passbolt-browser-extension 5.13.0 → 5.14.2

package/src/all/locales/pt-BR/common.json

@@ -4,7 +4,6 @@
   "An internal error occurred. The server response could not be parsed. Please contact your administrator.": "Ocorreu um erro interno. A resposta do servidor não pôde ser analisada. Por favor, contate o administrador.",
   "An RSA key should have a length of {{size}} bits minimum.": "Uma chave RSA deve ter o mínimo de {{size}} bits de comprimento.",
   "Autofill failed. Could not find the active tab.": "Falha no preenchimento automático. Não foi possível encontrar a aba ativa.",
-  "Calculate permissions": "Calcular permissões",
   "Calculating changes for {{name}}": "Calculando alterações para {{name}}",
   "Calculating folders permissions changes": "Calculando modificações das permissões das pastas",
   "Calculating resources permissions changes": "Calculando modificações das permissões dos recursos",
@@ -14,7 +13,7 @@
   "Could not verify the server key.": "Não foi possível verificar a chave do servidor.",
   "Creating folder...": "Criando pasta...",
   "Creating metadata key": "Criando chave de metadados",
-  "Creating resource": "Creating resource",
+  "Creating resource": "Criando recurso",
   "Decrypting ...": "Descriptografando...",
   "Decrypting {{counter}}/{{total}}": "Descriptografando {{counter}}/{{total}}",
   "Decrypting secrets": "Descriptografando segredos",
@@ -85,9 +84,7 @@
   "Sharing folders {{counter}}/{{total}}": "Compartilhando pastas {{counter}}/{{total}}",
   "Sharing resources": "Compartilhando recursos",
   "Sharing resources {{counter}}/{{total}}": "Compartilhando recursos {{counter}}/{{total}}",
-  "Start sharing": "Iniciar compartilhamento",
   "Synchronizing keyring": "Sincronizando chaves",
-  "Synchronizing keys": "Sincronizando chaves",
   "Tagging passwords {{taggedCount}}/{{total}}": "Etiquetando senhas {{taggedCount}}/{{total}}",
   "The encryption key used to share metadata between users could not be verified and is considered untrusted.": "A chave de criptografia usada para compartilhar metadados entre usuários não pôde ser verificada e é considerada não confiável.",
   "The external service is unavailable": "O serviço externo está indisponível",

package/src/all/locales/ro-RO/common.json

@@ -4,7 +4,6 @@
   "An internal error occurred. The server response could not be parsed. Please contact your administrator.": "A apărut o eroare internă. Răspunsul serverului nu a putut fi analizat. Vă rugăm să contactați administratorul.",
   "An RSA key should have a length of {{size}} bits minimum.": "O cheie RSA ar trebui să aibă o lungime minimă de {{size}} biți.",
   "Autofill failed. Could not find the active tab.": "Autocompletare eșuată. Nu s-a putut găsi un tab activ.",
-  "Calculate permissions": "Calculează permisiunile",
   "Calculating changes for {{name}}": "Se calculează modificările pentru {{name}}",
   "Calculating folders permissions changes": "Se calculează modificările permisiunilor folderelor",
   "Calculating resources permissions changes": "Se calculează modificările permisiunilor resurselor",
@@ -14,7 +13,7 @@
   "Could not verify the server key.": "Nu s-a putut verifica cheia serverului.",
   "Creating folder...": "Se creează folderul...",
   "Creating metadata key": "Se creează cheia de metadate",
-  "Creating resource": "Creating resource",
+  "Creating resource": "Se creează resursa",
   "Decrypting ...": "Se decriptează...",
   "Decrypting {{counter}}/{{total}}": "Decriptare {{counter}}/{{total}}",
   "Decrypting secrets": "Se decriptează secretele",
@@ -85,9 +84,7 @@
   "Sharing folders {{counter}}/{{total}}": "Partajarea folderelor {{counter}}/{{total}}",
   "Sharing resources": "Partajarea resurselor",
   "Sharing resources {{counter}}/{{total}}": "Partajarea resurselor {{counter}}/{{total}}",
-  "Start sharing": "Începe partajarea",
   "Synchronizing keyring": "Sincronizare keyring",
-  "Synchronizing keys": "Sincronizare chei",
   "Tagging passwords {{taggedCount}}/{{total}}": "Etichetare parole {{taggedCount}}/{{total}}",
   "The encryption key used to share metadata between users could not be verified and is considered untrusted.": "Cheia de criptare utilizată pentru a partaja metadatele între utilizatori nu a putut fi verificată și este considerată de neîncredere.",
   "The external service is unavailable": "Serviciul extern nu este disponibil",

