Transfer.cs

using System;
using System.Collections.Generic;
using System.Net;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using System.Xml;
using Waher.Content;
using Waher.Content.Xml;
using Waher.Events;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Networking.XMPP;
using Waher.Networking.XMPP.P2P.E2E;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.Inventory;
using Waher.Runtime.IO;
using Waher.Script;
using Waher.Script.Abstraction.Elements;
using Waher.Script.Cryptography.Functions.Encryption;
using Waher.Security;
using Waher.Security.JWT;
using Waher.Service.IoTBroker.DataStorage;
using Waher.Service.IoTBroker.Legal;
using Waher.Service.IoTBroker.Legal.Identity;
using Waher.Service.IoTBroker.WebServices.Agent.Crypto;
using Waher.Service.IoTBroker.WebServices.Agent.Legal;
 
namespace Waher.Service.IoTBroker.WebServices.Agent.Account
{
    public class Transfer : AgentPostResource
    {
        public Transfer()
            : base("Account/Transfer",
                new KeyValuePair<Type, Expression>(typeof(Dictionary<string, object>), new Expression(jsonPattern)),
                new KeyValuePair<Type, Expression>(typeof(XmlDocument), new Expression(xmlPattern)))
        {
        }
 
        private static readonly string jsonPattern = Resources.LoadResourceAsText(typeof(Transfer).Namespace + ".JSON.Transfer.req");
        private static readonly string xmlPattern = Resources.LoadResourceAsText(typeof(Transfer).Namespace + ".XML.Transfer.req");
 
        public override async Task POST(HttpRequest Request, HttpResponse Response, Dictionary<string, IElement> Parameters)
        {
            AccountUser User = AssertUserAuthenticated(Request);
 
            string Token = JwtAuthentication.GetAccessToken(Request);
            string KeyId = (string)Parameters["PKeyId"]?.AssociatedObjectValue;
            string Nonce = (string)Parameters["PNonce"].AssociatedObjectValue;
            string KeySignature = (string)Parameters["PKeySignature"]?.AssociatedObjectValue;
            string RequestSignature = (string)Parameters["PRequestSignature"].AssociatedObjectValue;
            string Pin = (string)Parameters["PPin"]?.AssociatedObjectValue;
            string BareJid = User.UserName + "@" + Gateway.Domain;
            StringBuilder sb = new StringBuilder();
            AgentKey AgentKey;
 
            if (string.IsNullOrEmpty(Nonce) || Nonce.Length < 32)
                throw new ForbiddenException(Request, "Nonce too short.");
 
            if (string.IsNullOrEmpty(KeyId))
            {
                if (!string.IsNullOrEmpty(KeySignature))
                    throw new BadRequestException("No Key ID provided");
 
                AgentKey = null;
            }
            else
            {
                AgentKey = await Database.FindFirstDeleteRest<AgentKey>(new FilterAnd(
                    new FilterFieldEqualTo("Account", User.UserName),
                    new FilterFieldEqualTo("Id", KeyId)))
                    ?? throw new NotFoundException("Key not found.");
            }
 
            sb.Append(User.UserName);
            sb.Append(':');
            sb.Append(Request.Header.Host.Value);
            sb.Append(':');
            sb.Append(AgentKey?.LocalName ?? string.Empty);
            sb.Append(':');
            sb.Append(AgentKey?.Namespace ?? string.Empty);
            sb.Append(':');
            sb.Append(KeyId);
 
            //string s1 = sb.ToString();
 
            sb.Append(':');
            sb.Append(KeySignature);
 
            string s2 = sb.ToString();
 
            sb.Append(':');
            sb.Append(Nonce);
            sb.Append(':');
            sb.Append(Pin);
 
            string s3 = sb.ToString();
 
            string s = Convert.ToBase64String(
                Hashes.ComputeHMACSHA256Hash(
                    Encoding.UTF8.GetBytes(User.Account.Password),
                    Encoding.UTF8.GetBytes(s3)));
 
            if (s != RequestSignature)
            {
                string Msg = "Request Signature invalid.";
                throw new ForbiddenException(Request, Msg);
            }
 
            if (await Gateway.HasNonceBeenUsed(Nonce))
            {
                string Msg = "Nonce value has already been used.";
                throw new ForbiddenException(Request, Msg);
            }
 
            await Gateway.RegisterNonceValue(Nonce);
 
