passbolt-styleguide 3.3.3 → 3.4.0-alpha2

package/src/shared/lib/SecretGenerator/PasswordGenerator.js

@@ -0,0 +1,103 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.3.0
+ *
+ * Generate a password following a configuration.
+ * @param configuration The generator configuration
+ */
+
+import {SecretGeneratorComplexity} from "./SecretGeneratorComplexity";
+
+/**
+ * The list of look-alike substitution
+ */
+const charactersToExclude = ["O", "l", "|", "I", "0", "1"];
+
+/**
+ * Returns a number between the given min and max
+ * @param min The minimum number
+ * @param max The maximum number
+ */
+function randomNumberRange(min, max) {
+  const arr = new Uint32Array(1);
+  window.crypto.getRandomValues(arr);
+  const random = arr[0] / (0xffffffff + 1);
+  return Math.floor(random * (max - min + 1)) + min;
+}
+
+/**
+ * Exclude look-alike characters
+ * @param characterArray A given character array
+ * @return {array}
+ */
+function excludeLookAlikeCharacters(characterArray) {
+  if (!characterArray) {
+    return characterArray;
+  }
+
+  const filterExcludedCharacters = (newCharacterArray, character) => {
+    if (!charactersToExclude.includes(character)) {
+      newCharacterArray.push(character);
+    }
+    return newCharacterArray;
+  };
+  return characterArray.reduce(filterExcludedCharacters, []);
+}
+
+/**
+ * Returns a generated password given a generator configuration
+ * @param configuration The generator configuration
+ */
+function generate(configuration) {
+  const mustExcludeLookAlikeCharacters = configuration.default_options.look_alike;
+  let secret = '';
+  let mask = [];
+
+  const availableMasks = configuration.masks.filter(mask => mask.active);
+  const secretLength = configuration.default_options.length;
+
+  const canGenerate = availableMasks.length > 0 &&
+    (secretLength >= configuration.default_options.min_length &&
+      secretLength <=  configuration.default_options.max_length);
+
+  if (canGenerate) {
+    // Build the mask to use to generate a secret.
+    mask = availableMasks.reduce((mask, currentMask) => [...mask, ...currentMask.characters], []);
+    if (mustExcludeLookAlikeCharacters) {
+      mask = excludeLookAlikeCharacters(mask);
+    }
+
+    /*
+     * Generate a password. Try to maximize the entropy of this one by fixing a goal entropy, if not reached keep
+     * the password with the highest entropy. Try maximum 10 times.
+     */
+    let attempt = 0;
+    const goalEntropy = Math.floor(SecretGeneratorComplexity.calculEntropy(secretLength, mask.length));
+    let secretEntropy = 0;
+
+    do {
+      let newSecret = '';
+      for (let i = 0; i < secretLength; i++) {
+        newSecret += mask[randomNumberRange(0, mask.length - 1)];
+      }
+      const newSecretEntropy = SecretGeneratorComplexity.entropyPassword(newSecret);
+      if (newSecretEntropy > secretEntropy) {
+        secret = newSecret;
+        secretEntropy = newSecretEntropy;
+      }
+    } while (secretEntropy < goalEntropy && attempt++ < 10);
+  }
+
+  return secret;
+}
+
+export const PasswordGenerator = {generate};

package/src/shared/lib/SecretGenerator/SecretGenerator.js

@@ -0,0 +1,45 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.3.0
+ */
+import {PasswordGenerator} from "./PasswordGenerator";
+import {PassphraseGenerator} from "./PassphraseGenerator";
+import {SecretGeneratorComplexity} from "./SecretGeneratorComplexity";
+
+export const SecretGenerator = {
+  /**
+   * Generate a secret given a generator configuration
+   * @param configuration A generator configuration
+   * @return {string} A generated secret
+   */
+  generate: configuration => {
+    const {type} = configuration;
+    if (type === 'password') {
+      return PasswordGenerator.generate(configuration);
+    } else if (type === 'passphrase') {
+      return PassphraseGenerator.generate(configuration);
+    }
+  },
+  /**
+   * Calculates the secret entropy
+   * @param secret A secret
+   * @return {Number} The secret entropy
+   */
+  entropy: (secret) => {
+    const {numberWords, separator, isPassphrase} = PassphraseGenerator.detectPassphrase(secret);
+    if (isPassphrase) {
+      return SecretGeneratorComplexity.entropyPassphrase(numberWords, separator);
+    } else {
+      return SecretGeneratorComplexity.entropyPassword(secret);
+    }
+  }
+};

