AddNote.cs

using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using System.Xml;
using Waher.Content;
using Waher.Networking.HTTP;
using Waher.Networking.HTTP.Authentication;
using Waher.Persistence;
using Waher.Security;
using Waher.Security.Users;
using Waher.Service.IoTBroker.Legal.Contracts;
using Waher.Service.IoTBroker.NeuroFeatures.Events;
using Waher.Service.IoTBroker.StateMachines;
 
namespace Waher.Service.IoTBroker.NeuroFeatures.WebServices
{
    public class AddNote : HttpSynchronousResource, IHttpPostMethod
    {
        private static readonly HttpAuthenticationScheme[] authenticationSchemes = new HttpAuthenticationScheme[]
        {
            new MutualTlsAuthentication(128, Users.Source)
        };
 
        public AddNote()
            : base("/AddNote")
        {
        }
 
        public override bool HandlesSubPaths => true;
 
        public override bool UserSessions => true;
 
        public bool AllowsPOST => true;
 
        public override HttpAuthenticationScheme[] GetAuthenticationSchemes(HttpRequest Request)
        {
            return authenticationSchemes;
        }
 
        public async Task POST(HttpRequest Request, HttpResponse Response)
        {
            IUser User = Request.User;
            if (User is null)
            {
                await Response.SendResponse(new ForbiddenException(Request, "Unauthorized access prohibited: No user authenticated"));
                return;
            }
 
            if (string.IsNullOrEmpty(Request.SubPath))
            {
                await Response.SendResponse(new BadRequestException("Missing Token ID."));
                return;
            }
 
            string TokenId = Request.SubPath[1..];
            int i = TokenId.IndexOf('@');
            if (i < 0 || !Guid.TryParse(TokenId[..i], out _))
            {
                await Response.SendResponse(new BadRequestException("Invalid Token ID."));
                return;
            }
 
            Token Token = await NeuroFeaturesProcessor.GetToken(TokenId, true);
            if (Token is null)
            {
                await Response.SendResponse(new NotFoundException("Token '" + TokenId + "' not found on this neuron."));
                return;
            }
 
            if (!Request.HasData)
            {
                await Response.SendResponse(new BadRequestException("Missing content."));
                return;
            }
 
            ContentResponse Content = await Request.DecodeDataAsync();
            if (Content.HasError)
            {
                await Response.SendResponse(Content.Error);
                return;
            }
 
            if (Content.Decoded is string TextNote)
            {
                if (!User.HasPrivilege("NeuroFeatures.Notes.Add.Text"))
                {
                    await Response.SendResponse(new ForbiddenException(Request, "Missing privileges to add token text notes."));
                    return;
                }
 
                ExternalNoteText Event = new ExternalNoteText()
                {
                    ArchiveOptional = Token.ArchiveOptional,
                    ArchiveRequired = Token.ArchiveRequired,
                    Expires = Token.Expires,
                    Note = TextNote,
                    Source = User.UserName,
                    Timestamp = DateTime.UtcNow,
                    TokenId = Token.TokenId
                };
 
                await Database.Insert(Event);
                await StateMachineProcessor.EventGenerated(Token, Event);
            }
            else if (Content.Decoded is XmlDocument XmlNote)
            {
                if (!User.HasPrivilege("NeuroFeatures.Notes.Add.XML"))
                {
                    await Response.SendResponse(new ForbiddenException(Request, "Missing privileges to add token XML notes."));
                    return;
                }
 
                if (XmlNote.DocumentElement is null)
                {
                    await Response.SendResponse(new BadRequestException("Empty XML not permitted."));
                    return;
                }
 
                if (string.IsNullOrEmpty(XmlNote.DocumentElement.NamespaceURI))
                {
                    await Response.SendResponse(new BadRequestException("XML namespace requried."));
                    return;
                }
 
                AssertXmlSafe(XmlNote);
 
                (string, Dictionary<string, ValidationSchema>) P = await XmppServerModule.Legal.ValidateContent(XmlNote, null);
                if (!string.IsNullOrEmpty(P.Item1))
                {
                    await Response.SendResponse(new BadRequestException(P.Item1));
                    return;
                }
 
                ExternalNoteXml Event = new ExternalNoteXml()
                {
                    ArchiveOptional = Token.ArchiveOptional,
                    ArchiveRequired = Token.ArchiveRequired,
                    Expires = Token.Expires,
                    Note = XmlNote.DocumentElement.OuterXml,
                    LocalName = XmlNote.DocumentElement.LocalName,
                    Namespace = XmlNote.DocumentElement.NamespaceURI,
                    Source = User.UserName,
                    Timestamp = DateTime.UtcNow,
                    TokenId = Token.TokenId
                };
 
                await Database.Insert(Event);
                await StateMachineProcessor.EventGenerated(Token, Event);
            }
            else
            {
                await Response.SendResponse(new UnsupportedMediaTypeException("External notes on tokens must be plain text or XML."));
                return;
            }
        }
 
        private static void AssertXmlSafe(XmlNode Xml)
        {
            if (Xml is XmlProcessingInstruction)
                new BadRequestException("XML Processing instructions not allowed.");
 
            if (Xml.HasChildNodes)
            {
                foreach (XmlNode N in Xml.ChildNodes)
                    AssertXmlSafe(N);
            }
        }
    }
}