            DateTime TP;
 
            if (!(Gateway.LoginAuditor is null))
            {
                DateTime? Next = await Gateway.LoginAuditor.GetEarliestLoginOpportunity(BareJid, "XMPP");
 
                if (Next.HasValue)
                {
                    sb.Clear();
 
                    TP = Next.Value;
                    DateTime Today = DateTime.Today;
 
                    if (Next.Value == DateTime.MaxValue)
                    {
                        sb.Append("This endpoint (");
                        sb.Append(BareJid);
                        sb.Append(") has been blocked from the system.");
                    }
                    else
                    {
                        sb.Append("Too many failed identity applications in a row registered. Try again after ");
                        sb.Append(TP.ToLongTimeString());
 
                        if (TP.Date != Today)
                        {
                            if (TP.Date == Today.AddDays(1))
                                sb.Append(" tomorrow");
                            else
                            {
                                sb.Append(", ");
                                sb.Append(TP.ToShortDateString());
                            }
                        }
 
                        sb.Append(". Remote Endpoint: ");
                        sb.Append(BareJid);
                    }
 
                    throw new TooManyRequestsException(sb.ToString());
                }
            }
 
            sb.Clear();
            sb.Append("<Transfer xmlns=\"");
            sb.Append(Networking.XMPP.Contracts.ContractsClient.NamespaceOnboarding);
            sb.Append("\">");
 
            if (!(AgentKey is null))
            {
                EllipticCurveEndpoint KeyEndpoint = ApplyId.GetEndpoint(Request, AgentKey, s2);
                if (!KeyEndpoint.HasPrivateKey)
                    throw new BadRequestException("Key does not have a private key.");
 
                // TODO: Add Support for PQC.
 
                s = KeyEndpoint.Curve.Export();
                XmlDocument Doc = XML.ParseXml(s, true);
 
                sb.Append("<LegalId>");
 
                sb.Append("<S n=\"");
                sb.Append(XML.Encode(KeyEndpoint.LocalName));
                sb.Append("\" v=\"");
                sb.Append(XML.Encode(Doc.DocumentElement.GetAttribute("d")));
                sb.Append("\"/>");
 
                sb.Append("<DT n=\"Timestamp\" v=\"");
                sb.Append(XML.Encode(AgentKey.Updated));
                sb.Append("\"/>");
 
                foreach (LegalIdentity Identity in await Database.Find<LegalIdentity>(
                    new FilterAnd(
                        new FilterFieldEqualTo("Account", User.UserName),
                        new FilterFieldEqualTo("State", IoTBroker.Legal.Identity.IdentityState.Approved))))
                {
                    if (Identity.HasClientPublicKey &&
                        Convert.ToBase64String(Identity.ClientPubKey) == KeyEndpoint.PublicKeyBase64)
                    {
                        sb.Append("<State legalId=\"");
                        sb.Append(XML.Encode(Identity.Id));
                        sb.Append("\" publicKey=\"");
                        sb.Append(KeyEndpoint.PublicKeyBase64);
                        sb.Append("\" timestamp=\"");
                        sb.Append(XML.Encode(AgentKey.Created));
                        sb.Append("\"/>");
                    }
                }
 
                sb.Append("</LegalId>");
            }
 
            if (!string.IsNullOrEmpty(Pin))
            {
                sb.Append("<Pin pin=\"");
                sb.Append(XML.Encode(Pin));
                sb.Append("\"/>");
            }
 
