AttachmentsResource.cs

using System;
using System.Collections.Generic;
using System.IO;
using System.Security.Cryptography;
using System.Threading.Tasks;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Networking.XMPP.Server;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.IO;
using Waher.Runtime.Temporary;
using Waher.Service.IoTBroker.Legal.Contracts;
using Waher.Service.IoTBroker.Legal.Identity;
 
namespace Waher.Service.IoTBroker.Legal.Attachments
{
    public class AttachmentsResource : HttpSynchronousResource, IHttpGetMethod
    {
        private readonly HttpAuthenticationScheme[] authentication;
        private readonly LegalComponent legalComponent;
 
        public AttachmentsResource(LegalComponent LegalComponent)
            : base("/Attachments")
        {
            this.legalComponent = LegalComponent;
            this.authentication = new HttpAuthenticationScheme[]
            {
                new LegalSignature(this.legalComponent.MainDomain.Address.Value, this.legalComponent)
            };
        }
 
        public override bool HandlesSubPaths => true;
        public override bool UserSessions => true;
        
        public bool AllowsGET => true;
 
        public async Task GET(HttpRequest Request, HttpResponse Response)
        {
            string AttachmentId = Request.SubPath[1..];
            int i = AttachmentId.IndexOf('@');
 
            if (i > 0)
            {
                string AttachmentDomain = AttachmentId[(i + 1)..];
                AttachmentId = AttachmentId[..i];
 
                if (AttachmentDomain != this.legalComponent.MainDomain.Address.Value)
                {
                    if (!Request.Header.TryGetQueryParameter("Url", out string AttachmentUrl))
                        throw new BadRequestException("Attachment URL required for accessing attachment hosted by other nodes.");
 
                    KeyValuePair<string, TemporaryFile> P = await Gateway.ContractsClient.GetAttachmentAsync(AttachmentUrl, Networking.XMPP.Contracts.SignWith.LatestApprovedId, 30000);
                    using TemporaryFile File = P.Value;
                    
                    Response.ContentType = P.Key;
                    File.Position = 0;
 
                    long c = File.Length;
                    int BufferSize = (int)Math.Min(65536, c);
                    byte[] Buffer = new byte[BufferSize];
 
                    while (c > 0)
                    {
                        i = await File.TryReadAllAsync(Buffer, 0, (int)Math.Min(BufferSize, c));
                        if (i <= 0)
                            throw new IOException("Unexpected end of file.");
 
                        await Response.Write(true, Buffer, 0, i);
                        c -= i;
                    }
 
                    return;
                }
            }
 
            Attachment Attachment = await Database.TryLoadObject<Attachment>(AttachmentId)
                ?? throw new NotFoundException("Attachment not found.");
 
            bool Authorized;
 
            if (Request.User is LegalIdentityUser User)
            {
                if (string.IsNullOrEmpty(Attachment.ContractId))    // Attachment to legal identity.
                {
                    Authorized = this.legalComponent.IsAccessToIdentityAuthorized(User.From.BareJid, Attachment.UploaderLegalId);
 
                    if (!Authorized)
                    {
                        XmppAddress Addr = new XmppAddress(Attachment.UploaderLegalId);
 
                        if (this.legalComponent.IsComponentDomain(Addr.Domain, true))
                        {
                            LegalIdentity Identity = await Database.FindFirstDeleteRest<LegalIdentity>(
                                new FilterFieldEqualTo("Id", Attachment.UploaderLegalId), "Created");
 
                            if (User.From.Account == Identity.Account && this.legalComponent.Server.IsServerDomain(User.From.Domain, true))
                            {
                                Authorized = true;
                                this.legalComponent.IdentityAuthorization(User.From.BareJid, User.From.BareJid, Attachment.UploaderLegalId, true);
                            }
                        }
                    }
                }
                else                                                // Attachment to smart contract.
                {
                    Authorized = this.legalComponent.IsAccessToContractAuthorized(User.From.BareJid, Attachment.ContractId);
 
                    if (!Authorized)
                    {
                        XmppAddress Addr = new XmppAddress(Attachment.ContractId);
 
                        if (this.legalComponent.IsComponentDomain(Addr.Domain, true))
                        {
                            Contract Contract = await Database.FindFirstDeleteRest<Contract>(
                                new FilterFieldEqualTo("ContractId", Attachment.ContractId), "Created");
 
                            if (!(Contract is null))
                            {
                                switch (Contract.Visibility)
                                {
                                    case ContractVisibility.Public:
                                    case ContractVisibility.PublicSearchable:
                                        Authorized = true;
                                        break;
 
                                    default:
                                        Authorized = await Contract.CanRead(User.From, this.legalComponent.Server, this.legalComponent);
                                        break;
                                }
 
                                if (Authorized)
                                    this.legalComponent.ContractAuthorization(User.From.BareJid, User.From.BareJid, Attachment.ContractId, true);
                            }
                        }
                    }
                }
            }
            else
            {
                if (string.IsNullOrEmpty(Attachment.ContractId))    // Attachment to legal identity.
                    Authorized = Request.User?.HasPrivilege("Legal.Id." + Attachment.UploaderLegalId) ?? false;
                else                                                // Attachment to smart contract.
                {
                    Contract Contract = await Database.FindFirstDeleteRest<Contract>(
                        new FilterFieldEqualTo("ContractId", Attachment.ContractId), "Created");
 
                    if (!(Contract is null))
                    {
                        switch (Contract.Visibility)
                        {
                            case ContractVisibility.Public:
                            case ContractVisibility.PublicSearchable:
                                Authorized = true;
                                break;
 
                            default:
                                Authorized = Request.User?.HasPrivilege("Legal.Contract." + Attachment.ContractId) ?? false;
                                break;
                        }
                    }
                    else
                        Authorized = false;
                }
            }
 
            if (!Authorized)
                throw new ForbiddenException(Request, "Not authorized to access attachment.");
 
            Response.ContentType = Attachment.ContentType;
 
            using FileStream AttachmentFile = File.OpenRead(Attachment.LocalFileName);
            Aes Aes = Aes.Create();
 
            Aes.BlockSize = 128;
            Aes.KeySize = 256;
            Aes.Mode = CipherMode.CBC;
            Aes.Padding = PaddingMode.Zeros;
 
            byte[] Key = new byte[32];
            byte[] IV = new byte[16];
 
            Buffer.BlockCopy(Attachment.Salt, 0, Key, 0, 32);
            Buffer.BlockCopy(Attachment.Salt, 32, IV, 0, 16);
 
            using ICryptoTransform Decryptor = Aes.CreateDecryptor(Key, IV);
            using (CryptoStream DecryptedAttachmentFile = new CryptoStream(AttachmentFile, Decryptor, CryptoStreamMode.Read))
            {
                byte[] Buffer = new byte[65536];
                long c = Attachment.Size;
 
                while (c > 0)
                {
                    if (c > 65536)
                        i = await DecryptedAttachmentFile.TryReadAllAsync(Buffer, 0, 65536);
                    else
                        i = await DecryptedAttachmentFile.TryReadAllAsync(Buffer, 0, (int)c);
 
                    if (i <= 0)
                        throw new IOException("Unexpected end of file.");
 
                    await Response.Write(false, Buffer, 0, i);
 
                    c -= i;
                }
            }
        }
 
        public override HttpAuthenticationScheme[] GetAuthenticationSchemes(HttpRequest Request)
        {
            return this.authentication;
        }
 
    }
}