passbolt-browser-extension 5.13.0 → 5.14.2

package/src/all/background_page/model/entity/{organizationSettings/organizationSettingsEntity.js → siteSettings/siteSettingsEntity.js}

@@ -14,30 +14,23 @@
 import Entity from "passbolt-styleguide/src/shared/models/entity/abstract/entity";
 import EntitySchema from "passbolt-styleguide/src/shared/models/entity/abstract/entitySchema";
 
-const ENTITY_NAME = "OrganizationSettings";
+const ENTITY_NAME = "SiteSettings";
 
 // Organization status
 const ORGANIZATION_ENABLED = "enabled";
 const ORGANIZATION_DISABLED = "disabled";
 const ORGANIZATION_NOT_FOUND = "not found";
 
-class OrganizationSettingsEntity extends Entity {
+class SiteSettingsEntity extends Entity {
   /**
    * @inheritDoc
    * Sanitize: Override default settings using the data provided in the DTO.
    */
-  constructor(organizationSettingsDto, options = {}) {
+  constructor(siteSettingsDto, options = {}) {
     // Default properties values
-    const props = Object.assign(OrganizationSettingsEntity.getDefault(), organizationSettingsDto);
-    const sanitizedDto = OrganizationSettingsEntity.sanitizeDto(props);
-    super(
-      EntitySchema.validate(
-        OrganizationSettingsEntity.ENTITY_NAME,
-        sanitizedDto,
-        OrganizationSettingsEntity.getSchema(),
-      ),
-      options,
-    );
+    const props = Object.assign(SiteSettingsEntity.getDefault(), siteSettingsDto);
+    const sanitizedDto = SiteSettingsEntity.sanitizeDto(props);
+    super(EntitySchema.validate(SiteSettingsEntity.ENTITY_NAME, sanitizedDto, SiteSettingsEntity.getSchema()), options);
   }
 
   /**
@@ -46,7 +39,7 @@ class OrganizationSettingsEntity extends Entity {
    */
   static getDefault() {
     return {
-      status: OrganizationSettingsEntity.ORGANIZATION_ENABLED,
+      status: SiteSettingsEntity.ORGANIZATION_ENABLED,
     };
   }
 
@@ -62,9 +55,9 @@ class OrganizationSettingsEntity extends Entity {
         status: {
           type: "string",
           enum: [
-            OrganizationSettingsEntity.ORGANIZATION_ENABLED,
-            OrganizationSettingsEntity.ORGANIZATION_DISABLED,
-            OrganizationSettingsEntity.ORGANIZATION_NOT_FOUND,
+            SiteSettingsEntity.ORGANIZATION_ENABLED,
+            SiteSettingsEntity.ORGANIZATION_DISABLED,
+            SiteSettingsEntity.ORGANIZATION_NOT_FOUND,
           ],
         },
         app: {
@@ -84,7 +77,7 @@ class OrganizationSettingsEntity extends Entity {
   /**
    * Return a disabled organization settings.
    */
-  static get disabledOrganizationSettings() {
+  static get disabledSiteSettings() {
     return {
       status: this.ORGANIZATION_DISABLED,
     };
@@ -100,7 +93,7 @@ class OrganizationSettingsEntity extends Entity {
   static sanitizeDto(dto) {
     const sanitizedDto = JSON.parse(JSON.stringify(dto));
 
-    OrganizationSettingsEntity.sanitizeEmailValidateRegex(sanitizedDto);
+    SiteSettingsEntity.sanitizeEmailValidateRegex(sanitizedDto);
 
     return sanitizedDto;
   }
@@ -215,7 +208,7 @@ class OrganizationSettingsEntity extends Entity {
    * ==================================================
    */
   /**
-   * OrganizationSettingsEntity.ENTITY_NAME
+   * SiteSettingsEntity.ENTITY_NAME
    * @returns {string}
    */
   static get ENTITY_NAME() {
@@ -223,7 +216,7 @@ class OrganizationSettingsEntity extends Entity {
   }
 
   /**
-   * OrganizationSettingsEntity.ORGANIZATION_ENABLED
+   * SiteSettingsEntity.ORGANIZATION_ENABLED
    * @returns {string}
    */
   static get ORGANIZATION_ENABLED() {
@@ -231,7 +224,7 @@ class OrganizationSettingsEntity extends Entity {
   }
 
