RemoteLogin.cs

using Paiwise;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Waher.Content;
using Waher.Events;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Runtime.Collections;
using Waher.Runtime.Counters;
using Waher.Runtime.Inventory;
using Waher.Security;
using Waher.Security.JWT;
using Waher.Security.LoginMonitor;
 
namespace Waher.Service.IoTBroker.Legal.MFA
{
    public enum RemoteLoginResponseMethod
    {
        DelayedResponse,
 
        Poll,
 
        Callback,
 
        WebSocketEvent
    }
 
    public class RemoteLogin : HttpAsynchronousResource, IHttpGetMethod, IHttpPostMethod
    {
        private readonly Dictionary<string, bool> pendingPetitions = new Dictionary<string, bool>();
 
        public RemoteLogin()
            : base("/RemoteLogin")
        {
        }
 
        public override bool HandlesSubPaths => false;
 
        public override bool UserSessions => false;
 
        public bool AllowsGET => true;
 
        public bool AllowsPOST => true;
 
        public override HttpAuthenticationScheme[] GetAuthenticationSchemes(HttpRequest Request)
        {
            return XmppServerModule.Instance.DefaultAuthenticationSchemesAdmin;
        }
 
        public override Task OPTIONS(HttpRequest Request, HttpResponse Response)
        {
            Gateway.Root.SetDefaultResponseHeaders(Response);
            return base.OPTIONS(Request, Response);
        }
 
        public async Task GET(HttpRequest Request, HttpResponse Response)
        {
            string Location = "/Documentation/Neuron/RemoteLogin.md";
 
            if (!Gateway.TryGetLocalResourceFileName(Location, Gateway.Domain, out _))
            {
                string Domain = await LegalComponent.GetOnboardingNeuronDomainName();
                Location = "https://" + Domain + Location;
            }
 
            await Response.SendResponse(new FoundException(Location));
        }
 
        public async Task POST(HttpRequest Request, HttpResponse Response)
        {
            string Key = null;
            bool PreviousFailed = false;
 
            try
            {
                IUser User = Request.User;
                if (User is null)
                {
                    await Response.SendResponse(new ForbiddenException(Request, "Unauthorized access prohibited: No user authenticated"));
                    return;
                }
 
                if (!Request.HasData)
                {
                    await Response.SendResponse(new BadRequestException("No data provided in post."));
                    return;
                }
 
                ContentResponse Content = await Request.DecodeDataAsync();
 
                if (Content.HasError)
                {
                    await Response.SendResponse(Content.Error);
                    return;
                }
 
                if (!(Content.Decoded is Dictionary<string, object> Json))
                {
                    await Response.SendResponse(new BadRequestException("Expected JSON object."));
                    return;
                }
 
                #region Polling status of Petition
 
                Uri ChallengeUri;
 
                if (Json.TryGetValue("PetitionId", out object Obj))
                {
                    if (!(Obj is string PetitionId2))
                    {
                        await Response.SendResponse(new BadRequestException("Invalid PetitionId."));
                        return;
                    }
 
                    if (!XmppServerModule.Legal.TryGetItemFromCache(PetitionId2 + "|petition", out Obj) ||
                        !(Obj is PetitionInfo PetitionInfo))
                    {
                        await Response.SendResponse(new NotFoundException("Petition not found, or rejected."));
                        return;
                    }
 
                    if (User.UserName != PetitionInfo.User.UserName)
                    {
                        await Response.SendResponse(new ForbiddenException(Request, "Access to petition denied."));
                        return;
                    }
 
                    bool Pending = string.IsNullOrEmpty(PetitionInfo.Token);
 
                    Dictionary<string, object> ResponseObject = new Dictionary<string, object>
                    {
                        { "Pending", Pending },
                        { "Token", PetitionInfo.Token },
                    };
 
                    if (Pending)
                    {
                        ChallengeUri = await PetitionInfo.RemoteAuthentication.GetChallengeUri(
                            PetitionInfo.Purpose, PetitionInfo.RemoteEndPoint);
 
