Recover.cs

using System;
using System.Collections.Generic;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using System.Web;
using System.Xml;
using Waher.Content;
using Waher.Content.Markdown;
using Waher.Content.Xml;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Script;
using Waher.Script.Abstraction.Elements;
using Waher.Security.LoginMonitor;
using Waher.Service.IoTBroker.DataStorage;
using Waher.Service.IoTBroker.Legal;
using Waher.Service.IoTBroker.Legal.Identity;
using Waher.Service.IoTBroker.Legal.MFA;
 
namespace Waher.Service.IoTBroker.WebServices.Agent.Account
{
    public class Recover : AgentPostResource
    {
        public Recover()
            : base("Account/Recover",
                new KeyValuePair<Type, Expression>(typeof(Dictionary<string, object>), new Expression(jsonPattern)),
                new KeyValuePair<Type, Expression>(typeof(XmlDocument), new Expression(xmlPattern)))
        {
        }
 
        private static readonly string jsonPattern = Resources.LoadResourceAsText(typeof(Recover).Namespace + ".JSON.Recover.req");
        private static readonly string xmlPattern = Resources.LoadResourceAsText(typeof(Recover).Namespace + ".XML.Recover.req");
 
        public override HttpAuthenticationScheme[] GetAuthenticationSchemes(HttpRequest Request)
        {
            return null;
        }
 
        public override async Task POST(HttpRequest Request, HttpResponse Response, Dictionary<string, IElement> Parameters)
        {
            await this.CheckBlocks(Request);
 
            string UserName = (string)Parameters["PUserName"]?.AssociatedObjectValue ?? string.Empty;
            string PersonalNr = (string)Parameters["PPersonalNr"]?.AssociatedObjectValue ?? string.Empty;
            string Country = (string)Parameters["PCountry"]?.AssociatedObjectValue ?? string.Empty;
            string EMail = (string)Parameters["PEMail"]?.AssociatedObjectValue ?? string.Empty;
            string PhoneNr = (string)Parameters["PPhoneNr"]?.AssociatedObjectValue ?? string.Empty;
 
            if (string.IsNullOrEmpty(UserName) && string.IsNullOrEmpty(PersonalNr))
                throw new BadRequestException("Either User Name or Personal Number with a corresponding country must be provided.");
 
            if (string.IsNullOrEmpty(EMail) && string.IsNullOrEmpty(PhoneNr))
                throw new BadRequestException("Either e-Mail or Phone Number must be provided.");
 
            Create.AssertUserNameValid(UserName);
 
            LinkedList<LegalIdentity> Matches = new LinkedList<LegalIdentity>();
            NamedDictionary<string, object> Result = new NamedDictionary<string, object>(
                "RecoverResponse", "https://waher.se/Schema/BrokerAgent.xsd");
            DataStorage.Account Account = null;
 
            if (!string.IsNullOrEmpty(UserName))
            {
                Account = await Database.FindFirstIgnoreRest<DataStorage.Account>(
                    new FilterFieldEqualTo("UserName", UserName));
 
                if (Account is null)
                {
                    LoginAuditor.Fail("User tried to recover account that does not exist.", UserName, Request.RemoteEndPoint, "HTTPS");
 
                    await Response.Return(Result);
                    return;
                }
            }
 
            if (string.IsNullOrEmpty(PersonalNr))
            {
                foreach (LegalIdentity Identity in await Database.Find<LegalIdentity>(
                    new FilterFieldEqualTo("Account", UserName)))
                {
                    Matches.AddLast(Identity);
                }
            }
            else
            {
                IEnumerable<LegalIdentityReference> References = await Database.Find<LegalIdentityReference>(
                    new FilterAnd(
                    new FilterFieldEqualTo("Country", Country),
                    new FilterFieldEqualTo("PNr", PersonalNr)));
                bool Match = false;
 
                foreach (LegalIdentityReference Reference in References)
                {
                    if (!(XmppServerModule.Legal is null) && !XmppServerModule.Legal.IsComponentDomain(Reference.Provider, true))
                        continue;
 