package/src/shared/lib/SecretGenerator/SecretGeneratorComplexity.js

@@ -0,0 +1,190 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.3.0
+ * Secret generator complexity
+ * Entropy calculate following https://generatepasswords.org/how-to-calculate-entropy/
+ */
+
+import PassphraseGeneratorWords from "./PassphraseGeneratorWords";
+import GraphemeSplitter from "grapheme-splitter";
+
+const STRENGTH = [
+  {
+    id: 'not_available',
+    label: 'n/a',
+    strength: 0
+  },
+  {
+    id: 'very-weak',
+    label: 'very weak',
+    strength: 1
+  },
+  {
+    id: 'weak',
+    label: 'weak',
+    strength: 60
+  },
+  {
+    id: 'fair',
+    label: 'fair',
+    strength: 80
+  },
+  {
+    id: 'strong',
+    label: 'strong',
+    strength: 112
+  },
+  {
+    id: 'very-strong',
+    label: 'very strong',
+    strength: 128
+  }
+];
+
+// @todo the tool should use the masks provided by the background page.
+const MASKS = [
+  {
+    "name": "upper",
+    "label": "A-Z",
+    "characters": ["A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z"],
+    "active": true
+  },
+  {
+    "name": "lower",
+    "label": "a-z",
+    "characters": ["a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z"],
+    "active": true
+  },
+  {
+    "name": "digit",
+    "label": "0-9",
+    "characters": ["0", "1", "2", "3", "4", "5", "6", "7", "8", "9"],
+    "active": true
+  },
+  {
+    "name": "special_char1",
+    "label": "# $ % & @ ^ ~",
+    "characters": ["#", "$", "%", "&", "@", "^", "~"],
+    "active": true
+  },
+  {
+    "name": "parenthesis",
+    "label": "{ [ ( | ) ] ] }",
+    "characters": ["{", "(", "[", "|", "]", ")", "}"],
+    "active": true
+  },
+  {
+    "name": "special_char2",
+    "label": ". , : ;",
+    "characters": [".", ",", ":", ";"],
+    "active": true
+  },
+  {
+    "name": "special_char3",
+    "label": "' \" `",
+    "characters": ["'", "\"", "`"],
+    "active": true
+  },
+  {
+    "name": "special_char4",
+    "label": "/ \\ _ -",
+    "characters": ["/", "\\", "_", "-"],
+    "active": true
+  },
+  {
+    "name": "special_char5",
+    "label": "< * + ! ? =",
+    "characters": ["<", "*", "+", "!", "?", "="],
+    "active": true
+  },
+  {
+    "name": "emoji",
+    "label": "😘",
+    // Based on the initial emoticons block (introduce in unicode v6), not updated since 2015 (unicode v8), see https://en.wikipedia.org/wiki/Emoticons_(Unicode_block)
+    "characters": [
+      "😀", "😁", "😂", "😃", "😄", "😅", "😆", "😇", "😈", "😉",
+      "😊", "😋", "😌", "😍", "😎", "😏", "😐", "😑", "😒", "😓",
+      "😔", "😕", "😖", "😗", "😘", "😙", "😚", "😛", "😜", "😝",
+      "😞", "😟", "😠", "😡", "😢", "😣", "😤", "😥", "😦", "😧",
+      "😨", "😩", "😪", "😫", "😬", "😭", "😮", "😯", "😰", "😱",
+      "😲", "😳", "😴", "😵", "😶", "😷", "😸", "😹", "😺", "😻",
+      "😼", "😽", "😾", "😿", "🙀", "🙁", "🙂", "🙃", "🙄", "🙅",
+      "🙆", "🙇", "🙈", "🙉", "🙊", "🙋", "🙌", "🙍", "🙎", "🙏",
+    ],
+  }
+];
+
+const NUMBER_OF_ASCII_CHARACTER = 128;
+const NUMBER_OF_WORD_CASE = 3;
+
+export const SecretGeneratorComplexity = {
+  /**
+   * Calculate a password entropy.
+   * @param {string} password The password
+   * @returns {Number}
+   */
+  entropyPassword: (password = '') => {
+    const splitter = new GraphemeSplitter();
+    const passwordCharacters = splitter.splitGraphemes(password);
+    let maskSize = 0;
+
+    for (const mask of MASKS) {
+      const useMask = passwordCharacters.some(character => mask.characters.includes(character));
+      if (useMask) {
+        maskSize += mask.characters.length;
+      }
+    }
+
+    return calculEntropy(passwordCharacters.length, maskSize);
+  },
+
+  /**
+   * Calculate a passphrase entropy.
+   * @param {integer} numberOfWords The number of words
+   * @param {string} separator The passphrase separator
+   * @returns {Number}
+   */
+  entropyPassphrase: (numberOfWords = 0, separator = '') => {
+    const words = PassphraseGeneratorWords['en-UK'];
+    // determine a constant for separator
+    const maskSize = (separator.length * NUMBER_OF_ASCII_CHARACTER) + words.length + NUMBER_OF_WORD_CASE;
+    return calculEntropy(numberOfWords, maskSize);
+  },
+
+  /**
+   * Get the strength relative to an entropy
+   * @param {number} entropy The entropy
+   * @returns {{strength: number, id: string, label: string}|{strength: number, id: string, label: string}|{strength: number, id: string, label: string}|{strength: number, id: string, label: string}|{strength: number, id: string, label: string}}
+   */
+  strength: (entropy = 0) => {
+    return STRENGTH.reduce((accumulator, item) => {
+      if (!accumulator) {
+        return item;
+      }
+      if (item.strength > accumulator.strength && entropy >= item.strength) {
+        return item;
+      }
+      return accumulator;
+    });
+  },
+  calculEntropy
+};
+
+/**
+ * Calculate the entropy regarding the given primitives.
+ * @param length {int} The number of characters
+ * @param maskSize {int} The number of possibility for each character
+ * @return {int}
+ */
+function calculEntropy(length, maskSize) {
+  return (length && maskSize) ? length * (Math.log(maskSize) / Math.log(2)) : 0;
+}