package/src/all/locales/ru-RU/common.json

@@ -4,7 +4,6 @@
   "An internal error occurred. The server response could not be parsed. Please contact your administrator.": "Произошла внутренняя ошибка. Ответ сервера не может быть обработан. Пожалуйста, свяжитесь с вашим администратором.",
   "An RSA key should have a length of {{size}} bits minimum.": "RSA ключ должен иметь длину не менее {{size}} бит.",
   "Autofill failed. Could not find the active tab.": "Ошибка автозаполнения. Не удалось найти активную вкладку.",
-  "Calculate permissions": "Вычислить права доступа",
   "Calculating changes for {{name}}": "Вычисление изменений для {{name}}",
   "Calculating folders permissions changes": "Вычисление изменений разрешений папок",
   "Calculating resources permissions changes": "Вычисление изменений разрешений ресурсов",
@@ -14,7 +13,7 @@
   "Could not verify the server key.": "Не удалось проверить ключ сервера.",
   "Creating folder...": "Создание папки...",
   "Creating metadata key": "Создание ключа метаданных",
-  "Creating resource": "Creating resource",
+  "Creating resource": "Создание ресурса",
   "Decrypting ...": "Расшифровка ...",
   "Decrypting {{counter}}/{{total}}": "Расшифровка {{counter}}/{{total}}",
   "Decrypting secrets": "Расшифровка паролей",
@@ -85,9 +84,7 @@
   "Sharing folders {{counter}}/{{total}}": "Общий доступ к папкам {{counter}}/{{total}}",
   "Sharing resources": "Общий доступ к ресурсам",
   "Sharing resources {{counter}}/{{total}}": "Общий доступ к ресурсам {{counter}}/{{total}}",
-  "Start sharing": "Начать делиться",
   "Synchronizing keyring": "Синхронизация связки ключей",
-  "Synchronizing keys": "Синхронизация ключей",
   "Tagging passwords {{taggedCount}}/{{total}}": "Пометка паролей {{taggedCount}}/{{total}}",
   "The encryption key used to share metadata between users could not be verified and is considered untrusted.": "Ключ шифрования, используемый для обмена метаданными между пользователями, не удалось проверить, он считается ненадёжным.",
   "The external service is unavailable": "Внешний сервис недоступен",

