AddNote.cs

using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using System.Xml;
using Waher.Networking.HTTP;
using Waher.Networking.HTTP.Authentication;
using Waher.Persistence;
using Waher.Security;
using Waher.Security.Users;
using Waher.Service.IoTBroker.Legal.Contracts;
using Waher.Service.IoTBroker.NeuroFeatures.Events;
using Waher.Service.IoTBroker.StateMachines;
 
namespace Waher.Service.IoTBroker.NeuroFeatures.WebServices
{
    public class AddNote : HttpSynchronousResource, IHttpPostMethod
    {
        private static readonly HttpAuthenticationScheme[] authenticationSchemes = new HttpAuthenticationScheme[]
        {
            new MutualTlsAuthentication(128, Users.Source)
        };
 
        public AddNote()
            : base("/AddNote")
        {
        }
 
        public override bool HandlesSubPaths => true;
        public override bool UserSessions => true;
        public bool AllowsPOST => true;
 
        public override HttpAuthenticationScheme[] GetAuthenticationSchemes(HttpRequest Request) => authenticationSchemes;
 
        public async Task POST(HttpRequest Request, HttpResponse Response)
        {
            IUser User = Request.User
                ?? throw new ForbiddenException("Unauthorized access prohibited: No user authenticated");
 
            if (string.IsNullOrEmpty(Request.SubPath))
                throw new BadRequestException("Missing Token ID.");
 
            string TokenId = Request.SubPath.Substring(1);
            int i = TokenId.IndexOf('@');
            if (i < 0 || !Guid.TryParse(TokenId.Substring(0, i), out _))
                throw new BadRequestException("Invalid Token ID.");
 
            Token Token = await NeuroFeaturesProcessor.GetToken(TokenId, true)
                ?? throw new NotFoundException("Token '" + TokenId + "' not found on this neuron.");
 
            if (!Request.HasData)
                throw new BadRequestException("Missing content.");
 
            object Obj = await Request.DecodeDataAsync();
            if (Obj is string TextNote)
            {
                if (!User.HasPrivilege("NeuroFeatures.Notes.Add.Text"))
                    throw new ForbiddenException("Missing privileges to add token text notes.");
 
                ExternalNoteText Event = new ExternalNoteText()
                {
                    ArchiveOptional = Token.ArchiveOptional,
                    ArchiveRequired = Token.ArchiveRequired,
                    Expires = Token.Expires,
                    Note = TextNote,
                    Source = User.UserName,
                    Timestamp = DateTime.UtcNow,
                    TokenId = Token.TokenId
                };
 
                await Database.Insert(Event);
                await StateMachineProcessor.EventGenerated(Token, Event);
            }
            else if (Obj is XmlDocument XmlNote)
            {
                if (!User.HasPrivilege("NeuroFeatures.Notes.Add.XML"))
                    throw new ForbiddenException("Missing privileges to add token XML notes.");
 
                if (XmlNote.DocumentElement is null)
                    throw new BadRequestException("Empty XML not permitted.");
 
                if (string.IsNullOrEmpty(XmlNote.DocumentElement.NamespaceURI))
                    throw new BadRequestException("XML namespace requried.");
 
                AssertXmlSafe(XmlNote);
 
                (string, Dictionary<string, ValidationSchema>) P = await XmppServerModule.Legal.ValidateContent(XmlNote);
                if (!string.IsNullOrEmpty(P.Item1))
                    throw new BadRequestException(P.Item1);
 
                ExternalNoteXml Event = new ExternalNoteXml()
                {
                    ArchiveOptional = Token.ArchiveOptional,
                    ArchiveRequired = Token.ArchiveRequired,
                    Expires = Token.Expires,
                    Note = XmlNote.DocumentElement.OuterXml,
                    LocalName = XmlNote.DocumentElement.LocalName,
                    Namespace = XmlNote.DocumentElement.NamespaceURI,
                    Source = User.UserName,
                    Timestamp = DateTime.UtcNow,
                    TokenId = Token.TokenId
                };
 
                await Database.Insert(Event);
                await StateMachineProcessor.EventGenerated(Token, Event);
            }
            else
                throw new UnsupportedMediaTypeException("External notes on tokens must be plain text or XML.");
        }
 
        private static void AssertXmlSafe(XmlNode Xml)
        {
            if (Xml is XmlProcessingInstruction)
                throw new BadRequestException("XML Processing instructions not allowed.");
 
            if (Xml.HasChildNodes)
            {
                foreach (XmlNode N in Xml.ChildNodes)
                    AssertXmlSafe(N);
            }
        }
    }
}