package/src/shared/lib/SecretGenerator/SecretGeneratorComplexity.test.js

@@ -0,0 +1,95 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2021 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2021 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.3.0
+ */
+import {SecretGeneratorComplexity} from "./SecretGeneratorComplexity";
+
+describe.only("SecretGeneratorComplexity", () => {
+
+    /**
+     * To ensure the test is a bit more relevant, the results to compare with are taken from https://www.omnicalculator.com/other/password-entropy
+     */
+    it("should calculate the right entropy for a given set of length and maskSize", () => {
+        const entropyOf = (length, maskSize) => roundEntropy(SecretGeneratorComplexity.calculEntropy(length, maskSize));
+
+        expect(entropyOf(1,1)).toBe(0);
+        expect(entropyOf(5,16)).toBe(20);
+        expect(entropyOf(10,26)).toBe(47);
+        expect(entropyOf(20,52)).toBe(114.01);
+        expect(entropyOf(50,198)).toBe(381.47);
+    });
+
+    it("should not calculate entropy if one od length or maskSize is 0", () => {
+        const entropyOf = (length, maskSize) => roundEntropy(SecretGeneratorComplexity.calculEntropy(length, maskSize));;
+
+        expect(entropyOf(0, 1)).toBe(0);
+        expect(entropyOf(1, 0)).toBe(0);
+        expect(entropyOf(0, 0)).toBe(0);
+    });
+
+    it("evaluates the right strength based on the given entropy", () => {
+        const strengthOf = (entropy) => SecretGeneratorComplexity.strength(entropy).id;
+
+        expect(strengthOf(0)).toBe("not_available");
+
+        expect(strengthOf(1)).toBe("very-weak");
+        expect(strengthOf(30)).toBe("very-weak");
+
+        expect(strengthOf(60)).toBe("weak");
+        expect(strengthOf(70)).toBe("weak");
+
+        expect(strengthOf(80)).toBe("fair");
+        expect(strengthOf(100)).toBe("fair");
+
+        expect(strengthOf(112)).toBe("strong");
+        expect(strengthOf(120)).toBe("strong");
+
+        expect(strengthOf(128)).toBe("very-strong");
+        expect(strengthOf(256)).toBe("very-strong");
+    });
+
+    it("should compute the right entropy given a password", () => {
+        const passwordsAndEntropy = {
+            "aaaaaa": 28.2,
+            "AAAAAA": 28.2,
+            "111111": 19.93,
+            "((((((": 16.84,
+            "#$%&@^~": 19.65,
+            ".,:;": 8,
+            "<*+!?=": 15.51,
+            "aaaAAA1111": 59.54,
+            "🇫🇷": 0, // A char which doesn't match the known masks.
+            "😸😸😸😸😸😸😸😸": 50.58,
+            "😸😸😸😸😸😸😸🇫🇷": 50.58,
+            "aA1(~:<😸": 59,
+        };
+
+        for (let password in passwordsAndEntropy) {
+            let roundedEntropy = roundEntropy(SecretGeneratorComplexity.entropyPassword(password));
+            expect(roundedEntropy).toBe(passwordsAndEntropy[password]);
+        }
+    });
+
+    it("should compute the right entropy given a passphrase", () => {
+        const entropyOf = (wordCount, spacing) => roundEntropy(SecretGeneratorComplexity.entropyPassphrase(wordCount, spacing));
+        //Currently, the tests are written considering that there are 7776 words in the dictionnary and 3 word cases
+
+        expect(entropyOf(5, "")).toBe(64.63);
+        expect(entropyOf(5, "  ")).toBe(64.86);
+        expect(entropyOf(10, "")).toBe(129.25);
+        expect(entropyOf(10, "  ")).toBe(129.72);
+    });
+});
+
+function roundEntropy(entropy) {
+    return Math.round(entropy * 100) / 100;
+}