package/src/all/locales/sl-SI/common.json

@@ -4,7 +4,6 @@
   "An internal error occurred. The server response could not be parsed. Please contact your administrator.": "Prišlo je do notranje napake. Odgovora strežnika ni bilo mogoče obdelati. Obrnite se na svojega skrbnika.",
   "An RSA key should have a length of {{size}} bits minimum.": "Ključ RSA mora imeti najmanj {{size}} bitov dolžine.",
   "Autofill failed. Could not find the active tab.": "Samodejno izpolnjevanje ni uspelo. Aktivnega zavihka ni bilo mogoče najti.",
-  "Calculate permissions": "Izračunaj dovoljenja",
   "Calculating changes for {{name}}": "Izračunavam spremembe za {{name}}",
   "Calculating folders permissions changes": "Izračunavam spremembe dovoljenj za mape",
   "Calculating resources permissions changes": "Izračunavam spremembe dovoljenj za vire",
@@ -14,7 +13,7 @@
   "Could not verify the server key.": "Ključa strežnika ni bilo mogoče preveriti.",
   "Creating folder...": "Ustvarjanje mape...",
   "Creating metadata key": "Ustvarjanje ključa metapodatkov",
-  "Creating resource": "Creating resource",
+  "Creating resource": "Ustvarjanje vira",
   "Decrypting ...": "Dešifriranje ...",
   "Decrypting {{counter}}/{{total}}": "Dešifriranje {{counter}}/{{total}}",
   "Decrypting secrets": "Dešifriranje gesel",
@@ -85,9 +84,7 @@
   "Sharing folders {{counter}}/{{total}}": "Deljenje map {{counter}}/{{total}}",
   "Sharing resources": "Deljenje virov",
   "Sharing resources {{counter}}/{{total}}": "Deljenje virov {{counter}}/{{total}}",
-  "Start sharing": "Začni z deljenjem",
   "Synchronizing keyring": "Sinhronizacija zbirke ključev",
-  "Synchronizing keys": "Synchroniziranje ključev",
   "Tagging passwords {{taggedCount}}/{{total}}": "Označevanje gesel {{taggedCount}}/{{total}}",
   "The encryption key used to share metadata between users could not be verified and is considered untrusted.": "Šifrirnega ključa za izmenjavo metapodatkov med uporabniki ni bilo mogoče preveriti in velja za nezaupanja vrednega.",
   "The external service is unavailable": "Zunanja storitev ni na voljo",

package/src/all/locales/sv-SE/common.json

@@ -4,7 +4,6 @@
   "An internal error occurred. The server response could not be parsed. Please contact your administrator.": "Ett internt fel uppstod. Serversvaret kunde inte tolkas. Kontakta administratören.",
   "An RSA key should have a length of {{size}} bits minimum.": "En RSA-nyckel bör ha en längd på minst {{size}} bitar.",
   "Autofill failed. Could not find the active tab.": "Autofyll misslyckades. Det gick inte att hitta den aktiva fliken.",
-  "Calculate permissions": "Beräkna behörigheter",
   "Calculating changes for {{name}}": "Beräknar ändringar för {{name}}",
   "Calculating folders permissions changes": "Beräknar mappbehörighetsändringar",
   "Calculating resources permissions changes": "Beräknar resursbehörighetsändringar",
@@ -14,7 +13,7 @@
   "Could not verify the server key.": "Kunde inte verifiera servernyckeln.",
   "Creating folder...": "Skapar mapp...",
   "Creating metadata key": "Skapar metadata-nyckel",
-  "Creating resource": "Creating resource",
+  "Creating resource": "Skapar resurs",
   "Decrypting ...": "Dekrypterar ...",
   "Decrypting {{counter}}/{{total}}": "Dekrypterar {{counter}}/{{total}}",
   "Decrypting secrets": "Dekrypterar hemligheter",
@@ -85,9 +84,7 @@
   "Sharing folders {{counter}}/{{total}}": "Delar mappar {{counter}}/{{total}}",
   "Sharing resources": "Delar resurser",
   "Sharing resources {{counter}}/{{total}}": "Delar resurser {{counter}}/{{total}}",
-  "Start sharing": "Börja dela",
   "Synchronizing keyring": "Synkroniserar nyckelring",
-  "Synchronizing keys": "Synkroniserar nycklar",
   "Tagging passwords {{taggedCount}}/{{total}}": "Taggar lösenord {{taggedCount}}/{{total}}",
   "The encryption key used to share metadata between users could not be verified and is considered untrusted.": "Krypteringsnyckeln som används för att dela metadata mellan användare kunde inte verifieras och betraktas som opålitlig.",
   "The external service is unavailable": "Den externa tjänsten är inte tillgänglig",

