CreateVaultLink.cs

using System;
using System.Collections.Generic;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using System.Xml;
using Waher.Content;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Networking.XMPP.P2P.E2E;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.IO;
using Waher.Script;
using Waher.Script.Abstraction.Elements;
using Waher.Security;
using Waher.Service.IoTBroker.DataStorage;
using Waher.Service.IoTBroker.WebServices.Agent.Crypto;
using Waher.Service.IoTBroker.WebServices.Agent.Legal;
 
namespace Waher.Service.IoTBroker.WebServices.Agent.Storage
{
    public class CreateVaultLink : AgentPostResource
    {
        public CreateVaultLink()
            : base("Storage/CreateVaultLink",
                new KeyValuePair<Type, Expression>(typeof(Dictionary<string, object>), new Expression(jsonPattern)),
                new KeyValuePair<Type, Expression>(typeof(XmlDocument), new Expression(xmlPattern)))
        {
        }
 
        private static readonly string jsonPattern = Resources.LoadResourceAsText(typeof(StoreInVault).Namespace + ".JSON.CreateVaultLink.req");
        private static readonly string xmlPattern = Resources.LoadResourceAsText(typeof(StoreInVault).Namespace + ".XML.CreateVaultLink.req");
 
        public override async Task POST(HttpRequest Request, HttpResponse Response, Dictionary<string, IElement> Parameters)
        {
            AccountUser User = AssertUserAuthenticated(Request);
 
            string KeyId = (string)Parameters["PKeyId"].AssociatedObjectValue;
            string Nonce = (string)Parameters["PNonce"].AssociatedObjectValue;
            string KeySignature = (string)Parameters["PKeySignature"].AssociatedObjectValue;
            string RequestSignature = (string)Parameters["PRequestSignature"].AssociatedObjectValue;
            string VaultId = (string)Parameters["PVaultId"]?.AssociatedObjectValue;
            int Ttl = (int)(double)(Parameters["PTtl"]?.AssociatedObjectValue ?? 0.0);
            int UseCount = (int)(double)(Parameters["PUseCount"]?.AssociatedObjectValue ?? 0.0);
            bool Masked = (bool)(Parameters["PMasked"]?.AssociatedObjectValue ?? true);
            byte[] VaultIdBin;
 
            try
            {
                VaultIdBin = Convert.FromBase64String(VaultId);
            }
            catch (Exception)
            {
                throw new BadRequestException("Invalid Vault ID.");
            }
 
            if (string.IsNullOrEmpty(KeyId))
                throw new BadRequestException("Key ID cannot be empty.");
 
            if (string.IsNullOrEmpty(Nonce) || Nonce.Length < 32)
                throw new ForbiddenException(Request, "Nonce too short.");
 
            StringBuilder sb = new StringBuilder();
            AgentKey AgentKey = await Database.FindFirstDeleteRest<AgentKey>(new FilterAnd(
                new FilterFieldEqualTo("Account", User.UserName),
                new FilterFieldEqualTo("Id", KeyId)))
                ?? throw new NotFoundException("Key not found.");
 
            sb.Append(User.UserName);
            sb.Append(':');
            sb.Append(Request.Header.Host.Value);
            sb.Append(':');
            sb.Append(AgentKey.LocalName);
            sb.Append(':');
            sb.Append(AgentKey.Namespace);
            sb.Append(':');
            sb.Append(KeyId);
 
            //string s1 = sb.ToString();
 
            sb.Append(':');
            sb.Append(KeySignature);
 
            string s2 = sb.ToString();
 
            sb.Append(':');
            sb.Append(Nonce);
            sb.Append(':');
            sb.Append(VaultId);
            sb.Append(':');
            sb.Append(Ttl);
            sb.Append(':');
            sb.Append(UseCount);
            sb.Append(':');
            sb.Append(Masked ? '1' : '0');
 
            VaultItem Item = await Database.FindFirstIgnoreRest<VaultItem>(
                new FilterFieldEqualTo("VaultId", VaultIdBin))
                ?? throw new NotFoundException("Vault item not found.");
 
            if (Item.Account != User.UserName)
                throw new ForbiddenException(Request, "Access to vault item denied.");
            string s3 = sb.ToString();
 
            string s = Convert.ToBase64String(
                Hashes.ComputeHMACSHA256Hash(
                    Encoding.UTF8.GetBytes(User.Account.Password),
                    Encoding.UTF8.GetBytes(s3)));
 
            if (s != RequestSignature)
                throw new ForbiddenException(Request, "Request Signature invalid.");
 
            if (await Gateway.HasNonceBeenUsed(Nonce))
                throw new ForbiddenException(Request, "Nonce value has already been used.");
 
            await Gateway.RegisterNonceValue(Nonce);
 
            EllipticCurveEndpoint KeyEndpoint = ApplyId.GetEndpoint(Request, AgentKey, s2);
 
            VaultItemReference Ref = new VaultItemReference()
            {
                VaultId = VaultIdBin,
                UseCount = UseCount,
                Expires = Ttl > 0 ? DateTime.UtcNow.AddSeconds(Ttl) : DateTime.MaxValue,
                Masked = Masked,
                KeyId = KeyId,
                Seed = s2
            };
 
            await Database.Insert(Ref);
 
            sb.Clear();
            sb.Append("/Vault/");
            sb.Append(Ref.ObjectId.ToString());
            sb.Append('/');
 
            byte[] Signature = KeyEndpoint.Sign(Encoding.UTF8.GetBytes(sb.ToString()));
 
            sb.Append(Base64Url.Encode(Signature));
 
            string Url = Gateway.GetUrl(sb.ToString());
 
            s = "/Vault";
            if (!Request.Server.TryGetResource(ref s, out _, out _))
                Request.Server.Register(new Vault());
 
            await Response.Return(new NamedDictionary<string, object>("Link", AgentNamespace)
            {
                { "url", Url }
            });
        }
    }
}