LegalComponent.cs

using Paiwise;
using System;
using System.Collections.Generic;
using System.IO;
using System.Net;
using System.Net.Http;
using System.Reflection;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using System.Xml;
using System.Xml.Schema;
using Waher.Content;
using Waher.Content.Html.Elements;
using Waher.Content.Images;
using Waher.Content.Markdown;
using Waher.Content.Xml;
using Waher.Content.Xml.Text;
using Waher.Events;
using Waher.IoTGateway;
using Waher.Networking.DNS;
using Waher.Networking.HTTP;
using Waher.Networking.XMPP;
using Waher.Networking.XMPP.P2P;
using Waher.Networking.XMPP.P2P.E2E;
using Waher.Networking.XMPP.Server;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.Cache;
using Waher.Runtime.Collections;
using Waher.Runtime.Counters;
using Waher.Runtime.Inventory;
using Waher.Runtime.IO;
using Waher.Runtime.Profiling;
using Waher.Runtime.Settings;
using Waher.Runtime.Temporary;
using Waher.Runtime.Threading;
using Waher.Security;
using Waher.Security.JWT;
using Waher.Security.LoginMonitor;
using Waher.Service.IoTBroker.DataStorage;
using Waher.Service.IoTBroker.EDaler;
using Waher.Service.IoTBroker.EDaler.Uris.States;
using Waher.Service.IoTBroker.GeoSpatial;
using Waher.Service.IoTBroker.Legal.Attachments;
using Waher.Service.IoTBroker.Legal.Contracts;
using Waher.Service.IoTBroker.Legal.Contracts.CustomFilters;
using Waher.Service.IoTBroker.Legal.HumanReadable;
using Waher.Service.IoTBroker.Legal.Identity;
using Waher.Service.IoTBroker.Legal.Identity.Previews;
using Waher.Service.IoTBroker.Legal.MFA;
using Waher.Service.IoTBroker.Legal.PublicKeys;
using Waher.Service.IoTBroker.Marketplace;
using Waher.Service.IoTBroker.NeuroFeatures;
using Waher.Service.IoTBroker.Paiwise;
using Waher.Service.IoTBroker.PubSub;
using Waher.Service.IoTBroker.Setup;
using Waher.Service.IoTBroker.StateMachines;
using Waher.Service.IoTBroker.WebServices.Agent;
using Waher.Service.NeuroLedger.Setup;
 
namespace Waher.Service.IoTBroker.Legal
{
    public class LegalComponent : Component
    {
        public const string NamespaceLegalIdentityIeeeV1 = "urn:ieee:iot:leg:id:1.0";
 
        public const string NamespaceLegalIdentityNeuroFoundationV1 = "urn:nf:iot:leg:id:1.0";
 
        public static readonly string[] NamespacesLegalIdentity = new string[]
        {
            NamespaceLegalIdentityNeuroFoundationV1,
            NamespaceLegalIdentityIeeeV1
        };
 
        public static bool IsNamespaceLegalIdentity(string Namespace)
        {
            return Array.IndexOf(NamespacesLegalIdentity, Namespace) >= 0;
        }
 
        public const string NamespaceSmartContractsIeeeV1 = "urn:ieee:iot:leg:sc:1.0";
 
        public const string NamespaceSmartContractsNeuroFoundationV1 = "urn:nf:iot:leg:sc:1.0";
 
        public static readonly string[] NamespacesSmartContracts = new string[]
        {
            NamespaceSmartContractsNeuroFoundationV1,
            NamespaceSmartContractsIeeeV1
        };
 
        public static bool IsNamespaceSmartContract(string Namespace)
        {
            return Array.IndexOf(NamespacesSmartContracts, Namespace) >= 0;
        }
 
        public const string NamespaceE2EIeeeV1 = "urn:ieee:iot:e2e:1.0";
 
        public const string NamespaceE2ENeuroFoundationV1 = "urn:nf:iot:e2e:1.0";
 
        public static string NamespaceLegalIdentity(NamespaceSet Version)
        {
            switch (Version)
            {
                case NamespaceSet.XsfV0:
                case NamespaceSet.IeeeV1: return NamespaceLegalIdentityIeeeV1;
                default:
                case NamespaceSet.NeuroFoundationV1: return NamespaceLegalIdentityNeuroFoundationV1;
            }
        }
 
        public static string NamespaceSmartContracts(NamespaceSet Version)
        {
            switch (Version)
            {
                case NamespaceSet.XsfV0:
                case NamespaceSet.IeeeV1: return NamespaceSmartContractsIeeeV1;
                default:
                case NamespaceSet.NeuroFoundationV1: return NamespaceSmartContractsNeuroFoundationV1;
            }
        }
 
        public static string NamespaceE2E(NamespaceSet Version)
        {
            switch (Version)
            {
                case NamespaceSet.XsfV0:
                case NamespaceSet.IeeeV1: return NamespaceE2EIeeeV1;
                default:
                case NamespaceSet.NeuroFoundationV1: return NamespaceE2ENeuroFoundationV1;
            }
        }
 
        private Cache<CaseInsensitiveString, object> remoteComponents = new Cache<CaseInsensitiveString, object>(int.MaxValue, TimeSpan.FromDays(1), TimeSpan.FromHours(1));
        private Cache<CaseInsensitiveString, int> petitions = new Cache<CaseInsensitiveString, int>(int.MaxValue, TimeSpan.FromHours(1), TimeSpan.FromHours(1), true);
        private Cache<CaseInsensitiveString, Dictionary<CaseInsensitiveString, Parameter>> transientParameters = new Cache<CaseInsensitiveString, Dictionary<CaseInsensitiveString, Parameter>>(int.MaxValue, TimeSpan.FromDays(1), TimeSpan.FromHours(1), true);
        private readonly Dictionary<CaseInsensitiveString, Dictionary<CaseInsensitiveString, CaseInsensitiveString>> petitionsByBareJid = new Dictionary<CaseInsensitiveString, Dictionary<CaseInsensitiveString, CaseInsensitiveString>>();
        private readonly AttachmentsResource attachmentsResource;
        private readonly HttpServer httpServer;
        private readonly PubSubComponent pubsub;
        private readonly GeoSpatialComponent geo;
        private readonly string attachmentsFolder;
        private EDalerComponent eDaler;
 
        public LegalComponent(XmppServer Server, CaseInsensitiveString Subdomain, string Name, HttpServer HttpServer,
            string AttachmentsFolder, EDalerComponent EDaler, PubSubComponent PubSub, GeoSpatialComponent Geo)
            : base(Server, Subdomain, Name)
        {
            this.httpServer = HttpServer;
            this.attachmentsFolder = AttachmentsFolder;
            this.eDaler = EDaler;
            this.pubsub = PubSub;
            this.geo = Geo;
 
            if (!Directory.Exists(this.attachmentsFolder))
                Directory.CreateDirectory(this.attachmentsFolder);
 
            this.attachmentsResource = new AttachmentsResource(this);
            this.httpServer.Register(this.attachmentsResource);
 
            #region Neuro-Foundation V1 handlers
 
            this.RegisterIqGetHandler("getPublicKey", NamespaceLegalIdentityNeuroFoundationV1, this.GetPublicKeyHandler, true);
            this.RegisterIqGetHandler("applicationAttributes", NamespaceLegalIdentityNeuroFoundationV1, this.IdApplicationAttributesHandler, false); ;
            this.RegisterIqSetHandler("apply", NamespaceLegalIdentityNeuroFoundationV1, this.ApplyHandler, false);
            this.RegisterIqGetHandler("getLegalIdentities", NamespaceLegalIdentityNeuroFoundationV1, this.GetLegalIdentitiesHandler, false);
            this.RegisterIqGetHandler("getLegalIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.GetLegalIdentityHandler, false);
            this.RegisterIqGetHandler("validateSignature", NamespaceLegalIdentityNeuroFoundationV1, this.ValidateSignatureHandler, false);
            this.RegisterIqSetHandler("obsoleteLegalIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.ObsoleteLegalIdentityHandler, false);
            this.RegisterIqSetHandler("compromisedLegalIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.CompromiseLegalIdentityHandler, false);
            this.RegisterIqSetHandler("petitionIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.PetitionIdentityHandler, false);
            this.RegisterIqSetHandler("petitionIdentityResponse", NamespaceLegalIdentityNeuroFoundationV1, this.PetitionIdentityResponseHandler, false);
            this.RegisterIqSetHandler("addAttachment", NamespaceLegalIdentityNeuroFoundationV1, this.AddLegalIdAttachmentHandler, false);
            this.RegisterIqSetHandler("removeAttachment", NamespaceLegalIdentityNeuroFoundationV1, this.RemoveLegalIdAttachmentHandler, false);
            this.RegisterIqSetHandler("petitionSignature", NamespaceLegalIdentityNeuroFoundationV1, this.PetitionSignatureHandler, false);
            this.RegisterIqSetHandler("petitionSignatureResponse", NamespaceLegalIdentityNeuroFoundationV1, this.PetitionSignatureResponseHandler, false);
            this.RegisterIqSetHandler("authorizeAccess", NamespaceLegalIdentityNeuroFoundationV1, this.AuthorizeAccessToIdHandler, false);
            this.RegisterIqGetHandler("getNetworkIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.GetNetworkLegalIdentityHandler, false);
            this.RegisterIqGetHandler("canSignAs", NamespaceLegalIdentityNeuroFoundationV1, this.CanSignAsHandler, false);
            this.RegisterIqSetHandler("readyForApproval", NamespaceLegalIdentityNeuroFoundationV1, this.ReadyForApprovalHandler, false);
            this.RegisterIqGetHandler("reviewIdProviders", NamespaceLegalIdentityNeuroFoundationV1, this.GetReviewIdProvidersHandler, false);
            this.RegisterIqSetHandler("selectReviewService", NamespaceLegalIdentityNeuroFoundationV1, this.SelectReviewServiceHandler, false);
 
            this.Server.RegisterIqGetHandler("getNetworkIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.GetNetworkXmppIdentityHandler, false);
            this.Server.RegisterIqGetHandler("getTrustChain", NamespaceLegalIdentityNeuroFoundationV1, this.GetTrustChainHandler, false);
            this.Server.RegisterIqGetHandler("getIdentityReferences", NamespaceLegalIdentityNeuroFoundationV1, this.GetIdentityReferencesHandler, false);
 
            this.RegisterIqSetHandler("createContract", NamespaceSmartContractsNeuroFoundationV1, this.CreateContractHandler, true);
            this.RegisterIqGetHandler("getCreatedContracts", NamespaceSmartContractsNeuroFoundationV1, this.GetCreatedContractsHandler, false);
            this.RegisterIqSetHandler("signContract", NamespaceSmartContractsNeuroFoundationV1, this.SignContractHandler, false);
            this.RegisterIqGetHandler("getSignedContracts", NamespaceSmartContractsNeuroFoundationV1, this.GetSignedContractsHandler, false);
            this.RegisterIqGetHandler("getContract", NamespaceSmartContractsNeuroFoundationV1, this.GetContractHandler, false);
            this.RegisterIqGetHandler("getContracts", NamespaceSmartContractsNeuroFoundationV1, this.GetContractsHandler, false);
            this.RegisterIqGetHandler("isPart", NamespaceSmartContractsNeuroFoundationV1, this.IsPartHandler, false);
            this.RegisterIqSetHandler("obsoleteContract", NamespaceSmartContractsNeuroFoundationV1, this.ObsoleteContractHandler, false);
            this.RegisterIqSetHandler("deleteContract", NamespaceSmartContractsNeuroFoundationV1, this.DeleteContractHandler, false);
            this.RegisterIqSetHandler("updateContract", NamespaceSmartContractsNeuroFoundationV1, this.UpdateContractHandler, false);
            this.RegisterIqGetHandler("getSchemas", NamespaceSmartContractsNeuroFoundationV1, this.GetSchemasHandler, false);
            this.RegisterIqGetHandler("getSchema", NamespaceSmartContractsNeuroFoundationV1, this.GetSchemaHandler, false);
            this.RegisterIqGetHandler("getLegalIdentities", NamespaceSmartContractsNeuroFoundationV1, this.GetLegalIdentitiesOfContractHandler, false);
            this.RegisterIqGetHandler("getNetworkIdentities", NamespaceSmartContractsNeuroFoundationV1, this.GetNetworkIdentitiesHandler, false);
            this.RegisterIqGetHandler("searchPublicContracts", NamespaceSmartContractsNeuroFoundationV1, this.SearchPublicContractsHandler, false);
            this.RegisterIqSetHandler("petitionContract", NamespaceSmartContractsNeuroFoundationV1, this.PetitionContractHandler, false);
            this.RegisterIqSetHandler("petitionContractResponse", NamespaceSmartContractsNeuroFoundationV1, this.PetitionContractResponseHandler, false);
            this.RegisterIqSetHandler("addAttachment", NamespaceSmartContractsNeuroFoundationV1, this.AddContractAttachmentHandler, false);
            this.RegisterIqSetHandler("removeAttachment", NamespaceSmartContractsNeuroFoundationV1, this.RemoveContractAttachmentHandler, false);
            this.RegisterIqSetHandler("authorizeAccess", NamespaceSmartContractsNeuroFoundationV1, this.AuthorizeAccessToContractHandler, false);
            this.RegisterIqSetHandler("contractSigned", NamespaceSmartContractsNeuroFoundationV1, this.ContractSignedHandler, false);
            this.RegisterMessageHandler("failContract", NamespaceSmartContractsNeuroFoundationV1, this.FailContractHandler, false);
 
            #endregion
 
            #region IEEE V1 handlers
 
            this.RegisterIqGetHandler("getPublicKey", NamespaceLegalIdentityIeeeV1, this.GetPublicKeyHandler, true);
            this.RegisterIqGetHandler("applicationAttributes", NamespaceLegalIdentityIeeeV1, this.IdApplicationAttributesHandler, false); ;
            this.RegisterIqSetHandler("apply", NamespaceLegalIdentityIeeeV1, this.ApplyHandler, false);
            this.RegisterIqGetHandler("getLegalIdentities", NamespaceLegalIdentityIeeeV1, this.GetLegalIdentitiesHandler, false);
            this.RegisterIqGetHandler("getLegalIdentity", NamespaceLegalIdentityIeeeV1, this.GetLegalIdentityHandler, false);
            this.RegisterIqGetHandler("validateSignature", NamespaceLegalIdentityIeeeV1, this.ValidateSignatureHandler, false);
            this.RegisterIqSetHandler("obsoleteLegalIdentity", NamespaceLegalIdentityIeeeV1, this.ObsoleteLegalIdentityHandler, false);
            this.RegisterIqSetHandler("compromisedLegalIdentity", NamespaceLegalIdentityIeeeV1, this.CompromiseLegalIdentityHandler, false);
            this.RegisterIqSetHandler("petitionIdentity", NamespaceLegalIdentityIeeeV1, this.PetitionIdentityHandler, false);
            this.RegisterIqSetHandler("petitionIdentityResponse", NamespaceLegalIdentityIeeeV1, this.PetitionIdentityResponseHandler, false);
            this.RegisterIqSetHandler("addAttachment", NamespaceLegalIdentityIeeeV1, this.AddLegalIdAttachmentHandler, false);
            this.RegisterIqSetHandler("removeAttachment", NamespaceLegalIdentityIeeeV1, this.RemoveLegalIdAttachmentHandler, false);
            this.RegisterIqSetHandler("petitionSignature", NamespaceLegalIdentityIeeeV1, this.PetitionSignatureHandler, false);
            this.RegisterIqSetHandler("petitionSignatureResponse", NamespaceLegalIdentityIeeeV1, this.PetitionSignatureResponseHandler, false);
            this.RegisterIqSetHandler("authorizeAccess", NamespaceLegalIdentityIeeeV1, this.AuthorizeAccessToIdHandler, false);
            this.RegisterIqGetHandler("getNetworkIdentity", NamespaceLegalIdentityIeeeV1, this.GetNetworkLegalIdentityHandler, false);
            this.RegisterIqGetHandler("canSignAs", NamespaceLegalIdentityIeeeV1, this.CanSignAsHandler, false);
            this.RegisterIqSetHandler("readyForApproval", NamespaceLegalIdentityIeeeV1, this.ReadyForApprovalHandler, false);
            this.RegisterIqGetHandler("reviewIdProviders", NamespaceLegalIdentityIeeeV1, this.GetReviewIdProvidersHandler, false);
            this.RegisterIqSetHandler("selectReviewService", NamespaceLegalIdentityIeeeV1, this.SelectReviewServiceHandler, false);
 
            this.Server.RegisterIqGetHandler("getNetworkIdentity", NamespaceLegalIdentityIeeeV1, this.GetNetworkXmppIdentityHandler, false);
            this.Server.RegisterIqGetHandler("getTrustChain", NamespaceLegalIdentityIeeeV1, this.GetTrustChainHandler, false);
            this.Server.RegisterIqGetHandler("getIdentityReferences", NamespaceLegalIdentityIeeeV1, this.GetIdentityReferencesHandler, false);
 
            this.RegisterIqSetHandler("createContract", NamespaceSmartContractsIeeeV1, this.CreateContractHandler, true);
            this.RegisterIqGetHandler("getCreatedContracts", NamespaceSmartContractsIeeeV1, this.GetCreatedContractsHandler, false);
            this.RegisterIqSetHandler("signContract", NamespaceSmartContractsIeeeV1, this.SignContractHandler, false);
            this.RegisterIqGetHandler("getSignedContracts", NamespaceSmartContractsIeeeV1, this.GetSignedContractsHandler, false);
            this.RegisterIqGetHandler("getContract", NamespaceSmartContractsIeeeV1, this.GetContractHandler, false);
            this.RegisterIqGetHandler("getContracts", NamespaceSmartContractsIeeeV1, this.GetContractsHandler, false);
            this.RegisterIqGetHandler("isPart", NamespaceSmartContractsIeeeV1, this.IsPartHandler, false);
            this.RegisterIqSetHandler("obsoleteContract", NamespaceSmartContractsIeeeV1, this.ObsoleteContractHandler, false);
            this.RegisterIqSetHandler("deleteContract", NamespaceSmartContractsIeeeV1, this.DeleteContractHandler, false);
            this.RegisterIqSetHandler("updateContract", NamespaceSmartContractsIeeeV1, this.UpdateContractHandler, false);
            this.RegisterIqGetHandler("getSchemas", NamespaceSmartContractsIeeeV1, this.GetSchemasHandler, false);
            this.RegisterIqGetHandler("getSchema", NamespaceSmartContractsIeeeV1, this.GetSchemaHandler, false);
            this.RegisterIqGetHandler("getLegalIdentities", NamespaceSmartContractsIeeeV1, this.GetLegalIdentitiesOfContractHandler, false);
            this.RegisterIqGetHandler("getNetworkIdentities", NamespaceSmartContractsIeeeV1, this.GetNetworkIdentitiesHandler, false);
            this.RegisterIqGetHandler("searchPublicContracts", NamespaceSmartContractsIeeeV1, this.SearchPublicContractsHandler, false);
            this.RegisterIqSetHandler("petitionContract", NamespaceSmartContractsIeeeV1, this.PetitionContractHandler, false);
            this.RegisterIqSetHandler("petitionContractResponse", NamespaceSmartContractsIeeeV1, this.PetitionContractResponseHandler, false);
            this.RegisterIqSetHandler("addAttachment", NamespaceSmartContractsIeeeV1, this.AddContractAttachmentHandler, false);
            this.RegisterIqSetHandler("removeAttachment", NamespaceSmartContractsIeeeV1, this.RemoveContractAttachmentHandler, false);
            this.RegisterIqSetHandler("authorizeAccess", NamespaceSmartContractsIeeeV1, this.AuthorizeAccessToContractHandler, false);
            this.RegisterIqSetHandler("contractSigned", NamespaceSmartContractsIeeeV1, this.ContractSignedHandler, false);
            this.RegisterMessageHandler("failContract", NamespaceSmartContractsIeeeV1, this.FailContractHandler, false);
 