   /**
-   * OrganizationSettingsEntity.ORGANIZATION_DISABLED
+   * SiteSettingsEntity.ORGANIZATION_DISABLED
    * @returns {string}
    */
   static get ORGANIZATION_DISABLED() {
@@ -239,7 +232,7 @@ class OrganizationSettingsEntity extends Entity {
   }
 
   /**
-   * OrganizationSettingsEntity.ORGANIZATION_NOT_FOUND
+   * SiteSettingsEntity.ORGANIZATION_NOT_FOUND
    * @returns {string}
    */
   static get ORGANIZATION_NOT_FOUND() {
@@ -247,4 +240,4 @@ class OrganizationSettingsEntity extends Entity {
   }
 }
 
-export default OrganizationSettingsEntity;
+export default SiteSettingsEntity;

package/src/all/background_page/model/entity/{organizationSettings/organizationSettingsEntity.test.data.js → siteSettings/siteSettingsEntity.test.data.js}

@@ -12,11 +12,11 @@
  * @since         3.6.0
  */
 
-import OrganizationSettingsEntity from "./organizationSettingsEntity";
+import SiteSettingsEntity from "./siteSettingsEntity";
 
-export const anonymousOrganizationSettings = (data = {}) => {
+export const anonymousSiteSettings = (data = {}) => {
   const defaultData = {
-    status: OrganizationSettingsEntity.ORGANIZATION_ENABLED,
+    status: SiteSettingsEntity.ORGANIZATION_ENABLED,
     app: {
       url: "http://127.0.0.1:3001",
       locale: "en-UK",
@@ -132,8 +132,8 @@ export const anonymousOrganizationSettings = (data = {}) => {
   return Object.assign(defaultData, data);
 };
 
-export const defaultCeOrganizationSettings = (siteSettings) => {
-  const defaultData = anonymousOrganizationSettings();
+export const defaultCeSiteSettings = (siteSettings) => {
+  const defaultData = anonymousSiteSettings();
   defaultData.app = {
     url: "http://127.0.0.1:3001",
     locale: "en-UK",
@@ -214,8 +214,8 @@ export const defaultCeOrganizationSettings = (siteSettings) => {
   return Object.assign(defaultData, siteSettings);
 };
 
-export const defaultProOrganizationSettings = (siteSettings) => {
-  const defaultData = defaultCeOrganizationSettings();
+export const defaultProSiteSettings = (siteSettings) => {
+  const defaultData = defaultCeSiteSettings();
   defaultData.passbolt.edition = "pro";
   defaultData.passbolt.plugins = Object.assign(defaultData.passbolt.plugins, {
     accountRecoveryRequestHelp: {
@@ -267,8 +267,8 @@ export const defaultProOrganizationSettings = (siteSettings) => {
   return Object.assign(defaultData, siteSettings);
 };
 
-export const customEmailValidationProOrganizationSettings = (siteSettings) => {
-  const defaultData = defaultProOrganizationSettings();
+export const customEmailValidationProSiteSettings = (siteSettings) => {
+  const defaultData = defaultProSiteSettings();
   defaultData.passbolt.email = {
     validate: {
       regex: "\/.*@passbolt.(c|com)$\/",

package/src/all/background_page/model/entity/{organizationSettings/organizationSettingsEntity.test.js → siteSettings/siteSettingsEntity.test.js}

@@ -13,25 +13,22 @@
  */
 
 import EntitySchema from "passbolt-styleguide/src/shared/models/entity/abstract/entitySchema";
-import OrganizationSettingsEntity from "./organizationSettingsEntity";
-import {
-  customEmailValidationProOrganizationSettings,
-  defaultProOrganizationSettings,
-} from "./organizationSettingsEntity.test.data";
+import SiteSettingsEntity from "./siteSettingsEntity";
+import { customEmailValidationProSiteSettings, defaultProSiteSettings } from "./siteSettingsEntity.test.data";
 import * as assertEntityProperty from "passbolt-styleguide/test/assert/assertEntityProperty";
 
