OAuthIntrospectionResource.cs

using System.Collections.Generic;
using System.Threading.Tasks;
using Waher.Content;
using Waher.Runtime.IO;
using Waher.Security.JWT;
 
namespace Waher.Networking.HTTP.OAuth
{
    public class OAuthIntrospectionResource : OAuthResource, IHttpPostMethod
    {
        public const string OAuthIntrospectionPrivilege = "OAUTH.Introspection";
 
        public const string DefaultResourcePath = "/oauth/introspect";
 
        public OAuthIntrospectionResource(OAuth2Environment Environment)
            : this(Environment, DefaultResourcePath)
        {
        }
 
        public OAuthIntrospectionResource(OAuth2Environment Environment,
            string ResourceName)
            : base(Environment, ResourceName)
        {
            Environment.Register(this);
        }
 
        public override HttpAuthenticationScheme[]? GetAuthenticationSchemes(HttpRequest Request)
        {
            this.InitAuthentication();
 
            return this.AuthenticationSchemes;
        }
 
        public bool AllowsPOST => true;
 
        public async Task POST(HttpRequest Request, HttpResponse Response)
        {
            if (!Request.HasData)
            {
                await BadRequest(Response, "invalid_request", "Missing payload.");
                return;
            }
 
            if (!Request.User?.HasPrivilege(OAuthIntrospectionPrivilege) ?? false)
            {
                await Response.SendResponse(ForbiddenException.AccessDenied(this.ResourceName,
                    Request.RemoteEndPoint.RemovePortNumber(), OAuthIntrospectionPrivilege));
                return;
            }
 
            ContentResponse Decoded = await Request.DecodeDataAsync();
            if (Decoded.HasError)
            {
                await Response.SendResponse(Decoded.Error);
                return;
            }
 
            if (!(Decoded.Decoded is Dictionary<string, string> Form))
            {
                await BadRequest(Response, "invalid_request", "Expected form data.");
                return;
            }
 
            if (!(Request.Header.Authorization is null) &&
                Form.ContainsKey("client_secret") || Form.ContainsKey("password"))
            {
                await BadRequest(Response, "invalid_request", "Multiple client credentials provided.");
                return;
            }
 
            if (!Form.TryGetValue("token", out string Token) || string.IsNullOrEmpty(Token))
            {
                await BadRequest(Response, "invalid_request", "Missing token.");
                return;
            }
 
            OAuthTokenType? TokenType;
            JwtToken? ParsedToken;
            bool Active;
 
            if (!this.Environment.HasTokenResource)
            {
                Active = false;
                ParsedToken = null;
                TokenType = null;
            }
            else
            {
                KeyValuePair<OAuthTokenType?, JwtToken?> P = await this.Environment.
                    TokenResource.TryGetTokenType(Token);
 
                TokenType = P.Key;
                ParsedToken = P.Value;
 
                Active = TokenType.HasValue && (
                    TokenType == OAuthTokenType.AccessToken ||
                    TokenType == OAuthTokenType.RefreshToken);
            }
 
            Dictionary<string, object> Result = new Dictionary<string, object>()
            {
                { "active", Active }
            };
 
            if (Active)
            {
                if (!(ParsedToken is null))
                {
                    foreach (KeyValuePair<string, object> P in ParsedToken.Claims)
                    {
                        Result[P.Key] = P.Value;
 
                        if (P.Key == JwtClaims.Subject)
                        {
                            if (P.Value is string UserName &&
                                !(await this.Environment.UserSource.TryGetUser(UserName) is null))
                            {
                                Result["username"] = UserName;
                            }
                        }
                    }
                }
 
                if (TokenType == OAuthTokenType.AccessToken ||
                    TokenType == OAuthTokenType.ExpiredAccessToken)
                {
                    Result["token_type"] = "Bearer";
                }
                else
                    Result["token_type"] = "N_A";
            }
 
            await Response.Return(Result);
        }
    }
}