AddIdAttachment.cs

using Paiwise;
using System;
using System.Collections.Generic;
using System.Text;
using System.Threading.Tasks;
using System.Xml;
using Waher.Content;
using Waher.Content.Xml;
using Waher.Events;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Networking.XMPP.P2P.E2E;
using Waher.Networking.XMPP.Server;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.Counters;
using Waher.Runtime.IO;
using Waher.Runtime.Temporary;
using Waher.Runtime.Threading;
using Waher.Script;
using Waher.Script.Abstraction.Elements;
using Waher.Script.Constants;
using Waher.Security;
using Waher.Service.IoTBroker.DataStorage;
using Waher.Service.IoTBroker.Legal;
using Waher.Service.IoTBroker.Legal.Attachments;
using Waher.Service.IoTBroker.Legal.Identity;
using Waher.Service.IoTBroker.Setup;
using Waher.Service.IoTBroker.WebServices.Agent.Crypto;
using static Waher.Service.IoTBroker.Legal.LegalComponent;
 
namespace Waher.Service.IoTBroker.WebServices.Agent.Legal
{
    public class AddIdAttachment : AgentPostResource
    {
        public AddIdAttachment()
            : base("Legal/AddIdAttachment",
                new KeyValuePair<Type, Expression>(typeof(Dictionary<string, object>), new Expression(jsonPattern)),
                new KeyValuePair<Type, Expression>(typeof(XmlDocument), new Expression(xmlPattern)))
        {
        }
 
        private static readonly string jsonPattern = Resources.LoadResourceAsText(typeof(AddIdAttachment).Namespace + ".JSON.AddIdAttachment.req");
        private static readonly string xmlPattern = Resources.LoadResourceAsText(typeof(AddIdAttachment).Namespace + ".XML.AddIdAttachment.req");
 
        public override async Task POST(HttpRequest Request, HttpResponse Response, Dictionary<string, IElement> Parameters)
        {
            AccountUser User = AssertUserAuthenticated(Request);
 
            string KeyId = (string)Parameters["PKeyId"].AssociatedObjectValue;
            string Nonce = (string)Parameters["PNonce"].AssociatedObjectValue;
            string KeySignature = (string)Parameters["PKeySignature"].AssociatedObjectValue;
            string RequestSignature = (string)Parameters["PRequestSignature"].AssociatedObjectValue;
            CaseInsensitiveString LegalId = (string)Parameters["PLegalId"].AssociatedObjectValue;
            string AttachmentBase64 = (string)Parameters["PAttachmentBase64"].AssociatedObjectValue;
            string AttachmentFileName = (string)Parameters["PAttachmentFileName"].AssociatedObjectValue;
            string AttachmentContentType = (string)Parameters["PAttachmentContentType"].AssociatedObjectValue;
            StringBuilder sb = new StringBuilder();
            byte[] Attachment;
            object DecodedAttachment;
 
            if (string.IsNullOrEmpty(KeyId))
            {
                await Response.SendResponse(new BadRequestException("Key ID cannot be empty."));
                return;
            }
 
            if (string.IsNullOrEmpty(Nonce) || Nonce.Length < 32)
            {
                await Response.SendResponse(new ForbiddenException(Request, "Nonce too short."));
                return;
            }
 
            using Semaphore Semaphore = await Semaphores.BeginWrite("iotid:" + LegalId.LowerCase);
            LegalIdentity Identity = await LegalComponent.GetLocalLegalIdentity(LegalId);
            if (Identity is null)
            {
                await Response.SendResponse(new NotFoundException("Legal identity not found."));
                return;
            }
 
            if (Identity.Account != User.UserName)
            {
                await Response.SendResponse(new ForbiddenException(Request, "Only allowed to add attachments to your own legal identities."));
                return;
            }
 
            if (Identity.State != IoTBroker.Legal.Identity.IdentityState.Created)
            {
                await Response.SendResponse(new ForbiddenException(Request, "Attachments can only be added to newly created identities before they are approved."));
                return;
            }
 