-describe("OrganizationSettingsEntity entity", () => {
-  describe("OrganizationSettingsEntity::getSchema", () => {
+describe("SiteSettingsEntity entity", () => {
+  describe("SiteSettingsEntity::getSchema", () => {
     it("schema must validate", () => {
-      EntitySchema.validateSchema(OrganizationSettingsEntity.ENTITY_NAME, OrganizationSettingsEntity.getSchema());
+      EntitySchema.validateSchema(SiteSettingsEntity.ENTITY_NAME, SiteSettingsEntity.getSchema());
     });
 
     it("validates status property", () => {
       const successValues = ["enabled", "disabled", "not found"];
       const failValues = ["string"];
 
-      assertEntityProperty.enumeration(OrganizationSettingsEntity, "status", successValues, failValues);
-      assertEntityProperty.notRequired(OrganizationSettingsEntity, "status");
+      assertEntityProperty.enumeration(SiteSettingsEntity, "status", successValues, failValues);
+      assertEntityProperty.notRequired(SiteSettingsEntity, "status");
     });
 
     it("validates app property", () => {
@@ -42,8 +39,8 @@ describe("OrganizationSettingsEntity entity", () => {
        */
       const failingScenarios = [];
 
-      assertEntityProperty.assert(OrganizationSettingsEntity, "app", successScenarios, failingScenarios, "type");
-      assertEntityProperty.notRequired(OrganizationSettingsEntity, "app");
+      assertEntityProperty.assert(SiteSettingsEntity, "app", successScenarios, failingScenarios, "type");
+      assertEntityProperty.notRequired(SiteSettingsEntity, "app");
     });
 
     it("validates passbolt property", () => {
@@ -54,8 +51,8 @@ describe("OrganizationSettingsEntity entity", () => {
        */
       const failingScenarios = [];
 
-      assertEntityProperty.assert(OrganizationSettingsEntity, "passbolt", successScenarios, failingScenarios, "type");
-      assertEntityProperty.notRequired(OrganizationSettingsEntity, "passbolt");
+      assertEntityProperty.assert(SiteSettingsEntity, "passbolt", successScenarios, failingScenarios, "type");
+      assertEntityProperty.notRequired(SiteSettingsEntity, "passbolt");
     });
 
     it("validates serverTimeDiff property", () => {
@@ -66,52 +63,46 @@ describe("OrganizationSettingsEntity entity", () => {
         assertEntityProperty.SCENARIO_OBJECT,
       ];
 
-      assertEntityProperty.assert(
-        OrganizationSettingsEntity,
-        "serverTimeDiff",
-        successScenarios,
-        failingScenarios,
-        "type",
-      );
-      assertEntityProperty.notRequired(OrganizationSettingsEntity, "serverTimeDiff");
+      assertEntityProperty.assert(SiteSettingsEntity, "serverTimeDiff", successScenarios, failingScenarios, "type");
+      assertEntityProperty.notRequired(SiteSettingsEntity, "serverTimeDiff");
     });
   });
 
-  describe("OrganizationSettingsEntity::constructor", () => {
-    it("Should instantiate an OrganizationSettingsEntity with a minimal DTO", () => {
+  describe("SiteSettingsEntity::constructor", () => {
+    it("Should instantiate an SiteSettingsEntity with a minimal DTO", () => {
       expect.assertions(2);
       const dto = {};
-      expect(() => new OrganizationSettingsEntity(dto)).not.toThrow();
-      expect(new OrganizationSettingsEntity(dto).toDto()).toStrictEqual({
+      expect(() => new SiteSettingsEntity(dto)).not.toThrow();
+      expect(new SiteSettingsEntity(dto).toDto()).toStrictEqual({
         status: "enabled",
       });
     });
 
-    it("Should instantiate an OrganizationSettingsEntity with full DTO", () => {
+    it("Should instantiate an SiteSettingsEntity with full DTO", () => {
       expect.assertions(2);
-      const dto = defaultProOrganizationSettings();
-      expect(() => new OrganizationSettingsEntity(dto)).not.toThrow();
-      expect(new OrganizationSettingsEntity(dto).toDto()).toStrictEqual(dto);
+      const dto = defaultProSiteSettings();
+      expect(() => new SiteSettingsEntity(dto)).not.toThrow();
+      expect(new SiteSettingsEntity(dto).toDto()).toStrictEqual(dto);
     });
   });
 
