LegalSignature.cs

using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Waher.Content;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Networking.HTTP.HeaderFields;
using Waher.Networking.XMPP.Server;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Script;
using Waher.Security;
using Waher.Security.LoginMonitor;
using Waher.Service.IoTBroker.Legal.Attachments;
 
namespace Waher.Service.IoTBroker.Legal.Identity
{
    public class LegalSignature : HttpAuthenticationScheme
    {
        private readonly Dictionary<string, DateTime> expirationByNonce = new Dictionary<string, DateTime>();
        private readonly SortedDictionary<DateTime, string> nonceByExpiration = new SortedDictionary<DateTime, string>();
        private readonly LegalComponent legalComponent;
        private readonly string realm;
 
        public LegalSignature(string Realm, LegalComponent LegalComponent)
            : base(false, 0)
        {
            this.realm = Realm;
            this.legalComponent = LegalComponent;
        }
 
        public override bool UserSessions => true;
 
        public override string GetChallenge()
        {
            string Nonce = Convert.ToBase64String(Gateway.NextBytes(128));
            DateTime Expires = DateTime.Now.AddMinutes(1);
 
            while (true)
            {
                lock (this)
                {
                    if (!this.nonceByExpiration.ContainsKey(Expires))
                    {
                        this.expirationByNonce[Nonce] = Expires;
                        this.nonceByExpiration[Expires] = Nonce;
                        break;
                    }
                }
 
                byte[] b = Gateway.NextBytes(1);
 
                Expires = Expires.AddTicks(b[0] & 15);
            }
 
            return "NeuroFoundation.Sign realm=\"" + this.realm + "\", n=\"" + Nonce + "\"";
        }
 
        public override async Task<IUser> IsAuthenticated(HttpRequest Request)
        {
            if (!(Request.Session is null) &&
                Request.Session.TryGetVariable("User", out Variable v) &&
                v.ValueObject is IUser User &&
                (User is LegalIdentityUser || User.HasPrivilege("Legal.Attachments")))
            {
                return User;
            }
 
            HttpFieldAuthorization Authorization = Request.Header.Authorization;
            if (!(Authorization is null) && Authorization.Value.StartsWith("NeuroFoundation.Sign ", StringComparison.CurrentCultureIgnoreCase))
            {
                string FullJid = null;
                string Realm = null;
                string NonceStr = null;
                string SignatureStr = null;
 
                foreach (KeyValuePair<string, string> P in CommonTypes.ParseFieldValues(Authorization.Value.Substring(21)))
                {
                    switch (P.Key.ToLower())
                    {
                        case "jid":
                            FullJid = P.Value;
                            break;
 
                        case "realm":
                            Realm = P.Value;
                            break;
 
                        case "n":
                            NonceStr = P.Value;
                            break;
 
                        case "s":
                            SignatureStr = P.Value;
                            break;
                    }
                }
 
                if (this.realm != Realm || NonceStr is null || SignatureStr is null || FullJid is null)
                    return null;
 
                DateTime TP = DateTime.Now;
 
                lock (this)
                {
                    LinkedList<DateTime> ToRemove = null;
 
                    foreach (KeyValuePair<DateTime, string> Pair in this.nonceByExpiration)
                    {
                        if (Pair.Key <= TP)
                        {
                            if (ToRemove is null)
                                ToRemove = new LinkedList<DateTime>();
 
                            ToRemove.AddLast(Pair.Key);
                            this.expirationByNonce.Remove(Pair.Value);
                        }
                        else
                            break;
                    }
 
                    if (!(ToRemove is null))
                    {
                        foreach (DateTime ExpiryDate in ToRemove)
                            this.nonceByExpiration.Remove(ExpiryDate);
                    }
 
                    if (!this.expirationByNonce.TryGetValue(NonceStr, out TP))
                        return null;
 
                    if (Request.Header.Method != "HEAD")
                    {
                        this.expirationByNonce.Remove(NonceStr);
                        this.nonceByExpiration.Remove(TP);
                    }
                }
 
                XmppAddress From = new XmppAddress(FullJid);
                byte[] Nonce = Convert.FromBase64String(NonceStr);
                byte[] Signature = Convert.FromBase64String(SignatureStr);
                (LegalIdentity Identity, _) = await this.legalComponent.ValidateSenderSignature(From, null, TP, Nonce, Signature, null);
 
                if (Identity is null)
                {
                    if (Request.Resource is AttachmentsResource)
                    {
                        string AttachmentId = Request.SubPath.Substring(1);
 
                        foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                            new FilterFieldEqualTo("Account", From.Account),
                            new FilterFieldEqualTo("State", IdentityState.Created))))
                        {
                            if (ID.Attachments is null)
                                continue;
 
                            foreach (AttachmentReference Attachment in ID.Attachments)
                            {
                                if (Attachment.Id == AttachmentId)
                                {
                                    Identity = ID;
                                    break;
                                }
                            }
 
                            if (!(Identity is null))
                                break;
                        }
                    }
                }
                else if (Identity.State != IdentityState.Approved)
                    Identity = null;
 
                if (Identity is null)
                {
                    LoginAuditor.Fail("Login attempt failed.", From.BareJid, Request.RemoteEndPoint, "HTTP");
                    return null;
                }
                else
                {
                    LoginAuditor.Success("Login successful.", From.BareJid, Request.RemoteEndPoint, "HTTP");
                    return await LegalIdentityUser.Create(Identity, From, this.legalComponent);
                }
            }
 
            return null;
        }
 
    }
}