            #endregion
 
            this.RegisterIqSetHandler("legalIdReferenceAdded", QuickLogin.NamespaceTagSignature, this.LegalIdReferenceAddedHandler, true);
            this.RegisterIqSetHandler("legalIdReferenceRemoved", QuickLogin.NamespaceTagSignature, this.LegalIdReferenceRemovedHandler, true);
            Security.Users.User.UpdatingUserLegalId += this.User_UpdatingUserLegalId;
 
            this.Server.OnPresenceLocalSender += this.Server_OnPresenceLocalSender;
            this.petitions.Removed += this.Petitions_Removed;
            this.remoteComponents.Removed += this.RemoteComponents_Removed;
 
            this.RegisterPeerReviewHandlers();
            NeuroFeaturesProcessor.RegisterHandlers(this);
        }
 
        public override void Dispose()
        {
            this.Server.OnPresenceLocalSender -= this.Server_OnPresenceLocalSender;
 
            if (!(this.petitions is null))
            {
                this.petitions.Removed -= this.Petitions_Removed;
                this.remoteComponents.Removed -= this.RemoteComponents_Removed;
                this.petitions.Dispose();
                this.petitions = null;
            }
 
            this.transientParameters?.Dispose();
            this.transientParameters = null;
 
            this.httpServer.Unregister(this.attachmentsResource);
 
            #region Neuro-Foundation V1 handlers
 
            this.UnregisterIqGetHandler("getPublicKey", NamespaceLegalIdentityNeuroFoundationV1, this.GetPublicKeyHandler, true);
            this.UnregisterIqGetHandler("applicationAttributes", NamespaceLegalIdentityNeuroFoundationV1, this.IdApplicationAttributesHandler, false); ;
            this.UnregisterIqSetHandler("apply", NamespaceLegalIdentityNeuroFoundationV1, this.ApplyHandler, false);
            this.UnregisterIqGetHandler("getLegalIdentities", NamespaceLegalIdentityNeuroFoundationV1, this.GetLegalIdentitiesHandler, false);
            this.UnregisterIqGetHandler("getLegalIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.GetLegalIdentityHandler, false);
            this.UnregisterIqGetHandler("validateSignature", NamespaceLegalIdentityNeuroFoundationV1, this.ValidateSignatureHandler, false);
            this.UnregisterIqSetHandler("obsoleteLegalIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.ObsoleteLegalIdentityHandler, false);
            this.UnregisterIqSetHandler("compromisedLegalIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.CompromiseLegalIdentityHandler, false);
            this.UnregisterIqSetHandler("petitionIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.PetitionIdentityHandler, false);
            this.UnregisterIqSetHandler("petitionIdentityResponse", NamespaceLegalIdentityNeuroFoundationV1, this.PetitionIdentityResponseHandler, false);
            this.UnregisterIqSetHandler("addAttachment", NamespaceLegalIdentityNeuroFoundationV1, this.AddLegalIdAttachmentHandler, false);
            this.UnregisterIqSetHandler("removeAttachment", NamespaceLegalIdentityNeuroFoundationV1, this.RemoveLegalIdAttachmentHandler, false);
            this.UnregisterIqSetHandler("petitionSignature", NamespaceLegalIdentityNeuroFoundationV1, this.PetitionSignatureHandler, false);
            this.UnregisterIqSetHandler("petitionSignatureResponse", NamespaceLegalIdentityNeuroFoundationV1, this.PetitionSignatureResponseHandler, false);
            this.UnregisterIqSetHandler("authorizeAccess", NamespaceLegalIdentityNeuroFoundationV1, this.AuthorizeAccessToIdHandler, false);
            this.UnregisterIqGetHandler("getNetworkIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.GetNetworkLegalIdentityHandler, false);
            this.UnregisterIqGetHandler("canSignAs", NamespaceLegalIdentityNeuroFoundationV1, this.CanSignAsHandler, false);
            this.UnregisterIqSetHandler("readyForApproval", NamespaceLegalIdentityNeuroFoundationV1, this.ReadyForApprovalHandler, false);
            this.UnregisterIqGetHandler("reviewIdProviders", NamespaceLegalIdentityNeuroFoundationV1, this.GetReviewIdProvidersHandler, false);
            this.UnregisterIqSetHandler("selectReviewService", NamespaceLegalIdentityNeuroFoundationV1, this.SelectReviewServiceHandler, false);
 
            this.Server.UnregisterIqGetHandler("getNetworkIdentity", NamespaceLegalIdentityNeuroFoundationV1, this.GetNetworkXmppIdentityHandler, false);
            this.Server.UnregisterIqGetHandler("getTrustChain", NamespaceLegalIdentityNeuroFoundationV1, this.GetTrustChainHandler, false);
            this.Server.UnregisterIqGetHandler("getIdentityReferences", NamespaceLegalIdentityNeuroFoundationV1, this.GetIdentityReferencesHandler, false);
 
            this.UnregisterIqSetHandler("createContract", NamespaceSmartContractsNeuroFoundationV1, this.CreateContractHandler, true);
            this.UnregisterIqGetHandler("getCreatedContracts", NamespaceSmartContractsNeuroFoundationV1, this.GetCreatedContractsHandler, false);
            this.UnregisterIqSetHandler("signContract", NamespaceSmartContractsNeuroFoundationV1, this.SignContractHandler, false);
            this.UnregisterIqGetHandler("getSignedContracts", NamespaceSmartContractsNeuroFoundationV1, this.GetSignedContractsHandler, false);
            this.UnregisterIqGetHandler("getContract", NamespaceSmartContractsNeuroFoundationV1, this.GetContractHandler, false);
            this.UnregisterIqGetHandler("getContracts", NamespaceSmartContractsNeuroFoundationV1, this.GetContractsHandler, false);
            this.UnregisterIqGetHandler("isPart", NamespaceSmartContractsNeuroFoundationV1, this.IsPartHandler, false);
            this.UnregisterIqSetHandler("obsoleteContract", NamespaceSmartContractsNeuroFoundationV1, this.ObsoleteContractHandler, false);
            this.UnregisterIqSetHandler("deleteContract", NamespaceSmartContractsNeuroFoundationV1, this.DeleteContractHandler, false);
            this.UnregisterIqSetHandler("updateContract", NamespaceSmartContractsNeuroFoundationV1, this.UpdateContractHandler, false);
            this.UnregisterIqGetHandler("getSchemas", NamespaceSmartContractsNeuroFoundationV1, this.GetSchemasHandler, false);
            this.UnregisterIqGetHandler("getSchema", NamespaceSmartContractsNeuroFoundationV1, this.GetSchemaHandler, false);
            this.UnregisterIqGetHandler("getLegalIdentities", NamespaceSmartContractsNeuroFoundationV1, this.GetLegalIdentitiesOfContractHandler, false);
            this.UnregisterIqGetHandler("getNetworkIdentities", NamespaceSmartContractsNeuroFoundationV1, this.GetNetworkIdentitiesHandler, false);
            this.UnregisterIqGetHandler("searchPublicContracts", NamespaceSmartContractsNeuroFoundationV1, this.SearchPublicContractsHandler, false);
            this.UnregisterIqSetHandler("petitionContract", NamespaceSmartContractsNeuroFoundationV1, this.PetitionContractHandler, false);
            this.UnregisterIqSetHandler("petitionContractResponse", NamespaceSmartContractsNeuroFoundationV1, this.PetitionContractResponseHandler, false);
            this.UnregisterIqSetHandler("addAttachment", NamespaceSmartContractsNeuroFoundationV1, this.AddContractAttachmentHandler, false);
            this.UnregisterIqSetHandler("removeAttachment", NamespaceSmartContractsNeuroFoundationV1, this.RemoveContractAttachmentHandler, false);
            this.UnregisterIqSetHandler("authorizeAccess", NamespaceSmartContractsNeuroFoundationV1, this.AuthorizeAccessToContractHandler, false);
            this.UnregisterIqSetHandler("contractSigned", NamespaceSmartContractsNeuroFoundationV1, this.ContractSignedHandler, false);
            this.UnregisterMessageHandler("failContract", NamespaceSmartContractsNeuroFoundationV1, this.FailContractHandler, false);
 
            #endregion
 
            #region IEEE V1 handlers
 
            this.UnregisterIqGetHandler("getPublicKey", NamespaceLegalIdentityIeeeV1, this.GetPublicKeyHandler, true);
            this.UnregisterIqGetHandler("applicationAttributes", NamespaceLegalIdentityIeeeV1, this.IdApplicationAttributesHandler, false); ;
            this.UnregisterIqSetHandler("apply", NamespaceLegalIdentityIeeeV1, this.ApplyHandler, false);
            this.UnregisterIqGetHandler("getLegalIdentities", NamespaceLegalIdentityIeeeV1, this.GetLegalIdentitiesHandler, false);
            this.UnregisterIqGetHandler("getLegalIdentity", NamespaceLegalIdentityIeeeV1, this.GetLegalIdentityHandler, false);
            this.UnregisterIqGetHandler("validateSignature", NamespaceLegalIdentityIeeeV1, this.ValidateSignatureHandler, false);
            this.UnregisterIqSetHandler("obsoleteLegalIdentity", NamespaceLegalIdentityIeeeV1, this.ObsoleteLegalIdentityHandler, false);
            this.UnregisterIqSetHandler("compromisedLegalIdentity", NamespaceLegalIdentityIeeeV1, this.CompromiseLegalIdentityHandler, false);
            this.UnregisterIqSetHandler("petitionIdentity", NamespaceLegalIdentityIeeeV1, this.PetitionIdentityHandler, false);
            this.UnregisterIqSetHandler("petitionIdentityResponse", NamespaceLegalIdentityIeeeV1, this.PetitionIdentityResponseHandler, false);
            this.UnregisterIqSetHandler("addAttachment", NamespaceLegalIdentityIeeeV1, this.AddLegalIdAttachmentHandler, false);
            this.UnregisterIqSetHandler("removeAttachment", NamespaceLegalIdentityIeeeV1, this.RemoveLegalIdAttachmentHandler, false);
            this.UnregisterIqSetHandler("petitionSignature", NamespaceLegalIdentityIeeeV1, this.PetitionSignatureHandler, false);
            this.UnregisterIqSetHandler("petitionSignatureResponse", NamespaceLegalIdentityIeeeV1, this.PetitionSignatureResponseHandler, false);
            this.UnregisterIqSetHandler("authorizeAccess", NamespaceLegalIdentityIeeeV1, this.AuthorizeAccessToIdHandler, false);
            this.UnregisterIqGetHandler("getNetworkIdentity", NamespaceLegalIdentityIeeeV1, this.GetNetworkLegalIdentityHandler, false);
            this.UnregisterIqGetHandler("canSignAs", NamespaceLegalIdentityIeeeV1, this.CanSignAsHandler, false);
            this.UnregisterIqSetHandler("readyForApproval", NamespaceLegalIdentityIeeeV1, this.ReadyForApprovalHandler, false);
            this.UnregisterIqGetHandler("reviewIdProviders", NamespaceLegalIdentityIeeeV1, this.GetReviewIdProvidersHandler, false);
            this.UnregisterIqSetHandler("selectReviewService", NamespaceLegalIdentityIeeeV1, this.SelectReviewServiceHandler, false);
 
            this.Server.UnregisterIqGetHandler("getNetworkIdentity", NamespaceLegalIdentityIeeeV1, this.GetNetworkXmppIdentityHandler, false);
            this.Server.UnregisterIqGetHandler("getTrustChain", NamespaceLegalIdentityIeeeV1, this.GetTrustChainHandler, false);
            this.Server.UnregisterIqGetHandler("getIdentityReferences", NamespaceLegalIdentityIeeeV1, this.GetIdentityReferencesHandler, false);
 
            this.UnregisterIqSetHandler("createContract", NamespaceSmartContractsIeeeV1, this.CreateContractHandler, true);
            this.UnregisterIqGetHandler("getCreatedContracts", NamespaceSmartContractsIeeeV1, this.GetCreatedContractsHandler, false);
            this.UnregisterIqSetHandler("signContract", NamespaceSmartContractsIeeeV1, this.SignContractHandler, false);
            this.UnregisterIqGetHandler("getSignedContracts", NamespaceSmartContractsIeeeV1, this.GetSignedContractsHandler, false);
            this.UnregisterIqGetHandler("getContract", NamespaceSmartContractsIeeeV1, this.GetContractHandler, false);
            this.UnregisterIqGetHandler("getContracts", NamespaceSmartContractsIeeeV1, this.GetContractsHandler, false);
            this.UnregisterIqGetHandler("isPart", NamespaceSmartContractsIeeeV1, this.IsPartHandler, false);
            this.UnregisterIqSetHandler("obsoleteContract", NamespaceSmartContractsIeeeV1, this.ObsoleteContractHandler, false);
            this.UnregisterIqSetHandler("deleteContract", NamespaceSmartContractsIeeeV1, this.DeleteContractHandler, false);
            this.UnregisterIqSetHandler("updateContract", NamespaceSmartContractsIeeeV1, this.UpdateContractHandler, false);
            this.UnregisterIqGetHandler("getSchemas", NamespaceSmartContractsIeeeV1, this.GetSchemasHandler, false);
            this.UnregisterIqGetHandler("getSchema", NamespaceSmartContractsIeeeV1, this.GetSchemaHandler, false);
            this.UnregisterIqGetHandler("getLegalIdentities", NamespaceSmartContractsIeeeV1, this.GetLegalIdentitiesOfContractHandler, false);
            this.UnregisterIqGetHandler("getNetworkIdentities", NamespaceSmartContractsIeeeV1, this.GetNetworkIdentitiesHandler, false);
            this.UnregisterIqGetHandler("searchPublicContracts", NamespaceSmartContractsIeeeV1, this.SearchPublicContractsHandler, false);
            this.UnregisterIqSetHandler("petitionContract", NamespaceSmartContractsIeeeV1, this.PetitionContractHandler, false);
            this.UnregisterIqSetHandler("petitionContractResponse", NamespaceSmartContractsIeeeV1, this.PetitionContractResponseHandler, false);
            this.UnregisterIqSetHandler("addAttachment", NamespaceSmartContractsIeeeV1, this.AddContractAttachmentHandler, false);
            this.UnregisterIqSetHandler("removeAttachment", NamespaceSmartContractsIeeeV1, this.RemoveContractAttachmentHandler, false);
            this.UnregisterIqSetHandler("authorizeAccess", NamespaceSmartContractsIeeeV1, this.AuthorizeAccessToContractHandler, false);
            this.UnregisterIqSetHandler("contractSigned", NamespaceSmartContractsIeeeV1, this.ContractSignedHandler, false);
            this.UnregisterMessageHandler("failContract", NamespaceSmartContractsIeeeV1, this.FailContractHandler, false);
 
            #endregion
 
            this.UnregisterIqSetHandler("legalIdReferenceAdded", QuickLogin.NamespaceTagSignature, this.LegalIdReferenceAddedHandler, true);
            this.UnregisterIqSetHandler("legalIdReferenceRemoved", QuickLogin.NamespaceTagSignature, this.LegalIdReferenceRemovedHandler, true);
            Security.Users.User.UpdatingUserLegalId -= this.User_UpdatingUserLegalId;
 
            this.remoteComponents?.Dispose();
            this.remoteComponents = null;
 
            this.UnregisterPeerReviewHandlers();
            NeuroFeaturesProcessor.UnregisterHandlers(this);
        }
 
        public void RegisterPeerReviewHandlers()
        {
            if (!(Gateway.ContractsClient is null))
                Gateway.ContractsClient.PetitionForPeerReviewIDReceived += this.ContractsClient_PetitionForPeerReviewIDReceived;
        }
 
        public void UnregisterPeerReviewHandlers()
        {
            if (!(Gateway.ContractsClient is null))
                Gateway.ContractsClient.PetitionForPeerReviewIDReceived -= this.ContractsClient_PetitionForPeerReviewIDReceived;
        }
 
        public override bool SupportsAccounts => false;
 
        internal HttpServer HttpServer => this.httpServer;
 
        public EDalerComponent EDaler
        {
            get => this.eDaler;
            set
            {
                if (this.eDaler is null)
                    this.eDaler = value;
                else if (this.eDaler != value)
                    throw new InvalidOperationException("Not allowed to change component reference.");
            }
        }
 
        public GeoSpatialComponent Geo => this.geo;
 
        public string AttachmentsFolder => this.attachmentsFolder;
 
        internal byte[] Sign(byte[] Data)
        {
            return LedgerConfiguration.Sign(Data);
        }
 
        internal byte[] Sign(Stream Data)
        {
            return LedgerConfiguration.Sign(Data);
        }
 
        internal bool Verify(byte[] Data, byte[] Signature)
        {
            return LedgerConfiguration.Verify(Data, Signature);
        }
 
        public static Task<string> GetOnboardingNeuronDomainName()
        {
            return RuntimeSettings.GetAsync("Onboarding.DomainName", "id.tagroot.io");
        }
 
        #region Legal Identities
 
        private Task GetPublicKeyHandler(object Sender, IqEventArgs e)
        {
            StringBuilder Xml = new StringBuilder();
            NamespaceSet Version = XmppServerModule.GetVersion(e.Query.NamespaceURI);
            DateTime Timestamp = XML.Attribute(e.Query, "ts", DateTime.UtcNow);
 
            // TODO: Check Timestamp
 
            Xml.Append("<publicKey xmlns='");
            Xml.Append(NamespaceLegalIdentity(Version));
            Xml.Append("'><ed448 pub='");
            Xml.Append(Convert.ToBase64String(LedgerConfiguration.Instance.PublicKey));
            Xml.Append("' xmlns='");
            Xml.Append(NamespaceE2E(Version));
            Xml.Append("'/></publicKey>");
 
            e.IqResult(Xml.ToString(), e.To);
 
            return Task.CompletedTask;
        }
 
        public static Tuple<IE2eEndpoint, DateTime?, DateTime?> GetPublicKey(DateTime? Timestamp)
        {
            IE2eEndpoint Endpoint;
            DateTime? From;
            DateTime? To;
 
            if (!Timestamp.HasValue || 
                Timestamp.Value >= LedgerConfiguration.Instance.Created)
            {
                // TODO: Multiple keys. Switch to PQC.
 
