollection from "../../model/entity/group/update/groupUpdatesCollection";
 import GroupLocalStorage from "../local_storage/groupLocalStorage";
 import GroupApiService from "../api/group/groupApiService";
+import GroupUpdateSecretsCryptoService from "./groupUpdateSecretsCryptoService";
+import { RequestAddUsersToGroupOffscreenService } from "../../../../chrome-mv3/serviceWorker/service/addUsersToGroup/requestAddUsersToGroupOffscreenService";
 
 /**
  * Progress goals are:
@@ -37,7 +35,6 @@ import GroupApiService from "../api/group/groupApiService";
  * - Done
  */
 const PROGRESS_GOAL = 6;
-const YIELD_INTERVAL_MS = 8000; // PB-51648 yield reduce to 8s due to chrome 148 more strict to ping service worker
 
 class GroupUpdateService {
   /**
@@ -103,9 +100,18 @@ class GroupUpdateService {
    */
   async encryptNeededSecrets(passphrase, groupUpdateDryRunResultEntity) {
     this.progressService.finishStep(i18n.t("Encrypt required secrets for new users"), true);
-    const privateKey = await DecryptPrivateKeyService.decryptArmoredKey(this.account.userPrivateArmoredKey, passphrase);
-    const decryptedSecrets = await this.decryptSecrets(privateKey, groupUpdateDryRunResultEntity.secrets);
-    return await this.encryptSecrets(privateKey, groupUpdateDryRunResultEntity.neededSecrets, decryptedSecrets);
+
+    const isMV3 = chrome.runtime.getManifest().manifest_version === 3;
+    if (isMV3) {
+      return await this.decryptAndEncryptSecretsFromOffscreen(passphrase, groupUpdateDryRunResultEntity);
+    } else {
+      const privateKey = await DecryptPrivateKeyService.decryptArmoredKey(
+        this.account.userPrivateArmoredKey,
+        passphrase,
+      );
+      const decryptedSecrets = await this.decryptSecrets(privateKey, groupUpdateDryRunResultEntity.secrets);
+      return await this.encryptSecrets(privateKey, groupUpdateDryRunResultEntity.neededSecrets, decryptedSecrets);
+    }
   }
 
   /**
@@ -117,44 +123,16 @@ class GroupUpdateService {
    * @private
    */
   async encryptSecrets(privateKey, neededSecretsCollection, decryptedSecrets) {
-    const groupUpdateSecrets = new GroupUpdateSecretsCollection([]);
-    let lastYield = Date.now();
     this.progressService.finishStep(i18n.t("Synchronizing keyring"), true);
     const usersPublicKeys = await this.retrieveAndReadUserPublicKeys(neededSecretsCollection);
 
-    const collectionLength = neededSecretsCollection.length;
-    for (let i = 0; i < collectionLength; i++) {
-      const neededSecret = neededSecretsCollection.items[i];
-      const user_id = neededSecret.userId;
-      const resource_id = neededSecret.resourceId;
-
-      this.progressService.updateStepMessage(
-        i18n.t("Encrypting {{counter}}/{{total}}", { counter: i + 1, total: collectionLength }),
-      );
-      const data = await EncryptMessageService.encrypt(decryptedSecrets[resource_id], usersPublicKeys[user_id], [
-        privateKey,
-      ]);
-
-      const secret = new SecretEntity({ resource_id, user_id, data });
-      groupUpdateSecrets.push(secret);
-
-      /*
-       * PB-51434
-       * Force a timeout promise to let the service worker respond to chromium
-       *
-       * Starting with Chrome 147, the regular check of the service worker on the event lop seems more strict
-       * If the service worker do a process that consume too much time and performance that it can not respond
-       * It will be killed by the browser as it is not responding at time.
-       *
-       * Using promise set timeout will solve the issue it releases the even loop enough time to respond
-       */
-      if (Date.now() - lastYield >= YIELD_INTERVAL_MS) {
-        await new Promise((resolve) => setTimeout(resolve, 0));
-        lastYield = Date.now();
-      }
-    }
-
-    return groupUpdateSecrets;
+    return GroupUpdateSecretsCryptoService.encryptSecrets(
+      privateKey,
+      usersPublicKeys,
+      neededSecretsCollection,
+      decryptedSecrets,
+      (message) => this.progressService.updateStepMessage(message),
+    );
   }
 