package/src/all/locales/uk-UA/common.json

@@ -4,7 +4,6 @@
   "An internal error occurred. The server response could not be parsed. Please contact your administrator.": "Виникла внутрішня помилка. Не вдалося обробити відповідь сервера. Будь ласка, зверніться до адміністратора.",
   "An RSA key should have a length of {{size}} bits minimum.": "Ключ RSA повинен мати мінімальну довжину {{size}} біт.",
   "Autofill failed. Could not find the active tab.": "Помилка автозаповнення. Не вдалося знайти активну вкладку.",
-  "Calculate permissions": "Розрахунок прав доступу",
   "Calculating changes for {{name}}": "Обчислення змін для {{name}}",
   "Calculating folders permissions changes": "Обчислення змін прав доступу до тек",
   "Calculating resources permissions changes": "Обчислення змін дозволів ресурсів",
@@ -14,7 +13,7 @@
   "Could not verify the server key.": "Не вдалося перевірити ключ сервера.",
   "Creating folder...": "Створення теки…",
   "Creating metadata key": "Створення ключа метаданих",
-  "Creating resource": "Creating resource",
+  "Creating resource": "Створення ресурсу",
   "Decrypting ...": "Розшифрування…",
   "Decrypting {{counter}}/{{total}}": "Розшифрування {{counter}}/{{total}}",
   "Decrypting secrets": "Розшифрування секретів",
@@ -85,9 +84,7 @@
   "Sharing folders {{counter}}/{{total}}": "Надання спільного доступу до тек {{counter}}/{{total}}",
   "Sharing resources": "Надання спільного доступу до ресурсів",
   "Sharing resources {{counter}}/{{total}}": "Надання спільного доступу до ресурсів {{counter}}/{{total}}",
-  "Start sharing": "Надати спільний доступ",
   "Synchronizing keyring": "Синхронізація зв'язки ключів",
-  "Synchronizing keys": "Синхронізація ключів",
   "Tagging passwords {{taggedCount}}/{{total}}": "Тегування паролів {{taggedCount}}/{{total}}",
   "The encryption key used to share metadata between users could not be verified and is considered untrusted.": "Ключ шифрування, який використовується для обміну метаданими між користувачами не може бути підтверджений і вважається ненадійним.",
   "The external service is unavailable": "Зовнішня служба недоступна",

package/src/all/webAccessibleResources/js/app/QuickAccess.js

@@ -17,6 +17,13 @@ import ExtQuickAccess from "passbolt-styleguide/src/react-quickaccess/ExtQuickAc
 import Port from "../lib/port";
 
 async function main() {
+  // The QuickAccess is only ever rendered as a top-level extension surface (toolbar popup or detached window).
+  // If it is running inside a frame, a remote page has embedded it; refuse to initialise to prevent
+  // clickjacking / UI redress of the QuickAccess UI.
+  if (window.top !== window.self) {
+    return;
+  }
+
   const query = new URLSearchParams(window.location.search);
   const portname = query.get("passbolt");
   const port = new Port(portname);

package/src/chrome/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 2,
   "name": "__MSG_appName__",
   "short_name": "passbolt",
-  "version": "5.13.0",
+  "version": "5.14.2",
   "description": "__MSG_appDescription__",
   "default_locale": "en",
   "externally_connectable": {},

package/src/chrome-mv3/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "__MSG_appName__",
   "short_name": "passbolt",
-  "version": "5.13.0",
+  "version": "5.14.2",
   "description": "__MSG_appDescription__",
   "default_locale": "en",
   "minimum_chrome_version": "116",

package/src/chrome-mv3/offscreens/service/group/addUsersToGroupOffscreenService.js

