ApplyId.cs

using System;
using System.Collections.Generic;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using System.Xml;
using Waher.Content;
using Waher.Content.Markdown;
using Waher.Events;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Networking.XMPP.P2P.E2E;
using Waher.Networking.XMPP.Server;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.Settings;
using Waher.Script;
using Waher.Script.Abstraction.Elements;
using Waher.Security;
using Waher.Service.IoTBroker.DataStorage;
using Waher.Service.IoTBroker.Legal;
using Waher.Service.IoTBroker.Legal.Identity;
using Waher.Service.IoTBroker.WebServices.Agent.Crypto;
 
namespace Waher.Service.IoTBroker.WebServices.Agent.Legal
{
    public class ApplyId : AgentPostResource
    {
        public ApplyId()
            : base("Legal/ApplyId",
                new KeyValuePair<Type, Expression>(typeof(Dictionary<string, object>), new Expression(jsonPattern)),
                new KeyValuePair<Type, Expression>(typeof(XmlDocument), new Expression(xmlPattern)))
        {
        }
 
        private static readonly string jsonPattern = Resources.LoadResourceAsText(typeof(ApplyId).Namespace + ".JSON.ApplyId.req");
        private static readonly string xmlPattern = Resources.LoadResourceAsText(typeof(ApplyId).Namespace + ".XML.ApplyId.req");
 
        public override async Task POST(HttpRequest Request, HttpResponse Response, Dictionary<string, IElement> Parameters)
        {
            AccountUser User = AssertUserAuthenticated(Request);
 
            string KeyId = (string)Parameters["PKeyId"].AssociatedObjectValue;
            string Nonce = (string)Parameters["PNonce"].AssociatedObjectValue;
            string KeySignature = (string)Parameters["PKeySignature"].AssociatedObjectValue;
            string RequestSignature = (string)Parameters["PRequestSignature"].AssociatedObjectValue;
            object[] PropertyNames = (object[])Parameters["PPropertyName"].AssociatedObjectValue;
            object[] PropertyValues = (object[])Parameters["PPropertyValue"].AssociatedObjectValue;
            Dictionary<CaseInsensitiveString, Property> PropertiesByName = new Dictionary<CaseInsensitiveString, Property>();
            List<Property> Properties = new List<Property>();
            StringBuilder sb = new StringBuilder();
            string Agent = Request.Header.Referer?.Value;
 
            if (string.IsNullOrEmpty(Agent))
                throw new BadRequestException("Missing Referer header.");
 
            if (string.IsNullOrEmpty(KeyId))
                throw new BadRequestException("Key ID cannot be empty.");
 
            if (string.IsNullOrEmpty(Nonce) || Nonce.Length < 32)
                throw new ForbiddenException("Nonce too short.");
 
            AgentKey AgentKey = await Database.FindFirstDeleteRest<AgentKey>(new FilterAnd(
                new FilterFieldEqualTo("Account", User.UserName),
                new FilterFieldEqualTo("Id", KeyId)))
                ?? throw new NotFoundException("Key not found.");
 
            sb.Append(User.UserName);
            sb.Append(':');
            sb.Append(Request.Header.Host.Value);
            sb.Append(':');
            sb.Append(AgentKey.LocalName);
            sb.Append(':');
            sb.Append(AgentKey.Namespace);
            sb.Append(':');
            sb.Append(KeyId);
 
            //string s1 = sb.ToString();
 
            sb.Append(':');
            sb.Append(KeySignature);
 
            string s2 = sb.ToString();
 
            sb.Append(':');
            sb.Append(Nonce);
 
            int i, c = PropertyNames?.Length ?? 0;
            if ((PropertyValues?.Length ?? 0) != c)
                throw new BadRequestException("Invalid Properties.");
 
            bool JidAdded = false;
            bool EMailAdded = false;
            bool PhoneNrAdded = false;
 
            for (i = 0; i < c; i++)
            {
                if (!(PropertyNames[i] is string PropertyName) || string.IsNullOrEmpty(PropertyName))
                    throw new BadRequestException("Invalid Property Name.");
 
                if (!(PropertyValues[i] is string PropertyValue) || string.IsNullOrEmpty(PropertyValue))
                    throw new BadRequestException("Invalid Property Value.");
 
                switch (PropertyName.ToUpper())
                {
                    case "AGENT":
                        throw new BadRequestException("AGENT property is reserved.");
 
                    case "JID":
                        int j = PropertyValue.IndexOf('@');
                        if (j < 0)
                            throw new BadRequestException("Invalid JID.");
 