                    LegalIdentity Identity = await Database.FindFirstIgnoreRest<LegalIdentity>(
                        new FilterFieldEqualTo("Id", Reference.LegalId));
 
                    if (Identity is null)
                        continue;
 
                    Matches.AddLast(Identity);
 
                    if (Account is null)
                    {
                        if (string.IsNullOrEmpty(UserName))
                        {
                            UserName = Identity.Account;
                            Match = true;
                        }
                        else if (UserName != Identity.Account)
                        {
                            LoginAuditor.Fail("Account recovery failed. Provided personal number that matches multiple accounts.", UserName, Request.RemoteEndPoint, "HTTPS");
 
                            throw new UnprocessableEntityException("Multiple accounts registered for that person on the server. You need to specify which account you want to recover.");
                        }
                    }
                    else if (Account.UserName == Identity.Account)
                        Match = true;
                    else
                        continue;
                }
 
                if (!Match)
                {
                    if (Account is null)
                        LoginAuditor.Fail("Account recovery failed. Provided personal number does not match any account.", UserName, Request.RemoteEndPoint, "HTTPS");
                    else
                        LoginAuditor.Fail("Account recovery failed. Provided personal number does not match provided account.", UserName, Request.RemoteEndPoint, "HTTPS");
 
                    await Response.Return(Result);
                    return;
                }
 
                if (Account is null)
                {
                    Account = await Database.FindFirstIgnoreRest<DataStorage.Account>(
                        new FilterFieldEqualTo("UserName", UserName));
 
                    if (Account is null)
                    {
                        LoginAuditor.Fail("User tried to recover account that does not exist.", UserName, Request.RemoteEndPoint, "HTTPS");
 
                        await Response.Return(Result);
                        return;
                    }
                }
            }
 
            if (!string.IsNullOrEmpty(EMail) && Account.EMail != EMail)
            {
                LoginAuditor.Fail("User tried to recover account using wrong e-mail.", UserName, Request.RemoteEndPoint, "HTTPS");
 
                await Response.Return(Result);
                return;
            }
 
            if (!string.IsNullOrEmpty(PhoneNr))
            {
                bool PhoneNrMatches = false;
 
                foreach (LegalIdentity Identity in Matches)
                {
                    string s = Identity["PHONE"];
                    if (string.IsNullOrEmpty(s))
                        continue;
 
                    if (ComparePhoneNumbers(s, PhoneNr))
                    {
                        PhoneNrMatches = true;
                        break;
                    }
                }
 
                if (!PhoneNrMatches)
                {
                    LoginAuditor.Fail("User tried to recover account using wrong phone number.", UserName, Request.RemoteEndPoint, "HTTPS");
 
                    await Response.Return(Result);
                    return;
                }
            }
 
            if (string.IsNullOrEmpty(Account.EMail))
                throw new ServiceUnavailableException("Account does not have a registered e-mail address to send recovery information to.");
 
            LoginAuditor.Success("Account recovery validation successful.", UserName, Request.RemoteEndPoint, "HTTPS");
 
            if (Matches.First is null)
            {
                StringBuilder Xml = new StringBuilder();
 
                Xml.Append("<Account xmlns=\"http://waher.se/schema/Onboarding/v1.xsd\" userName=\"");
                Xml.Append(XML.Encode(Account.UserName));
                Xml.Append("\" password=\"");
                Xml.Append(XML.Encode(Account.Password));
                Xml.Append("\" domain=\"");
                Xml.Append(XML.Encode(Gateway.Domain));
                Xml.Append("\"/>");
 
                byte[] Data = Encoding.UTF8.GetBytes(Xml.ToString());
                byte[] Key = Gateway.NextBytes(16);
                byte[] IV = Gateway.NextBytes(16);
                byte[] Encrypted;
 
                using (Aes Aes = Aes.Create())
                {
                    Aes.BlockSize = 128;
                    Aes.KeySize = 256;
                    Aes.Mode = CipherMode.CBC;
                    Aes.Padding = PaddingMode.PKCS7;
 
                    using (ICryptoTransform Transform = Aes.CreateEncryptor(Key, IV))
                    {
                        Encrypted = Transform.TransformFinalBlock(Data, 0, Data.Length);
                    }
                }
 