@@ -0,0 +1,132 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+import GroupUpdateSecretsCollection from "../../../../all/background_page/model/entity/secret/groupUpdate/groupUpdateSecretsCollection";
+import NeededSecretsCollection from "../../../../all/background_page/model/entity/secret/needed/neededSecretsCollection";
+import DecryptPrivateKeyService from "../../../../all/background_page/service/crypto/decryptPrivateKeyService";
+import GroupUpdateSecretsCryptoService from "../../../../all/background_page/service/group/groupUpdateSecretsCryptoService";
+
+export const SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN = "add-user-to-group-offscreen";
+export const SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_HANDLER =
+  "service-worker-add-user-to-group-offscreen-response-handler";
+export const SEND_MESSAGE_TARGET_OFFSCREEN_PROGRESS_SERVICE_HANDLER =
+  "service-worker-offscreen-progress-service-handler";
+export const ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_SUCCESS = "success";
+export const ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_ERROR = "error";
+export const ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_PROGRESS = "progress";
+
+const PROGRESS_INTERVAL_MS = 80; // send progress message every 80ms
+
+export default class AddUsersToGroupOffscreenService {
+  /**
+   * Handle decryption and encryption of add user to group.
+   * @param {{requestId: string, addUsersToGroupContent: object}} message arguments to pass to decrypt and encrypt secrets for users.
+   * @returns {Promise<object>}
+   */
+  static async handleRequest({ requestId, addUsersToGroupContent }) {
+    try {
+      const groupUpdateSecrets = await AddUsersToGroupOffscreenService._handleDecryptAndEncryptRequest(
+        requestId,
+        addUsersToGroupContent,
+      );
+      return await AddUsersToGroupOffscreenService.handleSuccessResponse(groupUpdateSecrets);
+    } catch (error) {
+      return AddUsersToGroupOffscreenService.handleErrorResponse(error);
+    }
+  }
+
+  /**
+   * Handles decrypt and encrypt secrets
+   * @param {string} requestId The offscreen request id, used to route progress messages.
+   * @param {object} addUsersToGroupContent
+   * @returns {Promise<GroupUpdateSecretsCollection>}
+   * @private
+   */
+  static async _handleDecryptAndEncryptRequest(requestId, addUsersToGroupContent) {
+    const privateKey = await DecryptPrivateKeyService.decryptArmoredKey(
+      addUsersToGroupContent.privateKey.armoredKey,
+      addUsersToGroupContent.privateKey.passphrase,
+    );
+    const secrets = new GroupUpdateSecretsCollection(addUsersToGroupContent.secrets, { validate: false });
+    const neededSecrets = new NeededSecretsCollection(addUsersToGroupContent.neededSecrets, { validate: false });
+
+    /*
+     * Throttle progress messages to the service worker. Sending a message also keeps the app progress
+     * dialog refreshed while the offscreen processes the cryptographic operations.
+     */
+    let lastYield = Date.now();
+    const onProgress = async (message) => {
+      if (Date.now() - lastYield >= PROGRESS_INTERVAL_MS) {
+        await AddUsersToGroupOffscreenService.handleProgressResponse(requestId, { message });
+        lastYield = Date.now();
+      }
+    };
+
+    const decryptedSecrets = await GroupUpdateSecretsCryptoService.decryptSecrets(privateKey, secrets, onProgress);
+    return await GroupUpdateSecretsCryptoService.encryptSecrets(
+      privateKey,
+      addUsersToGroupContent.usersPublicKeys,
+      neededSecrets,
+      decryptedSecrets,
+      onProgress,
+    );
+  }
+
+  /**
+   * Build the success response sent back to the service worker.
+   * @param {GroupUpdateSecretsCollection} groupUpdateSecrets The groupUpdateSecrets
+   * @returns {Promise<object>}
+   * @private
+   */
+  static async handleSuccessResponse(groupUpdateSecrets) {
+    return {
+      data: groupUpdateSecrets.toDto(),
+      type: ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_SUCCESS,
+      target: SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_HANDLER,
+    };
+  }
+
+  /**
+   * Build the error response sent back to the service worker.
+   * @param {Error} error The error
+   * @returns {object}
+   * @private
+   */
+  static handleErrorResponse(error) {
+    console.error(error);
+    return {
+      data: {
+        name: error?.name,
+        message: error?.message || "AddUsersToGroupOffscreenService: an unexpected error occurred",
+      },
+      type: ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_ERROR,
+      target: SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_HANDLER,
+    };
+  }
+
+  /**
+   * Send a progress message to the service worker so it can update the app progress dialog.
+   * @param {string} requestId The offscreen request id, used to route the progress to the right progress service.
+   * @param {{message: string}} progress
+   * @returns {Promise<void>}
+   * @private
+   */
+  static async handleProgressResponse(requestId, progress) {
+    await chrome.runtime.sendMessage({
+      id: requestId,
+      data: progress,
+      type: ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_PROGRESS,
+      target: SEND_MESSAGE_TARGET_OFFSCREEN_PROGRESS_SERVICE_HANDLER,
+    });
+  }
+}