                Endpoint = new Edwards448Endpoint(LedgerConfiguration.Instance.PublicKey);
                From = LedgerConfiguration.Instance.Created;
                To = null;
            }
            else
            {
                Endpoint = null;
                From = null;
                To = null;
            }
 
            return new Tuple<IE2eEndpoint, DateTime?, DateTime?>(Endpoint, From, To);
        }
 
        private Task IdApplicationAttributesHandler(object Sender, IqEventArgs e)
        {
            StringBuilder Xml = new StringBuilder();
            NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
 
            Xml.Append("<idApplicationAttributes xmlns='");
            Xml.Append(NamespaceLegalIdentity(QueryVersion));
 
            if (PeerReviewConfiguration.Instance?.AllowPeerReview ?? false)
            {
                Xml.Append("' peerReview='true' nrReviewers='");
                Xml.Append(PeerReviewConfiguration.Instance.NrReviewersToApprove.ToString());
                Xml.Append("' nrPhotos='");
                Xml.Append(PeerReviewConfiguration.Instance.NrPhotosRequired.ToString());
                Xml.Append("' iso3166='");
                Xml.Append(CommonTypes.Encode(PeerReviewConfiguration.Instance.RequireIso3166Compliance));
                Xml.Append("'>");
 
                if (PeerReviewConfiguration.Instance.RequireFirstName)
                    Xml.Append("<required>FIRST</required>");
 
                if (PeerReviewConfiguration.Instance.RequireMiddleName)
                    Xml.Append("<required>MIDDLE</required>");
 
                if (PeerReviewConfiguration.Instance.RequireLastName)
                    Xml.Append("<required>LAST</required>");
 
                if (PeerReviewConfiguration.Instance.RequirePersonalNumber)
                    Xml.Append("<required>PNR</required>");
 
                if (PeerReviewConfiguration.Instance.RequireAddress)
                    Xml.Append("<required>ADDR</required>");
 
                if (PeerReviewConfiguration.Instance.RequirePostalCode)
                    Xml.Append("<required>ZIP</required>");
 
                if (PeerReviewConfiguration.Instance.RequireArea)
                    Xml.Append("<required>AREA</required>");
 
                if (PeerReviewConfiguration.Instance.RequireCity)
                    Xml.Append("<required>CITY</required>");
 
                if (PeerReviewConfiguration.Instance.RequireRegion)
                    Xml.Append("<required>REGION</required>");
 
                if (PeerReviewConfiguration.Instance.RequireCountry)
                    Xml.Append("<required>COUNTRY</required>");
 
                if (PeerReviewConfiguration.Instance.RequireNationality)
                    Xml.Append("<required>NATIONALITY</required>");
 
                if (PeerReviewConfiguration.Instance.RequireGender)
                    Xml.Append("<required>GENDER</required>");
 
                if (PeerReviewConfiguration.Instance.RequireBirthDate)
                {
                    Xml.Append("<required>BDAY</required>");
                    Xml.Append("<required>BMONTH</required>");
                    Xml.Append("<required>BYEAR</required>");
                }
 
                Xml.Append("</idApplicationAttributes>");
            }
            else
                Xml.Append("' peerReview='false'/>");
 
            e.IqResult(Xml.ToString(), e.To);
 
            return Task.CompletedTask;
        }
 
        private async Task ApplyHandler(object Sender, IqEventArgs e)
        {
            try
            {
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Only accounts on the broker can apply for registering legal identities.", "en");
                    return;
                }
 
                if (!(Gateway.LoginAuditor is null))
                {
                    DateTime? Next = await Gateway.LoginAuditor.GetEarliestLoginOpportunity(e.From.BareJid.Value, "XMPP");
 
                    if (Next.HasValue)
                    {
                        StringBuilder sb = new StringBuilder();
                        DateTime TP = Next.Value;
                        DateTime Today = DateTime.Today;
 
                        if (Next.Value == DateTime.MaxValue)
                        {
                            sb.Append("This endpoint (");
                            sb.Append(e.From.BareJid.Value);
                            sb.Append(") has been blocked from the system.");
                        }
                        else
                        {
                            sb.Append("Too many failed identity applications in a row registered. Try again after ");
                            sb.Append(TP.ToLongTimeString());
 
                            if (TP.Date != Today)
                            {
                                if (TP.Date == Today.AddDays(1))
                                    sb.Append(" tomorrow");
                                else
                                {
                                    sb.Append(", ");
                                    sb.Append(TP.ToShortDateString());
                                }
                            }
 
                            sb.Append(". Remote Endpoint: ");
                            sb.Append(e.From.BareJid.Value);
                        }
 
                        await e.IqErrorForbidden(e.To, sb.ToString(), "en");
                        return;
                    }
                }
 
                LegalIdentity Identity = null;
                bool Preview = XML.Attribute(e.Query, "preview", false);
 
                foreach (XmlNode N in e.Query.ChildNodes)
                {
                    if (N is XmlElement E && E.LocalName == "identity" && E.NamespaceURI == e.Query.NamespaceURI)
                    {
                        Identity = LegalIdentity.Parse(E, out bool HasStatus, out _);
                        if (HasStatus)
                        {
                            await e.IqErrorBadRequest(e.To, "Status element not permitted when applying for a legal identity.", "en");
                            return;
                        }
                    }
                }
 
                if (Identity is null)
                {
                    await e.IqErrorBadRequest(e.To, "Identity missing.", "en");
                    return;
                }
 
                if (!CaseInsensitiveString.IsNullOrEmpty(Identity.Id))
                {
                    await e.IqErrorBadRequest(e.To, "id attribute must not be set by client.", "en");
                    return;
                }
 
                if (!Identity.HasClientPublicKey)
                {
                    await e.IqErrorBadRequest(e.To, "Client public key missing.", "en");
                    return;
                }
 
                if (!Identity.HasClientSignature)
                {
                    await e.IqErrorBadRequest(e.To, "Client signature missing.", "en");
                    return;
                }
 
                if (!(Identity.ServerSignature is null))
                {
                    await e.IqErrorBadRequest(e.To, "Server signature cannot be provided by client.", "en");
                    return;
                }
 
                if (!Identity.ValidateClientSignature(this))
                {
                    await e.IqErrorBadRequest(e.To, "Invalid client signature.", "en");
                    return;
                }
 
                if (!CaseInsensitiveString.IsNullOrEmpty(Identity[PersonalInformation.AgentTag]))
                {
                    await e.IqErrorBadRequest(e.To, "AGENT property is reserved.", "en");
                    return;
                }
 
                string JID = Identity[PersonalInformation.JidTag];
                if (!string.IsNullOrEmpty(JID) && JID != e.From.BareJid)
                {
                    await e.IqErrorBadRequest(e.To, "JID does not match sender Bare JID.", "en");
                    return;
                }
 
                foreach (Property P in Identity.Properties)
                {
                    if (!CheckNameWhitespace(P.Value))
                    {
                        await e.IqErrorBadRequest(e.To, "Invalid space characters used in " + P.Name, "en");
                        return;
                    }
                }
 
                IAccount Account = await XmppServerModule.GetAccountAsync(e.From.Account);
                if (Account is null)
                    await e.IqErrorBadRequest(e.To, "Account not found.", "en");
 
                string EMail = Identity[PersonalInformation.EMailTag];
                if (!string.IsNullOrEmpty(EMail) && !string.IsNullOrEmpty(Account.EMail) && Account.EMail != EMail)
                {
                    await e.IqErrorBadRequest(e.To, "EMAIL does not match account e-mail.", "en");
                    return;
                }
 
                string PhoneNr = Identity[PersonalInformation.PhoneTag];
                if (!string.IsNullOrEmpty(PhoneNr) && !string.IsNullOrEmpty(Account.PhoneNr) && Account.PhoneNr != PhoneNr)
                {
                    await e.IqErrorBadRequest(e.To, "PHONE does not match account phone number.", "en");
                    return;
                }
 
                string Domain = Identity[PersonalInformation.DomainTag];
                if (!string.IsNullOrEmpty(Domain))
                {
                    if (!this.Server.TryGetClientConnection(e.From.Address, out IClientConnection Connection) ||
                        string.IsNullOrEmpty(Connection.RemoteEndPoint))
                    {
                        await e.IqErrorForbidden(e.To, "Connection to corroborate DOMAIN missing.", "en");
                        return;
                    }
 
                    if (!IPAddress.TryParse(Connection.RemoteEndPoint.RemovePortNumber(), out IPAddress RemoteAddress))
                    {
                        await e.IqErrorForbidden(e.To, "Requests for a DOMAIN identity requires a connection using TCP/IP.", "en");
                        return;
                    }
 
                    if (IPAddress.TryParse(Domain, out IPAddress _))
                    {
                        await e.IqErrorForbidden(e.To, "DOMAIN name cannot be an IP Address.", "en");
                        return;
                    }
 
                    switch (RemoteAddress.AddressFamily)
                    {
                        case System.Net.Sockets.AddressFamily.InterNetwork:
                            try
                            {
                                IPAddress[] Ip4Addresses = await DnsResolver.TryLookupIP4Addresses(Domain);
 
                                if (Ip4Addresses is null || Array.IndexOf(Ip4Addresses, RemoteAddress) < 0)
                                {
                                    await e.IqErrorForbidden(e.To, "Request did not come from the domain specified in DOMAIN.", "en");
                                    return;
                                }
                            }
                            catch
                            {
                                await e.IqErrorForbidden(e.To, "Unable to lookup IPv4 address(es) of " + Domain + ".", "en");
                                return;
                            }
                            break;
 
                        case System.Net.Sockets.AddressFamily.InterNetworkV6:
                            try
                            {
                                IPAddress[] Ip6Addresses = await DnsResolver.TryLookupIP6Addresses(Domain);
 
                                if (Ip6Addresses is null || Array.IndexOf(Ip6Addresses, RemoteAddress) < 0)
                                {
                                    await e.IqErrorForbidden(e.To, "Request did not come from the domain specified in DOMAIN.", "en");
                                    return;
                                }
                            }
                            catch
                            {
                                await e.IqErrorForbidden(e.To, "Unable to lookup IPv6 address(es) of " + Domain + ".", "en");
                                return;
                            }
                            break;
 
                        default:
                            await e.IqErrorForbidden(e.To, "Requests for a DOMAIN identity requires a connection using TCP/IP.", "en");
                            return;
                    }
                }
 
                Identity.Provider = e.To.Domain;
                Identity.Account = e.From.Account;
                Identity.State = Legal.Identity.IdentityState.Created;
                Identity.Created = UtcNowSecond;
                Identity.Updated = DateTime.MinValue;
                Identity.From = Identity.Created.Date;
                Identity.To = Identity.From.AddMonths((int)await RuntimeSettings.GetAsync("LegalIdentity.Months", 24));
 
                if (Preview)
                    Identity.ObjectId = Guid.NewGuid().ToString();
                else
                {
                    foreach (LegalIdentity ToRemove in await Database.FindDelete<LegalIdentity>(new FilterAnd(
                        new FilterFieldEqualTo("Account", e.From.Account),
                        new FilterFieldEqualTo("State", Legal.Identity.IdentityState.Created))))
                    {
                        Log.Informational("Obsolete Legal Identity Registration deleted.",
                            ToRemove.Id.Value, e.From.BareJid.Value,
                            "LegalIdDeleted", ToRemove.GetTags());
                    }
 
                    await Database.Insert(Identity);
                }
 
                Identity.Id = Identity.ObjectId + "@" + this.SubdomainSuffixed + e.From.Domain;
                Identity.Sign(this);
 
                if (!Preview)
                    await Database.Update(Identity);
 
                KeyValuePair<string, object>[] Tags = Identity.GetTags();
 
                if (!Preview)
                {
                    Log.Informational("Legal Identity application registered.", Identity.Id.Value, e.From.BareJid.Value,
                        "LegalIdRegistered", Tags);
 
                    this.IdentityAuthorization(e.From.BareJid, e.From.BareJid, Identity.Id, true);
                }
 
                StringBuilder Xml = new StringBuilder();
                Identity.Serialize(Xml, true, true, true, true, true, true, true, null, this);
                string IdentityXml = Xml.ToString();
 
                await e.IqResult(IdentityXml, e.To);
 
                if (Preview)
                {
                    await RuntimeCounters.IncrementCounter("Legal.IDPreview." + Identity.State.ToString());
                    await AddPreview(Identity);
                }
                else
                {
                    await RuntimeCounters.IncrementCounter("Legal.ID." + Identity.State.ToString());
 
                    if (BrokerNotificationConfiguration.Instance?.LegalIdReceived ?? false)
                    {
                        StringBuilder Markdown = new StringBuilder();
 
                        Markdown.Append("Legal identity application received: [`");
                        Markdown.Append(Identity.Id);
                        Markdown.Append("`](");
                        Markdown.Append(Gateway.GetUrl("/LegalIdentity.md?Id="));
                        Markdown.Append(Identity.Id);
                        Markdown.AppendLine(")");
                        Markdown.AppendLine();
                        Output(Markdown, Tags);
 
                        await Gateway.SendNotification(Markdown.ToString());
 
                        if (BrokerNotificationConfiguration.Instance?.OtherLegalIds ?? false)
                        {
                            bool First = true;
 
                            foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                                new FilterFieldEqualTo("Account", Identity.Account),
                                new FilterFieldNotEqualTo("Id", Identity.Id)), "Created"))
                            {
                                switch (ID.State)
                                {
                                    case Legal.Identity.IdentityState.Created:
                                    case Legal.Identity.IdentityState.Approved:
                                        if (First)
                                        {
                                            First = false;
                                            Markdown.Clear();
                                            Markdown.AppendLine("Other identities registered for the same account:");
 
                                            await Gateway.SendNotification(Markdown.ToString());
                                        }
 
                                        Markdown.Clear();
 
                                        Markdown.Append("[`");
                                        Markdown.Append(ID.Id);
                                        Markdown.Append("`](");
                                        Markdown.Append(Gateway.GetUrl("/LegalIdentity.md?Id="));
                                        Markdown.Append(ID.Id);
                                        Markdown.AppendLine(")");
                                        Markdown.AppendLine();
 
                                        Output(Markdown, ID.GetTags());
                                        await Gateway.SendNotification(Markdown.ToString());
                                        break;
                                }
                            }
                        }
                    }
                }
 
                await this.Server.SendMessage(string.Empty, string.Empty, e.To,
                    new XmppAddress(e.From.BareJid), string.Empty, IdentityXml);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal static bool CheckNameWhitespace(string FullName)
        {
            bool LastWhiteSpace = true;
 
            foreach (char ch in FullName)
            {
                if (char.IsWhiteSpace(ch))
                {
                    if (LastWhiteSpace || ch != ' ')
                        return false;
                    else
                        LastWhiteSpace = true;
                }
                else
                    LastWhiteSpace = false;
            }
 
            return !LastWhiteSpace;
        }
 
        internal static PersonalInformation GetPersonalInformation(LegalIdentity Identity)
        {
            return GetPersonalInformation(Identity.Properties);
        }
 
        internal static PersonalInformation GetPersonalInformation(IEnumerable<Property> Properties)
        {
            PersonalInformation Result = new PersonalInformation();
 
            foreach (Property P in Properties)
            {
                switch (P.Name)
                {
                    case PersonalInformation.FirstNameTag:
                        Result.FirstName = P.Value;
                        break;
 
                    case PersonalInformation.MiddleNamesTag:
                        Result.MiddleNames = P.Value;
                        break;
 
                    case PersonalInformation.LastNamesTag:
                        Result.LastNames = P.Value;
                        break;
 
                    case PersonalInformation.FullNameTag:
                        Result.FullName = P.Value;
                        break;
 
                    case PersonalInformation.AddressTag:
                        Result.Address = P.Value;
                        break;
 
                    case PersonalInformation.Address2Tag:
                        Result.Address2 = P.Value;
                        break;
 
                    case PersonalInformation.PostalCodeTag:
                        Result.PostalCode = P.Value;
                        break;
 
                    case PersonalInformation.AreaTag:
                        Result.Area = P.Value;
                        break;
 
                    case PersonalInformation.CityTag:
                        Result.City = P.Value;
                        break;
 
                    case PersonalInformation.RegionTag:
                        Result.Region = P.Value;
                        break;
 
                    case PersonalInformation.CountryTag:
                        Result.Country = P.Value;
                        break;
 
                    case PersonalInformation.NationalityTag:
                        Result.Nationality = P.Value;
                        break;
 
                    case PersonalInformation.GenderTag:
                        switch (P.Value.LowerCase)
                        {
                            case "m":
                                Result.Gender = Gender.Male;
                                break;
 
                            case "f":
                                Result.Gender = Gender.Female;
                                break;
 
                            case "x":
                                Result.Gender = Gender.Other;
                                break;
                        }
                        break;
 
                    case PersonalInformation.BirthDayTag:
                        if (int.TryParse(P.Value, out int i) && i >= 1 && i <= 31)
                            Result.BirthDay = i;
                        break;
 
                    case PersonalInformation.BirthMonthTag:
                        if (int.TryParse(P.Value, out i) && i >= 1 && i <= 12)
                            Result.BirthMonth = i;
                        break;
 
                    case PersonalInformation.BirthYearTag:
                        if (int.TryParse(P.Value, out i) && i >= 1900 && i <= 2100)
                            Result.BirthYear = i;
                        break;
 
                    case PersonalInformation.AgeAboveTag:
                        if (int.TryParse(P.Value.ToString(), out i) && i >= 0)
                            Result.AgeAbove = i;
                        break;
 
                    case PersonalInformation.PersonalNumberTag:
                        Result.PersonalNumber = P.Value;
                        break;
 
                    case PersonalInformation.OrganizationNameTag:
                        Result.OrgName = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.OrganizationDepartmentTag:
                        Result.OrgDepartment = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.OrganizationRoleTag:
                        Result.OrgRole = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.OrganizationAddressTag:
                        Result.OrgAddress = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.OrganizationAddress2Tag:
                        Result.OrgAddress2 = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.OrganizationPostalCodeTag:
                        Result.OrgPostalCode = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.OrganizationAreaTag:
                        Result.OrgArea = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.OrganizationCityTag:
                        Result.OrgCity = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.OrganizationRegionTag:
                        Result.OrgRegion = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.OrganizationCountryTag:
                        Result.OrgCountry = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.OrganizationNumberTag:
                        Result.OrgNumber = P.Value;
                        Result.HasOrg = true;
                        break;
 
                    case PersonalInformation.PhoneTag:
                        Result.Phone = P.Value;
                        break;
 
                    case PersonalInformation.EMailTag:
                        Result.EMail = P.Value;
                        break;
 
                    case PersonalInformation.JidTag:
                        Result.Jid = P.Value;
                        break;
                }
            }
 