-  describe("OrganizationSettingsEntity::sanitizeEmailValidateRegex", () => {
+  describe("SiteSettingsEntity::sanitizeEmailValidateRegex", () => {
     it("should sanitize API regex and remove starting and trailing slash", () => {
-      const organizationSettings = customEmailValidationProOrganizationSettings();
-      OrganizationSettingsEntity.sanitizeEmailValidateRegex(organizationSettings);
-      expect(organizationSettings.passbolt.email.validate.regex).toEqual(".*@passbolt.(c|com)$");
+      const siteSettings = customEmailValidationProSiteSettings();
+      SiteSettingsEntity.sanitizeEmailValidateRegex(siteSettings);
+      expect(siteSettings.passbolt.email.validate.regex).toEqual(".*@passbolt.(c|com)$");
     });
   });
 
-  describe("OrganizationSettingsEntity::emailValidateRegex", () => {
+  describe("SiteSettingsEntity::emailValidateRegex", () => {
     it("should return null if undefined", () => {
-      const organizationSettings = defaultProOrganizationSettings();
-      const entity = new OrganizationSettingsEntity(organizationSettings);
+      const siteSettings = defaultProSiteSettings();
+      const entity = new SiteSettingsEntity(siteSettings);
       expect(entity.emailValidateRegex).toBeNull();
     });
     it("should return the customized setting if any", () => {
-      const organizationSettings = customEmailValidationProOrganizationSettings();
-      const entity = new OrganizationSettingsEntity(organizationSettings);
+      const siteSettings = customEmailValidationProSiteSettings();
+      const entity = new SiteSettingsEntity(siteSettings);
       expect(entity.emailValidateRegex).toEqual(".*@passbolt.(c|com)$");
     });
   });

package/src/all/background_page/model/entity/user/userEntity.test.js

@@ -13,12 +13,12 @@
  */
 import BextUserEntity from "./userEntity";
 import AppEmailValidatorService from "../../../service/validator/appEmailValidatorService";
-import OrganizationSettingsModel from "../../organizationSettings/organizationSettingsModel";
-import OrganizationSettingsEntity from "../organizationSettings/organizationSettingsEntity";
-import { customEmailValidationProOrganizationSettings } from "../organizationSettings/organizationSettingsEntity.test.data";
+import SiteSettingsEntity from "passbolt-styleguide/src/shared/models/entity/siteSettings/siteSettingsEntity";
+import { customEmailValidationProSiteSettings } from "passbolt-styleguide/src/shared/models/entity/siteSettings/siteSettingsEntity.test.data";
 import { defaultUserDto } from "passbolt-styleguide/src/shared/models/entity/user/userEntity.test.data";
 import GroupsUsersCollection from "passbolt-styleguide/src/shared/models/entity/groupUser/groupsUsersCollection";
 import * as assertEntityProperty from "passbolt-styleguide/test/assert/assertEntityProperty";
+import SiteSettingsRuntimeCache from "../../../service/siteSettings/siteSettingsRuntimeCache";
 
 describe("BextUserEntity", () => {
   describe("BextUserEntity::getSchema", () => {
@@ -36,8 +36,8 @@ describe("BextUserEntity", () => {
 
     it("validates username with custom validation rule", () => {
       expect.assertions(2);
-      const organizationSettings = customEmailValidationProOrganizationSettings();
-      OrganizationSettingsModel.set(new OrganizationSettingsEntity(organizationSettings));
+      const organizationSettings = customEmailValidationProSiteSettings();
+      SiteSettingsRuntimeCache.set(new SiteSettingsEntity(organizationSettings));
       const dto = defaultUserDto({ username: "ada@passbolt.c" });
       const entity = new BextUserEntity(dto);
       expect(entity.username).toEqual("ada@passbolt.c");
@@ -45,7 +45,7 @@ describe("BextUserEntity", () => {
        * Ensure that the custom formula used to validate the format of the email is dynamic, and can be changed even if the
        * entity schema is cached. This formula might loaded after the schema was cached and could lead to user not valid.
        */
-      OrganizationSettingsModel.flushCache();
+      SiteSettingsRuntimeCache.flushAll();
       expect(() => new BextUserEntity(dto)).toThrowEntityValidationError("username", "custom");
     });
   });

package/src/all/background_page/model/export/resources/resourcesKdbxExporter.js

@@ -14,6 +14,7 @@ import ExternalFolderEntity from "../../entity/folder/external/externalFolderEnt
 import * as kdbxweb from "kdbxweb";
 import { FORMAT_KDBX, FORMAT_KDBX_OTHERS } from "../../entity/export/exportResourcesFileEntity";
 import { ICON_TYPE_KEEPASS_ICON_SET } from "passbolt-styleguide/src/shared/models/entity/resource/metadata/IconEntity";
+import { KDBX_SUPPORTED_FIELDS } from "../../import/resources/resourcesKdbxImportParser";
 
 class ResourcesKdbxExporter {
   /**
@@ -22,11 +23,12 @@ class ResourcesKdbxExporter {
    */
   constructor(exportEntity) {
     this.exportEntity = exportEntity;
+    this.customFieldsConflicts = [];
   }
 