            User.Account.AppendAccountXml(sb, false);
 
            sb.Append("</Transfer>");
 
            string TransferXml = sb.ToString();
            byte[] Bin = Encoding.UTF8.GetBytes(TransferXml);
            byte[] Key = Gateway.NextBytes(16);
            byte[] IV = Gateway.NextBytes(16);
            byte[] Encrypted = Aes256Encrypt.Encrypt(Bin, Key, IV, CipherMode.CBC, PaddingMode.PKCS7);
 
            sb.Clear();
 
            sb.Append("<Info xmlns='");
            sb.Append(Networking.XMPP.Contracts.ContractsClient.NamespaceOnboarding);
            sb.Append("' base64='");
            sb.Append(Convert.ToBase64String(Encrypted));
            sb.Append("' once='true' expires='");
            sb.Append(XML.Encode(DateTime.UtcNow.AddHours(1)));
            sb.Append("'/>");
 
            string OnboardingNeuron = await LegalComponent.GetOnboardingNeuronDomainName();
 
            XmppClient Client = Gateway.XmppClient;
            if (Client.Domain == "example.com" &&
                Types.TryGetModuleParameter("XMPP_TEST", out XmppClient TestClient))
            {
                Client = TestClient;
            }
            XmlElement E = await Client.IqSetAsync("onboarding." + OnboardingNeuron, sb.ToString());
 
            foreach (XmlNode N in E.ChildNodes)
            {
                if (N is XmlElement E2 && E2.LocalName == "Code" && E2.HasAttribute("code"))
                {
                    string Code = E2.GetAttribute("code");
 
                    sb.Clear();
 
                    sb.Append("obinfo:");
                    sb.Append(OnboardingNeuron);
                    sb.Append(':');
                    sb.Append(Code);
                    sb.Append(':');
                    sb.Append(Convert.ToBase64String(Key));
                    sb.Append(':');
                    sb.Append(Convert.ToBase64String(IV));
 
                    string OnboardingUri = sb.ToString();
 
                    sb.Clear();
 
                    sb.Append("/QR/");
                    sb.Append(WebUtility.UrlEncode(OnboardingUri));
                    sb.Append("?w=400&h=400&q=2");
 
                    await Database.Delete<TransferCode>(
                        new FilterFieldLesserOrEqualTo("Created", DateTime.UtcNow.AddDays(-2)));
 
                    await Database.Insert(new TransferCode()
                    {
                        Code = Code,
                        Created = DateTime.UtcNow,
                        Account = User.UserName,
                        Token = Token
                    });
 
                    await Response.Return(new NamedDictionary<string, object>("TransferCode", AgentNamespace)
                    {
                        { "onboardingUri", OnboardingUri },
                        { "qrCodeUrl", Gateway.GetUrl(sb.ToString()) },
                        { "qrCodeWidth", 400 },
                        { "qrCodeHeight", 400 }
                    });
 
                    return;
                }
            }
 
            throw new ServiceUnavailableException("Unable to generate onboarding code. Please try again later.");
        }
 
        public static async Task TransferCodeDelivered(string Code)
        {
            TransferCode CodeObj = await Database.FindFirstIgnoreRest<TransferCode>(new FilterFieldEqualTo("Code", Code));
            if (CodeObj is null)
                return;
 
            if (!string.IsNullOrEmpty(CodeObj.Token))
            {
                try
                {
                    if (JwtToken.TryParse(CodeObj.Token, out JwtToken ParsedToken, out string Reason))
                        JwtFactory.Deprecate(ParsedToken);
                    else
                        Log.Error(Reason);
                }
                catch (Exception ex)
                {
                    Log.Exception(ex);
                }
            }
 
            int KeyCount = await Database.Delete<AgentKey>(
                new FilterFieldEqualTo("Account", CodeObj.Account));
 
            Log.Informational("Agent API Account transferred.",
                new KeyValuePair<string, object>("Account", CodeObj.Account),
                new KeyValuePair<string, object>("Keys Deleted", KeyCount));
        }
    }
}