AccountUser.cs

using System;
using System.Collections.Generic;
using System.Text;
using System.Threading.Tasks;
using Waher.Content;
using Waher.IoTGateway;
using Waher.Networking.SMTP.Server;
using Waher.Security.JWT;
using Waher.Security.Users;
using Waher.Things;
 
namespace Waher.Service.IoTBroker.DataStorage
{
    public class AccountUser : IUserWithClaims, IRequestOrigin
    {
        private readonly Account account;
 
        public AccountUser(Account Account)
        {
            this.account = Account;
        }
 
        public Account Account => this.account;
 
        public string UserName => this.account.UserName;
 
        public string FederatedUserName => this.account.UserName + "@" + Gateway.Domain;
 
        public string FriendlyName
        {
            get
            {
                string s = this.account.FullName;
                return string.IsNullOrEmpty(s) ? this.UserName : s;
            }
        }
 
        public string PasswordHash => this.account.Password;
 
        public string PasswordHashType => string.Empty;
 
        public bool HasPrivilege(string Privilege)
        {
            return this.account.HasPrivilege(Privilege);
        }
 
        public Task<RequestOrigin> GetOrigin()
        {
            return Task.FromResult(new RequestOrigin(this.UserName + "@" + Gateway.Domain, null, null, null, this));
        }
 
        public async Task<IEnumerable<KeyValuePair<string, object>>> CreateClaims(bool Encrypted)
        {
            if (!this.account.Enabled)
                return null;
 
            int IssuedAt = (int)Math.Round(DateTime.UtcNow.Subtract(JSON.UnixEpoch).TotalSeconds);
            int Expires = IssuedAt + 3600;
 
            List<KeyValuePair<string, object>> Claims = new List<KeyValuePair<string, object>>()
            {
                new KeyValuePair<string, object>(JwtClaims.JwtId, Convert.ToBase64String(Gateway.NextBytes(32))),
                new KeyValuePair<string, object>(JwtClaims.Subject, this.account.UserName + "@" + Gateway.Domain),
                new KeyValuePair<string, object>(JwtClaims.IssueTime, IssuedAt),
                new KeyValuePair<string, object>(JwtClaims.ExpirationTime, Expires),
                new KeyValuePair<string, object>(JwtClaims.Issuer, Gateway.Domain)
            };
 
            if (Encrypted)
            {
                if (!string.IsNullOrWhiteSpace(this.account.EMail))
                    Claims.Add(new KeyValuePair<string, object>(JwtClaims.EMail, this.account.EMail));
 
                if (!string.IsNullOrWhiteSpace(this.account.PhoneNr))
                    Claims.Add(new KeyValuePair<string, object>(JwtClaims.PhoneNumber, this.account.PhoneNr));
 
                if (this.account.CanRelayMessages)
                    Claims.Add(new KeyValuePair<string, object>(JwtClaims.Entitlements, "+" + SmtpServer.SmtpRelayPrivilegeID.Replace(".", "\\.")));
 
                if ((this.account.RoleIds?.Length ?? 0) > 0)
                {
                    StringBuilder sb = null;
 
                    foreach (string RoleId in this.account.RoleIds)
                        User.AppendValue(ref sb, "\"" + RoleId + "\"", ", ");
 
                    Claims.Add(new KeyValuePair<string, object>(JwtClaims.Roles, sb?.ToString()));
 
                    sb = null;
 
                    foreach (Role Role in await this.account.LoadRoles())
                    {
                        foreach (PrivilegePattern Privilege in Role.Privileges)
                        {
                            if (Privilege.Include)
                                User.AppendValue(ref sb, "+" + Privilege.Expression, Environment.NewLine);
                            else
                                User.AppendValue(ref sb, "-" + Privilege.Expression, Environment.NewLine);
                        }
                    }
 
                    Claims.Add(new KeyValuePair<string, object>(JwtClaims.Entitlements, sb?.ToString()));
                }
            }
 
            return Claims;
        }
 
        public async Task<string> CreateToken(JwtFactory Factory, bool Encrypted,
            params KeyValuePair<string, object>[] AdditionalClaims)
        {
            IEnumerable<KeyValuePair<string, object>> Claims = await this.CreateClaims(Encrypted);
            if (Claims is null)
                return null;
 
            Claims = JwtFactory.JoinClaims(Claims, AdditionalClaims);
            return Factory.Create(Claims);
        }
    }
}