   /**
@@ -165,36 +143,9 @@ class GroupUpdateService {
    * @private
    */
   async decryptSecrets(privateKey, secretsCollection) {
-    const result = [];
-    let lastYield = Date.now();
-
-    const collectionLength = secretsCollection.length;
-    for (let i = 0; i < collectionLength; i++) {
-      const secret = secretsCollection.items[i];
-      const secretMessage = await OpenpgpAssertion.readMessageOrFail(secret.data);
-
-      this.progressService.updateStepMessage(
-        i18n.t("Decrypting {{counter}}/{{total}}", { counter: i + 1, total: collectionLength }),
-      );
-      result[secret.resourceId] = await DecryptMessageService.decrypt(secretMessage, privateKey);
-
-      /*
-       * PB-51434
-       * Force a timeout promise to let the service worker respond to chromium
-       *
-       * Starting with Chrome 147, the regular check of the service worker on the event lop seems more strict
-       * If the service worker do a process that consume too much time and performance that it can not respond
-       * It will be killed by the browser as it is not responding at time.
-       *
-       * Using promise set timeout will solve the issue it releases the even loop enough time to respond
-       */
-      if (Date.now() - lastYield >= YIELD_INTERVAL_MS) {
-        await new Promise((resolve) => setTimeout(resolve, 0));
-        lastYield = Date.now();
-      }
-    }
-
-    return result;
+    return GroupUpdateSecretsCryptoService.decryptSecrets(privateKey, secretsCollection, (message) =>
+      this.progressService.updateStepMessage(message),
+    );
   }
 
   /**
@@ -225,10 +176,10 @@ class GroupUpdateService {
   }
 
   /**
-   * Retrieve and read the user public keys.
+   * Retrieve the user public keys.
    * @param {NeededSecretsCollection} neededSecrets The needed secrets
-   * @returns {Promise<object>} User public key organized in an object where the property name represents the user id,
-   * and the value contains the user openpgp public key.
+   * @returns {Promise<object>} User public keys organized in an object where the property name represents the user id,
+   * and the value contains the user public armored key.
    * @private
    */
   async retrieveAndReadUserPublicKeys(neededSecrets) {
@@ -239,12 +190,32 @@ class GroupUpdateService {
     await keyring.sync();
 
     for (const userId of userIds) {
-      const userPublicArmoredKey = keyring.findPublic(userId).armoredKey;
-      userOpenpgpPublicKeys[userId] = await OpenpgpAssertion.readKeyOrFail(userPublicArmoredKey);
+      // Keep armored key to send it through a message for offscreen
+      userOpenpgpPublicKeys[userId] = keyring.findPublic(userId).armoredKey;
     }
 
     return userOpenpgpPublicKeys;
   }
+
+  /**
+   * Delegate the decryption and encryption secrets to the offscreen
+   * @param {string} passphrase
+   * @param {GroupUpdateDryRunResultEntity} groupUpdateDryRunResultEntity
+   * @return {Promise<GroupUpdateSecretsCollection>}
+   */
+  async decryptAndEncryptSecretsFromOffscreen(passphrase, groupUpdateDryRunResultEntity) {
+    this.progressService.finishStep(i18n.t("Synchronizing keyring"), true);
+    // User public key are stored in local storage that is not accessible from offscreen
+    const usersPublicKeys = await this.retrieveAndReadUserPublicKeys(groupUpdateDryRunResultEntity.neededSecrets);
+    const groupUpdateSecrets = await RequestAddUsersToGroupOffscreenService.decryptAndEncryptSecrets(
+      this.account,
+      passphrase,
+      groupUpdateDryRunResultEntity,
+      usersPublicKeys,
+      this.progressService,
+    );
+    return new GroupUpdateSecretsCollection(groupUpdateSecrets, { validate: false });
+  }
 }
 
 export default GroupUpdateService;