                        if (!(ChallengeUri is null))
                            ResponseObject["ChallengeUri"] = ChallengeUri.ToString();
                    }
 
                    await Response.Return(ResponseObject);
 
                    return;
                }
 
                #endregion
 
                #region LoginAuditor Integration
 
                if (!Json.TryGetValue("RemoteEndPoint", out Obj) ||
                    !(Obj is string RemoteEndPoint) ||
                    string.IsNullOrEmpty(RemoteEndPoint) ||
                    RemoteEndPoint.Length > 128)
                {
                    RemoteEndPoint = Request.RemoteEndPoint;
                }
 
                DateTime? Next = await Gateway.LoginAuditor.GetEarliestLoginOpportunity(RemoteEndPoint, "RemoteLogin");
                if (Next.HasValue)
                {
                    if (Next.Value == DateTime.MaxValue)
                    {
                        await Response.SendResponse(new ForbiddenException(
                            "Remote Endpoint (" + RemoteEndPoint + ") permanently blocked."));
 
                        return;
                    }
                    else
                    {
                        await Response.SendResponse(new TooManyRequestsException(
                            new Dictionary<string, object>()
                            {
                            { "RemoteEndPoint", RemoteEndPoint },
                            { "Next", Next.Value }
                            }));
 
                        return;
                    }
                }
 
                #endregion
 
                #region Validating or Refreshing Token
 
                if (Json.TryGetValue("Token", out Obj))
                {
                    if (!(Obj is string Token))
                    {
                        await Response.SendResponse(new BadRequestException("Invalid Token."));
                        return;
                    }
 
                    bool IsValid = XmppServerModule.Instance.ValidateJwtToken(Token, true,
                        out JwtToken ParsedToken);
 
                    if (!Json.TryGetValue("Seconds", out Obj) || !IsValid)
                    {
                        await Response.Return(new Dictionary<string, object>
                    {
                        { "Valid", IsValid }
                    });
                        return;
                    }
 
                    if (!(Obj is int Seconds2) ||
                        Seconds2 < 1 || Seconds2 > 3600)
                    {
                        await Response.SendResponse(new BadRequestException("Invalid number of seconds. Permitted range: 1-3600"));
                        return;
                    }
 
                    ChunkedList<KeyValuePair<string, object>> Claims = new ChunkedList<KeyValuePair<string, object>>();
                    int IssuedAt = (int)Math.Round(DateTime.UtcNow.Subtract(JSON.UnixEpoch).TotalSeconds);
                    int Expires = IssuedAt + Seconds2;
 
                    foreach (KeyValuePair<string, object> Claim in ParsedToken.Claims)
                    {
                        switch (Claim.Key)
                        {
                            case JwtClaims.JwtId:
                                Claims.Add(new KeyValuePair<string, object>(JwtClaims.JwtId,
                                    Convert.ToBase64String(Gateway.NextBytes(32))));
                                break;
 
                            case JwtClaims.IssueTime:
                                Claims.Add(new KeyValuePair<string, object>(JwtClaims.IssueTime, IssuedAt));
                                break;
 
                            case JwtClaims.ExpirationTime:
                                Claims.Add(new KeyValuePair<string, object>(JwtClaims.ExpirationTime, Expires));
                                break;
 
                            case JwtClaims.Audience:
                                if (User.UserName != Claim.Value?.ToString())
                                {
                                    await Response.SendResponse(new ForbiddenException(Request, "Not authorized to refresh token."));
                                    return;
                                }
 
                                Claims.Add(Claim);
                                break;
 
                            case JwtClaims.Actor:
                                Claims.Add(new KeyValuePair<string, object>(JwtClaims.Actor, RemoteEndPoint));
                                break;
 
                            default:
                                Claims.Add(Claim);
                                break;
                        }
                    }
 
                    Token = XmppServerModule.Instance.CreateJwtToken(Claims);
 
                    await Response.Return(new Dictionary<string, object>
                    {
                        { "Valid", IsValid },
                        { "Token", Token }
                    });
                    return;
                }
 
