PackageUrlValidator.cs

using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Waher.Content.Xml;
using Waher.Events;
using Waher.Networking.HTTP;
using Waher.Security;
 
namespace Waher.Service.IoTBroker.Provisioning.SoftwareUpdates
{
    public class PackageUrlValidator : HttpAuthenticationScheme
    {
        public PackageUrlValidator()
        {
        }
 
        public override string DisplayName => "Package URL";
 
        public override string[] GetChallenges(HttpRequest Request)
        {
            return Array.Empty<string>();
        }
 
        public override async Task<IUser> IsAuthenticated(HttpRequest Request)
        {
            string FileName = Request.SubPath;
            if (FileName.StartsWith('/'))
                FileName = FileName[1..];
 
            if (!Request.Header.TryGetQueryParameter("s", out string SignatureStr) ||
                !Request.Header.TryGetQueryParameter("p", out string PublishedStr) ||
                !XML.TryParse(PublishedStr, out DateTime Published))
            {
                Log.Error("Attempting to access package without valid signature or published date.",
                    FileName, Request.RemoteEndPoint);
                return null;
            }
 
            Package Package = await ProvisioningComponent.GetPackage(FileName);
 
            if (Package is null)
            {
                Log.Error("Attempting to access package that does not exist.",
                    FileName, Request.RemoteEndPoint);
                return null;
            }
 
            string Expected = XML.Encode(Package.Published);
            string Requested = XML.Encode(Published);
 
            if (Expected != Requested)
            {
                Log.Error("Attempting to access package with invalid publishing timestamp.",
                    FileName, Request.RemoteEndPoint,
                    new KeyValuePair<string, object>("Expected", Expected),
                    new KeyValuePair<string, object>("Requested", Requested));
 
                return null;
            }
 
            Expected = Package.SignatureBase64Url;
 
            if (string.Compare(Expected, SignatureStr, true) != 0)
            {
                Log.Error("Attempting to access package with invalid signature.",
                    FileName, Request.RemoteEndPoint,
                    new KeyValuePair<string, object>("Expected", Expected),
                    new KeyValuePair<string, object>("Requested", SignatureStr));
 
                return null;
            }
 
            Log.Informational("Access to package authorized.", FileName, Request.RemoteEndPoint);
 
            return new PackageUser(Package);
        }
 
        private class PackageUser : IUser
        {
            private readonly Package package;
 
            public PackageUser(Package Package)
            {
                this.package = Package;
            }
 
            public string UserName => this.package.FileName;
            public string FederatedUserName => this.package.FileName;
            public string FriendlyName => this.package.FileName;
            public string PasswordHash => throw new InvalidOperationException();
            public string PasswordHashType => throw new InvalidOperationException();
 
            public bool HasPrivilege(string Privilege)
            {
                return false;
            }
        }
    }
}