            Result.HasBirthDate =
                Result.BirthDay.HasValue &&
                Result.BirthMonth.HasValue &&
                Result.BirthYear.HasValue &&
                Result.BirthDay.Value <= DateTime.DaysInMonth(Result.BirthYear.Value, Result.BirthMonth.Value);
 
            if (!Result.HasBirthDate)
            {
                Result.BirthDay = null;
                Result.BirthMonth = null;
                Result.BirthYear = null;
            }
 
            if (CaseInsensitiveString.IsNullOrEmpty(Result.FullName))
                Result.FullName = LegalIdentity.JoinNames(Result.FirstName, Result.MiddleNames, Result.LastNames);
            else if (CaseInsensitiveString.IsNullOrEmpty(Result.FirstName) &&
                CaseInsensitiveString.IsNullOrEmpty(Result.MiddleNames) &&
                CaseInsensitiveString.IsNullOrEmpty(Result.LastNames))
            {
                LegalIdentity.SeparateNames(Result.FullName, out Result.FirstName, out Result.MiddleNames, out Result.LastNames);
            }
 
            return Result;
        }
 
        internal static async Task<KeyValuePair<IPhoto[], XmlDocument[]>> GetPhotosAndDocuments(LegalIdentity Identity, bool Review)
        {
            ChunkedList<IPhoto> Photos = new ChunkedList<IPhoto>();
            ChunkedList<XmlDocument> Documents = new ChunkedList<XmlDocument>();
 
            if (!(Identity.Attachments is null))
            {
                foreach (AttachmentReference Ref in Identity.Attachments)
                {
                    string s = Ref.ContentType.ToLower();
                    int i = s.IndexOf(';');
                    if (i > 0)
                        s = s[..i].TrimEnd();
 
                    bool IsImage = Array.IndexOf(ImageCodec.ImageContentTypes, s) >= 0;
                    bool IsXml = Array.IndexOf(XmlCodec.XmlContentTypes, s) >= 0;
 
                    if (!IsImage && !IsXml)
                        continue;
 
                    byte[] Bin;
 
                    if (Review)
                        Bin = await GetPreviewAttachment(Ref);
                    else
                    {
                        Attachment Attachment = await Database.FindFirstIgnoreRest<Attachment>(new FilterFieldEqualTo("Id", Ref.Id));
                        if (Attachment is null || Attachment.Size > int.MaxValue)
                            continue;
 
                        using FileStream AttachmentFile = File.OpenRead(Attachment.LocalFileName);
                        Aes Aes = Aes.Create();
 
                        Aes.BlockSize = 128;
                        Aes.KeySize = 256;
                        Aes.Mode = CipherMode.CBC;
                        Aes.Padding = PaddingMode.Zeros;
 
                        byte[] Key = new byte[32];
                        byte[] IV = new byte[16];
 
                        Buffer.BlockCopy(Attachment.Salt, 0, Key, 0, 32);
                        Buffer.BlockCopy(Attachment.Salt, 32, IV, 0, 16);
 
                        using ICryptoTransform Decryptor = Aes.CreateDecryptor(Key, IV);
                        using CryptoStream DecryptedAttachmentFile = new CryptoStream(AttachmentFile, Decryptor, CryptoStreamMode.Read);
                        int c = (int)Attachment.Size;
 
                        Bin = await DecryptedAttachmentFile.ReadAllAsync(c);
                    }
 
                    if (IsImage)
                        Photos.Add(new Photo(Ref.ContentType, Ref.FileName, Bin));
                    else
                    {
                        XmlDocument Doc = new XmlDocument();
 
                        try
                        {
                            Doc.Load(new MemoryStream(Bin));
                        }
                        catch (Exception ex)
                        {
                            Log.Exception(ex);
                            continue;
                        }
 
                        Documents.Add(Doc);
                    }
                }
            }
 
            return new KeyValuePair<IPhoto[], XmlDocument[]>(Photos.ToArray(), Documents.ToArray());
        }
 
        public static DateTime UtcNowSecond
        {
            get
            {
                DateTime TP = DateTime.UtcNow;
                TP = new DateTime(TP.Year, TP.Month, TP.Day, TP.Hour, TP.Minute, TP.Second, DateTimeKind.Utc);
                return TP;
            }
        }
 
        internal static void Output(StringBuilder Markdown, KeyValuePair<string, object>[] Tags)
        {
            Output(Markdown, Tags, true);
        }
 
        internal static void Output(StringBuilder Markdown, KeyValuePair<string, object>[] Tags, bool IncludeHeader)
        {
            if (IncludeHeader)
            {
                Markdown.AppendLine("| Key | Value |");
                Markdown.AppendLine("|:----|:------|");
            }
 
            foreach (KeyValuePair<string, object> Tag in Tags)
            {
                Markdown.Append("| ");
                Markdown.Append(MarkdownDocument.Encode(Tag.Key).Replace("\r\n", "\n").Replace("\n", "<br/>").Replace("\r", "<br/>"));
                Markdown.Append(" | ");
 
                if (!(Tag.Value is null))
                    Markdown.Append(MarkdownDocument.Encode(Tag.Value.ToString()).Replace("\r\n", "\n").Replace("\n", "<br/>").Replace("\r", "<br/>"));
 
                Markdown.AppendLine(" |");
            }
        }
 
        private async Task GetLegalIdentitiesHandler(object Sender, IqEventArgs e)
        {
            try
            {
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Only accounts on the broker can apply for registering legal identities.", "en");
                    return;
                }
 
                NamespaceSet Version = XmppServerModule.GetVersion(e.Query.NamespaceURI);
                string Xml = this.SerializeIdentities(await Database.Find<LegalIdentity>(
                    new FilterFieldEqualTo("Account", e.From.Account)), null, Version);
 
                await e.IqResult(Xml, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private string SerializeIdentities(IEnumerable<LegalIdentity> Identities, IEnumerable<Dictionary<string, string>> AttachmentUrls,
            NamespaceSet Version)
        {
            using IEnumerator<Dictionary<string, string>> e = AttachmentUrls?.GetEnumerator();
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<identities xmlns='");
            Xml.Append(NamespaceLegalIdentity(Version));
            Xml.Append("'>");
 
            foreach (LegalIdentity Identity in Identities)
                Identity.Serialize(Xml, Identity.Version != Version, true, true, true, true, true, true, (e?.MoveNext() ?? false) ? e.Current : null, this);
 
            Xml.Append("</identities>");
 
            return Xml.ToString();
        }
 
        internal static async Task<LegalIdentity> GetLocalLegalIdentity(string LegalId)
        {
            KeyValuePair<LegalIdentity, bool> P = await GetLocalLegalIdentity(LegalId, false);
            return P.Key;
        }
 
        public static string GetPreviewFolder()
        {
            string Folder = Gateway.AppDataFolder is null ? "Previews" :
                Path.Combine(Gateway.AppDataFolder, "Previews");
 
            if (!Directory.Exists(Folder))
                Directory.CreateDirectory(Folder);
 
            return Folder;
        }
 
        internal static string GetPreviewFileName(string Id, string Extension)
        {
            string Folder = GetPreviewFolder();
            int i = Id.IndexOf('@');
            if (i > 0)
                Id = Id[..i];
 
            string FileName = Path.Combine(Folder, Id + Extension);
            FileName = Path.GetFullPath(FileName);
 
            return FileName;
        }
 
        internal static string GetPreviewKey(string FileName)
        {
            StringBuilder sb = new StringBuilder();
            sb.Append(FileName);
            sb.Append('|');
            sb.Append(Gateway.Domain?.Value);
 
            string Key = sb.ToString();
            Key = Hashes.ComputeSHA256HashString(Encoding.UTF8.GetBytes(Key));
 
            return Key;
        }
 
        internal static async Task<byte[]> CreatePreviewSalt(string FileName, string UserName)
        {
            string Key = GetPreviewKey(FileName);
            return await XmppServerModule.CreateSalt(Key, Encoding.UTF8.GetBytes(UserName));
        }
 
        internal static async Task<KeyValuePair<byte[], string>> GetPreviewSalt(string FileName)
        {
            string Key = GetPreviewKey(FileName);
            KeyValuePair<byte[], byte[]> P = await XmppServerModule.GetSaltWithAdditionalData(Key);
            string UserName = Encoding.UTF8.GetString(P.Value);
            return new KeyValuePair<byte[], string>(P.Key, UserName);
        }
 
        internal static async Task<bool> RemovePreviewSalt(string FileName)
        {
            string Key = GetPreviewKey(FileName);
            return await XmppServerModule.RemoveSalt(Key);
        }
 
        private static async Task AddPreview(LegalIdentity Identity)
        {
            string FileName = GetPreviewFileName(Identity.Id, ".id");
            byte[] Salt = await CreatePreviewSalt(FileName, Identity.Account.Value);
 
            StringBuilder sb = new StringBuilder();
            Identity.Serialize(sb, true, true, true, true, true, true, true, null, XmppServerModule.Legal);
 
            byte[] Data = Encoding.UTF8.GetBytes(sb.ToString());
 
            await XmppServerModule.SaveEncryptedFile(FileName, Salt, Data);
 
            await PreviewIdApplicationSource.PreviewFileSaved(FileName, Identity);
        }
 
        internal static async Task<KeyValuePair<LegalIdentity, bool>> GetLocalLegalIdentity(string LegalId, bool IncludePreviews)
        {
            LegalIdentity Identity = await Database.FindFirstDeleteRest<LegalIdentity>(new FilterFieldEqualTo("Id", LegalId), "Created");
            if (!(Identity is null))
                return new KeyValuePair<LegalIdentity, bool>(Identity, false);
 
            if (!IncludePreviews)
                return new KeyValuePair<LegalIdentity, bool>(null, false);
 
            string FileName = GetPreviewFileName(LegalId, ".id");
            if (!File.Exists(FileName))
                return new KeyValuePair<LegalIdentity, bool>(null, false);
 
            Identity = await GetPreviewIdentity(FileName);
            return new KeyValuePair<LegalIdentity, bool>(Identity, !(Identity is null));
        }
 
        internal static async Task<LegalIdentity> GetPreviewIdentity(string FileName)
        {
            KeyValuePair<byte[], string> P = await GetPreviewSalt(FileName);
            if (P.Key is null)
                return null;
 
            byte[] Salt = P.Key;
            string UserName = P.Value;
 
            byte[] Data = await XmppServerModule.LoadEncryptedFile(FileName, Salt);
            string s = Encoding.UTF8.GetString(Data);
 
            XmlDocument Doc = new XmlDocument();
            Doc.LoadXml(s);
 
            LegalIdentity Identity = LegalIdentity.Parse(Doc.DocumentElement, out _, out _);
            Identity.Account = UserName;
 
            return Identity;
        }
 
        internal static async Task<byte[]> GetPreviewAttachment(string AttachmentId)
        {
            string AttachmentFileName = GetPreviewFileName(AttachmentId, ".att");
            KeyValuePair<byte[], string> P = await GetPreviewSalt(AttachmentFileName);
            byte[] Salt = P.Key;
 
            byte[] Data = await XmppServerModule.LoadEncryptedFile(AttachmentFileName, Salt);
            Stream Decoded = await XmppServerModule.DecodeBlob(new MemoryStream(Data));
 
            return await Decoded.ReadAllAsync();
        }
 
        public static Task<byte[]> GetPreviewAttachment(AttachmentReference Attachment)
        {
            return GetPreviewAttachment(Attachment.Id);
        }
 
        internal async Task<int> DeleteOldPreviewApplications(int KeepDays)
        {
            string Folder = GetPreviewFolder();
            string[] FileNames = Directory.GetFiles(Folder, "*.*", SearchOption.TopDirectoryOnly);
            DateTime Limit = DateTime.UtcNow.AddDays(-KeepDays);
            int Count = 0;
 
            foreach (string FileName in FileNames)
            {
                try
                {
                    if (File.GetCreationTimeUtc(FileName) > Limit)
                        continue;
 
                    bool IsPreviewIdFile = string.Compare(Path.GetExtension(FileName), ".id", true) == 0;
 
                    if (IsPreviewIdFile)
                    {
                        try
                        {
                            LegalIdentity Identity = await GetPreviewIdentity(FileName);
 
                            if (!(Identity is null))
                            {
                                await this.UpdateState(Identity, Legal.Identity.IdentityState.Obsoleted,
                                    Array.Empty<string>(), null, true, false, null);
                            }
                        }
                        catch (Exception ex)
                        {
                            Log.Exception(ex);
                        }
                    }
 
                    File.Delete(FileName);
                    Count++;
 
                    if (IsPreviewIdFile)
                        await PreviewIdApplicationSource.PreviewFileDeleted(FileName);
                }
                catch (Exception ex)
                {
                    Log.Exception(ex, FileName);
                }
            }
 
            return Count;
        }
 
        private async Task GetLegalIdentityHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString Id = XML.Attribute(e.Query, "id");
                using Semaphore Semaphore = await Semaphores.BeginRead("iotid:" + Id.LowerCase);
                KeyValuePair<LegalIdentity, bool> P = await GetLocalLegalIdentity(Id, true);
                LegalIdentity Identity = P.Key;
                bool Preview = P.Value;
 
                if (Identity is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Legal identity not found.", "en");
                    return;
                }
 
                if ((e.From.Account == Identity.Account &&
                    this.Server.IsServerDomain(e.From.Domain, true)) ||
                    (!Preview && this.IsAccessToIdentityAuthorized(e.From.BareJid, Identity.Id)))
                {
                    this.IdentityAuthorization(e.From.BareJid, e.From.BareJid, Id, true);
 
                    StringBuilder Xml = new StringBuilder();
                    Identity.Serialize(Xml, true, true, true, true, true, true, true, null, this);
 
                    await e.IqResult(Xml.ToString(), e.To);
                }
                else
                {
                    this.IdentityAuthorization(e.From.BareJid, e.From.BareJid, Id, false);
                    await e.IqErrorForbidden(e.To, "A client can only access its own legal identities, and the legal identities of parts in smart contracts to which the client is part.", "en");
                }
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task PetitionIdentityHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString LegalId = XML.Attribute(e.Query, "id");
                string PetitionId = XML.Attribute(e.Query, "pid");
                string Purpose = XML.Attribute(e.Query, "purpose");
                string Nonce = XML.Attribute(e.Query, "nonce");
                byte[] Signature = Convert.FromBase64String(XML.Attribute(e.Query, "s"));
                byte[] Data = Encoding.UTF8.GetBytes(PetitionId + ":" + LegalId + ":" + Purpose + ":" + Nonce + ":" + e.From.BareJid.LowerCase);
 
                if (!TryGetContext(e.Query, out XmlElement ContextXml, out string _,
                    out string[] Properties, out string[] Attachments))
                {
                    await e.IqErrorBadRequest(e.To, "Invalid context.", "en");
                    return;
                }
 
                LegalIdentity Identity = await GetLocalLegalIdentity(LegalId);
                if (Identity is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Legal identity not found.", "en");
                    return;
                }
 
                XmppAddress LegalIdAddr = new XmppAddress(LegalId);
                int i = LegalIdAddr.Domain.IndexOf('.');
                string JidDomain = i < 0 ? this.Server.Domain : LegalIdAddr.Domain.Substring(i + 1);
 
                (LegalIdentity RequestorIdentity, Dictionary<string, string> RequestorAttachmentUrls) = await this.ValidateSenderSignature(
                    e.From, new ExternalRequest(e), DateTime.Now, Data, Signature, Identity.Account + "@" + JidDomain);
 
                if (RequestorIdentity is null)
                    return;
 
                StringBuilder Msg = new StringBuilder();
 
                Msg.Append("<petitionIdentityMsg id=\"");
                Msg.Append(XML.Encode(LegalId));
                Msg.Append("\" pid=\"");
                Msg.Append(XML.Encode(PetitionId));
                Msg.Append("\" from=\"");
                Msg.Append(XML.Encode(e.From.Address.Value));
                Msg.Append("\" purpose=\"");
                Msg.Append(XML.Encode(Purpose));
 
                if (this.Server.TryGetClientConnection(e.From.Address, out IClientConnection Connection) &&
                    !string.IsNullOrEmpty(Connection.RemoteEndPoint))
                {
                    Msg.Append("\" clientEp=\"");
                    Msg.Append(XML.Encode(Connection.RemoteEndPoint));
                }
                else
                {
                    ClientInformation ClientInfo = await this.GetNetworkIdentity(RequestorIdentity.Id, true, false, Identity.Version);
                    if (!(ClientInfo is null))
                    {
                        string ClientEndpoint = ClientInfo.MostRecentEndpoint;
 
                        if (!string.IsNullOrEmpty(ClientEndpoint))
                        {
                            Msg.Append("\" clientEp=\"");
                            Msg.Append(XML.Encode(ClientEndpoint));
                        }
                    }
                }
 
                Msg.Append("\" xmlns=\"");
                Msg.Append(NamespaceLegalIdentity(Identity.Version));
                Msg.Append("\">");
 
                this.Append(Msg, Properties, Attachments, ContextXml, null, RequestorIdentity,
                    Identity.Version, RequestorAttachmentUrls);
 
                Msg.Append("</petitionIdentityMsg>");
 
                await this.Server.SendMessage(string.Empty, string.Empty, e.To, new XmppAddress(Identity.Account + "@" + JidDomain),
                    string.Empty, Msg.ToString());
 
                await e.IqResult(string.Empty, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private void Append(StringBuilder Msg, string[] Properties, string[] Attachments,
            XmlElement ContextXml, string Content, LegalIdentity RequestorIdentity,
            NamespaceSet RequestNamespace, Dictionary<string, string> RequestorAttachmentUrls)
        {
            if (!(Properties is null))
            {
                Msg.Append("<properties>");
 
                foreach (string Property in Properties)
                {
                    Msg.Append("<property>");
                    Msg.Append(XML.Encode(Property));
                    Msg.Append("</property>");
                }
 