                #endregion
 
                #region Initiating new Petition
 
                if (!Json.TryGetValue("Seconds", out Obj))
                {
                    await Response.SendResponse(new BadRequestException("Seconds missing."));
                    return;
                }
 
                if (!(Obj is int Seconds) ||
                    Seconds < 1 || Seconds > 3600)
                {
                    await Response.SendResponse(new BadRequestException("Invalid number of seconds. Permitted range: 1-3600"));
                    return;
                }
 
                if (!Json.TryGetValue("ResponseMethod", out Obj))
                {
                    await Response.SendResponse(new BadRequestException("ResponseMethod missing."));
                    return;
                }
 
                if (!(Obj is string ResponseMethodStr) ||
                    !Enum.TryParse(ResponseMethodStr, true, out RemoteLoginResponseMethod ResponseMethod))
                {
                    await Response.SendResponse(new BadRequestException("Invalid ResponseMethod."));
                    return;
                }
 
                Uri CallbackUrl = null;
                string TabID = null;
                string Function = null;
 
                switch (ResponseMethod)
                {
                    case RemoteLoginResponseMethod.Callback:
                        if (!Json.TryGetValue("CallbackURL", out Obj))
                        {
                            await Response.SendResponse(new BadRequestException("CallbackURL missing."));
                            return;
                        }
 
                        if (!(Obj is string CallbackUrlStr) ||
                            string.IsNullOrEmpty(CallbackUrlStr) ||
                            !Uri.TryCreate(CallbackUrlStr, UriKind.Absolute, out CallbackUrl) ||
                            (string.Compare(CallbackUrl.Scheme, "https", true) != 0 &&
                            string.Compare(CallbackUrl.Scheme, "httpx", true) != 0))
                        {
                            await Response.SendResponse(new BadRequestException("Invalid CallbackURL."));
                            return;
                        }
                        break;
 
                    case RemoteLoginResponseMethod.WebSocketEvent:
                        if (!Json.TryGetValue("TabID", out Obj))
                        {
                            await Response.SendResponse(new BadRequestException("TabID missing."));
                            return;
                        }
 
                        if (!(Obj is string TabIDStr) ||
                            string.IsNullOrEmpty(TabIDStr))
                        {
                            await Response.SendResponse(new BadRequestException("Invalid Tab ID."));
                            return;
                        }
 
                        if (!Json.TryGetValue("Function", out Obj))
                        {
                            await Response.SendResponse(new BadRequestException("Function missing."));
                            return;
                        }
 
                        if (!(Obj is string FunctionStr) ||
                            string.IsNullOrEmpty(FunctionStr))
                        {
                            await Response.SendResponse(new BadRequestException("Invalid Function name."));
                            return;
                        }
 
                        TabID = TabIDStr;
                        Function = FunctionStr;
                        break;
                }
 
                string Privilege = nameof(RemoteLogin) + ".Method." + ResponseMethodStr;
                if (!User.HasPrivilege(Privilege))
                {
                    await Response.SendResponse(ForbiddenException.AccessDenied(Request, this.ResourceName, User.UserName, Privilege));
                    return;
                }
 
                if (!Json.TryGetValue("AddressType", out Obj))
                {
                    await Response.SendResponse(new BadRequestException("AddressType missing."));
                    return;
                }
 
                if (!(Obj is string AddressTypeStr))
                {
                    await Response.SendResponse(new BadRequestException("Invalid AddressType."));
                    return;
                }
 
                Privilege = nameof(RemoteLogin) + ".Type." + AddressTypeStr;
                if (!User.HasPrivilege(Privilege))
                {
                    await Response.SendResponse(ForbiddenException.AccessDenied(Request, this.ResourceName, User.UserName, Privilege));
                    return;
                }
 
                if (!Json.TryGetValue("Address", out Obj))
                {
                    await Response.SendResponse(new BadRequestException("Address missing."));
                    return;
                }
 
                if (!(Obj is string AddressStr))
                {
                    await Response.SendResponse(new BadRequestException("Invalid Address."));
                    return;
                }
 