   /**
    * Export
-   * @returns {Promise<void>}
+   * @returns {Promise<Array<{resourceName: string, originalKey: string, newKey: string}>>} The custom fields renamed to avoid conflicting with reserved KeePass field names
    */
   async export() {
     const kdbxDb = await this.createKdbxDb();
@@ -39,6 +41,7 @@ class ResourcesKdbxExporter {
       this.createKdbxEntry(kdbxDb, childExportResource, kdbxDb.getDefaultGroup()),
     );
     this.exportEntity.file = await kdbxDb.save();
+    return this.customFieldsConflicts;
   }
 
   /**
@@ -120,7 +123,9 @@ class ResourcesKdbxExporter {
   }
 
   /**
-   * Set the custom fields according to the kdbx format
+   * Set the custom fields according to the kdbx format.
+   * A custom field whose key collides with a reserved KeePass field (e.g. "Password") or an already set field
+   * is renamed with a post-fix numeration ("Password (1)") to avoid overwriting the reserved field value.
    * @param {kdbxweb.KdbxEntry} kdbxEntry
    * @param {ExternalResourceEntity} externalResourceEntity
    * @returns {void}
@@ -128,11 +133,43 @@ class ResourcesKdbxExporter {
   setCustomFields(kdbxEntry, externalResourceEntity) {
     if (externalResourceEntity.customFields) {
       externalResourceEntity.customFields.items.forEach((customField) => {
-        kdbxEntry.fields.set(customField.key, kdbxweb.ProtectedValue.fromString(customField.value));
+        const key = this.getNonConflictingFieldName(kdbxEntry, customField.key);
+        if (key !== customField.key) {
+          this.customFieldsConflicts.push({
+            resourceName: externalResourceEntity.name,
+            originalKey: customField.key,
+            newKey: key,
+          });
+        }
+        kdbxEntry.fields.set(key, kdbxweb.ProtectedValue.fromString(customField.value));
       });
     }
   }
 
+  /**
+   * Resolve a custom field key to a name that does not conflict with a reserved KeePass field or an already set field.
+   * A name conflicts when it is a reserved field or already present on the entry. The static reserved list is required
+   * because some reserved fields (e.g. "Notes") are set after the custom fields, while already set fields (including
+   * the multi-uri KP2A_URL fields, written before the custom fields) are caught by the entry lookup.
+   * @param {kdbxweb.KdbxEntry} kdbxEntry
+   * @param {string} key The custom field key
+   * @returns {string} The original key, or a numbered variant ("key (1)", "key (2)", ...) when it conflicts
+   */
+  getNonConflictingFieldName(kdbxEntry, key) {
+    const isConflicting = (name) => KDBX_SUPPORTED_FIELDS.includes(name) || kdbxEntry.fields.has(name);
+
+    if (!isConflicting(key)) {
+      return key;
+    }
+    let index = 1;
+    let candidate = `${key} (${index})`;
+    while (isConflicting(candidate)) {
+      index++;
+      candidate = `${key} (${index})`;
+    }
+    return candidate;
+  }
+
   /**
    * Set the URL fields according to the kdbx format
    * @param {kdbxweb.KdbxEntry} kdbxEntry

package/src/all/background_page/model/export/resources/resourcesKdbxExporter.test.js