                Msg.Append("</properties>");
            }
 
            if (!(Attachments is null))
            {
                Msg.Append("<attachments>");
 
                foreach (string Attachment in Attachments)
                {
                    Msg.Append("<attachment>");
                    Msg.Append(XML.Encode(Attachment));
                    Msg.Append("</attachment>");
                }
 
                Msg.Append("</attachments>");
            }
 
            RequestorIdentity?.Serialize(Msg, RequestorIdentity.Version != RequestNamespace,
                true, true, true, true, true, true, RequestorAttachmentUrls, this);
 
            if (!string.IsNullOrEmpty(Content))
            {
                Msg.Append("<content>");
                Msg.Append(Content);
                Msg.Append("</content>");
            }
 
            if (!(ContextXml is null))
                Msg.Append(ContextXml.OuterXml);
        }
 
        private static bool TryGetContext(XmlElement Query, out XmlElement Context,
            out string Content, out string[] Properties, out string[] Attachments)
        {
            ChunkedList<string> PropertyList = null;
            ChunkedList<string> AttachmentList = null;
            bool IsIdentityNamespace = IsNamespaceLegalIdentity(Query.NamespaceURI);
            bool IsContractNamespace = IsNamespaceSmartContract(Query.NamespaceURI);
            Context = null;
            Properties = null;
            Attachments = null;
            Content = null;
 
            foreach (XmlNode N in Query)
            {
                if (!(N is XmlElement E))
                    continue;
 
                if (IsIdentityNamespace)
                {
                    if (!IsNamespaceLegalIdentity(E.NamespaceURI))
                        continue;
                }
                else if (IsContractNamespace)
                {
                    if (!IsNamespaceSmartContract(E.NamespaceURI))
                        continue;
                }
                else
                {
                    if (E.NamespaceURI != Query.NamespaceURI)
                        continue;
                }
 
                switch (E.LocalName)
                {
                    case "content":
                        if (string.IsNullOrEmpty(Content))
                        {
                            Content = E.InnerText;
                            continue;
                        }
                        else
                            return false;
 
                    case "properties":
                        foreach (XmlNode N2 in E.ChildNodes)
                        {
                            if (!(N2 is XmlElement E2))
                                continue;
 
                            if (E2.LocalName == "property")
                            {
                                PropertyList ??= new ChunkedList<string>();
                                PropertyList.Add(E2.InnerText);
                            }
                            else
                                return false;
                        }
                        continue;
 
                    case "attachments":
                        foreach (XmlNode N2 in E.ChildNodes)
                        {
                            if (!(N2 is XmlElement E2))
                                continue;
 
                            if (E2.LocalName == "attachment")
                            {
                                AttachmentList ??= new ChunkedList<string>();
                                AttachmentList.Add(E2.InnerText);
                            }
                            else
                                return false;
                        }
                        continue;
                }
 
                if (Context is null)
                    Context = E;
                else
                    return false;
                break;
            }
 
            Properties = PropertyList?.ToArray();
            Attachments = AttachmentList?.ToArray();
 
            return true;
        }
 
        private async Task PetitionIdentityResponseHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString LegalId = XML.Attribute(e.Query, "id");
                string PetitionId = XML.Attribute(e.Query, "pid");
                XmppAddress RequestorFullJid = new XmppAddress(XML.Attribute(e.Query, "jid"));
                bool Response = XML.Attribute(e.Query, "response", false);
                LegalIdentity Identity;
                XmlElement ContextXml = null;
 
                foreach (XmlNode N in e.Query)
                {
                    if (!(N is XmlElement E))
                        continue;
 
                    if (ContextXml is null)
                        ContextXml = E;
                    else
                    {
                        await e.IqErrorBadRequest(e.To, "Invalid context.", "en");
                        return;
                    }
                }
 
                Identity = await GetLocalLegalIdentity(LegalId);
                if (Identity is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Legal identity not found.", "en");
                    return;
                }
 
                StringBuilder Msg = new StringBuilder();
 
                Msg.Append("<petitionIdentityResponseMsg pid=\"");
                Msg.Append(XML.Encode(PetitionId));
                Msg.Append("\" response=\"");
                Msg.Append(CommonTypes.Encode(Response));
 
                if (this.Server.TryGetClientConnection(e.From.Address, out IClientConnection Connection) &&
                    !string.IsNullOrEmpty(Connection.RemoteEndPoint))
                {
                    Msg.Append("\" clientEp=\"");
                    Msg.Append(XML.Encode(Connection.RemoteEndPoint));
                }
 
                Msg.Append("\" xmlns=\"");
                Msg.Append(NamespaceLegalIdentity(Identity.Version));
                Msg.Append("\">");
 
                if (Response)
                {
                    this.IdentityAuthorization(RequestorFullJid.BareJid, e.From.BareJid, LegalId, Response);
 
                    Identity.Serialize(Msg, false, true, true, true, true, true, true, null, this);
                }
 
                if (!(ContextXml is null))
                    Msg.Append(ContextXml.OuterXml);
 
                Msg.Append("</petitionIdentityResponseMsg>");
 
                await this.Server.SendMessage(string.Empty, string.Empty, e.To, RequestorFullJid, string.Empty, Msg.ToString());
 
                await e.IqResult(string.Empty, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal void IdentityAuthorization(CaseInsensitiveString ToBareJid, CaseInsensitiveString FromBareJid,
            CaseInsensitiveString LegalId, bool Authorized)
        {
            this.Authorization("I:", ToBareJid, FromBareJid, LegalId, Authorized ? 1 : 0);
        }
 
        internal void Authorization(CaseInsensitiveString Prefix, CaseInsensitiveString ToBareJid, CaseInsensitiveString FromBareJid,
            CaseInsensitiveString Id, int Value)
        {
            CaseInsensitiveString Key1 = Prefix + Id;
            CaseInsensitiveString Key2 = Key1 + ":" + ToBareJid;
 
            if (Value > 0)
            {
                this.petitions?.Add(Key2, Value);
 
                lock (this.petitionsByBareJid)
                {
                    if (!this.petitionsByBareJid.TryGetValue(ToBareJid, out Dictionary<CaseInsensitiveString, CaseInsensitiveString> ByLegalId))
                    {
                        ByLegalId = new Dictionary<CaseInsensitiveString, CaseInsensitiveString>();
                        this.petitionsByBareJid[ToBareJid] = ByLegalId;
                    }
 
                    ByLegalId[Key1] = FromBareJid;
                }
            }
            else
            {
                this.petitions?.Remove(Key2);
 
                lock (this.petitionsByBareJid)
                {
                    if (this.petitionsByBareJid.TryGetValue(ToBareJid, out Dictionary<CaseInsensitiveString, CaseInsensitiveString> ByLegalId) &&
                        ByLegalId.Remove(Key1) &&
                        ByLegalId.Count == 0)
                    {
                        this.petitionsByBareJid.Remove(ToBareJid);
                    }
                }
            }
        }
 
        private Task Petitions_Removed(object Sender, CacheItemEventArgs<CaseInsensitiveString, int> e)
        {
            if (e.Reason != RemovedReason.Manual)
            {
                string Key = e.Key;
                int i1 = Key.IndexOf(':');
                if (i1 >= 0)
                {
                    int i2 = Key.IndexOf(':', i1 + 1);
                    if (i2 >= 0)
                    {
                        CaseInsensitiveString Key1 = Key[..i2];
                        CaseInsensitiveString ToBareJid = Key[(i2 + 1)..];
 
                        lock (this.petitionsByBareJid)
                        {
                            if (this.petitionsByBareJid.TryGetValue(ToBareJid, out Dictionary<CaseInsensitiveString, CaseInsensitiveString> ByLegalId) &&
                                ByLegalId.Remove(Key1) &&
                                ByLegalId.Count == 0)
                            {
                                this.petitionsByBareJid.Remove(ToBareJid);
                            }
                        }
                    }
                }
            }
 
            return Task.CompletedTask;
        }
 
        private Task RemoteComponents_Removed(object Sender, CacheItemEventArgs<CaseInsensitiveString, object> e)
        {
            if (e.Value is IDisposableAsync DisposableAsync)
                return DisposableAsync.DisposeAsync();
 
            if (e.Value is IDisposable Disposable)
                Disposable.Dispose();
 
            return Task.CompletedTask;
        }
 
        internal bool IsAccessToIdentityAuthorized(CaseInsensitiveString BareJid, CaseInsensitiveString LegalId)
        {
            CaseInsensitiveString Key = "I:" + LegalId + ":" + BareJid;
            return (this.petitions?.TryGetValue(Key, out int i) ?? false) && (i > 0);
        }
 
        private async Task Server_OnPresenceLocalSender(object Sender, PresenceEventArgs e)
        {
            if (!e.To.IsEmpty && !(e.Stanza?.StanzaElement is null))
            {
                switch (e.Type)
                {
                    case "subscribe":
                        string Namespace = NamespaceLegalIdentity(XmppServerModule.GetVersion(e.Content?.NamespaceURI ?? string.Empty));
 
                        foreach (XmlNode N in e.Stanza.StanzaElement.ChildNodes)
                        {
                            if (N is XmlElement E && E.LocalName == "identity" && E.NamespaceURI == Namespace)
                            {
                                LegalIdentity Identity = LegalIdentity.Parse(E, out _, out _);
                                if (!(Identity is null))
                                {
                                    using Semaphore Semaphore = await Semaphores.BeginRead("iotid:" + Identity.Id.LowerCase);
                                    LegalIdentity Identity2 = await GetLocalLegalIdentity(Identity.Id);
                                    if (Identity is null)
                                    {
                                        await e.PresenceErrorItemNotFound(e.To, "Legal identity not found.", "en");
                                        return;
                                    }
 
                                    if (e.From.Account != Identity2.Account)
                                    {
                                        Log.Warning("Client tried to forward someone else's identity in a presence subscription request.",
                                            Identity.Id.Value, e.From.Address.Value, "IdValidationError",
                                            new KeyValuePair<string, object>("Sender", e.From.BareJid.Value),
                                            new KeyValuePair<string, object>("ID", Identity.Id.Value),
                                            new KeyValuePair<string, object>("ID Account", Identity.Account.Value));
 
                                        await e.PresenceErrorForbidden(e.To, "A client can only forward its own identity objects.", "en");
                                        return;
                                    }
                                    else
                                    {
                                        StringBuilder Id1 = new StringBuilder();
                                        Identity.Serialize(Id1, true, true, true, true, true, true, false, null, this);
                                        string Id1Xml = Id1.ToString();
 
                                        StringBuilder Id2 = new StringBuilder();
                                        Identity.Serialize(Id2, true, true, true, true, true, true, false, null, this);
                                        string Id2Xml = Id2.ToString();
 
                                        if (Id1Xml == Id2Xml)
                                            this.IdentityAuthorization(e.To.BareJid, e.From.BareJid, Identity.Id, true);
                                        else
                                        {
                                            Log.Warning("Client tried to forward invalid ID in a presence subscription request.",
                                                Identity.Id.Value, e.From.Address.Value, "IdValidationError",
                                                new KeyValuePair<string, object>("Sender", e.From.BareJid.Value),
                                                new KeyValuePair<string, object>("ID", Identity.Id.Value),
                                                new KeyValuePair<string, object>("Attempt", Id1Xml),
                                                new KeyValuePair<string, object>("Actual", Id2Xml));
 
                                            await e.PresenceErrorForbidden(e.To, "Invalid ID representation.", "en");
                                            return;
                                        }
                                    }
                                }
                            }
                        }
                        break;
 
                    case "unsubscribed":
                        LinkedList<KeyValuePair<CaseInsensitiveString, CaseInsensitiveString>> ToRemove = null;
 
                        lock (this.petitionsByBareJid)
                        {
                            if (this.petitionsByBareJid.TryGetValue(e.To.BareJid, out Dictionary<CaseInsensitiveString, CaseInsensitiveString> ByLegalId))
                            {
                                foreach (KeyValuePair<CaseInsensitiveString, CaseInsensitiveString> P in ByLegalId)
                                {
                                    if (P.Value == e.From.BareJid && P.Key.Length > 2)
                                    {
                                        ToRemove ??= new LinkedList<KeyValuePair<CaseInsensitiveString, CaseInsensitiveString>>();
                                        ToRemove.AddLast(P);
                                    }
                                }
                            }
                        }
 
                        if (!(ToRemove is null))
                        {
                            foreach (KeyValuePair<CaseInsensitiveString, CaseInsensitiveString> P in ToRemove)
                                this.Authorization(P.Key.Substring(0, 2), e.To.BareJid, P.Value, P.Key.Substring(2), 0);
                        }
                        break;
                }
            }
        }
 
        private async Task PetitionSignatureHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString LegalId = XML.Attribute(e.Query, "id");
                string PetitionId = XML.Attribute(e.Query, "pid");
                string Purpose = XML.Attribute(e.Query, "purpose");
                string Nonce = XML.Attribute(e.Query, "nonce");
                byte[] Signature = Convert.FromBase64String(XML.Attribute(e.Query, "s"));
 
                if (!TryGetContext(e.Query, out XmlElement ContextXml, out string ContentStr,
                    out string[] Properties, out string[] Attachments))
                {
                    await e.IqErrorBadRequest(e.To, "Invalid context.", "en");
                    return;
                }
 
                if (ContentStr is null)
                {
                    if (ContextXml is null)
                        ContentStr = e.Query.InnerText;
                    else
                    {
                        await e.IqErrorBadRequest(e.To, "No content to sign.", "en");
                        return;
                    }
                }
 
                byte[] Content = Convert.FromBase64String(ContentStr);
                string DataStr = PetitionId + ":" + LegalId + ":" + Purpose + ":" + Nonce + ":" + e.From.BareJid.LowerCase + ":" + ContentStr;
                byte[] Data = Encoding.UTF8.GetBytes(DataStr);
                string s = Encoding.UTF8.GetString(Content);
                LegalIdentity ReqIdentity = null;
                Dictionary<string, string> ReqAttachmentUrls = null;
                bool PeerReview = false;
 
                if (s.StartsWith("<identity") && s.EndsWith("</identity>"))
                {
                    try
                    {
                        XmlDocument Doc = XML.ParseXml(s, true);
 
                        if (Doc.DocumentElement.LocalName == "identity")
                        {
                            LegalIdentity TempId = LegalIdentity.Parse(Doc.DocumentElement, out bool HasStatus, out _);
                            CaseInsensitiveString Jid = TempId[PersonalInformation.JidTag];
 
                            if (HasStatus &&
                                TempId.State == Legal.Identity.IdentityState.Created &&
                                Jid == e.From.BareJid)
                            {
                                ReqIdentity = TempId;
                                PeerReview = true;
 
                                if (!TempId.ValidateSignature(Data, Signature))
                                {
                                    await e.IqErrorForbidden(e.To, "Signature of identity proving access to private keys not valid.", "en");
                                    return;
                                }
                            }
                        }
                    }
                    catch (Exception)
                    {
                        // Ignore
                    }
                }
 
                LegalIdentity Identity = await GetLocalLegalIdentity(LegalId);
                if (Identity is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Legal identity not found.", "en");
                    return;
                }
 
                XmppAddress LegalIdAddr = new XmppAddress(LegalId);
                int i = LegalIdAddr.Domain.IndexOf('.');
                string JidDomain = i < 0 ? this.Server.Domain : LegalIdAddr.Domain.Substring(i + 1);
 
                if (ReqIdentity is null)
                {
                    (ReqIdentity, ReqAttachmentUrls) = await this.ValidateSenderSignature(e.From, new ExternalRequest(e), DateTime.Now, Data, Signature, Identity.Account + "@" + JidDomain);
                    if (ReqIdentity is null)
                        return;
                }
 
                StringBuilder Msg = new StringBuilder();
 
                Msg.Append("<petitionSignatureMsg id=\"");
                Msg.Append(XML.Encode(LegalId));
                Msg.Append("\" pid=\"");
                Msg.Append(XML.Encode(PetitionId));
                Msg.Append("\" from=\"");
                Msg.Append(XML.Encode(e.From.Address.Value));
                Msg.Append("\" purpose=\"");
                Msg.Append(XML.Encode(Purpose));
 
                if (this.Server.TryGetClientConnection(e.From.Address, out IClientConnection Connection) &&
                    !string.IsNullOrEmpty(Connection.RemoteEndPoint))
                {
                    Msg.Append("\" clientEp=\"");
                    Msg.Append(XML.Encode(Connection.RemoteEndPoint));
                }
                else
                {
                    ClientInformation ClientInfo = await this.GetNetworkIdentity(ReqIdentity.Id, true, false, Identity.Version);
                    if (!(ClientInfo is null))
                    {
                        string ClientEndpoint = ClientInfo.MostRecentEndpoint;
 
                        if (!string.IsNullOrEmpty(ClientEndpoint))
                        {
                            Msg.Append("\" clientEp=\"");
                            Msg.Append(XML.Encode(ClientEndpoint));
                        }
                    }
                }
 
                Msg.Append("\" xmlns=\"");
                Msg.Append(NamespaceLegalIdentity(Identity.Version));
                Msg.Append("\">");
 
                this.Append(Msg, Properties, Attachments, ContextXml,
                    ContentStr, PeerReview ? null : ReqIdentity,
                    Identity.Version, ReqAttachmentUrls);
 
                XmppAddress ClientBareJid = new XmppAddress(Identity.Account + "@" + JidDomain);
 
                if (!(ContextXml is null) &&
                    ContextXml.LocalName == "agentApi" &&
                    ContextXml.NamespaceURI == QuickLogin.NamespaceTagSignature)
                {
                    CaseInsensitiveString Domain = XML.Attribute(ContextXml, "domain");
                    int Timeout = XML.Attribute(ContextXml, "timeout", 3600);
 
                    if (Timeout < 1 || Timeout > 3600)
                    {
                        await e.IqErrorBadRequest(e.To, "Agent API Timeout out of range.", "en");
                        return;
                    }
 
                    if (CaseInsensitiveString.IsNullOrEmpty(Domain))
                    {
                        await e.IqErrorBadRequest(e.To, "Missing domain.", "en");
                        return;
                    }
 
                    CaseInsensitiveString ReqDomain = ReqIdentity[PersonalInformation.DomainTag];
                    if (CaseInsensitiveString.IsNullOrEmpty(ReqDomain))
                    {
                        await e.IqErrorBadRequest(e.To, "Requestor lacks DOMAIN property in its legal identity.", "en");
                        return;
                    }
 
                    if (ReqDomain != Domain)
                    {
                        await e.IqErrorBadRequest(e.To, "Requestor domain does not match stated domain in agent API context.", "en");
                        return;
                    }
 
                    this.AgentApiLoginCorrelation(e.From.BareJid, ClientBareJid.Address, PetitionId, Timeout);
                }
 