                RemoteIdentifier RemoteIdentifier = new RemoteIdentifier(AddressTypeStr, AddressStr);
                IRemoteAuthenticator Authenticator = Types.FindBest<IRemoteAuthenticator, IRemoteIdentifier>(RemoteIdentifier);
 
                if (Authenticator is null)
                {
                    await Response.SendResponse(new BadRequestException("Unrecognized AddressType."));
                    return;
                }
 
                IRemoteAuthentication RemoteAuthentication = await Authenticator.CreateAuthentication(RemoteIdentifier);
 
                if (!await RemoteAuthentication.IsValidAddress())
                {
                    await Response.SendResponse(new BadRequestException("Address does not conform to address type."));
                    return;
                }
 
                if (!await RemoteAuthentication.IsLegalIdAvailable())
                {
                    await Response.SendResponse(new UnavailableForLegalReasonsException("Remote Address does not have a remote Legal ID associated with it."));
                    return;
                }
 
                if (!await RemoteAuthentication.IsPermitted(User))
                {
                    await Response.SendResponse(ForbiddenException.AccessDenied(Request, this.ResourceName, User.UserName, Privilege));
                    return;
                }
 
                if (!Json.TryGetValue("Purpose", out Obj))
                {
                    await Response.SendResponse(new BadRequestException("Purpose missing."));
                    return;
                }
 
                if (!(Obj is string Purpose) || string.IsNullOrEmpty(Purpose))
                {
                    await Response.SendResponse(new BadRequestException("Invalid Purpose."));
                    return;
                }
 
                if (!Purpose.Contains(User.UserName))
                    Purpose = User.UserName + ": " + Purpose;
 
                ChallengeUri = await RemoteAuthentication.GetChallengeUri(Purpose, RemoteEndPoint);
 
                if (!(ChallengeUri is null) && ResponseMethod == RemoteLoginResponseMethod.DelayedResponse)
                {
                    await Response.SendResponse(new BadRequestException("Method uses a Challenge URI, which is incompatible with the delayed response method."));
                    return;
                }
 
                // TODO: Properties & Attachments
 
                Key = RemoteEndPoint + " " + RemoteAuthentication.Key;
 
                lock (this.pendingPetitions)
                {
                    if (this.pendingPetitions.ContainsKey(Key))
                        PreviousFailed = true;
                    else
                        this.pendingPetitions[Key] = true;
                }
 
                if (PreviousFailed)
                {
                    LoginAuditor.Fail("Remote API repetitive Login attempt.",
                        User.UserName, RemoteEndPoint, "RemoteLogin",
                        new KeyValuePair<string, object>("Remote Identifier", RemoteAuthentication.Key));
                }
 
                await RuntimeCounters.IncrementCounter("RemoteLogin." + RemoteAuthentication.GetType().FullName);
 
                string PetitionId = string.Empty;
 
                PetitionId = await RemoteAuthentication.Start(Purpose, RemoteEndPoint,
                    async (_, e) =>
                    {
                        lock (this.pendingPetitions)
                        {
                            this.pendingPetitions.Remove(Key);
                        }
 
                        if (e.Ok)
                        {
                            int IssuedAt = (int)Math.Round(DateTime.UtcNow.Subtract(JSON.UnixEpoch).TotalSeconds);
                            int Expires = IssuedAt + Seconds;
 
                            string Token = XmppServerModule.Instance.CreateJwtToken(
                                new KeyValuePair<string, object>[]
                                {
                                    new KeyValuePair<string, object>(JwtClaims.JwtId, Convert.ToBase64String(Gateway.NextBytes(32))),
                                    new KeyValuePair<string, object>(JwtClaims.Issuer, Gateway.Domain.Value),
                                    new KeyValuePair<string, object>(JwtClaims.Subject, User.UserName),
                                    new KeyValuePair<string, object>(JwtClaims.Actor, RemoteEndPoint),
                                    new KeyValuePair<string, object>(JwtClaims.IssueTime, IssuedAt),
                                    new KeyValuePair<string, object>(JwtClaims.ExpirationTime, Expires)
                                }.Join(e.JwtClaims));
 