@@ -21,6 +21,7 @@ import fs from "fs";
 import { defaultTotpDto } from "../../entity/totp/totpDto.test.data";
 import { defaultIconDto } from "passbolt-styleguide/src/shared/models/entity/resource/metadata/iconEntity.test.data";
 import { defaultCustomFieldsCollection } from "passbolt-styleguide/src/shared/models/entity/customField/customFieldsCollection.test.data";
+import { defaultCustomField } from "passbolt-styleguide/src/shared/models/entity/customField/customFieldEntity.test.data";
 
 global.kdbxweb = kdbxweb;
 kdbxweb.CryptoEngine.argon2 = argon2;
@@ -398,4 +399,125 @@ describe("ResourcesKdbxExporter", () => {
     const kdbxCredentials = new kdbxweb.Credentials(null, kdbxweb.ByteUtils.base64ToBytes(exportEntity.keyfile));
     await kdbxweb.Kdbx.load(exportEntity.file, kdbxCredentials);
   });
+
+  describe("custom field name conflicts", () => {
+    async function exportAndLoadFirstEntry(customFields, data = {}) {
+      const exportResource = buildImportResourceDto(1, {
+        name: "GitHub",
+        totp: undefined,
+        uris: [],
+        custom_fields: customFields,
+        ...data,
+      });
+      const exportDto = { format: "kdbx", export_resources: [exportResource], export_folders: [] };
+      const exportEntity = new ExportResourcesFileEntity(exportDto);
+      const exporter = new ResourcesKdbxExporter(exportEntity);
+      const conflicts = await exporter.export();
+      const kdbxDb = await kdbxweb.Kdbx.load(exportEntity.file, new kdbxweb.Credentials(null, null));
+      return { entry: kdbxDb.groups[0].entries[0], conflicts };
+    }
+
+    it("should rename a custom field colliding with the reserved Password field and preserve the real password", async () => {
+      expect.assertions(3);
+      const { entry, conflicts } = await exportAndLoadFirstEntry([
+        defaultCustomField({ metadata_key: "Password", secret_value: "evil-password" }),
+      ]);
+
+      expect(entry.fields.get("Password").getText()).toEqual("Secret 1");
+      expect(entry.fields.get("Password (1)").getText()).toEqual("evil-password");
+      expect(conflicts).toEqual([{ resourceName: "GitHub", originalKey: "Password", newKey: "Password (1)" }]);
+    });
+
+    it("should rename a custom field named Notes even though Notes is written after the custom fields", async () => {
+      expect.assertions(2);
+      const { entry } = await exportAndLoadFirstEntry(
+        [defaultCustomField({ metadata_key: "Notes", secret_value: "evil-notes" })],
+        { description: "real description" },
+      );
+
+      expect(entry.fields.get("Notes")).toEqual("real description");
+      expect(entry.fields.get("Notes (1)").getText()).toEqual("evil-notes");
+    });
+
+    it("should number multiple custom fields colliding with the same reserved field", async () => {
+      expect.assertions(4);
+      const { entry, conflicts } = await exportAndLoadFirstEntry([
+        defaultCustomField({ metadata_key: "Password", secret_value: "v1" }),
+        defaultCustomField({ metadata_key: "Password", secret_value: "v2" }),
+      ]);
+
+      expect(entry.fields.get("Password").getText()).toEqual("Secret 1");
+      expect(entry.fields.get("Password (1)").getText()).toEqual("v1");
+      expect(entry.fields.get("Password (2)").getText()).toEqual("v2");
+      expect(conflicts).toHaveLength(2);
+    });
+
+    it("should not lose data when a custom field is literally named like a renamed field", async () => {
+      expect.assertions(3);
+      const { entry } = await exportAndLoadFirstEntry([
+        defaultCustomField({ metadata_key: "Password", secret_value: "v1" }),
+        defaultCustomField({ metadata_key: "Password (1)", secret_value: "literal" }),
+      ]);
+
+      expect(entry.fields.get("Password").getText()).toEqual("Secret 1");
+      expect(entry.fields.get("Password (1)").getText()).toEqual("v1");
+      expect(entry.fields.get("Password (1) (1)").getText()).toEqual("literal");
+    });
+
+    it("should rename a custom field colliding with the reserved Password field even when no real password is set", async () => {
+      expect.assertions(2);
+      const { entry } = await exportAndLoadFirstEntry(
+        [defaultCustomField({ metadata_key: "Password", secret_value: "value" })],
+        { secret_clear: "" },
+      );
+
+      // The reserved Password slot keeps its default empty value rather than the custom value.
+      const passwordField = entry.fields.get("Password");
+      const passwordValue = typeof passwordField === "string" ? passwordField : passwordField?.getText();
+      expect(passwordValue).not.toEqual("value");
+      expect(entry.fields.get("Password (1)").getText()).toEqual("value");
+    });
+
+    it("should rename a custom field colliding with the multi-uri KP2A_URL field", async () => {
+      expect.assertions(2);
+      const { entry } = await exportAndLoadFirstEntry(
+        [defaultCustomField({ metadata_key: "KP2A_URL", secret_value: "custom-value" })],
+        { uris: ["https://url.com", "https://alt.com"] },
+      );
+
+      expect(entry.fields.get("KP2A_URL")).toEqual("https://alt.com");
+      expect(entry.fields.get("KP2A_URL (1)").getText()).toEqual("custom-value");
+    });
+
+    it("should not rename custom fields that do not conflict and return no conflicts", async () => {
+      expect.assertions(3);
+      const { entry, conflicts } = await exportAndLoadFirstEntry([
+        defaultCustomField({ metadata_key: "Key 0", secret_value: "Value 0" }),
+        defaultCustomField({ metadata_key: "Key 1", secret_value: "Value 1" }),
+      ]);
+
+      expect(entry.fields.get("Key 0").getText()).toEqual("Value 0");
+      expect(entry.fields.get("Key 1").getText()).toEqual("Value 1");
+      expect(conflicts).toEqual([]);
+    });
+
+    it("should rename a custom field colliding with the reserved otp field for other keepass", async () => {
+      expect.assertions(2);
+      const exportResource = buildImportResourceDto(1, {
+        name: "GitHub",
+        uris: [],
+        totp: defaultTotpDto(),
+        custom_fields: [defaultCustomField({ metadata_key: "otp", secret_value: "custom-otp" })],
+      });
+      const exportDto = { format: "kdbx-others", export_resources: [exportResource], export_folders: [] };
+      const exportEntity = new ExportResourcesFileEntity(exportDto);
+      const exporter = new ResourcesKdbxExporter(exportEntity);
+      await exporter.export();
+      const kdbxDb = await kdbxweb.Kdbx.load(exportEntity.file, new kdbxweb.Credentials(null, null));
+      const entry = kdbxDb.groups[0].entries[0];
+
+      expect(entry.fields.get("otp").getText()).toContain("otpauth://");
+      expect(entry.fields.get("otp (1)").getText()).toEqual("custom-otp");
+    });
+  });
 });