                Msg.Append("</petitionSignatureMsg>");
 
                await this.Server.SendMessage(string.Empty, string.Empty, e.To, ClientBareJid, string.Empty, Msg.ToString());
 
                await e.IqResult(string.Empty, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal void AgentApiLoginCorrelation(CaseInsensitiveString ToBareJid, CaseInsensitiveString FromBareJid,
            CaseInsensitiveString PetitionId, int Timeout)
        {
            this.Authorization("A:", ToBareJid, FromBareJid, PetitionId, Timeout);
        }
 
        internal bool IsAgentApiLoginCorrelated(CaseInsensitiveString ToBareJid, CaseInsensitiveString FromBareJid,
            CaseInsensitiveString PetitionId, out int Timeout)
        {
            CaseInsensitiveString Key1 = "A:" + PetitionId;
            CaseInsensitiveString Key2 = Key1 + ":" + ToBareJid;
            if (!(this.petitions?.TryGetValue(Key2, out Timeout) ?? false))
            {
                Timeout = 0;
                return false;
            }
 
            lock (this.petitionsByBareJid)
            {
                if (!this.petitionsByBareJid.TryGetValue(ToBareJid, out Dictionary<CaseInsensitiveString, CaseInsensitiveString> ByLegalId))
                {
                    Timeout = 0;
                    return false;
                }
 
                if (!ByLegalId.TryGetValue(Key1, out CaseInsensitiveString FromBareJid2) || FromBareJid != FromBareJid2)
                {
                    Timeout = 0;
                    return false;
                }
            }
 
            return true;
        }
 
        private async Task PetitionSignatureResponseHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString LegalId = XML.Attribute(e.Query, "id");
                string PetitionId = XML.Attribute(e.Query, "pid");
                XmppAddress RequestorFullJid = new XmppAddress(XML.Attribute(e.Query, "jid"));
                bool Response = XML.Attribute(e.Query, "response", false);
                string ContentStr = null;
                string SignatureStr = null;
                byte[] Content = null;
                byte[] Signature = null;
                LegalIdentity Identity;
                XmlElement ContextXml = null;
 
                foreach (XmlNode N in e.Query.ChildNodes)
                {
                    if (!(N is XmlElement E))
                        continue;
 
                    if (E.NamespaceURI == e.Query.NamespaceURI)
                    {
                        switch (E.LocalName)
                        {
                            case "content":
                                ContentStr = E.InnerText;
                                Content = Convert.FromBase64String(ContentStr);
                                break;
 
                            case "signature":
                                SignatureStr = E.InnerText;
                                Signature = Convert.FromBase64String(SignatureStr);
                                break;
                        }
                    }
                    else if (ContextXml is null)
                        ContextXml = E;
                    else
                    {
                        await e.IqErrorBadRequest(e.To, "Invalid context.", "en");
                        return;
                    }
                }
 
                Identity = await GetLocalLegalIdentity(LegalId);
                if (Identity is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Legal identity not found.", "en");
                    return;
                }
 
                StringBuilder Msg = new StringBuilder();
 
                Msg.Append("<petitionSignatureResponseMsg pid=\"");
                Msg.Append(XML.Encode(PetitionId));
                Msg.Append("\" response=\"");
                Msg.Append(CommonTypes.Encode(Response));
 
                if (this.Server.TryGetClientConnection(e.From.Address, out IClientConnection Connection) &&
                    !string.IsNullOrEmpty(Connection.RemoteEndPoint))
                {
                    Msg.Append("\" clientEp=\"");
                    Msg.Append(XML.Encode(Connection.RemoteEndPoint));
                }
 
                Msg.Append("\" xmlns=\"");
                Msg.Append(NamespaceLegalIdentity(Identity.Version));
                Msg.Append("\">");
 
                if (Response)
                {
                    if (Content is null)
                    {
                        await e.IqErrorBadRequest(e.To, "Content missing.", "en");
                        return;
                    }
 
                    if (Signature is null)
                    {
                        await e.IqErrorBadRequest(e.To, "Signature missing.", "en");
                        return;
                    }
 
                    if (!Identity.ValidateSignature(Content, Signature))
                    {
                        await e.IqErrorBadRequest(e.To, "Signature incorrect.", "en");
                        return;
                    }
 
                    Msg.Append("<signature>");
                    Msg.Append(SignatureStr);
                    Msg.Append("</signature>");
                    Identity.Serialize(Msg, false, true, true, true, true, true, true, null, this);
 
                    this.IdentityAuthorization(RequestorFullJid.BareJid, e.From.BareJid, LegalId, Response);
 
                    if (ContextXml is null &&
                        this.IsAgentApiLoginCorrelated(RequestorFullJid.BareJid, e.From.BareJid, PetitionId, out int Timeout) &&
                        Timeout > 0 &&
                        Timeout <= 3600)
                    {
                        string RemoteEndPoint;
 
                        if (e.Sender is ClientConnection ClientConnection)
                            RemoteEndPoint = ClientConnection.RemoteEndPoint;
                        else if (e.Sender is XmppS2SEndpoint XmppServerConnection)
                            RemoteEndPoint = XmppServerConnection.RemoteEndPoint;
                        else
                            RemoteEndPoint = string.Empty;
 
                        if (!string.IsNullOrEmpty(RemoteEndPoint))
                            LoginAuditor.Success("Successful Agent API account login.", e.From.Account, RemoteEndPoint, "XMPP");
 
                        int IssuedAt = (int)Math.Round(DateTime.UtcNow.Subtract(JSON.UnixEpoch).TotalSeconds);
                        int Expires = IssuedAt + Timeout;
 
                        string Token = AgentResource.Factory.Create(
                            new KeyValuePair<string, object>(JwtClaims.JwtId, Convert.ToBase64String(Gateway.NextBytes(32))),
                            new KeyValuePair<string, object>(JwtClaims.Issuer, Gateway.Domain?.Value ?? string.Empty),
                            new KeyValuePair<string, object>(JwtClaims.Subject, e.From.BareJid),
                            new KeyValuePair<string, object>(JwtClaims.IssueTime, IssuedAt),
                            new KeyValuePair<string, object>(JwtClaims.ExpirationTime, Expires));
 
                        Msg.Append("<agentApiToken xmlns='");
                        Msg.Append(QuickLogin.NamespaceTagSignature);
                        Msg.Append("'>");
                        Msg.Append(XML.Encode(Token));
                        Msg.Append("</agentApiToken>");
                    }
                }
 
                if (!(ContextXml is null))
                    Msg.Append(ContextXml.OuterXml);
 
                Msg.Append("</petitionSignatureResponseMsg>");
 
                await this.Server.SendMessage(string.Empty, string.Empty, e.To,
                    RequestorFullJid, string.Empty, Msg.ToString());
 
                await e.IqResult(string.Empty, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task ValidateSignatureHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString Id = null;
                CaseInsensitiveString BareJid = null;
                byte[] Data = null;
                byte[] Signature = null;
                string ForBareJid = null;
 
                foreach (XmlAttribute Attr in e.Query.Attributes)
                {
                    switch (Attr.Name)
                    {
                        case "id":
                            Id = Attr.Value;
                            break;
 
                        case "bareJid":
                            BareJid = Attr.Value;
                            break;
 
                        case "data":
                            Data = Convert.FromBase64String(Attr.Value);
                            break;
 
                        case "s":
                            Signature = Convert.FromBase64String(Attr.Value);
                            break;
 
                        case "for":
                            ForBareJid = Attr.Value;
                            break;
                    }
                }
 
                if (Data is null || Signature is null)
                {
                    await e.IqErrorBadRequest(e.To, "Request attributes missing.", "en");
                    return;
                }
 
                if (!CaseInsensitiveString.IsNullOrEmpty(Id) && !CaseInsensitiveString.IsNullOrEmpty(BareJid))
                {
                    await e.IqErrorBadRequest(e.To, "Both the id and bareJid attributes cannot be specified at the same time.", "en");
                    return;
                }
 
                LegalIdentity Identity = null;
 
                if (!CaseInsensitiveString.IsNullOrEmpty(Id))
                {
                    using Semaphore Semaphore = await Semaphores.BeginRead("iotid:" + Id.LowerCase);
 
                    Identity = await GetLocalLegalIdentity(Id);
                    if (Identity is null)
                    {
                        await e.IqErrorItemNotFound(e.To, "Legal identity not found.", "en");
                        return;
                    }
 
                    if (!Identity.ValidateSignature(Data, Signature))
                    {
                        await e.IqErrorForbidden(e.To, "signature not valid.", "en");
                        return;
                    }
                }
                else
                {
                    CaseInsensitiveString AccountName;
 
                    if (!CaseInsensitiveString.IsNullOrEmpty(BareJid))
                    {
                        XmppAddress Addr = new XmppAddress(BareJid);
                        if (!this.Server.IsServerDomain(Addr.Domain, true))
                        {
                            await e.IqErrorForbidden(e.To, "Bare JID does not correspond to this Trust Provider.", "en");
                            return;
                        }
 
                        AccountName = Addr.Account;
                    }
                    else
                    {
                        AccountName = e.From.Account;
                        BareJid = e.From.BareJid;
                    }
 
                    DateTime UtcNow = DateTime.UtcNow;
 
                    foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                        new FilterFieldEqualTo("Account", AccountName),
                        new FilterFieldEqualTo("State", Legal.Identity.IdentityState.Approved),
                        new FilterFieldLesserOrEqualTo("From", UtcNow),
                        new FilterFieldGreaterOrEqualTo("To", UtcNow)), "-Created"))
                    {
                        if (ID.ValidateSignature(Data, Signature))
                        {
                            Identity = ID;
                            break;
                        }
                    }
 
                    if (Identity is null)
                    {
                        await e.IqErrorForbidden(e.To, "No matching legal identity found that can validate the signature.", "en");
                        return;
                    }
                }
 
                if (!string.IsNullOrEmpty(ForBareJid))
                    this.IdentityAuthorization(ForBareJid, BareJid, Identity.Id, true);
                else
                    this.IdentityAuthorization(e.From.BareJid, BareJid, Identity.Id, true);
 
                StringBuilder Xml = new StringBuilder();
                Identity.Serialize(Xml, true, true, true, true, true, true, true, null, this);
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private Task ObsoleteLegalIdentityHandler(object Sender, IqEventArgs e)
        {
            return this.ChangeStateLegalIdentityHandler(e, Identity.IdentityState.Obsoleted, true);
        }
 
        private Task CompromiseLegalIdentityHandler(object Sender, IqEventArgs e)
        {
            return this.ChangeStateLegalIdentityHandler(e, Identity.IdentityState.Compromised, false);
        }
 
        private async Task ChangeStateLegalIdentityHandler(IqEventArgs e, Identity.IdentityState State, bool IncludePreviews)
        {
            try
            {
                CaseInsensitiveString Id = XML.Attribute(e.Query, "id");
                using Semaphore Semaphore = await Semaphores.BeginWrite("iotid:" + Id.LowerCase);
 
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Only accounts on the broker can apply for registering legal identities.", "en");
                    return;
                }
 
                KeyValuePair<LegalIdentity, bool> P = await GetLocalLegalIdentity(Id, IncludePreviews);
                LegalIdentity Identity = P.Key;
                bool IsPreview = P.Value;
 
                if (Identity is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Legal identity not found.", "en");
                    return;
                }
 
                if (Identity.Account != e.From.Account)
                {
                    await e.IqErrorForbidden(e.To, "Only allowed to obsolete your own legal identities.", "en");
                    return;
                }
 
                IAccount Account = await XmppServerModule.GetAccountAsync(Identity.Account);
                if (Account is null)
                {
                    await e.IqErrorForbidden(e.To, "Account has been removed.", "en");
                    return;
                }
 
                if (!Account.Enabled)
                {
                    await e.IqErrorForbidden(e.To, "Account has been disabled.", "en");
                    return;
                }
 
                if (Identity.State != State)
                {
                    switch (Identity.State)
                    {
                        case Legal.Identity.IdentityState.Created:
                            State = Legal.Identity.IdentityState.Rejected;
                            break;
 
                        case Legal.Identity.IdentityState.Rejected:
                            await e.IqErrorForbidden(e.To, "Legal identity has been rejected, and cannot be changed.", "en");
                            return;
 
                        case Legal.Identity.IdentityState.Compromised:
                            await e.IqErrorForbidden(e.To, "Legal identity has been flagged as compromised, and cannot be changed.", "en");
                            return;
                    }
 
                    await this.UpdateState(Identity, State, new string[] { e.From.Address },
                        Account as Account, IsPreview, true, null);
                }
 
                StringBuilder Xml = new StringBuilder();
                Identity.Serialize(Xml, true, true, true, true, true, true, true, null, this);
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal static async Task CopyPropertiesFromApprovedIdentity(LegalIdentity Identity, Account Account)
        {
            if (Account is null)
                return;
 
            CaseInsensitiveString s;
 
            Account.LatestIdentity = Identity.Id;
            Account.LatestIdentityState = Identity.State;
            Account.FirstName = CaseInsensitiveString.Empty;
            Account.MiddleNames = CaseInsensitiveString.Empty;
            Account.LastNames = CaseInsensitiveString.Empty;
            Account.PersonalNumber = CaseInsensitiveString.Empty;
            Account.Country = CaseInsensitiveString.Empty;
            Account.OrgName = CaseInsensitiveString.Empty;
            Account.OrgNumber = CaseInsensitiveString.Empty;
            Account.OrgDepartment = CaseInsensitiveString.Empty;
            Account.OrgRole = CaseInsensitiveString.Empty;
            Account.OrgCountry = CaseInsensitiveString.Empty;
 
            foreach (Property P in Identity.Properties)
            {
                s = P.Value;
                if (CaseInsensitiveString.IsNullOrEmpty(s))
                    continue;
 
                switch (P.Name.Value.ToUpper())
                {
                    case PersonalInformation.EMailTag:
                        if (Account.EMail != s)
                        {
                            Account.EMail = s;
                            Account.EMailVerified = null;
                        }
                        break;
 
                    case PersonalInformation.PhoneTag:
                        if (Account.PhoneNr != s)
                        {
                            Account.PhoneNr = s;
                            Account.PhoneNrVerified = null;
                        }
                        break;
 
                    case PersonalInformation.FirstNameTag:
                        Account.FirstName = s;
                        break;
 
                    case PersonalInformation.MiddleNamesTag:
                        Account.MiddleNames = s;
                        break;
 
                    case PersonalInformation.LastNamesTag:
                        Account.LastNames = s;
                        break;
 
                    case PersonalInformation.FullNameTag:
                        LegalIdentity.SeparateNames(s, out CaseInsensitiveString FirstName,
                            out CaseInsensitiveString MiddleNames,
                            out CaseInsensitiveString LastNames);
 
                        Account.FirstName = FirstName;
                        Account.MiddleNames = MiddleNames;
                        Account.LastNames = LastNames;
                        break;
 
                    case PersonalInformation.PersonalNumberTag:
                        Account.PersonalNumber = s;
                        break;
 
                    case PersonalInformation.CountryTag:
                        Account.Country = s;
                        break;
 
                    case PersonalInformation.OrganizationNameTag:
                        Account.OrgName = s;
                        break;
 
                    case PersonalInformation.OrganizationNumberTag:
                        Account.OrgNumber = s;
                        break;
 
                    case PersonalInformation.OrganizationDepartmentTag:
                        Account.OrgDepartment = s;
                        break;
 
                    case PersonalInformation.OrganizationRoleTag:
                        Account.OrgRole = s;
                        break;
 
                    case PersonalInformation.OrganizationCountryTag:
                        Account.OrgCountry = s;
                        break;
                }
            }
 
            Account.Updated = DateTime.UtcNow;
 
            await Database.Update(Account);
        }
 
        internal Task UpdateState(LegalIdentity Identity, Identity.IdentityState State,
            string Actor, Account Account, bool Preview, bool Save, IdentityApplication Application)
        {
            return this.UpdateState(Identity, State, new string[] { Actor }, Account,
                Preview, Save, Application);
        }
 
        internal async Task UpdateState(LegalIdentity Identity, Identity.IdentityState State,
            string[] Actors, Account Account, bool Preview, bool Save, IdentityApplication Application)
        {
            if (Identity.State != State)
            {
                bool ApprovedBefore = Identity.State == Legal.Identity.IdentityState.Approved;
 
                Identity.State = State;
                Identity.Updated = UtcNowSecond;
                Identity.Sign(this);
 
                if (Save)
                {
                    if (Preview)
                        await AddPreview(Identity);
                    else
                        await Database.Update(Identity);
                }
 
                if (Preview)
                    await RuntimeCounters.IncrementCounter("Legal.IDPreview." + Identity.State.ToString());
                else
                    await RuntimeCounters.IncrementCounter("Legal.ID." + Identity.State.ToString());
 
                string Msg = Preview
                    ? "Legal Identity preview registration updated."
                    : "Legal Identity registration updated.";
 
                if (Actors.Length == 0)
                {
                    Log.Informational(Msg, Identity.Id.Value, string.Empty,
                        "LegalIdUpdated", Identity.GetTags(Preview));
                }
                else
                {
                    foreach (string Actor in Actors)
                    {
                        Log.Informational(Msg, Identity.Id.Value, Actor,
                            "LegalIdUpdated", Identity.GetTags(Preview));
                    }
                }
 
                bool ApprovedAfter = Identity.State == Legal.Identity.IdentityState.Approved;
 
                if (!Preview && Save)
                {
                    if (ApprovedBefore && ApprovedAfter)
                        await UpdateLegalIdentityReference(Identity);
                    else if (ApprovedBefore)
                        await DeleteLegalIdentityReference(Identity.Id);
                    else if (ApprovedAfter)
                        await AddLegalIdentityReference(Identity);
                }
 
                StringBuilder Xml = new StringBuilder();
                Identity.Serialize(Xml, true, true, true, true, true, true, true, null, this);
 
                await this.Server.SendMessage(string.Empty, string.Empty, Identity.Provider,
                    Identity.Account + "@" + Identity.Provider.Substring(this.SubdomainSuffixed.Length), string.Empty, Xml.ToString());
 
                if (!(Account is null) && !Preview && Save)
                {
                    if (State == Legal.Identity.IdentityState.Approved)
                        await CopyPropertiesFromApprovedIdentity(Identity, Account);
                    else if (Identity.Id == Account.LatestIdentity)
                    {
                        Account.LatestIdentityState = State;
                        Account.Updated = DateTime.UtcNow;
 