            IAccount Account = await XmppServerModule.GetAccountAsync(Identity.Account);
            if (Account is null)
            {
                await Response.SendResponse(new ForbiddenException(Request, "Account has been removed."));
                return;
            }
 
            if (!Account.Enabled)
            {
                await Response.SendResponse(new ForbiddenException(Request, "Account has been disabled."));
                return;
            }
 
            AgentKey AgentKey = await Database.FindFirstDeleteRest<AgentKey>(new FilterAnd(
                new FilterFieldEqualTo("Account", User.UserName),
                new FilterFieldEqualTo("Id", KeyId)));
 
            if (AgentKey is null)
            {
                await Response.SendResponse(new NotFoundException("Key not found."));
                return;
            }
 
            sb.Append(User.UserName);
            sb.Append(':');
            sb.Append(Request.Header.Host.Value);
            sb.Append(':');
            sb.Append(AgentKey.LocalName);
            sb.Append(':');
            sb.Append(AgentKey.Namespace);
            sb.Append(':');
            sb.Append(KeyId);
 
            //string s1 = sb.ToString();
 
            sb.Append(':');
            sb.Append(KeySignature);
 
            string s2 = sb.ToString();
 
            sb.Append(':');
            sb.Append(Nonce);
            sb.Append(':');
            sb.Append(AttachmentBase64);
            sb.Append(':');
            sb.Append(AttachmentFileName);
            sb.Append(':');
            sb.Append(AttachmentContentType);
            sb.Append(':');
            sb.Append(LegalId.Value);
 
            string s3 = sb.ToString();
 
            string s = Convert.ToBase64String(
                Hashes.ComputeHMACSHA256Hash(
                    Encoding.UTF8.GetBytes(User.Account.Password),
                    Encoding.UTF8.GetBytes(s3)));
 
            if (s != RequestSignature)
            {
                string Msg = "Request Signature invalid.";
                await Response.SendResponse(new ForbiddenException(Request, Msg));
                return;
            }
 
            if (await Gateway.HasNonceBeenUsed(Nonce))
            {
                string Msg = "Nonce value has already been used.";
                await Response.SendResponse(new ForbiddenException(Request, Msg));
                return;
            }
 
            await Gateway.RegisterNonceValue(Nonce);
 
            try
            {
                Attachment = Convert.FromBase64String(AttachmentBase64);
                ContentResponse ContentResponse = await InternetContent.DecodeAsync(AttachmentContentType, Attachment, null);
 
                if (ContentResponse.HasError)
                {
                    await Response.SendResponse(ContentResponse.Error);
                    return;
                }
 
                DecodedAttachment = ContentResponse.Decoded;
            }
            catch (Exception)
            {
                await Response.SendResponse(new BadRequestException("Invalid attachment."));
                return;
            }
 
            try
            {
                EllipticCurveEndpoint KeyEndpoint = ApplyId.GetEndpoint(Request, AgentKey, s2);
                byte[] AttachmentSignature = KeyEndpoint.Sign(Attachment);
 
                if (!(Identity.Attachments is null))
                {
                    string AttachmentSignatureBase64 = Convert.ToBase64String(AttachmentSignature);
 
                    foreach (AttachmentReference Ref in Identity.Attachments)
                    {
                        if (Convert.ToBase64String(Ref.Signature) == s)
                        {
                            await Response.SendResponse(new BadRequestException("Attachment already assigned to identity."));
                            return;
                        }
                    }
                }
 
                bool IncNrPeerReviews = false;
                List<LegalIdentity> Reviewers = null;
                string LegalNamespace = NamespaceLegalIdentity(Identity.Version);
 
