ApplyId.cs

using Paiwise;
using System;
using System.Collections.Generic;
using System.Net;
using System.Net.Sockets;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using System.Xml;
using Waher.Content;
using Waher.Content.Xml;
using Waher.Events;
using Waher.IoTGateway;
using Waher.Networking.DNS;
using Waher.Networking.DNS.Enumerations;
using Waher.Networking.DNS.ResourceRecords;
using Waher.Networking.HTTP;
using Waher.Networking.XMPP.P2P.E2E;
using Waher.Networking.XMPP.Server;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.Counters;
using Waher.Runtime.IO;
using Waher.Runtime.Settings;
using Waher.Script;
using Waher.Script.Abstraction.Elements;
using Waher.Security;
using Waher.Service.IoTBroker.DataStorage;
using Waher.Service.IoTBroker.Legal;
using Waher.Service.IoTBroker.Legal.Identity;
using Waher.Service.IoTBroker.Setup;
using Waher.Service.IoTBroker.WebServices.Agent.Crypto;
 
namespace Waher.Service.IoTBroker.WebServices.Agent.Legal
{
    public class ApplyId : AgentPostResource
    {
        public ApplyId()
            : base("Legal/ApplyId",
                new KeyValuePair<Type, Expression>(typeof(Dictionary<string, object>), new Expression(jsonPattern)),
                new KeyValuePair<Type, Expression>(typeof(XmlDocument), new Expression(xmlPattern)))
        {
        }
 
        private static readonly string jsonPattern = Resources.LoadResourceAsText(typeof(ApplyId).Namespace + ".JSON.ApplyId.req");
        private static readonly string xmlPattern = Resources.LoadResourceAsText(typeof(ApplyId).Namespace + ".XML.ApplyId.req");
 
        public override async Task POST(HttpRequest Request, HttpResponse Response, Dictionary<string, IElement> Parameters)
        {
            AccountUser User = AssertUserAuthenticated(Request);
 
            string KeyId = (string)Parameters["PKeyId"].AssociatedObjectValue;
            string Nonce = (string)Parameters["PNonce"].AssociatedObjectValue;
            string KeySignature = (string)Parameters["PKeySignature"].AssociatedObjectValue;
            string RequestSignature = (string)Parameters["PRequestSignature"].AssociatedObjectValue;
            object[] PropertyNames = (object[])Parameters["PPropertyName"].AssociatedObjectValue;
            object[] PropertyValues = (object[])Parameters["PPropertyValue"].AssociatedObjectValue;
            Dictionary<CaseInsensitiveString, Property> PropertiesByName = new Dictionary<CaseInsensitiveString, Property>();
            List<Property> Properties = new List<Property>();
            StringBuilder sb = new StringBuilder();
            string Agent = Request.Header.Referer?.Value;
 
            if (string.IsNullOrEmpty(Agent))
                throw new BadRequestException("Missing Referer header.");
 
            if (string.IsNullOrEmpty(KeyId))
                throw new BadRequestException("Key ID cannot be empty.");
 
            if (string.IsNullOrEmpty(Nonce) || Nonce.Length < 32)
                throw new ForbiddenException(Request, "Nonce too short.");
 
            if (Agent.Contains(':') || Agent.Contains('/'))
            {
                if (!Uri.TryCreate(Agent, UriKind.Absolute, out Uri AgentUri))
                    throw new BadRequestException("Invalid Referer header.");
 
                ContentResponse Content;
 
                try
                {
                    Content = await InternetContent.GetAsync(AgentUri);
                }
                catch (Exception ex)
                {
                    if (Gateway.HasDomain ||
                        !XmppServerModule.Server.IsServerDomain(AgentUri.Host, true))
                    {
                        throw new BadRequestException("Referer header invalid. Unable to resolve URI: " + ex.Message);
                    }
 
                    Content = null;
                }
 
                if (Content?.HasError ?? false)
                {
                    if (Content.Error is Content.Getters.WebException ex)
                    {
                        if (ex.StatusCode == HttpStatusCode.NotFound)
                            throw new BadRequestException("Referer header invalid. Referer resource not found.");
                        else if ((int)ex.StatusCode >= 500)
                            throw new BadRequestException("Referer header invalid. Referer returns server error: " + ex.Message);
                    }
                    else
                        throw new BadRequestException("Referer header invalid. Unable to resolve URI: " + Content.Error.Message);
                }
            }
            else if (IPAddress.TryParse(Request.RemoteEndPoint.RemovePortNumber(), out IPAddress RemoteAddress))
            {
                ResourceRecord[] Records;
 