                Xml.Clear();
 
                Xml.Append("<Info xmlns=\"http://waher.se/schema/Onboarding/v1.xsd\" base64=\"");
                Xml.Append(Convert.ToBase64String(Encrypted));
                Xml.Append("\" once=\"true\" expires=\"");
                Xml.Append(XML.Encode(DateTime.Now.AddHours(1).ToUniversalTime()));
                Xml.Append("\"/>");
 
                string OnboardingDomainName = await LegalComponent.GetOnboardingNeuronDomainName();
                XmlElement E = await Gateway.XmppClient.IqSetAsync("onboarding." + OnboardingDomainName, Xml.ToString());
                string Code = E.GetAttribute("code");
 
                Xml.Clear();
 
                Xml.Append("obinfo:");
                Xml.Append(OnboardingDomainName);
                Xml.Append(":");
                Xml.Append(Code);
                Xml.Append(":");
                Xml.Append(Convert.ToBase64String(Key));
                Xml.Append(":");
                Xml.Append(Convert.ToBase64String(IV));
 
                string Url = Xml.ToString();
                StringBuilder Markdown = new StringBuilder();
 
                Markdown.AppendLine("Account recovery");
                Markdown.AppendLine("===================");
                Markdown.AppendLine();
                Markdown.AppendLine("Someone has requested to recover access to your TAG ID account.");
                Markdown.AppendLine("If this is not you, you can ignore this message, and the account will not be affected.");
                Markdown.AppendLine("If it is you that has requested to recover your account, scan the following QR code to get access to the account.");
                Markdown.AppendLine("If you view this e-mail in the phone containing the TAG ID app (or derivative), you can also click on the QR code itself.");
                Markdown.AppendLine("This recovery code is only valid for one hour.");
                Markdown.AppendLine();
                Markdown.Append("![Recovery Code](");
                Markdown.Append(Gateway.GetUrl("/QR/" + HttpUtility.UrlEncode(Url)));
                Markdown.AppendLine(")");
                Markdown.AppendLine();
                Markdown.Append("If you have any questions, please let us know through our [feedback page](");
                Markdown.Append(Gateway.GetUrl("/Feedback.md"));
                Markdown.AppendLine(").");
 
                await XmppServerModule.SendMailMessage(Account.EMail, "Account recovery", Markdown.ToString());
            }
            else
            {
                LegalIdentity[] Reviewers = null;
                LegalIdentity Latest = null;
                LegalIdentity LatestApproved = null;
 
                foreach (LegalIdentity Identity in Matches)
                {
                    if (Latest is null || Identity.Created > Latest.Created)
                        Latest = Identity;
 
                    if (Identity.State != IdentityState.Approved)
                        continue;
 
                    if (LatestApproved is null || Identity.Created > LatestApproved.Created)
                        LatestApproved = Identity;
                }
 
                if (!(LatestApproved is null) && !(LatestApproved.Attachments is null))
                    Reviewers = await LegalComponent.GetPeerReviewers(LatestApproved);
 
                // TODO: Send signature request to reviewers
 
                //if (Reviewers is null || 
                //  Reviewers.Length == 0 || 
                //  !LegalIdentityConfiguration.HasApprovedLegalIdentities ||
                //  Gateway.ContractsClient is null)
                //{
                StringBuilder Markdown = new StringBuilder();
 