                if (DecodedAttachment is XmlDocument Doc)
                {
                    if (Doc.DocumentElement.LocalName == "identityReview" &&
                        Doc.DocumentElement.NamespaceURI == LegalNamespace)
                    {
                        await Response.SendResponse(new ForbiddenException(Request, "Forbidden to add Identity Review documents."));
                        return;
                    }
                    else if (Doc.DocumentElement.LocalName == "peerReview" && 
                        Doc.DocumentElement.NamespaceURI == LegalNamespace)
                    {
                        LegalIdentity ReviewedIdentity = null;
                        LegalIdentity ReviewerIdentity = null;
                        CaseInsensitiveString ReviewedJid = CaseInsensitiveString.Empty;
                        CaseInsensitiveString ReviewerJid = CaseInsensitiveString.Empty;
                        bool ReviewedHasStatus = false;
                        bool ReviewerHasStatus = false;
                        byte[] PeerSignature = Convert.FromBase64String(XML.Attribute(Doc.DocumentElement, "s"));
                        DateTime TP = XML.Attribute(Doc.DocumentElement, "tp", DateTime.Now);
                        byte[] SignedIdentity = null;
                        DateTime UtcNow = DateTime.UtcNow;
 
                        foreach (XmlNode N in Doc.DocumentElement.ChildNodes)
                        {
                            if (!(N is XmlElement E) || N.NamespaceURI != LegalNamespace)
                                continue;
 
                            foreach (XmlNode N2 in E.ChildNodes)
                            {
                                if (N2 is XmlElement E2 &&
                                    E2.LocalName == "identity" &&
                                    E2.NamespaceURI == LegalNamespace)
                                {
                                    switch (E.LocalName)
                                    {
                                        case "reviewed":
                                            ReviewedIdentity = LegalIdentity.Parse(E2, out ReviewedHasStatus,
                                                out Dictionary<string, string> ReviewedIdentityAttachmentsUrls);
 
                                            sb.Clear();
                                            ReviewedIdentity.Serialize(sb, true, true, true, false, false, false, false, null, XmppServerModule.Legal);
                                            string s1 = sb.ToString();
 
                                            sb.Clear();
                                            Identity.Serialize(sb, true, true, true, false, false, false, false, null, XmppServerModule.Legal);
                                            s2 = sb.ToString();
 
                                            if (s1 != s2)
                                            {
                                                await Response.SendResponse(new ForbiddenException(Request, "Reviewed identity mismatch."));
                                                return;
                                            }
 
                                            sb.Clear();
                                            ReviewedIdentity.Serialize(sb, true, true, true, true, true, true, true, ReviewedIdentityAttachmentsUrls, XmppServerModule.Legal);
                                            SignedIdentity = Encoding.UTF8.GetBytes(sb.ToString());
                                            break;
 
                                        case "reviewer":
                                            ReviewerIdentity = LegalIdentity.Parse(E2, out ReviewerHasStatus,
                                                out Dictionary<string, string> ReviewerIdentityAttachmentsUrls);
 
                                            sb.Clear();
                                            ReviewerIdentity.Serialize(sb, false, false, false, false, false, false, false, null, XmppServerModule.Legal);
                                            byte[] Data = Encoding.UTF8.GetBytes(sb.ToString());
                                            ReviewerJid = ReviewerIdentity[PersonalInformation.JidTag];
 
                                            if (!CaseInsensitiveString.IsNullOrEmpty(ReviewerJid))
                                            {
                                                (ReviewerIdentity, _) = await XmppServerModule.Legal.ValidateSignature(new XmppAddress(ReviewerJid), TP, Data, ReviewerIdentity.ClientSignature);
                                                if (ReviewerIdentity is null || ReviewerJid != ReviewerIdentity[PersonalInformation.JidTag])
                                                {
                                                    await Response.SendResponse(new ForbiddenException(Request, "Peer identity signature invalid."));
                                                    return;
                                                }
                                            }
 
                                            if (ReviewerIdentity.State != IoTBroker.Legal.Identity.IdentityState.Approved)
                                            {
                                                await Response.SendResponse(new ForbiddenException(Request, "Reviewer identity not approved."));
                                                return;
                                            }
 
                                            if (UtcNow < ReviewerIdentity.From.ToUniversalTime() ||
                                                UtcNow > ReviewerIdentity.To.ToUniversalTime())
                                            {
                                                await Response.SendResponse(new ForbiddenException(Request, "Reviewer identity not valid."));
                                                return;
                                            }
 
