HttpModule.cs

using System;
using System.Collections.Generic;
using System.Security.Cryptography.X509Certificates;
using System.Threading.Tasks;
using Waher.Events;
using Waher.Networking;
using Waher.Networking.HTTP;
using Waher.Networking.HTTP.Authentication;
using Waher.Runtime.Inventory;
using Waher.Runtime.Language;
using Waher.Runtime.Timing;
using Waher.Security;
using Waher.Security.Authorization;
using Waher.Security.JWT;
using Waher.Security.Users;
using Waher.Things.Metering;
 
namespace Waher.Things.Http
{
    [Singleton]
    [ModuleDependency("Waher.Service.IoTBroker.XmppServerModule")]  // For JWT factory, if available.
    public class HttpModule : IModule, ITlsCertificateEndpoint, IAuthorization<HttpRequest>
    {
        internal const string PostPrivileges = "Admin.SensorData.Post";
 
        private static HttpServer webServer;
        private static SensorDataReceptorResource api;
        private static LocalWebServerNode localWebServerNode;
        private static X509Certificate certificate;
        private static Scheduler scheduler;
        private static string rootFolder;
 
        public Task Start()
        {
            try
            {
                if (!Types.TryGetModuleParameter("HTTP", out object Obj) ||
                    !(Obj is HttpServer WebServer))
                {
                    Log.Error("Local Web Server not found.");
                    return Task.CompletedTask;
                }
 
                webServer = WebServer;
 
                if (!Types.TryGetModuleParameter("Root", out Obj) ||
                    !(Obj is string RootFolder))
                {
                    Log.Warning("Root folder not defined.");
                    rootFolder = null;
                }
                else
                    rootFolder = RootFolder;
 
                if (!Types.TryGetModuleParameter("Scheduler", out Obj) ||
                    !(Obj is Scheduler Scheduler))
                {
                    Log.Warning("Scheduler not available.");
                    scheduler = null;
                }
                else
                    scheduler = Scheduler;
 
                HttpAuthenticationScheme[] Schemes = GetAuthenticationSchemes(this);
 
                api = new SensorDataReceptorResource("/ReportSensorData", Schemes);
                webServer.Register(api);
            }
            catch (Exception ex)
            {
                Log.Exception(ex);
            }
 
            return Task.CompletedTask;
        }
 
        public bool IsAuthorized(HttpRequest Request, IHasPrivileges User)
        {
            string Privilege;
 
            if (string.IsNullOrEmpty(Request.SubPath))
                Privilege = PostPrivileges;
            else
                Privilege = PostPrivileges + Request.SubPath.Replace('/', '.');
 
            return User.HasPrivilege(Privilege);
        }
 
        public static HttpAuthenticationScheme[] GetAuthenticationSchemes()
        {
            return GetAuthenticationSchemes(Array.Empty<string>());
        }
 
        public static HttpAuthenticationScheme[] GetAuthenticationSchemes(string RequiredPrivilege)
        {
            return GetAuthenticationSchemes(new SinglePrivilege<HttpRequest>(RequiredPrivilege));
        }
 
        public static HttpAuthenticationScheme[] GetAuthenticationSchemes(params string[] RequiredPrivileges)
        {
            if ((RequiredPrivileges?.Length ?? 0) == 0)
                return GetAuthenticationSchemes((IAuthorization<HttpRequest>)null);
            else
                return GetAuthenticationSchemes(Networking.HTTP.Authentication.RequiredPrivileges.GetAuthorization(RequiredPrivileges));
        }
 
        public static HttpAuthenticationScheme[] GetAuthenticationSchemes(IAuthorization<HttpRequest> Authorization)
        {
            return GetAuthenticationSchemes(null, Authorization);
        }
 
        public static HttpAuthenticationScheme[] GetAuthenticationSchemes(Uri ResourceMetaData)
        {
            return GetAuthenticationSchemes(ResourceMetaData, Array.Empty<string>());
        }
 
        public static HttpAuthenticationScheme[] GetAuthenticationSchemes(
            Uri ResourceMetaData, string RequiredPrivilege)
        {
            return GetAuthenticationSchemes(ResourceMetaData, 
                new SinglePrivilege<HttpRequest>(RequiredPrivilege));
        }
 