                if (RemoteAddress.AddressFamily == AddressFamily.InterNetwork)
                    Records = await DnsResolver.TryResolve(Agent, QTYPE.A, QCLASS.IN) ?? Array.Empty<ResourceRecord>();
                else if (RemoteAddress.AddressFamily == AddressFamily.InterNetworkV6)
                    Records = await DnsResolver.TryResolve(Agent, QTYPE.AAAA, QCLASS.IN) ?? Array.Empty<ResourceRecord>();
                else
                    Records = null;
 
                if (Records is null)
                    throw new BadRequestException("Referer header invalid. Invalid domain.");
 
                bool Match = false;
 
                foreach (ResourceRecord Rec in Records)
                {
                    if (Rec is ResourceAddressRecord AddressRecord &&
                        AddressRecord.Address == RemoteAddress)
                    {
                        Match = true;
                        break;
                    }
                }
 
                if (!Match)
                    throw new BadRequestException("Referer header invalid. Domain does not match caller IP Address.");
            }
            else
            {
                if (Agent != Request.RemoteEndPoint)
                    throw new BadRequestException("Referer header invalid. Domain does not match caller domain name, as provided in certificate.");
            }
 
            AgentKey AgentKey = await Database.FindFirstDeleteRest<AgentKey>(new FilterAnd(
                new FilterFieldEqualTo("Account", User.UserName),
                new FilterFieldEqualTo("Id", KeyId)))
                ?? throw new NotFoundException("Key not found.");
 
            sb.Append(User.UserName);
            sb.Append(':');
            sb.Append(Request.Header.Host.Value);
            sb.Append(':');
            sb.Append(AgentKey.LocalName);
            sb.Append(':');
            sb.Append(AgentKey.Namespace);
            sb.Append(':');
            sb.Append(KeyId);
 
            //string s1 = sb.ToString();
 
            sb.Append(':');
            sb.Append(KeySignature);
 
            string s2 = sb.ToString();
            sb.Append(':');
            sb.Append(Nonce);
 
            int i, c = PropertyNames?.Length ?? 0;
            if ((PropertyValues?.Length ?? 0) != c)
                throw new BadRequestException("Invalid Properties.");
 
            bool JidAdded = false;
            bool EMailAdded = false;
            bool PhoneNrAdded = false;
 
            for (i = 0; i < c; i++)
            {
                if (!(PropertyNames[i] is string PropertyName) || string.IsNullOrEmpty(PropertyName))
                    throw new BadRequestException("Invalid Property Name.");
 
                if (!(PropertyValues[i] is string PropertyValue) || string.IsNullOrEmpty(PropertyValue))
                    throw new BadRequestException("Invalid Property Value.");
 
                if (!LegalComponent.CheckNameWhitespace(PropertyValue))
                    throw new BadRequestException("Invalid space characters used in " + PropertyName);
 
                switch (PropertyName.ToUpper())
                {
                    case PersonalInformation.AgentTag:
                        throw new BadRequestException("AGENT property is reserved.");
 
                    case PersonalInformation.JidTag:
                        int j = PropertyValue.IndexOf('@');
                        if (j < 0)
                            throw new BadRequestException("Invalid JID.");
 
                        if (PropertyValue[..j] != User.UserName)
                            throw new BadRequestException("JID does not match sender Bare JID.");
 
                        if (!Gateway.IsDomain(PropertyValue[(j + 1)..], true))
                            throw new BadRequestException("JID does not match sender Bare JID.");
 
                        JidAdded = true;
                        break;
 
                    case PersonalInformation.EMailTag:
                        if (PropertyValue != User.Account.EMail && !string.IsNullOrEmpty(User.Account.EMail))
                            throw new BadRequestException("EMAIL does not match account e-mail.");
 
                        EMailAdded = true;
                        break;
 
                    case PersonalInformation.PhoneTag:
                        if (PropertyValue != User.Account.PhoneNr && !string.IsNullOrEmpty(User.Account.PhoneNr))
                            throw new BadRequestException("PHONE does not match account phone number.");
 
                        PhoneNrAdded = true;
                        break;
                }
 
                Property Property = new Property(PropertyName, PropertyValue);
 
                if (PropertiesByName.ContainsKey(Property.Name))
                    throw new BadRequestException("Duplicate property.");
 