package/src/all/background_page/model/import/resources/resourcesKdbxImportParser.js

@@ -21,7 +21,7 @@ import { CUSTOM_FIELD_TYPE } from "passbolt-styleguide/src/shared/models/entity/
 import { v4 as uuidv4 } from "uuid";
 import { RESOURCE_TYPE_VERSION_5 } from "passbolt-styleguide/src/shared/models/entity/metadata/metadataTypesSettingsEntity";
 
-const KDBX_SUPPORTED_FIELDS = [
+export const KDBX_SUPPORTED_FIELDS = [
   "Title",
   "URL",
   "UserName",

package/src/all/background_page/model/locale/localeModel.js

@@ -11,7 +11,7 @@
  * @link          https://www.passbolt.com Passbolt(tm)
  * @since         3.2.0
  */
-import OrganizationSettingsModel from "../organizationSettings/organizationSettingsModel";
+import GetOrFindSiteSettingsService from "../../service/siteSettings/getOrFindSiteSettingsService";
 import AccountSettingsService from "../../service/api/accountSettings/accountSettingsService";
 import { Config } from "../config";
 import i18n from "../../sdk/i18n";
@@ -42,11 +42,14 @@ class LocaleModel {
    * Constructor
    *
    * @param {ApiClientOptions} apiClientOptions
+   * @param {AccountEntity} [account] The account. Required for the organization-locale finders that
+   *   read the site settings; not needed by `updateUserLocale`.
    * @public
    */
-  constructor(apiClientOptions) {
+  constructor(apiClientOptions, account) {
     this.accountSettingsService = new AccountSettingsService(apiClientOptions);
-    this.organizationSettingsModel = new OrganizationSettingsModel(apiClientOptions);
+    this.apiClientOptions = apiClientOptions;
+    this.account = account;
   }
 