package/src/chrome-mv3/offscreens/service/group/addUsersToGroupOffscreenService.test.js

@@ -0,0 +1,125 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+import AddUsersToGroupOffscreenService, {
+  ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_ERROR,
+  ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_PROGRESS,
+  ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_SUCCESS,
+  SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_HANDLER,
+  SEND_MESSAGE_TARGET_OFFSCREEN_PROGRESS_SERVICE_HANDLER,
+} from "./addUsersToGroupOffscreenService";
+import { defaultGroupDto } from "passbolt-styleguide/src/shared/models/entity/group/groupEntity.test.data";
+import GroupEntity from "passbolt-styleguide/src/shared/models/entity/group/groupEntity";
+import GroupUserEntity from "passbolt-styleguide/src/shared/models/entity/groupUser/groupUserEntity";
+import { createGroupUser } from "passbolt-styleguide/src/shared/models/entity/groupUser/groupUserEntity.test.data";
+import { defaultResourcesSecretsDtos } from "../../../../all/background_page/model/entity/secret/groupUpdate/groupUpdateSecretsCollection.test.data";
+import { OpenpgpAssertion } from "../../../../all/background_page/utils/openpgp/openpgpAssertions";
+import { plaintextSecretPasswordAndDescriptionDto } from "passbolt-styleguide/src/shared/models/entity/plaintextSecret/plaintextSecretEntity.test.data";
+import EncryptMessageService from "../../../../all/background_page/service/crypto/encryptMessageService";
+import AccountEntity from "../../../../all/background_page/model/entity/account/accountEntity";
+import { defaultAccountDto } from "../../../../all/background_page/model/entity/account/accountEntity.test.data";
+import GroupUpdateDryRunResultEntity from "../../../../all/background_page/model/entity/group/update/groupUpdateDryRunResultEntity";
+import { pgpKeys } from "passbolt-styleguide/test/fixture/pgpKeys/keys";
+import DecryptMessageService from "../../../../all/background_page/service/crypto/decryptMessageService";
+
+describe("AddUsersToGroupOffscreenService", () => {
+  describe("::handleRequest", () => {
+    it("should decrypt and encrypt secrets for the requester", async () => {
+      expect.assertions(2);
+
+      const account = new AccountEntity(defaultAccountDto());
+
+      const existingEntityDto = defaultGroupDto({}, { withGroupsUsers: 1 });
+      const updateGroupEntity = new GroupEntity({ ...existingEntityDto });
+
+      const newUser = new GroupUserEntity(createGroupUser({ group_id: existingEntityDto.id }));
+      updateGroupEntity._groups_users._items = [...updateGroupEntity._groups_users.items, newUser];
+
+      const secrets = defaultResourcesSecretsDtos(1);
+
+      const adaPublicKey = await OpenpgpAssertion.readKeyOrFail(pgpKeys.ada.public);
+      const originalDecryptedSecret = plaintextSecretPasswordAndDescriptionDto();
+      secrets[0].data = await EncryptMessageService.encrypt(JSON.stringify(originalDecryptedSecret), adaPublicKey);
+      const needed_secrets = [
+        {
+          user_id: newUser._props.user_id,
+          resource_id: secrets[0].resource_id,
+        },
+      ];
+      const groupUpdateDryRunResultDto = { needed_secrets, secrets };