                        await Database.Update(Account);
                    }
                }
 
                if (Application is null)
                {
                    KeyValuePair<IPhoto[], XmlDocument[]> P = await GetPhotosAndDocuments(Identity, Preview);
                    Application = new IdentityApplication(Identity.Id,
                        NamespaceLegalIdentity(Identity.Version), Preview,
                        GetPersonalInformation(Identity), Identity.GetTags(true, Preview),
                        P.Key, P.Value, Account);
                }
 
                IIdentityStatefulService[] StatefulServices = Types.FindSupport<IIdentityStatefulService, IIdentityApplication>(Application);
                if (StatefulServices.Length > 0)
                {
                    IIdentityApplicationState CurrentState = new IdentityApplicationState(Application,
                        (Security.IdentityState)(int)Identity.State);
 
                    foreach (IIdentityStatefulService Service in StatefulServices)
                    {
                        try
                        {
                            await Service.ApplicationUpdated(CurrentState);
                        }
                        catch (Exception ex)
                        {
                            Log.Exception(ex);
                        }
                    }
                }
            }
        }
 
        public Task<LegalIdentity> GetCurrentApprovedLegalIdentityAsync(CaseInsensitiveString Account)
        {
            return this.GetApprovedLegalIdentityAsync(Account, DateTime.Now);
        }
 
        public async Task<LegalIdentity> GetApprovedLegalIdentityAsync(CaseInsensitiveString Account, DateTime Timestamp)
        {
            LegalIdentity Result = null;
 
            Timestamp = Timestamp.ToUniversalTime();
 
            foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                new FilterFieldEqualTo("Account", Account),
                new FilterFieldEqualTo("State", Identity.IdentityState.Approved))))
            {
                if (ID.From.ToUniversalTime() <= Timestamp &&
                    ID.To.ToUniversalTime() >= Timestamp &&
                    (Result is null || ID.Created.ToUniversalTime() > Result.Created.ToUniversalTime()))
                {
                    Result = ID;
                }
            }
 
            return Result;
        }
 
        private async Task AddLegalIdAttachmentHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString Id = XML.Attribute(e.Query, "id");
                string GetUrl = XML.Attribute(e.Query, "getUrl");
                byte[] Signature = Convert.FromBase64String(XML.Attribute(e.Query, "s"));
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
                string Namespace = NamespaceLegalIdentity(QueryVersion);
 
                using Semaphore Semaphore = await Semaphores.BeginWrite("iotid:" + Id.LowerCase);
 
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Only accounts on the broker can add attachments.", "en");
                    return;
                }
 
                if (!Uri.TryCreate(GetUrl, UriKind.Absolute, out Uri GetUri))
                {
                    await e.IqErrorBadRequest(e.To, "Invalid Get URL.", "en");
                    return;
                }
 
                IAccount Account = await XmppServerModule.GetAccountAsync(e.From.Account);
                if (Account is null)
                {
                    await e.IqErrorForbidden(e.To, "Account not found.", "en");
                    return;
                }
 
                if (!Account.Enabled)
                {
                    await e.IqErrorForbidden(e.To, "Account has been disabled.", "en");
                    return;
                }
 
                if (!(Account is Account Account2))
                {
                    await e.IqErrorForbidden(e.To, "Forbidden to add attachments.", "en");
                    return;
                }
 
                KeyValuePair<LegalIdentity, bool> P = await GetLocalLegalIdentity(Id, true);
                LegalIdentity Identity = P.Key;
                bool Preview = P.Value;
 
                if (Identity is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Legal identity not found.", "en");
                    return;
                }
 
                if (Identity.Account != Account.UserName)
                {
                    await e.IqErrorForbidden(e.To, "Only allowed to add attachments to your own legal identities.", "en");
                    return;
                }
 
                string PreapprovedAttachment = null;
                string PreapprovedAttachmentKey = null;
                bool PreapprovedAttachmentValid = false;
                string ReviewKey = Identity.Id + "|identityReview";
 
                using ContentStreamResponse P2 = await LocalContent.GetTempStreamAsync(GetUri);
                if (P2.HasError)
                {
                    if (!(P2.Encoded is null))
                        await P2.Encoded.DisposeAsync();
 
                    await e.IqError(P2.Error, e.To);
                    return;
                }
 
                string ContentType = P2.ContentType;
                using TemporaryStream File = P2.Encoded;
 
                if (this.remoteComponents.TryGetValue(ReviewKey, out object Obj) &&
                    Obj is string IdentityReview &&
                    XML.IsValidXml(IdentityReview))
                {
                    if (ContentType.StartsWith(XmlCodec.DefaultContentType) ||
                        ContentType.StartsWith(XmlCodec.SchemaContentType))
                    {
                        PreapprovedAttachment = IdentityReview;
                        PreapprovedAttachmentKey = ReviewKey;
                        PreapprovedAttachmentValid = true;
                    }
                }
 
                if (Identity.State != Legal.Identity.IdentityState.Created)
                {
                    if (!PreapprovedAttachmentValid)
                    {
                        await e.IqErrorForbidden(e.To, "Attachments can only be added to newly created identities before they are approved.", "en");
                        return;
                    }
                }
 
                if (!(Identity.Attachments is null))
                {
                    string s = Convert.ToBase64String(Signature);
 
                    foreach (AttachmentReference Ref in Identity.Attachments)
                    {
                        if (Convert.ToBase64String(Ref.Signature) == s)
                        {
                            await e.IqErrorForbidden(e.To, "Attachment already assigned to identity.", "en");
                            return;
                        }
                    }
                }
 
                File.Position = 0;
                if (!Identity.ValidateSignature(File, Signature))
                {
                    await e.IqErrorForbidden(e.To, "Attachment signature is invalid.", "en");
                    return;
                }
 
                XmlDocument Doc;
                bool IncNrPeerReviews = false;
                StringBuilder sb = new StringBuilder();
                List<LegalIdentity> Reviewers = null;
 
                if (ContentType.StartsWith(XmlCodec.DefaultContentType) ||
                    ContentType.StartsWith(XmlCodec.SchemaContentType))
                {
                    File.Position = 0;
 
                    Doc = new XmlDocument()
                    {
                        PreserveWhitespace = true
                    };
                    Doc.Load(File);
 
                    if (Doc.DocumentElement.LocalName == "identityReview" &&
                        Doc.DocumentElement.NamespaceURI == Namespace)
                    {
                        if (string.IsNullOrEmpty(PreapprovedAttachment))
                        {
                            await e.IqErrorForbidden(e.To, "Identity Review not expected.", "en");
                            return;
                        }
 
                        if (XML.NormalizeXml(Doc.DocumentElement) != XML.NormalizeXml(PreapprovedAttachment))
                        {
                            await e.IqErrorForbidden(e.To, "Identity Review manipulated.", "en");
                            return;
                        }
 
                        this.remoteComponents?.Remove(PreapprovedAttachmentKey);
                    }
                    else if (Doc.DocumentElement.LocalName == "peerReview" &&
                        Doc.DocumentElement.NamespaceURI == Namespace)
                    {
                        LegalIdentity ReviewedIdentity = null;
                        LegalIdentity ReviewerIdentity = null;
                        CaseInsensitiveString ReviewedJid = CaseInsensitiveString.Empty;
                        CaseInsensitiveString ReviewerJid = CaseInsensitiveString.Empty;
                        bool ReviewedHasStatus = false;
                        bool ReviewerHasStatus = false;
                        byte[] PeerSignature = Convert.FromBase64String(XML.Attribute(Doc.DocumentElement, "s"));
                        DateTime TP = XML.Attribute(Doc.DocumentElement, "tp", DateTime.Now);
                        byte[] SignedIdentity = null;
                        DateTime UtcNow = DateTime.UtcNow;
 
                        foreach (XmlNode N in Doc.DocumentElement.ChildNodes)
                        {
                            if (!(N is XmlElement E) || N.NamespaceURI != Namespace)
                                continue;
 
                            foreach (XmlNode N2 in E.ChildNodes)
                            {
                                if (N2 is XmlElement E2 &&
                                    E2.LocalName == "identity" &&
                                    E2.NamespaceURI == Namespace)
                                {
                                    switch (E.LocalName)
                                    {
                                        case "reviewed":
                                            ReviewedIdentity = LegalIdentity.Parse(E2, out ReviewedHasStatus,
                                                out Dictionary<string, string> ReviewedIdentityAttachmentsUrls);
 
                                            sb.Clear();
                                            ReviewedIdentity.Serialize(sb, true, true, true, false, false, false, false, null, this);
                                            string s1 = sb.ToString();
 
                                            sb.Clear();
                                            Identity.Serialize(sb, true, true, true, false, false, false, false, null, this);
                                            string s2 = sb.ToString();
 
                                            if (s1 != s2)
                                            {
                                                await e.IqErrorForbidden(e.To, "Reviewed identity mismatch.", "en");
                                                return;
                                            }
 
                                            sb.Clear();
                                            ReviewedIdentity.Serialize(sb, true, true, true, true, true, true, true, ReviewedIdentityAttachmentsUrls, this);
                                            SignedIdentity = Encoding.UTF8.GetBytes(sb.ToString());
                                            break;
 
                                        case "reviewer":
                                            ReviewerIdentity = LegalIdentity.Parse(E2, out ReviewerHasStatus,
                                                out Dictionary<string, string> ReviewerIdentityAttachmentsUrls);
 
                                            sb.Clear();
                                            ReviewerIdentity.Serialize(sb, false, false, false, false, false, false, false, null, this);
                                            byte[] Data = Encoding.UTF8.GetBytes(sb.ToString());
                                            ReviewerJid = ReviewerIdentity[PersonalInformation.JidTag];
 
                                            if (!CaseInsensitiveString.IsNullOrEmpty(ReviewerJid))
                                            {
                                                (ReviewerIdentity, _) = await this.ValidateSignature(new XmppAddress(ReviewerJid), TP, Data,
                                                    ReviewerIdentity.ClientSignature);
 
                                                if (ReviewerIdentity is null || ReviewerJid != ReviewerIdentity[PersonalInformation.JidTag])
                                                {
                                                    await e.IqErrorForbidden(e.To, "Peer identity signature invalid.", "en");
                                                    return;
                                                }
                                            }
 
                                            if (ReviewerIdentity.State != Legal.Identity.IdentityState.Approved)
                                            {
                                                await e.IqErrorForbidden(e.To, "Reviewer identity not approved.", "en");
                                                return;
                                            }
 
                                            if (UtcNow < ReviewerIdentity.From.ToUniversalTime() ||
                                                UtcNow > ReviewerIdentity.To.ToUniversalTime())
                                            {
                                                await e.IqErrorForbidden(e.To, "Reviewer identity not valid.", "en");
                                                return;
                                            }
 
                                            if (CaseInsensitiveString.IsNullOrEmpty(ReviewerIdentity.Provider))
                                            {
                                                await e.IqErrorForbidden(e.To, "Reviewer identity lacks a provider.", "en");
                                                return;
                                            }
 
                                            if (string.IsNullOrEmpty(ReviewerIdentity.ClientKeyName) ||
                                                ReviewerIdentity.ClientPubKey is null ||
                                                ReviewerIdentity.ClientPubKey.Length == 0)
                                            {
                                                await e.IqErrorForbidden(e.To, "Reviewer identity lacks a key.", "en");
                                                return;
                                            }
 
                                            if (ReviewerIdentity.ClientSignature is null ||
                                                ReviewerIdentity.ClientSignature.Length == 0)
                                            {
                                                await e.IqErrorForbidden(e.To, "Reviewer identity lacks a signature.", "en");
                                                return;
                                            }
 
                                            if (CaseInsensitiveString.IsNullOrEmpty(ReviewerJid))
                                            {
                                                await e.IqErrorForbidden(e.To, "Reviewer identity not trusted for reviewing.", "en");
                                                return;
                                            }
                                            break;
                                    }
                                }
                            }
                        }
 
                        if (ReviewedIdentity is null || !ReviewedHasStatus ||
                            ReviewerIdentity is null || !ReviewerHasStatus ||
                            SignedIdentity is null)
                        {
                            await e.IqErrorForbidden(e.To, "Attachment not a correctly formed peer-review document.", "en");
                            return;
                        }
 
                        CaseInsensitiveString Pnr = ReviewedIdentity[PersonalInformation.PersonalNumberTag];
 
                        if (Pnr == ReviewerIdentity[PersonalInformation.PersonalNumberTag] && !CaseInsensitiveString.IsNullOrEmpty(Pnr))
                        {
                            await e.IqErrorForbidden(e.To, "Reviewer cannot be the same person as the reviewed person.", "en");
                            return;
                        }
 
                        if (!ReviewerIdentity.ValidateSignature(SignedIdentity, PeerSignature))
                        {
                            await e.IqErrorForbidden(e.To, "Peer signature invalid.", "en");
                            return;
                        }
 
                        if (PeerReviewConfiguration.Instance?.AllowPeerReview ?? false)
                        {
                            int NrPhotos = 0;
 
                            if (!(Identity.Attachments is null))
                            {
                                foreach (AttachmentReference Ref in Identity.Attachments)
                                {
                                    if (Ref.ContentType.StartsWith("image/"))
                                        NrPhotos++;
                                }
                            }
 
                            if (NrPhotos < PeerReviewConfiguration.Instance.NrPhotosRequired)
                            {
                                await e.IqErrorForbidden(e.To, "Peer review not accepted: Identity lacks sufficient photos (" +
                                    PeerReviewConfiguration.Instance.NrPhotosRequired.ToString() + ").", "en");
                                return;
                            }
 
                            PersonalInformation RI = GetPersonalInformation(ReviewerIdentity);
 
                            if (!PeerReviewConfiguration.Instance.IsReviewerAllowed(RI.Jid, ReviewerIdentity.Id))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer not white-listed. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireFirstName && CaseInsensitiveString.IsNullOrEmpty(RI.FirstName))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a First name. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireMiddleName && CaseInsensitiveString.IsNullOrEmpty(RI.MiddleNames))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a Middle name. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireLastName && CaseInsensitiveString.IsNullOrEmpty(RI.LastNames))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a Last name. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequirePersonalNumber && CaseInsensitiveString.IsNullOrEmpty(RI.PersonalNumber))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a Personal number. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireAddress && CaseInsensitiveString.IsNullOrEmpty(RI.Address))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks an address. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequirePostalCode && CaseInsensitiveString.IsNullOrEmpty(RI.PostalCode))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a Postal Code (ZIP). Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireArea && CaseInsensitiveString.IsNullOrEmpty(RI.Area))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks an Area. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireCity && CaseInsensitiveString.IsNullOrEmpty(RI.City))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a City. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireRegion && CaseInsensitiveString.IsNullOrEmpty(RI.Region))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a Region. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireCountry && CaseInsensitiveString.IsNullOrEmpty(RI.Country))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a Country. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (!CaseInsensitiveString.IsNullOrEmpty(RI.Country))
                            {
                                if (PeerReviewConfiguration.Instance.RequireIso3166Compliance && !Iso3166.TryGetCountry(RI.Country, out string _))
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer Country is not an ISO 3166-1 Country Code. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (!CaseInsensitiveString.IsNullOrEmpty(RI.PersonalNumber))
                                {
                                    bool? Valid = await PersonalNumberSchemes.IsValid(RI.Country, RI.PersonalNumber);
                                    if (Valid.HasValue && !Valid.Value)
                                    {
                                        await e.IqErrorBadRequest(e.To, "The personal number format used by the reviewer does not comply with regulations.", "en");
                                        return;
                                    }
                                }
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireNationality && CaseInsensitiveString.IsNullOrEmpty(RI.Nationality))
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a Nationality. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireGender && !RI.Gender.HasValue)
                            {
                                await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a Gender. Peer review not accepted.", "en");
                                return;
                            }
 
                            if (PeerReviewConfiguration.Instance.RequireBirthDate)
                            {
                                if (!RI.HasBirthDate)
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a Birth Date. Peer review not accepted.", "en");
                                    return;
                                }
 
                                DateTime BirthDate = RI.BirthDate.Value;
 
                                if (RI.Age < 18)
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity too young. Peer review not accepted.", "en");
                                    return;
                                }
                            }
 
                            if (RI.HasOrg)
                            {
                                if (CaseInsensitiveString.IsNullOrEmpty(RI.OrgName))    // TODO: Configurable
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks an organization name. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (CaseInsensitiveString.IsNullOrEmpty(RI.OrgDepartment))  // TODO: Configurable
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a department. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (CaseInsensitiveString.IsNullOrEmpty(RI.OrgRole))    // TODO: Configurable
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks a role. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (CaseInsensitiveString.IsNullOrEmpty(RI.OrgNumber))  // TODO: Configurable
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks an organization number. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequireAddress && CaseInsensitiveString.IsNullOrEmpty(RI.OrgAddress))
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks an organization address. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequirePostalCode && CaseInsensitiveString.IsNullOrEmpty(RI.OrgPostalCode))
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks an organization Postal Code (ZIP). Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequireArea && CaseInsensitiveString.IsNullOrEmpty(RI.OrgArea))
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks an organization Area. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequireCity && CaseInsensitiveString.IsNullOrEmpty(RI.OrgCity))
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks an organization City. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequireRegion && CaseInsensitiveString.IsNullOrEmpty(RI.OrgRegion))
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks an organization Region. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (PeerReviewConfiguration.Instance.RequireCountry && CaseInsensitiveString.IsNullOrEmpty(RI.OrgCountry))
                                {
                                    await e.IqErrorBadRequest(e.To, "Reviewer identity lacks an organization Country. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (!CaseInsensitiveString.IsNullOrEmpty(RI.OrgCountry))
                                {
                                    if (PeerReviewConfiguration.Instance.RequireIso3166Compliance && !Iso3166.TryGetCountry(RI.OrgCountry, out string _))
                                    {
                                        await e.IqErrorBadRequest(e.To, "Reviewer organization Country is not an ISO 3166-1 Country Code. Peer review not accepted.", "en");
                                        return;
                                    }
                                }
                            }
 
                            if (!await CheckPeerReviewFields(e, ReviewedIdentity))
                                return;
 
                            PersonalInformation PI = GetPersonalInformation(ReviewedIdentity);
 
                            if (PI.HasOrg)
                            {
                                if (!RI.HasOrg)
                                {
                                    await e.IqErrorBadRequest(e.To, "Peer reviewer lacks organization information. Peer review not accepted.", "en");
                                    return;
                                }
 