                                            if (CaseInsensitiveString.IsNullOrEmpty(ReviewerIdentity.Provider))
                                            {
                                                await Response.SendResponse(new ForbiddenException(Request, "Reviewer identity lacks a provider."));
                                                return;
                                            }
 
                                            if (string.IsNullOrEmpty(ReviewerIdentity.ClientKeyName) ||
                                                ReviewerIdentity.ClientPubKey is null ||
                                                ReviewerIdentity.ClientPubKey.Length == 0)
                                            {
                                                await Response.SendResponse(new ForbiddenException(Request, "Reviewer identity lacks a key."));
                                                return;
                                            }
 
                                            if (ReviewerIdentity.ClientSignature is null ||
                                                ReviewerIdentity.ClientSignature.Length == 0)
                                            {
                                                await Response.SendResponse(new ForbiddenException(Request, "Reviewer identity lacks a signature."));
                                                return;
                                            }
 
                                            if (CaseInsensitiveString.IsNullOrEmpty(ReviewerJid))
                                            {
                                                await Response.SendResponse(new ForbiddenException(Request, "Reviewer identity not trusted for reviewing."));
                                                return;
                                            }
 
                                            break;
                                    }
                                }
                            }
                        }
 
                        if (ReviewedIdentity is null || !ReviewedHasStatus ||
                            ReviewerIdentity is null || !ReviewerHasStatus ||
                            SignedIdentity is null)
                        {
                            await Response.SendResponse(new ForbiddenException(Request, "Attachment not a correctly formed peer-review document."));
                            return;
                        }
 
                        CaseInsensitiveString Pnr = ReviewedIdentity[PersonalInformation.PersonalNumberTag];
 
                        if (Pnr == ReviewerIdentity[PersonalInformation.PersonalNumberTag] && !CaseInsensitiveString.IsNullOrEmpty(Pnr))
                        {
                            await Response.SendResponse(new ForbiddenException(Request, "Reviewer cannot be the same person as the reviewed person."));
                            return;
                        }
 
                        if (!ReviewerIdentity.ValidateSignature(SignedIdentity, PeerSignature))
                        {
                            await Response.SendResponse(new ForbiddenException(Request, "Peer signature invalid."));
                            return;
                        }
 
                        if (PeerReviewConfiguration.Instance?.AllowPeerReview ?? false)
                        {
                            int NrPhotos = 0;
 
                            if (!(Identity.Attachments is null))
                            {
                                foreach (AttachmentReference Ref in Identity.Attachments)
                                {
                                    if (Ref.ContentType.StartsWith("image/"))
                                        NrPhotos++;
                                }
                            }
 
                            if (NrPhotos < PeerReviewConfiguration.Instance.NrPhotosRequired)
                            {
                                await Response.SendResponse(new ForbiddenException(Request, "Peer review not accepted: Identity lacks sufficient photos (" +
                                    PeerReviewConfiguration.Instance.NrPhotosRequired.ToString() + ")."));
                                return;
                            }
 
                            global::Paiwise.PersonalInformation RI = GetPersonalInformation(ReviewerIdentity);
 
                            if (!PeerReviewConfiguration.Instance.IsReviewerAllowed(RI.Jid, ReviewerIdentity.Id))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer not white-listed. Peer review not accepted."));
                                return;
                            }
                            if (PeerReviewConfiguration.Instance.RequireFirstName && CaseInsensitiveString.IsNullOrEmpty(RI.FirstName))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a First name. Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireMiddleName && CaseInsensitiveString.IsNullOrEmpty(RI.MiddleNames))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a Middle name. Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireLastName && CaseInsensitiveString.IsNullOrEmpty(RI.LastNames))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a Last name. Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequirePersonalNumber && CaseInsensitiveString.IsNullOrEmpty(RI.PersonalNumber))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a Personal number. Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireAddress && CaseInsensitiveString.IsNullOrEmpty(RI.Address))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks an address. Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequirePostalCode && CaseInsensitiveString.IsNullOrEmpty(RI.PostalCode))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a Postal Code (ZIP). Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireArea && CaseInsensitiveString.IsNullOrEmpty(RI.Area))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks an Area. Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireCity && CaseInsensitiveString.IsNullOrEmpty(RI.City))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a City. Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireRegion && CaseInsensitiveString.IsNullOrEmpty(RI.Region))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a Region. Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireCountry && CaseInsensitiveString.IsNullOrEmpty(RI.Country))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a Country. Peer review not accepted."));
                                return;
                            }
 