package/src/shared/lib/Settings/SiteSettings.js

@@ -167,6 +167,14 @@ export default class SiteSettings {
     return supportedLocales || SiteSettings.DEFAULT_SUPPORTED_LOCALES;
   }
 
+  /**
+   * Get the generator configuration
+   * @return {*}
+   */
+  get generatorConfiguration() {
+    return getPropValue(this.settings, "passbolt.plugins.generator.configuration");
+  }
+
   /**
    * Get the default supported locales.
    * @type {array<object>}

package/src/shared/lib/apiClient/apiClient.test.js

@@ -81,7 +81,7 @@ describe("Integration test with real fetch", () => {
       await testClient.findAll();
       expect(true).toBeFalsy();
     } catch (error) {
-      expect(error.data.code).toBe(403);
+      expect(error.data.code).toBe(401);
       /*
        * TODO find out why we can't use:
        *   expect(error).toBeInstanceOf(PassboltApiFetchError)

package/.babelrc

@@ -1,11 +0,0 @@
-{
-  "presets": [
-    "@babel/env",
-    "@babel/preset-react"
-  ],
-  "plugins": [
-    ["@babel/plugin-transform-runtime", {
-      "regenerator": true
-    }],
-  ]
-}

package/.editorconfig

@@ -1,13 +0,0 @@
-; This file is for unifying the coding style for different editors and IDEs.
-; More information at http://editorconfig.org
-
-root = true
-
-[*]
-indent_style = space
-end_of_line = lf
-insert_final_newline = false
-trim_trailing_whitespace = true
-
-[*.js]
-indent_size = 2