+      const groupUpdateDryRunEntity = new GroupUpdateDryRunResultEntity(groupUpdateDryRunResultDto);
+
+      const result = await AddUsersToGroupOffscreenService.handleRequest({
+        requestId: "11111111-1111-4111-8111-111111111111",
+        addUsersToGroupContent: {
+          privateKey: {
+            armoredKey: account.userPrivateArmoredKey,
+            passphrase: "ada@passbolt.com",
+          },
+          secrets: groupUpdateDryRunEntity.secrets.toDto(),
+          neededSecrets: groupUpdateDryRunEntity.neededSecrets.toDto(),
+          usersPublicKeys: { [newUser._props.user_id]: pgpKeys.betty.public },
+        },
+      });
+
+      const expectedResult = {
+        type: ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_SUCCESS,
+        target: SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_HANDLER,
+        data: expect.any(Object),
+      };
+
+      const decryptedData = await DecryptMessageService.decrypt(
+        await OpenpgpAssertion.readMessageOrFail(result.data[0].data),
+        await OpenpgpAssertion.readKeyOrFail(pgpKeys.betty.private_decrypted),
+      );
+
+      expect(JSON.parse(decryptedData)).toStrictEqual(originalDecryptedSecret);
+      expect(result).toStrictEqual(expectedResult);
+    });
+
+    it("should send error if any unexpected error happen", async () => {
+      expect.assertions(1);
+
+      const result = await AddUsersToGroupOffscreenService.handleRequest({
+        requestId: "11111111-1111-4111-8111-111111111111",
+        addUsersToGroupContent: {},
+      });
+
+      const expectedResult = {
+        type: ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_ERROR,
+        target: SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_HANDLER,
+        data: expect.any(Object),
+      };
+
+      expect(result).toStrictEqual(expectedResult);
+    });
+  });
+
+  describe("::handleProgressResponse", () => {
+    it("should send a progress message tagged with the request id", async () => {
+      expect.assertions(1);
+
+      const requestId = "11111111-1111-4111-8111-111111111111";
+      jest.spyOn(chrome.runtime, "sendMessage").mockImplementation(() => {});
+
+      await AddUsersToGroupOffscreenService.handleProgressResponse(requestId, { message: "Encrypting 1/2" });
+
+      expect(chrome.runtime.sendMessage).toHaveBeenCalledWith({
+        id: requestId,
+        data: { message: "Encrypting 1/2" },
+        type: ADD_USERS_TO_GROUP_OFFSCREEN_RESPONSE_TYPE_PROGRESS,
+        target: SEND_MESSAGE_TARGET_OFFSCREEN_PROGRESS_SERVICE_HANDLER,
+      });
+    });
+  });
+});

package/src/chrome-mv3/offscreens/service/offscreen/handleOffscreenRequestService.js

@@ -17,6 +17,9 @@ import WriteClipobardOffscreenService, {
   SEND_MESSAGE_TARGET_CLIPBOARD_WRITE_OFFSCREEN,
 } from "../clipboard/writeClipobardOffscreenService";
 import { assertUuid } from "../../../../all/background_page/utils/assertions";
+import AddUsersToGroupOffscreenService, {
+  SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN,
+} from "../group/addUsersToGroupOffscreenService";
 
 export const SEND_MESSAGE_TARGET_OFFSCREEN_ERROR_RESPONSE_HANDLER = "service-worker-offscreen-error-response-handler";
 