                            XmppServerModule.Legal.AddItemToCache(PetitionId + "|petition", new PetitionInfo()
                            {
                                PetitionId = PetitionId,
                                User = User,
                                Token = Token,
                                Purpose = Purpose,
                                RemoteEndPoint = RemoteEndPoint,
                                RemoteAuthentication = RemoteAuthentication
                            });
 
                            await this.ReturnResponse(ResponseMethod, Response, CallbackUrl,
                                TabID, Function, PetitionId, Token);
 
                            LoginAuditor.Success("Remote API Login successful.",
                                User.UserName, RemoteEndPoint, "RemoteLogin",
                                new KeyValuePair<string, object>("Remote Identifier", RemoteAuthentication.Key));
                        }
                        else
                        {
                            XmppServerModule.Legal.RemoveItemFromCache(PetitionId + "|petition");
 
                            await this.ReturnResponse(ResponseMethod, Response, CallbackUrl,
                                TabID, Function, PetitionId, null);
 
                            if (e.LogAuditFailure)
                            {
                                LoginAuditor.Fail(e.ErrorMessage,
                                    User.UserName, RemoteEndPoint, "RemoteLogin",
                                    new KeyValuePair<string, object>("Remote Identifier", RemoteAuthentication.Key));
                            }
                        }
                    },
                    null);
 
                if (ResponseMethod != RemoteLoginResponseMethod.DelayedResponse)
                {
                    XmppServerModule.Legal.AddItemToCache(PetitionId + "|petition", new PetitionInfo()
                    {
                        PetitionId = PetitionId,
                        User = User,
                        Token = null,
                        Purpose = Purpose,
                        RemoteEndPoint = RemoteEndPoint,
                        RemoteAuthentication = RemoteAuthentication
                    });
 
                    Dictionary<string, object> ResponseObject = new Dictionary<string, object>
                    {
                        { "PetitionId", PetitionId }
                    };
 
                    if (!(ChallengeUri is null))
                        ResponseObject["ChallengeUri"] = ChallengeUri.ToString();
 
                    await Response.Return(ResponseObject);
                    return;
                }
 
                #endregion
            }
            catch (Exception ex)
            {
                if (!string.IsNullOrEmpty(Key))
                {
                    lock (this.pendingPetitions)
                    {
                        this.pendingPetitions.Remove(Key);
                    }
                }
 
                Log.Exception(ex);
 
                await Response.SendResponse(new ServiceUnavailableException(
                    "Authentication service unavailable."));
            }
        }
 
        private async Task ReturnResponse(RemoteLoginResponseMethod Method,
            HttpResponse Response, Uri CallbackUrl, string TabID, string Function,
            string PetitionId, string TokenResult)
        {
            switch (Method)
            {
                case RemoteLoginResponseMethod.DelayedResponse:
                    if (string.IsNullOrEmpty(TokenResult))
                    {
                        await Response.SendResponse(new NotFoundException("Petition rejected."));
                        return;
                    }
                    else
                    {
                        await Response.Return(new Dictionary<string, object>
                        {
                            { "Pending", false },
                            { "Token", TokenResult }
                        });
                    }
                    break;
 
                case RemoteLoginResponseMethod.Callback:
                    await InternetContent.PostAsync(CallbackUrl,
                        new Dictionary<string, object>
                        {
                            { "PetitionId", PetitionId },
                            { "Rejected", string.IsNullOrEmpty(TokenResult) },
                            { "Token", TokenResult }
                        }, Gateway.Certificate);
                    break;
 
                case RemoteLoginResponseMethod.WebSocketEvent:
                    await ClientEvents.PushEvent(new string[] { TabID }, Function,
                        JSON.Encode(new Dictionary<string, object>
                        {
                            { "PetitionId", PetitionId },
                            { "Rejected", string.IsNullOrEmpty(TokenResult) },
                            { "Token", TokenResult }
                        }, false), true);
                    break;
            }
        }
 
        private class PetitionInfo
        {
            public string PetitionId;
            public IUser User;
            public string Token;
            public string Purpose;
            public string RemoteEndPoint;
            public IRemoteAuthentication RemoteAuthentication;
        }
    }
}