                            if (!CaseInsensitiveString.IsNullOrEmpty(RI.Country))
                            {
                                if (PeerReviewConfiguration.Instance.RequireIso3166Compliance && !Iso3166.TryGetCountry(RI.Country, out string _))
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer Country is not an ISO 3166-1 Country Code. Peer review not accepted."));
                                    return;
                                }
 
                                if (!CaseInsensitiveString.IsNullOrEmpty(RI.PersonalNumber))
                                {
                                    bool? Valid = await PersonalNumberSchemes.IsValid(RI.Country, RI.PersonalNumber);
                                    if (Valid.HasValue && !Valid.Value)
                                    {
                                        await Response.SendResponse(new BadRequestException("The personal number format used by the reviewer does not comply with regulations."));
                                        return;
                                    }
                                }
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireNationality && CaseInsensitiveString.IsNullOrEmpty(RI.Nationality))
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a Nationality. Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireGender && !RI.Gender.HasValue)
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a Gender. Peer review not accepted."));
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireBirthDate && !RI.BirthDate.HasValue)
                            {
                                await Response.SendResponse(new BadRequestException("Reviewer identity lacks a Birth Date. Peer review not accepted."));
                                return;
                            }
 
                            if (RI.HasOrg)
                            {
                                if (CaseInsensitiveString.IsNullOrEmpty(RI.OrgName))    // TODO: Configurable
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer identity lacks an organization name. Peer review not accepted."));
                                    return;
                                }
 
                                if (CaseInsensitiveString.IsNullOrEmpty(RI.OrgDepartment))  // TODO: Configurable
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer identity lacks a department. Peer review not accepted."));
                                    return;
                                }
 
                                if (CaseInsensitiveString.IsNullOrEmpty(RI.OrgRole))    // TODO: Configurable
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer identity lacks a role. Peer review not accepted."));
                                    return;
                                }
 
                                if (CaseInsensitiveString.IsNullOrEmpty(RI.OrgNumber))  // TODO: Configurable
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer identity lacks an organization number. Peer review not accepted."));
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequireAddress && CaseInsensitiveString.IsNullOrEmpty(RI.OrgAddress))
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer identity lacks an organization address. Peer review not accepted."));
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequirePostalCode && CaseInsensitiveString.IsNullOrEmpty(RI.OrgPostalCode))
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer identity lacks an organization Postal Code (ZIP). Peer review not accepted."));
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequireArea && CaseInsensitiveString.IsNullOrEmpty(RI.OrgArea))
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer identity lacks an organization Area. Peer review not accepted."));
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequireCity && CaseInsensitiveString.IsNullOrEmpty(RI.OrgCity))
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer identity lacks an organization City. Peer review not accepted."));
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequireRegion && CaseInsensitiveString.IsNullOrEmpty(RI.OrgRegion))
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer identity lacks an organization Region. Peer review not accepted."));
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequireCountry && CaseInsensitiveString.IsNullOrEmpty(RI.OrgCountry))
                                {
                                    await Response.SendResponse(new BadRequestException("Reviewer identity lacks an organization Country. Peer review not accepted."));
                                    return;
                                }
 
                                if (!CaseInsensitiveString.IsNullOrEmpty(RI.Country))
                                {
                                    if (PeerReviewConfiguration.Instance.RequireIso3166Compliance && !Iso3166.TryGetCountry(RI.Country, out string _))
                                    {
                                        await Response.SendResponse(new BadRequestException("Reviewer organization Country is not an ISO 3166-1 Country Code. Peer review not accepted."));
                                        return;
                                    }
                                }
                            }
 
                            if (!await CheckPeerReviewFields(ReviewedIdentity, Response))
                                return;
 
                            global::Paiwise.PersonalInformation PI = GetPersonalInformation(ReviewedIdentity);
 