                        if (PropertyValue.Substring(0, j) != User.UserName)
                            throw new BadRequestException("JID does not match sender Bare JID.");
 
                        if (!Gateway.IsDomain(PropertyValue.Substring(j + 1), true))
                            throw new BadRequestException("JID does not match sender Bare JID.");
 
                        JidAdded = true;
                        break;
 
                    case "EMAIL":
                        if (PropertyValue != User.Account.EMail && !string.IsNullOrEmpty(User.Account.EMail))
                            throw new BadRequestException("EMAIL does not match account e-mail.");
 
                        EMailAdded = true;
                        break;
 
                    case "PHONE":
                        if (PropertyValue != User.Account.PhoneNr && !string.IsNullOrEmpty(User.Account.PhoneNr))
                            throw new BadRequestException("PHONE does not match account phone number.");
 
                        PhoneNrAdded = true;
                        break;
                }
 
                Property Property = new Property(PropertyName, PropertyValue);
 
                if (PropertiesByName.ContainsKey(Property.Name))
                    throw new BadRequestException("Duplicate property.");
 
                Properties.Add(Property);
                PropertiesByName[Property.Name] = Property;
 
                sb.Append(':');
                sb.Append(Property.Name.Value);
                sb.Append(':');
                sb.Append(Property.Value.Value);
            }
 
            string s3 = sb.ToString();
 
            string s = Convert.ToBase64String(
                Hashes.ComputeHMACSHA256Hash(
                    Encoding.UTF8.GetBytes(User.Account.Password),
                    Encoding.UTF8.GetBytes(s3)));
 
            if (s != RequestSignature)
            {
                string Msg = "Request Signature invalid.";
                throw new ForbiddenException(Msg);
            }
 
            if (await this.Api.HasNonceBeenUsed(Nonce))
            {
                string Msg = "Nonce value has already been used.";
                throw new ForbiddenException(Msg);
            }
 
            await this.Api.RegisterNonceValue(Nonce);
 
            EllipticCurveEndpoint KeyEndpoint = GetEndpoint(AgentKey, s2);
            string BareJid = User.UserName + "@" + Gateway.Domain;
 
            if (!JidAdded)
                Properties.Add(new Property("JID", BareJid));
 
            if (!EMailAdded && !string.IsNullOrEmpty(User.Account.EMail))
                Properties.Add(new Property("EMAIL", User.Account.EMail));
 
            if (!PhoneNrAdded && !string.IsNullOrEmpty(User.Account.PhoneNr))
                Properties.Add(new Property("PHONE", User.Account.PhoneNr));
 
            Properties.Add(new Property("AGENT", Agent));
 
            DateTime TP = LegalComponent.NowSecond;
            DateTime From = TP.Date;
            CaseInsensitiveString LegalDomain = XmppServerModule.Legal?.MainDomain.Address ?? "legal.example.com";
 
            LegalIdentity Identity = new LegalIdentity()
            {
                Account = User.UserName,
                ClientKeyName = KeyEndpoint.LocalName,
                ClientPubKey = KeyEndpoint.PublicKey,
                Created = TP,
                Updated = DateTime.MinValue,
                From = From,
                To = From.AddMonths((int)await RuntimeSettings.GetAsync("LegalIdentity.Months", 24)),
                State = IdentityState.Created,
                Provider = LegalDomain,
                Properties = Properties.ToArray(),
                Version = NamespaceSet.Current
            };
 
            StringBuilder Xml = new StringBuilder();
            Identity.Serialize(Xml, false, false, false, false, false, false, false, null, XmppServerModule.Legal);
            Identity.ClientSignature = KeyEndpoint.Sign(Encoding.UTF8.GetBytes(Xml.ToString()));
 
            foreach (LegalIdentity ToRemove in await Database.FindDelete<LegalIdentity>(new FilterAnd(
                new FilterFieldEqualTo("Account", User.UserName),
                new FilterFieldEqualTo("State", IdentityState.Created))))
            {
                Log.Informational("Obsolete Legal Identity Registration deleted.",
                    ToRemove.Id.Value, BareJid, "LegalIdDeleted", ToRemove.GetTags());
            }
 
            await Database.Insert(Identity);
 
            Identity.Id = Identity.ObjectId + "@" + LegalDomain;
            Identity.Sign(XmppServerModule.Legal);  // Adds server signature
 
            await Database.Update(Identity);
 