@@ -32,6 +35,7 @@ export default class HandleOffscreenRequestService {
     const REQUEST_HANDLE_MAP = {
       [SEND_MESSAGE_TARGET_FETCH_OFFSCREEN]: FetchOffscreenService.handleFetchRequest,
       [SEND_MESSAGE_TARGET_CLIPBOARD_WRITE_OFFSCREEN]: WriteClipobardOffscreenService.handleClipboardRequest,
+      [SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN]: AddUsersToGroupOffscreenService.handleRequest,
     };
 
     const requestHandler = REQUEST_HANDLE_MAP[message.target];

package/src/chrome-mv3/serviceWorker/service/addUsersToGroup/requestAddUsersToGroupOffscreenService.js

@@ -0,0 +1,83 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         5.13.0
+ */
+import CreateOffscreenDocumentService from "../offscreen/createOffscreenDocumentService";
+import HandleOffscreenResponseService from "../offscreen/handleOffscreenResponseService";
+import { SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN } from "../../../offscreens/service/group/addUsersToGroupOffscreenService";
+import ResponseAddUsersToGroupOffscreenService from "./responseAddUsersToGroupOffscreenService";
+import { assertPassphrase, assertType } from "../../../../all/background_page/utils/assertions";
+import AccountEntity from "../../../../all/background_page/model/entity/account/accountEntity";
+import GroupUpdateDryRunResultEntity from "../../../../all/background_page/model/entity/group/update/groupUpdateDryRunResultEntity";
+import ProgressService from "../../../../all/background_page/service/progress/progressService";
+
+export class RequestAddUsersToGroupOffscreenService {
+  /**
+   * Run the decryption and encryption of the secrets through offscreen.
+   * @param {AccountEntity} account
+   * @param {string} passphrase
+   * @param {GroupUpdateDryRunResultEntity} groupUpdateDryRunResultEntity
+   * @param {object} usersPublicKeys
+   * @param {ProgressService} progressService the progress service
+   * @returns {Promise<object[]>} The encrypted group update secrets as DTOs.
+   */
+  static async decryptAndEncryptSecrets(
+    account,
+    passphrase,
+    groupUpdateDryRunResultEntity,
+    usersPublicKeys,
+    progressService,
+  ) {
+    assertType(account, AccountEntity);
+    assertPassphrase(passphrase);
+    assertType(groupUpdateDryRunResultEntity, GroupUpdateDryRunResultEntity);
+    assertType(progressService, ProgressService);
+    await CreateOffscreenDocumentService.createIfNotExistOffscreenDocument();
+
+    const requestId = crypto.randomUUID();
+    const offscreenAddUsersToGroupData = {
+      requestId: requestId,
+      addUsersToGroupContent: {
+        privateKey: {
+          armoredKey: account.userPrivateArmoredKey,
+          passphrase: passphrase,
+        },
+        secrets: groupUpdateDryRunResultEntity.secrets.toDto(),
+        neededSecrets: groupUpdateDryRunResultEntity.neededSecrets.toDto(),
+        usersPublicKeys: usersPublicKeys,
+      },
+    };
+    // Register the progress service for this request so progress messages can be routed back to the app
+    ResponseAddUsersToGroupOffscreenService.setProgressService(requestId, progressService);
+    return new Promise((resolve, reject) => {
+      // Stack the response listener callbacks.
+      HandleOffscreenResponseService.setResponseCallback(requestId, { resolve, reject });
+      return RequestAddUsersToGroupOffscreenService.sendOffscreenMessage(requestId, offscreenAddUsersToGroupData).catch(
+        reject,
+      );
+    });
+  }
+
+  /**
+   * Send message to the offscreen document for add users to group decryption and encryption operations.
+   * @param {string} id The id.
+   * @param {object} data The data to handle.
+   * @returns {Promise<*>}
+   */
+  static async sendOffscreenMessage(id, data) {
+    return chrome.runtime.sendMessage({
+      id: id,
+      data: data,
+      target: SEND_MESSAGE_TARGET_ADD_USERS_TO_GROUP_OFFSCREEN,
+    });
+  }
+}