                            if (PI.HasOrg)
                            {
                                if (!RI.HasOrg)
                                {
                                    await Response.SendResponse(new BadRequestException("Peer reviewer lacks organization information. Peer review not accepted."));
                                    return;
                                }
 
                                if (PI.OrgName != RI.OrgName ||
                                    PI.OrgNumber != RI.OrgNumber ||
                                    PI.OrgCountry != RI.OrgCountry)
                                {
                                    await Response.SendResponse(new BadRequestException("Peer reviewer must be from same company. Peer review not accepted."));
                                    return;
                                }
                            }
 
                            if (!(Identity.Attachments is null))
                            {
                                LegalIdentity[] Reviewers2 = await GetPeerReviewers(Identity);
 
                                foreach (LegalIdentity ReviewerID in Reviewers2)
                                {
                                    if (ReviewerID[PersonalInformation.PersonalNumberTag] == Pnr)
                                    {
                                        await Response.SendResponse(new BadRequestException("A reviewer can only review the application once."));
                                        return;
                                    }
                                }
 
                                Reviewers ??= new List<LegalIdentity>();
                                Reviewers.AddRange(Reviewers2);
                            }
                        }
 
                        Reviewers ??= new List<LegalIdentity>();
                        Reviewers.Add(ReviewerIdentity);
                        IncNrPeerReviews = true;
 
                        sb.Clear();
                    }
                }
                else
                    Doc = null;
 
                using TemporaryStream TempFile = new TemporaryStream();
 
                await TempFile.WriteAsync(Attachment, 0, Attachment.Length);
 
                KeyValuePair<Attachment, AttachmentReference> A =
                    await CreateAttachment(AttachmentFileName, Identity, AttachmentSignature, 
                        TempFile, AttachmentContentType, User.Account, null, 
                        XmppServerModule.Legal?.AttachmentsFolder ?? "Attachments",
                        Identity.To.ToUniversalTime(), false);
 
                // TODO: ID Preview
 
                List<AttachmentReference> References = new List<AttachmentReference>();
                bool Approved = false;
 
                if (!(Identity.Attachments is null))
                    References.AddRange(Identity.Attachments);
 
                References.Add(A.Value);
                Identity.Attachments = References.ToArray();
                Identity.Updated = LegalComponent.UtcNowSecond;
 
                if (IncNrPeerReviews)
                {
                    Identity.NrPeerReviews++;
 
                    if ((PeerReviewConfiguration.Instance?.AllowPeerReview ?? true) &&
                        Identity.NrPeerReviews >= (PeerReviewConfiguration.Instance?.NrReviewersToApprove ?? 2) &&
                        Identity.State == IoTBroker.Legal.Identity.IdentityState.Created)
                    {
                        Identity.State = IoTBroker.Legal.Identity.IdentityState.Approved;
                        Approved = true;
 
                        await RuntimeCounters.IncrementCounter("Legal.ID." + Identity.State.ToString());
 
                        if (BrokerNotificationConfiguration.Instance?.PeerReviewApproved ?? false)
                        {
                            StringBuilder Markdown = new StringBuilder();
 
                            Markdown.AppendLine("Peer reviewed Legal ID approved");
                            Markdown.AppendLine("===================================");
                            Markdown.AppendLine();
 
                            XmppServerModule.Legal.AppendMarkdown(Markdown, Identity, "Applicant");
 
                            int Index = 0;
 
                            foreach (LegalIdentity Reviewer in Reviewers)
                            {
                                Index++;
                                XmppServerModule.Legal.AppendMarkdown(Markdown, Reviewer, "Reviewer " + Index.ToString());
                            }
 
                            await Gateway.SendNotification(Markdown.ToString());
                        }
                    }
                }
 
                Identity.Sign(XmppServerModule.Legal);
                await Database.Update(Identity);
 
                if (Identity.State == IoTBroker.Legal.Identity.IdentityState.Approved)
                    await CopyPropertiesFromApprovedIdentity(Identity, Account as DataStorage.Account);
 
                string BareJid = User.UserName + "@" + Gateway.Domain;
 