                Properties.Add(Property);
                PropertiesByName[Property.Name] = Property;
 
                sb.Append(':');
                sb.Append(Property.Name.Value);
                sb.Append(':');
                sb.Append(Property.Value.Value);
            }
 
            string s3 = sb.ToString();
 
            string s = Convert.ToBase64String(
                Hashes.ComputeHMACSHA256Hash(
                    Encoding.UTF8.GetBytes(User.Account.Password),
                    Encoding.UTF8.GetBytes(s3)));
 
            if (s != RequestSignature)
            {
                string Msg = "Request Signature invalid.";
                throw new ForbiddenException(Request, Msg);
            }
 
            if (await Gateway.HasNonceBeenUsed(Nonce))
            {
                string Msg = "Nonce value has already been used.";
                throw new ForbiddenException(Request, Msg);
            }
 
            await Gateway.RegisterNonceValue(Nonce);
 
            EllipticCurveEndpoint KeyEndpoint = GetEndpoint(Request, AgentKey, s2);
            string BareJid = User.UserName + "@" + Gateway.Domain;
 
            if (!JidAdded)
                Properties.Add(new Property(PersonalInformation.JidTag, BareJid));
 
            if (!EMailAdded && !string.IsNullOrEmpty(User.Account.EMail))
                Properties.Add(new Property(PersonalInformation.EMailTag, User.Account.EMail));
 
            if (!PhoneNrAdded && !string.IsNullOrEmpty(User.Account.PhoneNr))
                Properties.Add(new Property(PersonalInformation.PhoneTag, User.Account.PhoneNr));
 
            Properties.Add(new Property(PersonalInformation.AgentTag, Agent));
 
            DateTime TP;
 
            if (!(Gateway.LoginAuditor is null))
            {
                DateTime? Next = await Gateway.LoginAuditor.GetEarliestLoginOpportunity(BareJid, "XMPP");
 
                if (Next.HasValue)
                {
                    sb.Clear();
 
                    TP = Next.Value;
                    DateTime Today = DateTime.Today;
 
                    if (Next.Value == DateTime.MaxValue)
                    {
                        sb.Append("This endpoint (");
                        sb.Append(BareJid);
                        sb.Append(") has been blocked from the system.");
                    }
                    else
                    {
                        sb.Append("Too many failed identity applications in a row registered. Try again after ");
                        sb.Append(TP.ToLongTimeString());
 
                        if (TP.Date != Today)
                        {
                            if (TP.Date == Today.AddDays(1))
                                sb.Append(" tomorrow");
                            else
                            {
                                sb.Append(", ");
                                sb.Append(TP.ToShortDateString());
                            }
                        }
 
                        sb.Append(". Remote Endpoint: ");
                        sb.Append(BareJid);
                    }
 
                    throw new TooManyRequestsException(sb.ToString());
                }
            }
 
            TP = LegalComponent.UtcNowSecond;
            DateTime From = TP.Date;
            CaseInsensitiveString LegalDomain = XmppServerModule.Legal?.MainDomain.Address ?? "legal.example.com";
 
            LegalIdentity Identity = new LegalIdentity()
            {
                Account = User.UserName,
                ClientKeyName = KeyEndpoint.LocalName,
                ClientPubKey = KeyEndpoint.PublicKey,
                Created = TP,
                Updated = DateTime.MinValue,
                From = From,
                To = From.AddMonths((int)await RuntimeSettings.GetAsync("LegalIdentity.Months", 24)),
                State = IoTBroker.Legal.Identity.IdentityState.Created,
                Provider = LegalDomain,
                Properties = Properties.ToArray(),
                Version = NamespaceSet.Current
            };
 
            StringBuilder Xml = new StringBuilder();
            Identity.Serialize(Xml, false, false, false, false, false, false, false, null, XmppServerModule.Legal);
            Identity.ClientSignature = KeyEndpoint.Sign(Encoding.UTF8.GetBytes(Xml.ToString()));
 
            foreach (LegalIdentity ToRemove in await Database.FindDelete<LegalIdentity>(new FilterAnd(
                new FilterFieldEqualTo("Account", User.UserName),
                new FilterFieldEqualTo("State", IoTBroker.Legal.Identity.IdentityState.Created))))
            {
                Log.Informational("Obsolete Legal Identity Registration deleted.",
                    ToRemove.Id.Value, BareJid, "LegalIdDeleted", ToRemove.GetTags());
            }
 
            await Database.Insert(Identity);
 
            Identity.Id = Identity.ObjectId + "@" + LegalDomain;
            Identity.Sign(XmppServerModule.Legal);  // Adds server signature
 
            await Database.Update(Identity);
            await RuntimeCounters.IncrementCounter("Legal.ID." + Identity.State.ToString());
 
            KeyValuePair<string, object>[] Tags = Identity.GetTags();
 