                Markdown.AppendLine("User requests account recovery");
                Markdown.AppendLine("==================================");
                Markdown.AppendLine();
                Markdown.AppendLine("Someone has requested to recover access to an account.");
                Markdown.AppendLine("Following is some information provided in the request.");
                Markdown.AppendLine();
                Markdown.AppendLine("| Provided by user ||");
                Markdown.AppendLine("|:--------|:--------|");
                Markdown.Append("| User Name | `");
                Markdown.Append(UserName);
                Markdown.AppendLine("` |");
                Markdown.Append("| Personal Number | `");
                Markdown.Append(PersonalNr);
                Markdown.AppendLine("` |");
                Markdown.Append("| Country | `");
                Markdown.Append(Country);
                Markdown.AppendLine("` |");
                Markdown.Append("| e-mail | <mailto:");
                Markdown.Append(EMail);
                Markdown.AppendLine("> |");
                Markdown.Append("| Phone Number | <tel:");
                Markdown.Append(PhoneNr);
                Markdown.AppendLine("> |");
                Markdown.AppendLine();
 
                IP4Localization Locale = await XmppServerModule.FindIpAddress(Request.RemoteEndPoint);
                if (!(Locale is null))
                {
                    Markdown.AppendLine("| Remote Endpoint  ||");
                    Markdown.AppendLine("|:--------|:--------|");
                    Markdown.Append("| Country Code | ");
                    Markdown.Append(MarkdownDocument.Encode(Locale.CountryCode));
                    Markdown.AppendLine(" |");
                    Markdown.Append("| Country | ");
                    Markdown.Append(MarkdownDocument.Encode(Locale.Country));
                    Markdown.AppendLine(" |");
                    Markdown.Append("| Region | ");
                    Markdown.Append(MarkdownDocument.Encode(Locale.Region));
                    Markdown.AppendLine(" |");
                    Markdown.Append("| City | ");
                    Markdown.Append(MarkdownDocument.Encode(Locale.City));
                    Markdown.AppendLine(" |");
                }
                else
                    Markdown.AppendLine("No information found about IP address.");
 
                Markdown.AppendLine();
 
                if (!(LatestApproved is null))
                {
                    Markdown.AppendLine("| Latest Approved ID ||");
                    Markdown.AppendLine("|:---------|:---------|");
                    Markdown.Append("| ID | [");
                    Markdown.Append(MarkdownDocument.Encode(LatestApproved.Id));
                    Markdown.Append("](");
                    Markdown.Append(Gateway.GetUrl("/ValidateLegalId.md"));
                    Markdown.Append("?ID=");
                    Markdown.Append(HttpUtility.UrlEncode(LatestApproved.Id));
                    Markdown.AppendLine("&Purpose=Review%20recovery%20application) |");
 
                    LegalComponent.Output(Markdown, LatestApproved.GetTags(false), false);
                }
                else if (!(Latest is null))
                {
                    Markdown.AppendLine("| Latest ID (not approved) ||");
                    Markdown.AppendLine("|:------------|:------------|");
                    Markdown.Append("| ID | [");
                    Markdown.Append(MarkdownDocument.Encode(Latest.Id));
                    Markdown.Append("](");
                    Markdown.Append(Gateway.GetUrl("/ValidateLegalId.md"));
                    Markdown.Append("?ID=");
                    Markdown.Append(HttpUtility.UrlEncode(Latest.Id));
                    Markdown.AppendLine("&Purpose=Review%20recovery%20application) |");
 
                    LegalComponent.Output(Markdown, Latest.GetTags(false), false);
                }
                else
                    Markdown.AppendLine("No Legal ID found.");
 
                await Gateway.SendNotification(Markdown.ToString());
                //}
                //else
                //{
                //  Gateway.ContractsClient.PetitionSignatureAsync()
                //}
            }
 
            await Response.Return(Result);
        }
 
        private static bool ComparePhoneNumbers(string Nr1, string Nr2)
        {
            return OnlyDigits(Nr1) == OnlyDigits(Nr2);
        }
 
        private static string OnlyDigits(string s)
        {
            StringBuilder sb = new StringBuilder();
 
            foreach (char ch in s)
            {
                if (char.IsDigit(ch))
                    sb.Append(ch);
            }
 
            return sb.ToString();
        }
    }
}