                Log.Informational("Attachment added to Legal Identity registration.",
                    Identity.Id.Value, BareJid, "LegalIdUpdated", Identity.GetTags());
 
                sb.Clear();
                Identity.Serialize(sb, true, true, true, true, true, true, true, null, XmppServerModule.Legal);
                string IdentityXml = sb.ToString();
 
                if (Approved)
                    await LegalComponent.AddLegalIdentityReference(Identity);
 
                if (Approved || Identity.State == IoTBroker.Legal.Identity.IdentityState.Approved)
                {
                    XmppAddress IdentityAddress = new XmppAddress(Identity.Id);
                    int i = IdentityAddress.Domain.IndexOf('.');
                    string JidDomain = i < 0 ? XmppServerModule.Server.Domain : IdentityAddress.Domain.Substring(i + 1);
 
                    await XmppServerModule.Server.SendMessage(string.Empty, string.Empty, XmppServerModule.Legal.MainDomain,
                        new XmppAddress(Identity.Account + "@" + XmppServerModule.Server.Domain), string.Empty, IdentityXml);
                }
 
                XmlDocument IdentityDoc = XML.ParseXml(IdentityXml, true);
 
                await Response.Return(new NamedDictionary<string, object>("IdentityResponse", AgentNamespace)
                    {
                        { "Identity", IdentityDoc },
                    });
 
            }
            finally
            {
                if (DecodedAttachment is IDisposableAsync DisposableAsync)
                    await DisposableAsync.DisposeAsync();
                else if (DecodedAttachment is IDisposable Disposable)
                    Disposable.Dispose();
            }
        }
 
        internal static async Task<bool> CheckPeerReviewFields(LegalIdentity ReviewedIdentity, HttpResponse Response)
        {
            if (PeerReviewConfiguration.Instance?.AllowPeerReview ?? false)
            {
                global::Paiwise.PersonalInformation PI = GetPersonalInformation(ReviewedIdentity);
 
                if (PeerReviewConfiguration.Instance.RequireFirstName && CaseInsensitiveString.IsNullOrEmpty(PI.FirstName))
                {
                    await Response.SendResponse(new BadRequestException("First name (FIRST) is a required field."));
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireMiddleName && CaseInsensitiveString.IsNullOrEmpty(PI.MiddleNames))
                {
                    await Response.SendResponse(new BadRequestException("Middle name (MIDDLE) is a required field."));
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireLastName && CaseInsensitiveString.IsNullOrEmpty(PI.LastNames))
                {
                    await Response.SendResponse(new BadRequestException("Last name (LAST) is a required field."));
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequirePersonalNumber && CaseInsensitiveString.IsNullOrEmpty(PI.PersonalNumber))
                {
                    await Response.SendResponse(new BadRequestException("Personal Number (PNR) is a required field."));
                    return false;
                }
 
 
                if (PeerReviewConfiguration.Instance.RequireAddress && CaseInsensitiveString.IsNullOrEmpty(PI.Address))
                {
                    await Response.SendResponse(new BadRequestException("Address (ADDR) is a required field."));
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequirePostalCode && CaseInsensitiveString.IsNullOrEmpty(PI.PostalCode))
                {
                    await Response.SendResponse(new BadRequestException("Postal Code (ZIP) is a required field."));
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireArea && CaseInsensitiveString.IsNullOrEmpty(PI.Area))
                {
                    await Response.SendResponse(new BadRequestException("Area (AREA) is a required field."));
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireCity && CaseInsensitiveString.IsNullOrEmpty(PI.City))
                {
                    await Response.SendResponse(new BadRequestException("City (CITY) is a required field."));
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireRegion && CaseInsensitiveString.IsNullOrEmpty(PI.Region))
                {
                    await Response.SendResponse(new BadRequestException("Region (REGION) is a required field."));
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireCountry && CaseInsensitiveString.IsNullOrEmpty(PI.Country))
                {
                    await Response.SendResponse(new BadRequestException("Country (COUNTRY) is a required field."));
                    return false;
                }
 