        public static HttpAuthenticationScheme[] GetAuthenticationSchemes(
            Uri ResourceMetaData, params string[] RequiredPrivileges)
        {
            if ((RequiredPrivileges?.Length ?? 0) == 0)
                return GetAuthenticationSchemes(ResourceMetaData, (IAuthorization<HttpRequest>)null);
            else
            {
                return GetAuthenticationSchemes(ResourceMetaData,
                    Networking.HTTP.Authentication.RequiredPrivileges.GetAuthorization(RequiredPrivileges));
            }
        }
 
        public static void GetDomainParameters(out string Domain, out int MinStrength,
            out bool Encrypted)
        {
            if (!Types.TryGetModuleParameter("X509", out object Obj) ||
                !(Obj is X509Certificate Certificate))
            {
                if (Types.TryGetModuleParameter("Realm", out Obj) &&
                    Obj is string Realm)
                {
                    Domain = Realm;
                }
                else
                    Domain = null;
 
                Encrypted = false;
                MinStrength = 0;
            }
            else
            {
                certificate = Certificate;
                Domain = BinaryTcpClient.GetDomainFromSubject(Certificate.Subject);
                Encrypted = Domain != "localhost";
                MinStrength = 128;
            }
        }
 
        public static HttpAuthenticationScheme[] GetAuthenticationSchemes(
            Uri ResourceMetaData, IAuthorization<HttpRequest> Authorization)
        {
            List<HttpAuthenticationScheme> Schemes = new List<HttpAuthenticationScheme>();
 
            GetDomainParameters(out string Domain, out int MinStrength, out bool Encrypted);
 
            if (!Types.TryGetModuleParameter("Users", out IUserSource UserSource))
                UserSource = Users.Source; // Default users source
 
            if (Types.TryGetModuleParameter("JWT", out JwtFactory JwtFactory) &&
                !JwtFactory.Disposed)
            {
                Schemes.Add(new JwtAuthentication(Encrypted, MinStrength, Domain,
                    UserSource, JwtFactory, ResourceMetaData));   
 
                // Any JWT token generated by the server will suffice. Does not have to point to a
                // registered user.
            }
 
            webServer ??= Types.TryGetModuleParameter<HttpServer>("HTTP");
 
            if (!(webServer is null) && webServer.ClientCertificates != ClientCertificates.NotUsed)
                Schemes.Add(new MutualTlsAuthentication(UserSource));
 
            Schemes.Add(new BasicAuthentication(Encrypted, MinStrength, Domain, UserSource));
            Schemes.Add(new DigestAuthentication(Encrypted, MinStrength, DigestAlgorithm.MD5, Domain, UserSource));
            Schemes.Add(new DigestAuthentication(Encrypted, MinStrength, DigestAlgorithm.SHA256, Domain, UserSource));
            Schemes.Add(new DigestAuthentication(Encrypted, MinStrength, DigestAlgorithm.SHA3_256, Domain, UserSource));
 
            if (!(webServer is null))
                Schemes.Add(new SessionAuthentication(webServer));
 
            if (Authorization is null)
                return Schemes.ToArray();
            else
            {
                return new HttpAuthenticationScheme[]
                {
                    new RequiredPrivileges(Schemes.ToArray(), Authorization)
                };
            }
        }
 
        public static async Task CheckLocalWebServerNode()
        {
            foreach (INode Node in await MeteringTopology.Root.ChildNodes)
            {
                if (Node is LocalWebServerNode LocalWebServerNode)
                {
                    localWebServerNode = LocalWebServerNode;
                    break;
                }
            }
 
            if (localWebServerNode is null)
            {
                localWebServerNode = new LocalWebServerNode()
                {
                    NodeId = await (await Translator.GetDefaultLanguageAsync()).GetStringAsync(typeof(LocalWebServerNode), 1, "Local Web Server")
                };
 
                await MeteringTopology.Root.AddAsync(localWebServerNode);
            }
        }
 
        public Task Stop()
        {
            if (!(webServer is null) && !(api is null))
            {
                webServer.Unregister(api);
                webServer = null;
                api = null;
            }
 
            return Task.CompletedTask;
        }
 
        public void UpdateCertificate(X509Certificate Certificate)
        {
            certificate = Certificate;
        }
 
        internal static X509Certificate Certificate => certificate;
 
        internal static string RootFolder => rootFolder;
 
        internal static HttpServer WebServer => webServer;
 
        internal static Scheduler Scheduler => scheduler;
 
        internal static LocalWebServerNode LocalWebServerNode => localWebServerNode;
    }
}