SignData.cs

using System;
using System.Collections.Generic;
using System.Text;
using System.Threading.Tasks;
using System.Xml;
using Waher.Content;
using Waher.Networking.HTTP;
using Waher.Networking.XMPP.P2P.E2E;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.IO;
using Waher.Script;
using Waher.Script.Abstraction.Elements;
using Waher.Security;
using Waher.Service.IoTBroker.DataStorage;
using Waher.Service.IoTBroker.Legal;
using Waher.Service.IoTBroker.Legal.Identity;
using Waher.Service.IoTBroker.WebServices.Agent.Crypto;
 
namespace Waher.Service.IoTBroker.WebServices.Agent.Legal
{
    public class SignData : AgentPostResource
    {
        public SignData()
            : base("Legal/SignData",
                new KeyValuePair<Type, Expression>(typeof(Dictionary<string, object>), new Expression(jsonPattern)),
                new KeyValuePair<Type, Expression>(typeof(XmlDocument), new Expression(xmlPattern)))
        {
        }
 
        private static readonly string jsonPattern = Resources.LoadResourceAsText(typeof(SignData).Namespace + ".JSON.SignData.req");
        private static readonly string xmlPattern = Resources.LoadResourceAsText(typeof(SignData).Namespace + ".XML.SignData.req");
 
        public override bool Synchronous => false;
 
        public override async Task POST(HttpRequest Request, HttpResponse Response, Dictionary<string, IElement> Parameters)
        {
            AccountUser User = AssertUserAuthenticated(Request);
 
            string KeyId = (string)Parameters["PKeyId"].AssociatedObjectValue;
            CaseInsensitiveString LegalId = (string)Parameters["PLegalId"].AssociatedObjectValue;
            string DataBase64 = (string)Parameters["PDataBase64"].AssociatedObjectValue;
            string KeySignature = (string)Parameters["PKeySignature"].AssociatedObjectValue;
            string RequestSignature = (string)Parameters["PRequestSignature"].AssociatedObjectValue;
            byte[] Data;
 
            if (string.IsNullOrEmpty(KeyId))
                throw new BadRequestException("Key ID cannot be empty.");
 
            try
            {
                Data = Convert.FromBase64String(DataBase64);
            }
            catch (Exception)
            {
                throw new BadRequestException("Invalid base64-encoded data.");
            }
 
            LegalIdentity Identity = await LegalComponent.GetLocalLegalIdentity(LegalId)
                ?? throw new NotFoundException("Legal identity not found.");
 
            if (Identity.Account != User.UserName)
                throw new ForbiddenException(Request, "Only allowed to add attachments to your own legal identities.");
 
            if (Identity.State != IoTBroker.Legal.Identity.IdentityState.Approved)
                throw new ForbiddenException(Request, "Legal Identity not approved.");
 
            AgentKey AgentKey = await Database.FindFirstDeleteRest<AgentKey>(new FilterAnd(
                new FilterFieldEqualTo("Account", User.UserName),
                new FilterFieldEqualTo("Id", KeyId)))
                ?? throw new NotFoundException("Key not found.");
 
            StringBuilder sb = new StringBuilder();
 
            sb.Append(User.UserName);
            sb.Append(':');
            sb.Append(Request.Header.Host.Value);
            sb.Append(':');
            sb.Append(AgentKey.LocalName);
            sb.Append(':');
            sb.Append(AgentKey.Namespace);
            sb.Append(':');
            sb.Append(KeyId);
 
            //string s1 = sb.ToString();
 
            sb.Append(':');
            sb.Append(KeySignature);
 
            string s2 = sb.ToString();
 
            sb.Append(':');
            sb.Append(DataBase64);
            sb.Append(':');
            sb.Append(LegalId);
 
            string s3 = sb.ToString();
 
            string s = Convert.ToBase64String(
                Hashes.ComputeHMACSHA256Hash(
                    Encoding.UTF8.GetBytes(User.Account.Password),
                    Encoding.UTF8.GetBytes(s3)));
 
            if (s != RequestSignature)
            {
                string Msg = "Request Signature invalid.";
                throw new ForbiddenException(Request, Msg);
            }
 
            EllipticCurveEndpoint KeyEndpoint = ApplyId.GetEndpoint(Request, AgentKey, s2);
            byte[] Signature = KeyEndpoint.Sign(Data);
 
            await Response.Return(new NamedDictionary<string, object>("SignatureResponse", AgentNamespace)
            {
                { "Signature", Convert.ToBase64String(Signature) }
            });
        }
 
    }
}