                if (!CaseInsensitiveString.IsNullOrEmpty(PI.Country))
                {
                    if (PeerReviewConfiguration.Instance.RequireIso3166Compliance &&
                        !Iso3166.TryGetCountry(PI.Country, out string _))
                    {
                        await Response.SendResponse(new BadRequestException("Country must be a ISO 3166-1 Country Code."));
                        return false;
                    }
 
                    if (!CaseInsensitiveString.IsNullOrEmpty(PI.PersonalNumber))
                    {
                        bool? Valid = await PersonalNumberSchemes.IsValid(PI.Country, PI.PersonalNumber);
                        if (Valid.HasValue && !Valid.Value)
                        {
                            await Response.SendResponse(new BadRequestException("The personal number format does not comply with regulations in your country."));
                            return false;
                        }
                    }
                }
 
                if (PeerReviewConfiguration.Instance.RequireNationality && CaseInsensitiveString.IsNullOrEmpty(PI.Nationality))
                {
                    await Response.SendResponse(new BadRequestException("Nationality (NATIONALITY) is a required field."));
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireGender && !PI.Gender.HasValue)
                {
                    await Response.SendResponse(new BadRequestException("Gender (GENDER) is a required field."));
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireBirthDate && !PI.BirthDate.HasValue)
                {
                    await Response.SendResponse(new BadRequestException("Birth Date (BDAY, BMONTH & BYEAR) are required fields."));
                    return false;
                }
 
                if (PI.HasOrg)
                {
                    if (CaseInsensitiveString.IsNullOrEmpty(PI.OrgName))    // TODO: Make configurable
                    {
                        await Response.SendResponse(new BadRequestException("Organization name is a required field for work identities."));
                        return false;
                    }
 
                    if (CaseInsensitiveString.IsNullOrEmpty(PI.OrgDepartment)) // TODO: Make configurable
                    {
                        await Response.SendResponse(new BadRequestException("Department is a required field for work identities."));
                        return false;
                    }
 
                    if (CaseInsensitiveString.IsNullOrEmpty(PI.OrgRole))   // TODO: Make configurable
                    {
                        await Response.SendResponse(new BadRequestException("Role is a required field for work identites."));
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequirePersonalNumber && CaseInsensitiveString.IsNullOrEmpty(PI.OrgNumber))
                    {
                        await Response.SendResponse(new BadRequestException("Organization Number is a required field for work identites."));
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequireAddress && CaseInsensitiveString.IsNullOrEmpty(PI.OrgAddress))
                    {
                        await Response.SendResponse(new BadRequestException("Organization Address is a required field for work identites."));
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequirePostalCode && CaseInsensitiveString.IsNullOrEmpty(PI.OrgPostalCode))
                    {
                        await Response.SendResponse(new BadRequestException("Organization Postal Code (ZIP) is a required field for work identites."));
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequireArea && CaseInsensitiveString.IsNullOrEmpty(PI.OrgArea))
                    {
                        await Response.SendResponse(new BadRequestException("Organization Area is a required field for work identites."));
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequireCity && CaseInsensitiveString.IsNullOrEmpty(PI.OrgCity))
                    {
                        await Response.SendResponse(new BadRequestException("Organization City is a required field for work identites."));
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequireRegion && CaseInsensitiveString.IsNullOrEmpty(PI.OrgRegion))
                    {
                        await Response.SendResponse(new BadRequestException("Organization Region is a required field for work identites."));
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequireCountry && CaseInsensitiveString.IsNullOrEmpty(PI.OrgCountry))
                    {
                        await Response.SendResponse(new BadRequestException("Organization Country is a required field for work identites."));
                        return false;
                    }
 
                    if (!CaseInsensitiveString.IsNullOrEmpty(PI.OrgCountry))
                    {
                        if (PeerReviewConfiguration.Instance.RequireIso3166Compliance && !Iso3166.TryGetCountry(PI.OrgCountry, out string _))
                        {
                            await Response.SendResponse(new BadRequestException("Organization Country must be a ISO 3166-1 Country Code."));
                            return false;
                        }
                    }
                }
            }
 
            return true;
        }
 
    }
}