package/.eslintrc.json

@@ -1,197 +0,0 @@
-{
-  "parserOptions": {
-    "ecmaVersion": 2018,
-    "sourceType": "module",
-    "ecmaFeatures": {
-      "jsx": true
-    }
-  },
-  "extends": [
-    "eslint:recommended",
-    "plugin:react/recommended"
-  ],
-  "plugins": [
-    "jest",
-    "no-unsanitized"
-  ],
-  "env": {
-    "browser": true,
-    "es6": true,
-    "amd": true,
-    "jquery": true,
-    "webextensions": true,
-    "jest": true
-  },
-  "globals": {
-    "global": true,
-    "__": true,
-    "secretComplexity": true,
-    "port": true
-  },
-  "rules": {
-    "strict": [
-      "error",
-      "never"
-    ],
-    /* possible errors */
-    "no-console": 0,
-    "no-empty": [
-      "error",
-      {
-        "allowEmptyCatch": true
-      }
-    ],
-    // disallow empty block statements
-    /* best practices */
-    "curly": 2,
-    // enforce consistent brace style for all control statements
-    "no-eval": 2,
-    // disallow the use of eval()
-    "no-extend-native": 2,
-    // disallow extending native types
-    "no-global-assign": 2,
-    // disallow assignments to native objects or read-only global variables
-    "no-implicit-coercion": 2,
-    // disallow shorthand type conversions
-    "no-implicit-globals": 2,
-    // disallow var and named function declarations in the global scope
-    "no-implied-eval": 2,
-    // disallow the use of eval()-like methods
-    "no-lone-blocks": 2,
-    // disallow unnecessary nested blocks
-    "no-useless-escape": 0,
-    // disallow unnecessary escape characters
-    /* Stylistic Issues */
-    "array-bracket-spacing": 1,
-    // enforce consistent spacing inside array brackets
-    "block-spacing": 1,
-    // enforce consistent spacing inside single-line blocks
-    "brace-style": [
-      "warn",
-      "1tbs",
-      {
-        "allowSingleLine": true
-      }
-    ],
-    // enforce consistent brace style for blocks
-    "comma-spacing": 1,
-    // enforce consistent spacing before and after commas
-    "computed-property-spacing": 1,
-    // enforce consistent spacing inside computed property brackets
-    "eol-last": 1,
-    // enforce at least one newline at the end of files
-    "func-call-spacing": 1,
-    // enforce consistent indentation
-    "key-spacing": [
-      "warn",
-      {
-        "mode": "minimum"
-      }
-    ],
-    // enforce consistent spacing before and after keywords
-    "keyword-spacing": 1,
-    // enforce consistent spacing between keys and values in object literal properties
-    "linebreak-style": 1,
-    // enforce consistent linebreak style
-    "no-trailing-spaces": 1,
-    // disallow trailing whitespace at the end of lines
-    "no-var": 1,
-    // require let or const instead of var
-    "object-curly-spacing": [
-      "warn",
-      "never"
-    ],
-    // enforce variables to be declared either together or separately in functions
-    "padded-blocks": [
-      "warn",
-      "never"
-    ],
-    // require or disallow padding within blocks
-    "semi": [
-      "warn",
-      "always"
-    ],
-    // require or disallow semicolons instead of ASI
-    "semi-spacing": 1,
-    // enforce consistent spacing before and after semicolons
-    "space-before-blocks": 1,
-    // enforce consistent spacing before blocks
-    "space-before-function-paren": [
-      "warn",
-      "never"
-    ],
-    // enforce consistent spacing before function definition opening parenthesis
-    "space-in-parens": [
-      "warn",
-      "never"
-    ],
-    // enforce consistent spacing inside parentheses
-    "space-infix-ops": 1,
-    // require spacing around operators
-    /* ES6 */
-    "arrow-body-style": [
-      "warn",
-      "as-needed"
-    ],
-    // require braces around arrow function bodies
-    "arrow-parens": [
-      "warn",
-      "as-needed"
-    ],
-    // require parentheses around arrow function arguments
-    "arrow-spacing": 1,
-    // enforce consistent spacing before and after the arrow in arrow functions
-    "no-useless-constructor": 1,
-    // disallow unnecessary constructors
-    //"object-shorthand": ["warn", "always", {"avoidQuotes": true}], // require or disallow method and property shorthand syntax for object literals
-    "prefer-arrow-callback": [
-      "warn",
-      {
-        "allowNamedFunctions": true
-      }
-    ],
-    // require const declarations for variables that are never reassigned after declared
-    "prefer-template": 1,
-    // require template literals instead of string concatenation
-    "template-curly-spacing": [
-      "warn",
-      "never"
-    ],
-    // require or disallow spacing around embedded expressions of template strings
-    /* PASSBOLT EXTENDED RULES */
-    "prefer-const": [
-      "error"
-    ],
-    "func-names": [
-      "error",
-      "never"
-    ],
-    "multiline-comment-style": [
-      "error",
-      "starred-block"
-    ],
-    // enforce multiple comment block line to follow indentation
-    "one-var": [
-      "error",
-      {
-        "initialized": "never",
-        "uninitialized": "always"
-      }
-    ],
-    // enforce variables to be declared either together or separately in functions
-    "indent": [
-      "warn",
-      2,
-      {
-        "MemberExpression": 1,
-        "SwitchCase": 1
-      }
-    ],
-    // enforce consistent indentation
-    "react/display-name": [0], // Off
-    // The display-name rule is only used for dev consideration and ease the debugging, no prod quality check
-    // Mozilla unsanitized rules
-    "no-unsanitized/method": "error",
-    "no-unsanitized/property": "error"
-  }
-}