            Log.Informational("Legal Identity application registered.", Identity.Id.Value, BareJid,
                "LegalIdRegistered", Tags);
 
            XmppServerModule.Legal?.IdentityAuthorization(BareJid, BareJid, Identity.Id, true);
 
            Xml.Clear();
            Identity.Serialize(Xml, true, true, true, true, true, true, true, null, XmppServerModule.Legal);
            string IdentityXml = Xml.ToString();
 
            XmlDocument IdentityDoc = XML.ParseXml(IdentityXml, true);
 
            await Response.Return(new NamedDictionary<string, object>("IdentityResponse", AgentNamespace)
            {
                { "Identity", IdentityDoc }
            });
 
            if (BrokerNotificationConfiguration.Instance?.LegalIdReceived ?? false)
            {
                StringBuilder Markdown = new StringBuilder();
 
                Markdown.Append("Legal identity application received: [`");
                Markdown.Append(Identity.Id);
                Markdown.Append("`](");
                Markdown.Append(Gateway.GetUrl("/LegalIdentity.md?Id="));
                Markdown.Append(Identity.Id);
                Markdown.AppendLine(")");
                Markdown.AppendLine();
                LegalComponent.Output(Markdown, Tags);
 
                await Gateway.SendNotification(Markdown.ToString());
 
                if (BrokerNotificationConfiguration.Instance.OtherLegalIds)
                {
                    bool First = true;
 
                    foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                        new FilterFieldEqualTo("Account", Identity.Account),
                        new FilterFieldNotEqualTo("Id", Identity.Id)), "Created"))
                    {
                        switch (ID.State)
                        {
                            case IoTBroker.Legal.Identity.IdentityState.Created:
                            case IoTBroker.Legal.Identity.IdentityState.Approved:
                                if (First)
                                {
                                    First = false;
                                    Markdown.Clear();
                                    Markdown.AppendLine("Other identities registered for the same account:");
 
                                    await Gateway.SendNotification(Markdown.ToString());
                                }
 
                                Markdown.Clear();
 
                                Markdown.Append("[`");
                                Markdown.Append(ID.Id);
                                Markdown.Append("`](");
                                Markdown.Append(Gateway.GetUrl("/LegalIdentity.md?Id="));
                                Markdown.Append(ID.Id);
                                Markdown.AppendLine(")");
                                Markdown.AppendLine();
 
                                LegalComponent.Output(Markdown, ID.GetTags());
                                await Gateway.SendNotification(Markdown.ToString());
                                break;
                        }
                    }
                }
            }
 
            if (!(XmppServerModule.Server is null))
            {
                await XmppServerModule.Server.SendMessage(string.Empty, string.Empty,
                    new XmppAddress(LegalDomain), new XmppAddress(BareJid),
                    string.Empty, IdentityXml);
            }
        }
 
        internal static EllipticCurveEndpoint GetEndpoint(HttpRequest Request,
            AgentKey AgentKey, string s2)
        {
            if (!GetAlgorithms.TryGetAlgorithm(AgentKey.LocalName, AgentKey.Namespace,
                out EllipticCurveEndpoint Endpoint))
            {
                throw new ServiceUnavailableException("Key algorithm no longer supported. Please generate a new key.");
            }
 
            string s4 = s2 + ":" + Convert.ToBase64String(AgentKey.Salt);
            byte[] Key = Hashes.ComputeSHA256Hash(Encoding.UTF8.GetBytes(s4));
            byte[] IV = new byte[16];
 
            Buffer.BlockCopy(AgentKey.Salt, 0, IV, 0, 16);
 
            Aes Aes = Aes.Create();
 
            Aes.BlockSize = 128;
            Aes.KeySize = 256;
            Aes.Mode = CipherMode.CBC;
            Aes.Padding = PaddingMode.PKCS7;
 
            using ICryptoTransform Decryptor = Aes.CreateDecryptor(Key, IV);
 
            XmlDocument Doc;
 
            try
            {
                byte[] Decrypted = Decryptor.TransformFinalBlock(AgentKey.EncryptedKey, 0, AgentKey.EncryptedKey.Length);
                Doc = XML.ParseXml(Encoding.UTF8.GetString(Decrypted));
            }
            catch (Exception)
            {
                throw new ForbiddenException(Request, "Invalid key signature.");
            }
 
            EllipticCurveEndpoint KeyEndpoint = (EllipticCurveEndpoint)Endpoint.Parse(Doc.DocumentElement)
                ?? throw new ServiceUnavailableException("Key no longer supported.");
 
            return KeyEndpoint;
        }
 
    }
}