AttachmentsResource.cs

using System;
using System.Collections.Generic;
using System.IO;
using System.Security.Cryptography;
using System.Threading.Tasks;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.Inventory;
using Waher.Runtime.Temporary;
using Waher.Service.IoTBroker.Legal.Contracts;
using Waher.Service.IoTBroker.Legal.Identity;
 
namespace Waher.Service.IoTBroker.Legal.Attachments
{
    public class AttachmentsResource : HttpSynchronousResource, IHttpGetMethod
    {
        private readonly HttpAuthenticationScheme[] authentication;
        private readonly LegalComponent legalComponent;
 
        public AttachmentsResource(LegalComponent LegalComponent)
            : base("/Attachments")
        {
            this.legalComponent = LegalComponent;
            this.authentication = new HttpAuthenticationScheme[]
            {
                new LegalSignature(this.legalComponent.MainDomain.Address.Value, this.legalComponent)
            };
        }
 
        public override bool HandlesSubPaths => true;
        public override bool UserSessions => true;
 
        public bool AllowsGET => true;
 
        public async Task GET(HttpRequest Request, HttpResponse Response)
        {
            string AttachmentId = Request.SubPath.Substring(1);
            int i = AttachmentId.IndexOf('@');
 
            if (i > 0)
            {
                string AttachmentDomain = AttachmentId.Substring(i + 1);
                AttachmentId = AttachmentId.Substring(0, i);
 
                if (AttachmentDomain != this.legalComponent.MainDomain.Address.Value)
                {
                    if (!Request.Header.TryGetQueryParameter("Url", out string AttachmentUrl))
                        throw new BadRequestException("Attachment URL required for accessing attachment hosted by other nodes.");
 
                    KeyValuePair<string, TemporaryFile> P = await Gateway.ContractsClient.GetAttachmentAsync(AttachmentUrl, Networking.XMPP.Contracts.SignWith.LatestApprovedId, 30000);
                    using (TemporaryFile File = P.Value)
                    {
                        Response.ContentType = P.Key;
                        File.Position = 0;
 
                        long c = File.Length;
                        int BufferSize = (int)Math.Min(65536, c);
                        byte[] Buffer = new byte[BufferSize];
 
                        while (c > 0)
                        {
                            i = await File.TryReadAllAsync(Buffer, 0, (int)Math.Min(BufferSize, c));
                            if (i <= 0)
                                throw new IOException("Unexpected end of file.");
 
                            await Response.Write(Buffer, 0, i);
                            c -= i;
                        }
                    }
 
                    return;
                }
            }
 
            Attachment Attachment = await Database.TryLoadObject<Attachment>(AttachmentId)
                ?? throw new NotFoundException("Attachment not found.");
 
            bool Authorized;
 
            if (Request.User is LegalIdentityUser User)
            {
                if (string.IsNullOrEmpty(Attachment.ContractId))    // Attachment to legal identity.
                {
                    Authorized = this.legalComponent.IsAccessToIdentityAuthorized(User.From.BareJid, Attachment.UploaderLegalId);
 
                    if (!Authorized && Attachment.UploaderLegalId.EndsWith("@" + this.legalComponent.MainDomain.Address.Value))
                    {
                        LegalIdentity Identity = await Database.FindFirstDeleteRest<LegalIdentity>(
                            new FilterFieldEqualTo("Id", Attachment.UploaderLegalId), "Created");
 
                        if (User.From.Account == Identity.Account && this.legalComponent.Server.IsServerDomain(User.From.Domain, true))
                        {
                            Authorized = true;
                            this.legalComponent.IdentityAuthorization(User.From.BareJid, User.From.BareJid, Attachment.UploaderLegalId, true);
                        }
                    }
                }
                else                                                // Attachment to smart contract.
                {
                    Authorized = this.legalComponent.IsAccessToContractAuthorized(User.From.BareJid, Attachment.ContractId);
 
                    if (!Authorized && Attachment.ContractId.EndsWith("@" + this.legalComponent.MainDomain.Address.Value))
                    {
                        Contract Contract = await Database.FindFirstDeleteRest<Contract>(
                            new FilterFieldEqualTo("ContractId", Attachment.ContractId), "Created");
 
                        if (!(Contract is null))
                        {
                            Authorized = await Contract.CanRead(User.From, this.legalComponent.Server, this.legalComponent);
                            if (Authorized)
                                this.legalComponent.ContractAuthorization(User.From.BareJid, User.From.BareJid, Attachment.ContractId, true);
                        }
                    }
                }
            }
            else
            {
                if (string.IsNullOrEmpty(Attachment.ContractId))    // Attachment to legal identity.
                    Authorized = Request.User?.HasPrivilege("Legal.Id." + Attachment.UploaderLegalId) ?? false;
                else                                                // Attachment to smart contract.
                    Authorized = Request.User?.HasPrivilege("Legal.Contract." + Attachment.ContractId) ?? false;
            }
 
            if (!Authorized)
                throw new ForbiddenException("Not authorized to access attachment.");
 
            Response.ContentType = Attachment.ContentType;
 
            using (FileStream AttachmentFile = File.OpenRead(Attachment.LocalFileName))
            {
                Aes Aes = Aes.Create();
 
                Aes.BlockSize = 128;
                Aes.KeySize = 256;
                Aes.Mode = CipherMode.CBC;
                Aes.Padding = PaddingMode.Zeros;
 
                byte[] Key = new byte[32];
                byte[] IV = new byte[16];
 
                Array.Copy(Attachment.Salt, 0, Key, 0, 32);
                Array.Copy(Attachment.Salt, 32, IV, 0, 16);
 
                using (ICryptoTransform Decryptor = Aes.CreateDecryptor(Key, IV))
                {
                    using (CryptoStream DecryptedAttachmentFile = new CryptoStream(AttachmentFile, Decryptor, CryptoStreamMode.Read))
                    {
                        byte[] Buffer = new byte[65536];
                        long c = Attachment.Size;
 
                        while (c > 0)
                        {
                            if (c > 65536)
                                i = await DecryptedAttachmentFile.TryReadAllAsync(Buffer, 0, 65536);
                            else
                                i = await DecryptedAttachmentFile.TryReadAllAsync(Buffer, 0, (int)c);
 
                            if (i <= 0)
                                throw new IOException("Unexpected end of file.");
 
                            await Response.Write(Buffer, 0, i);
 
                            c -= i;
                        }
                    }
                }
            }
        }
 
        public override HttpAuthenticationScheme[] GetAuthenticationSchemes(HttpRequest Request)
        {
            return this.authentication;
        }
 
    }
}