   /**
@@ -71,8 +74,9 @@ class LocaleModel {
    * @returns {Promise<LocaleEntity>}
    */
   async getOrganizationLocale() {
-    const organizationSettings = await this.organizationSettingsModel.getOrFind();
-    return this.getSupportedLocale(organizationSettings.locale);
+    const getOrFindSiteSettingsService = new GetOrFindSiteSettingsService(this.account, this.apiClientOptions);
+    const siteSettings = await getOrFindSiteSettingsService.getOrFind(false);
+    return this.getSupportedLocale(siteSettings.locale);
   }
 
   /**
@@ -80,11 +84,12 @@ class LocaleModel {
    * @returns {Promise<LocalesCollection>}
    */
   async getSupportedOrganizationLocales() {
-    const organizationSettings = await this.organizationSettingsModel.getOrFind();
-    const localePluginEnabled = organizationSettings.isPluginEnabled("locale");
+    const getOrFindSiteSettingsService = new GetOrFindSiteSettingsService(this.account, this.apiClientOptions);
+    const siteSettings = await getOrFindSiteSettingsService.getOrFind(false);
+    const localePluginEnabled = siteSettings.isPluginEnabled("locale");
 
     if (localePluginEnabled) {
-      const localePluginSettings = organizationSettings.getPluginSettings("locale");
+      const localePluginSettings = siteSettings.getPluginSettings("locale");
       return new LocalesCollection(localePluginSettings.options || []);
     }
 

package/src/all/background_page/model/passwordExpiry/passwordExpirySettingsModel.js

@@ -15,7 +15,7 @@
 import PasswordExpirySettingsService from "../../service/api/passwordExpiry/passwordExpirySettingsService";
 import { assertType, assertUuid } from "../../utils/assertions";
 import PasswordExpirySettingsEntity from "passbolt-styleguide/src/shared/models/entity/passwordExpiry/passwordExpirySettingsEntity";
-import OrganizationSettingsModel from "../organizationSettings/organizationSettingsModel";
+import GetOrFindSiteSettingsService from "../../service/siteSettings/getOrFindSiteSettingsService";
 import PasswordExpiryProSettingsEntity from "passbolt-styleguide/src/shared/models/entity/passwordExpiryPro/passwordExpiryProSettingsEntity";
 import PasswordExpirySettingsLocalStorage from "../../service/local_storage/passwordExpirySettingsLocalStorage";
 
@@ -30,7 +30,7 @@ class PasswordExpirySettingsModel {
   constructor(account, apiClientOptions) {
     this.passwordExpirySettingsLocalStorage = new PasswordExpirySettingsLocalStorage(account);
     this.passwordExpirySettingsService = new PasswordExpirySettingsService(apiClientOptions);
-    this.organisationSettingsModel = new OrganizationSettingsModel(apiClientOptions);
+    this.getOrFindSiteSettingsService = new GetOrFindSiteSettingsService(account, apiClientOptions);
   }
 
   /**
@@ -68,8 +68,8 @@ class PasswordExpirySettingsModel {
    * @returns {Promise<PasswordExpirySettingsEntity>}
    */
   async save(passwordExpirySettingsEntity) {
-    const organizationSettings = await this.organisationSettingsModel.getOrFind();
-    const isAdvancedSettingsEnable = organizationSettings.isPluginEnabled("passwordExpiryPolicies");
+    const siteSettings = await this.getOrFindSiteSettingsService.getOrFind(false);
+    const isAdvancedSettingsEnable = siteSettings.isPluginEnabled("passwordExpiryPolicies");
     if (!isAdvancedSettingsEnable) {
       assertType(
         passwordExpirySettingsEntity,
@@ -106,8 +106,8 @@ class PasswordExpirySettingsModel {
    * @returns {Promise<PasswordExpirySettingsEntity|PasswordExpiryProSettingsEntity>}
    */
   async createFromDefault(passwordExpirySettingsDto = {}) {
-    const organizationSettings = await this.organisationSettingsModel.getOrFind();
-    const isAdvancedSettingsEnabled = organizationSettings.isPluginEnabled("passwordExpiryPolicies");
+    const siteSettings = await this.getOrFindSiteSettingsService.getOrFind(false);
+    const isAdvancedSettingsEnabled = siteSettings.isPluginEnabled("passwordExpiryPolicies");
     if (!isAdvancedSettingsEnabled) {
       return PasswordExpirySettingsEntity.createFromDefault(passwordExpirySettingsDto);
     }