            KeyValuePair<string, object>[] Tags = Identity.GetTags();
 
            Log.Informational("Legal Identity application registered.", Identity.Id.Value, BareJid,
                "LegalIdRegistered", Tags);
 
            XmppServerModule.Legal?.IdentityAuthorization(BareJid, BareJid, Identity.Id, true);
 
            Xml.Clear();
            Identity.Serialize(Xml, true, true, true, true, true, true, true, null, XmppServerModule.Legal);
            string IdentityXml = Xml.ToString();
 
            XmlDocument IdentityDoc = new XmlDocument()
            {
                PreserveWhitespace = true
            };
            IdentityDoc.LoadXml(IdentityXml);
 
            await Response.Return(new NamedDictionary<string, object>("IdentityResponse", AgentNamespace)
            {
                { "Identity", IdentityDoc }
            });
 
            StringBuilder Markdown = new StringBuilder();
 
            Markdown.Append("Legal identity application received: [`");
            Markdown.Append(Identity.Id);
            Markdown.Append("`](");
            Markdown.Append(Gateway.GetUrl("/LegalIdentity.md?Id="));
            Markdown.Append(Identity.Id);
            Markdown.AppendLine(")");
            Markdown.AppendLine();
            LegalComponent.Output(Markdown, Tags);
 
            await Gateway.SendNotification(Markdown.ToString());
 
            bool First = true;
 
            foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                new FilterFieldEqualTo("Account", Identity.Account),
                new FilterFieldNotEqualTo("Id", Identity.Id)), "Created"))
            {
                switch (ID.State)
                {
                    case IdentityState.Created:
                    case IdentityState.Approved:
                        if (First)
                        {
                            First = false;
                            Markdown.Clear();
                            Markdown.AppendLine("Other identities registered for the same account:");
 
                            await Gateway.SendNotification(Markdown.ToString());
                        }
 
                        Markdown.Clear();
 
                        Markdown.Append("[`");
                        Markdown.Append(ID.Id);
                        Markdown.Append("`](");
                        Markdown.Append(Gateway.GetUrl("/LegalIdentity.md?Id="));
                        Markdown.Append(ID.Id);
                        Markdown.AppendLine(")");
                        Markdown.AppendLine();
 
                        LegalComponent.Output(Markdown, ID.GetTags());
                        await Gateway.SendNotification(Markdown.ToString());
                        break;
                }
            }
 
            if (!(XmppServerModule.Server is null))
            {
                await XmppServerModule.Server.SendMessage(string.Empty, string.Empty,
                    new XmppAddress(LegalDomain), new XmppAddress(BareJid),
                    string.Empty, IdentityXml);
            }
        }
 
        internal static EllipticCurveEndpoint GetEndpoint(AgentKey AgentKey, string s2)
        {
            if (!GetAlgorithms.TryGetAlgorithm(AgentKey.LocalName, AgentKey.Namespace,
                out EllipticCurveEndpoint Endpoint))
            {
                throw new ServiceUnavailableException("Key algorithm no longer supported. Please generate a new key.");
            }
 
            string s4 = s2 + ":" + Convert.ToBase64String(AgentKey.Salt);
            byte[] Key = Hashes.ComputeSHA256Hash(Encoding.UTF8.GetBytes(s4));
            byte[] IV = new byte[16];
 
            Array.Copy(AgentKey.Salt, 0, IV, 0, 16);
 
            Aes Aes = Aes.Create();
 
            Aes.BlockSize = 128;
            Aes.KeySize = 256;
            Aes.Mode = CipherMode.CBC;
            Aes.Padding = PaddingMode.PKCS7;
 
            using (ICryptoTransform Decryptor = Aes.CreateDecryptor(Key, IV))
            {
                XmlDocument Doc;
 
                try
                {
                    byte[] Decrypted = Decryptor.TransformFinalBlock(AgentKey.EncryptedKey, 0, AgentKey.EncryptedKey.Length);
                    Doc = new XmlDocument();
                    Doc.LoadXml(Encoding.UTF8.GetString(Decrypted));
                }
                catch (Exception)
                {
                    throw new ForbiddenException("Invalid key signature.");
                }
 
                EllipticCurveEndpoint KeyEndpoint = (EllipticCurveEndpoint)Endpoint.Parse(Doc.DocumentElement)
                    ?? throw new ServiceUnavailableException("Key no longer supported.");
 
                return KeyEndpoint;
            }
        }
 
    }
}