                                if (PI.OrgName != RI.OrgName ||
                                    PI.OrgNumber != RI.OrgNumber ||
                                    PI.OrgCountry != RI.OrgCountry)
                                {
                                    await e.IqErrorBadRequest(e.To, "Peer reviewer must be from same company. Peer review not accepted.", "en");
                                    return;
                                }
                            }
 
                            if (!(Identity.Attachments is null))
                            {
                                LegalIdentity[] Reviewers2 = await GetPeerReviewers(Identity);
 
                                foreach (LegalIdentity ReviewerID in Reviewers2)
                                {
                                    if (ReviewerID[PersonalInformation.PersonalNumberTag] == Pnr)
                                    {
                                        await e.IqErrorBadRequest(e.To, "A reviewer can only review the application once.", "en");
                                        return;
                                    }
                                }
 
                                Reviewers ??= new List<LegalIdentity>();
                                Reviewers.AddRange(Reviewers2);
                            }
                        }
 
                        Reviewers ??= new List<LegalIdentity>();
                        Reviewers.Add(ReviewerIdentity);
                        IncNrPeerReviews = true;
                    }
                }
                else
                {
                    Doc = null;
 
                    // Check again to avoid malicious user to add attachment after identity created.
                    if (Identity.State != Legal.Identity.IdentityState.Created)
                    {
                        await e.IqErrorForbidden(e.To, "Attachments can only be added to newly created identities before they are approved.", "en");
                        return;
                    }
                }
 
                List<AttachmentReference> References = new List<AttachmentReference>();
                bool Approved = false;
 
                if (!(Identity.Attachments is null))
                    References.AddRange(Identity.Attachments);
 
                KeyValuePair<Attachment, AttachmentReference> A = await this.CreateAttachment(
                    GetUri, Identity, Signature, File, ContentType, Account2, null,
                    Identity.To.ToUniversalTime(), Preview);
 
                References.Add(A.Value);
 
                Identity.Attachments = References.ToArray();
                Identity.Updated = UtcNowSecond;
 
                if (IncNrPeerReviews)
                {
                    Identity.NrPeerReviews++;
 
                    if ((PeerReviewConfiguration.Instance?.AllowPeerReview ?? true) &&
                        Identity.NrPeerReviews >= (PeerReviewConfiguration.Instance?.NrReviewersToApprove ?? 2) &&
                        Identity.State == Legal.Identity.IdentityState.Created)
                    {
                        Identity.State = Legal.Identity.IdentityState.Approved;
                        Approved = true;
 
                        if (!Preview &&
                            (BrokerNotificationConfiguration.Instance?.PeerReviewApproved ?? false))
                        {
                            StringBuilder Markdown = new StringBuilder();
 
                            Markdown.AppendLine("Peer reviewed Legal ID approved");
                            Markdown.AppendLine("===================================");
                            Markdown.AppendLine();
 
                            this.AppendMarkdown(Markdown, Identity, "Applicant");
 
                            int Index = 0;
 
                            foreach (LegalIdentity Reviewer in Reviewers)
                            {
                                Index++;
                                this.AppendMarkdown(Markdown, Reviewer, "Reviewer " + Index.ToString());
                            }
 
                            await Gateway.SendNotification(Markdown.ToString());
                        }
                    }
                }
 
                Identity.Sign(this);
 
                if (Preview)
                {
                    await AddPreview(Identity);
                    await RuntimeCounters.IncrementCounter("Legal.IDPreview." + Identity.State.ToString());
                }
                else
                {
                    await Database.Update(Identity);
                    await RuntimeCounters.IncrementCounter("Legal.ID." + Identity.State.ToString());
 
                    if (Identity.State == Legal.Identity.IdentityState.Approved)
                        await CopyPropertiesFromApprovedIdentity(Identity, Account as Account);
 
                    Log.Informational("Attachment added to Legal Identity registration.",
                        Identity.Id.Value, e.From.Address.Value,
                        "LegalIdUpdated", Identity.GetTags());
                }
 
                sb.Clear();
                Identity.Serialize(sb, true, true, true, true, true, true, true, null, this);
                string Xml = sb.ToString();
 
                if (!Preview && Approved)
                    await AddLegalIdentityReference(Identity);
 
                if (Approved || Identity.State == Legal.Identity.IdentityState.Approved)
                {
                    XmppAddress IdentityAddress = new XmppAddress(Identity.Id);
                    int i = IdentityAddress.Domain.IndexOf('.');
                    string JidDomain = i < 0 ? this.Server.Domain : IdentityAddress.Domain.Substring(i + 1);
 
                    await this.Server.SendMessage(string.Empty, string.Empty, e.To,
                        new XmppAddress(Identity.Account + "@" + this.Server.Domain), string.Empty, Xml);
                }
 
                await e.IqResult(Xml, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal static async Task<bool> CheckPeerReviewFields(IqEventArgs e, LegalIdentity Identity)
        {
            if (PeerReviewConfiguration.Instance?.AllowPeerReview ?? false)
            {
                PersonalInformation PI = GetPersonalInformation(Identity);
 
                if (PeerReviewConfiguration.Instance.RequireFirstName && CaseInsensitiveString.IsNullOrEmpty(PI.FirstName))
                {
                    await e.IqErrorBadRequest(e.To, "First name is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireMiddleName && CaseInsensitiveString.IsNullOrEmpty(PI.MiddleNames))
                {
                    await e.IqErrorBadRequest(e.To, "Middle name is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireLastName && CaseInsensitiveString.IsNullOrEmpty(PI.LastNames))
                {
                    await e.IqErrorBadRequest(e.To, "Last name is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequirePersonalNumber && CaseInsensitiveString.IsNullOrEmpty(PI.PersonalNumber))
                {
                    await e.IqErrorBadRequest(e.To, "Personal Number is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireAddress && CaseInsensitiveString.IsNullOrEmpty(PI.Address))
                {
                    await e.IqErrorBadRequest(e.To, "Address is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequirePostalCode && CaseInsensitiveString.IsNullOrEmpty(PI.PostalCode))
                {
                    await e.IqErrorBadRequest(e.To, "Postal Code (ZIP) is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireArea && CaseInsensitiveString.IsNullOrEmpty(PI.Area))
                {
                    await e.IqErrorBadRequest(e.To, "Area is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireCity && CaseInsensitiveString.IsNullOrEmpty(PI.City))
                {
                    await e.IqErrorBadRequest(e.To, "City is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireRegion && CaseInsensitiveString.IsNullOrEmpty(PI.Region))
                {
                    await e.IqErrorBadRequest(e.To, "Region is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireCountry && CaseInsensitiveString.IsNullOrEmpty(PI.Country))
                {
                    await e.IqErrorBadRequest(e.To, "Country is a required field.", "en");
                    return false;
                }
 
                if (!CaseInsensitiveString.IsNullOrEmpty(PI.Country))
                {
                    if (PeerReviewConfiguration.Instance.RequireIso3166Compliance && !Iso3166.TryGetCountry(PI.Country, out string _))
                    {
                        await e.IqErrorBadRequest(e.To, "Country must be a ISO 3166-1 Country Code.", "en");
                        return false;
                    }
 
                    if (!CaseInsensitiveString.IsNullOrEmpty(PI.PersonalNumber))
                    {
                        bool? Valid = await PersonalNumberSchemes.IsValid(PI.Country, PI.PersonalNumber);
                        if (Valid.HasValue && !Valid.Value)
                        {
                            await e.IqErrorBadRequest(e.To, "The personal number format does not comply with regulations in your country.", "en");
                            return false;
                        }
                    }
                }
 
                if (PeerReviewConfiguration.Instance.RequireNationality && CaseInsensitiveString.IsNullOrEmpty(PI.Nationality))
                {
                    await e.IqErrorBadRequest(e.To, "Nationality is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireGender && !PI.Gender.HasValue)
                {
                    await e.IqErrorBadRequest(e.To, "Gender is a required field.", "en");
                    return false;
                }
 
                if (PeerReviewConfiguration.Instance.RequireBirthDate && !PI.HasBirthDate)
                {
                    await e.IqErrorBadRequest(e.To, "Birth Date is a required field.", "en");
                    return false;
                }
 
                if (PI.HasOrg)
                {
                    if (CaseInsensitiveString.IsNullOrEmpty(PI.OrgName))    // TODO: Make configurable
                    {
                        await e.IqErrorBadRequest(e.To, "Organization name is a required field for work identities.", "en");
                        return false;
                    }
 
                    if (CaseInsensitiveString.IsNullOrEmpty(PI.OrgDepartment)) // TODO: Make configurable
                    {
                        await e.IqErrorBadRequest(e.To, "Department is a required field for work identities.", "en");
                        return false;
                    }
 
                    if (CaseInsensitiveString.IsNullOrEmpty(PI.OrgRole))   // TODO: Make configurable
                    {
                        await e.IqErrorBadRequest(e.To, "Role is a required field for work identites.", "en");
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequirePersonalNumber && CaseInsensitiveString.IsNullOrEmpty(PI.OrgNumber))
                    {
                        await e.IqErrorBadRequest(e.To, "Organization Number is a required field for work identites.", "en");
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequireAddress && CaseInsensitiveString.IsNullOrEmpty(PI.OrgAddress))
                    {
                        await e.IqErrorBadRequest(e.To, "Organization Address is a required field for work identites.", "en");
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequirePostalCode && CaseInsensitiveString.IsNullOrEmpty(PI.OrgPostalCode))
                    {
                        await e.IqErrorBadRequest(e.To, "Organization Postal Code (ZIP) is a required field for work identites.", "en");
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequireArea && CaseInsensitiveString.IsNullOrEmpty(PI.OrgArea))
                    {
                        await e.IqErrorBadRequest(e.To, "Organization Area is a required field for work identites.", "en");
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequireCity && CaseInsensitiveString.IsNullOrEmpty(PI.OrgCity))
                    {
                        await e.IqErrorBadRequest(e.To, "Organization City is a required field for work identites.", "en");
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequireRegion && CaseInsensitiveString.IsNullOrEmpty(PI.OrgRegion))
                    {
                        await e.IqErrorBadRequest(e.To, "Organization Region is a required field for work identites.", "en");
                        return false;
                    }
 
                    if (PeerReviewConfiguration.Instance.RequireCountry && CaseInsensitiveString.IsNullOrEmpty(PI.OrgCountry))
                    {
                        await e.IqErrorBadRequest(e.To, "Organization Country is a required field for work identites.", "en");
                        return false;
                    }
 
                    if (!CaseInsensitiveString.IsNullOrEmpty(PI.OrgCountry))
                    {
                        if (PeerReviewConfiguration.Instance.RequireIso3166Compliance && !Iso3166.TryGetCountry(PI.OrgCountry, out string _))
                        {
                            await e.IqErrorBadRequest(e.To, "Organization Country must be a ISO 3166-1 Country Code.", "en");
                            return false;
                        }
                    }
                }
            }
 
            return true;
        }
 
        internal static async Task<LegalIdentity[]> GetPeerReviewers(LegalIdentity Identity)
        {
            List<LegalIdentity> Result = new List<LegalIdentity>();
            string Namespace = NamespaceLegalIdentity(Identity.Version);
 
            if (!(Identity?.Attachments is null))
            {
                foreach (AttachmentReference Ref in Identity.Attachments)
                {
                    if (Ref.ContentType.StartsWith(XmlCodec.DefaultContentType) ||
                        Ref.ContentType.StartsWith(XmlCodec.SchemaContentType))
                    {
                        Attachment Attachment = await Database.FindFirstDeleteRest<Attachment>(new FilterFieldEqualTo("Id", Ref.Id));
                        if (Attachment is null)
                            continue;
 
                        using FileStream AttachmentFile = File.OpenRead(Attachment.LocalFileName);
                        Aes Aes = Aes.Create();
 
                        Aes.BlockSize = 128;
                        Aes.KeySize = 256;
                        Aes.Mode = CipherMode.CBC;
                        Aes.Padding = PaddingMode.Zeros;
 
                        byte[] Key = new byte[32];
                        byte[] IV = new byte[16];
 
                        Buffer.BlockCopy(Attachment.Salt, 0, Key, 0, 32);
                        Buffer.BlockCopy(Attachment.Salt, 32, IV, 0, 16);
 
                        using ICryptoTransform Decryptor = Aes.CreateDecryptor(Key, IV);
                        using CryptoStream DecryptedAttachmentFile = new CryptoStream(AttachmentFile, Decryptor, CryptoStreamMode.Read);
                        XmlDocument Doc = new XmlDocument()
                        {
                            PreserveWhitespace = true
                        };
                        Doc.Load(DecryptedAttachmentFile);
 
                        if (Doc.DocumentElement.LocalName == "peerReview" &&
                            Doc.DocumentElement.NamespaceURI == Namespace)
                        {
                            foreach (XmlNode N in Doc.DocumentElement.ChildNodes)
                            {
                                if (N is XmlElement E &&
                                    E.LocalName == "reviewer" &&
                                    E.NamespaceURI == Namespace)
                                {
                                    foreach (XmlNode N2 in E.ChildNodes)
                                    {
                                        if (N2 is XmlElement E2 &&
                                            E2.LocalName == "identity" &&
                                            E2.NamespaceURI == Namespace)
                                        {
                                            LegalIdentity ReviewerID = LegalIdentity.Parse(E2, out _, out _);
                                            Result.Add(ReviewerID);
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
 
            return Result.ToArray();
        }
 
        internal void AppendMarkdown(StringBuilder Markdown, LegalIdentity Identity, string Title)
        {
            Markdown.AppendLine(Title);
            Markdown.AppendLine(new string('-', Title.Length + 3));
            Markdown.AppendLine();
 
            Markdown.Append("| `");
            Markdown.Append(Identity.Id);
            Markdown.AppendLine("` ||");
            Markdown.AppendLine("|:----|:----|");
 
            foreach (Property P in Identity.Properties)
            {
                Markdown.Append("| `");
                Markdown.Append(P.Name);
                Markdown.Append("` | ");
                Markdown.Append(MarkdownDocument.Encode(P.Value));
                Markdown.AppendLine(" |");
            }
 
            Markdown.AppendLine();
        }
 
        private Task<KeyValuePair<Attachment, AttachmentReference>> CreateAttachment(Uri GetUri,
            LegalIdentity UploadingIdentity, byte[] Signature, TemporaryStream File, string ContentType,
            Account Account, CaseInsensitiveString ContractId, DateTime ExpiresUtc, bool Preview)
        {
            return CreateAttachment(Path.GetFileName(GetUri.AbsolutePath), UploadingIdentity,
                Signature, File, ContentType, Account, ContractId, this.attachmentsFolder, ExpiresUtc, Preview);
        }
 
        internal static string GetFolderName(string AttachmentsFolder, out DateTime Timestamp)
        {
            Timestamp = DateTime.UtcNow;
            string Folder = Path.Combine(AttachmentsFolder, Timestamp.Year.ToString("D4"),
                Timestamp.Month.ToString("D2"), Timestamp.Day.ToString("D2"));
 
            if (!Directory.Exists(Folder))
                Directory.CreateDirectory(Folder);
 
            return Folder;
        }
 
        internal static async Task<KeyValuePair<Attachment, AttachmentReference>> CreateAttachment(string RemoteFileName,
            LegalIdentity UploadingIdentity, byte[] Signature, TemporaryStream File, string ContentType,
            Account Account, CaseInsensitiveString ContractId, string AttachmentsFolder,
            DateTime ExpiresUtc, bool Preview)
        {
            byte[] Salt;
            DateTime Timestamp;
            string Folder;
 
            if (Preview)
            {
                Timestamp = DateTime.UtcNow;
                Folder = GetPreviewFolder();
                Salt = null;
            }
            else
            {
                Folder = GetFolderName(AttachmentsFolder, out Timestamp);
                Salt = Gateway.NextBytes(48);
            }
 
            Attachment Attachment = new Attachment()
            {
                Account = Account.UserName,
                ContentType = ContentType,
                ContractId = ContractId,
                RemoteFileName = RemoteFileName,
                Signature = Signature,
                Timestamp = Timestamp,
                UploaderLegalId = UploadingIdentity.Id,
                Size = File.Length,
                Salt = Salt
            };
 
            if (Preview)
                Attachment.ObjectId = Guid.NewGuid().ToString();
            else
                await Database.Insert(Attachment);
 
            string AttachmentId = Attachment.ObjectId;
            string FileName = Preview ? GetPreviewFileName(AttachmentId, ".att") :
                Path.Combine(Folder, AttachmentId + ".bin");
 
            Attachment.Id = AttachmentId + "@" + UploadingIdentity.Provider;
            Attachment.LocalFileName = FileName;
 
            File.Position = 0;
 
            if (Preview)
            {
                Salt = await CreatePreviewSalt(FileName, Account.UserName);
                Attachment.Salt = Salt;
 
                using Stream Blob = await XmppServerModule.EncodeBlob(File);
 
                await XmppServerModule.SaveEncryptedFile(FileName, Salt, Blob);
            }
            else
            {
                await Database.Update(Attachment);
 
                byte[] Key = new byte[32];
                byte[] IV = new byte[16];
 
                Buffer.BlockCopy(Salt, 0, Key, 0, 32);
                Buffer.BlockCopy(Salt, 32, IV, 0, 16);
 
                using FileStream AttachmentFile = System.IO.File.Create(FileName);
                Aes Aes = Aes.Create();
 
                Aes.BlockSize = 128;
                Aes.KeySize = 256;
                Aes.Mode = CipherMode.CBC;
                Aes.Padding = PaddingMode.Zeros;
 
                using ICryptoTransform Encryptor = Aes.CreateEncryptor(Key, IV);
                using CryptoStream EncryptedAttachmentFile = new CryptoStream(AttachmentFile, Encryptor, CryptoStreamMode.Write);
 
                await File.CopyToAsync(EncryptedAttachmentFile);
                EncryptedAttachmentFile.FlushFinalBlock();
 
                AttachmentCacheItem CacheItem = new AttachmentCacheItem()
                {
                    AttachmentId = Attachment.Id,
                    Created = DateTime.UtcNow,
                    Expires = ExpiresUtc,
                    ContentType = ContentType,
                    LocalAttachmentId = Attachment.ObjectId,
                    FileName = Attachment.LocalFileName,
                    Size = Attachment.Size,
                    Salt = Salt
                };
 
                await Database.Insert(CacheItem);
            }
 
            AttachmentReference Ref = new AttachmentReference()
            {
                ContentType = ContentType,
                FileName = Attachment.RemoteFileName,
                Id = Attachment.Id,
                LegalId = Attachment.UploaderLegalId,
                Signature = Signature,
                Timestamp = Timestamp,
                Preview = Preview
            };
 
            return new KeyValuePair<Attachment, AttachmentReference>(Attachment, Ref);
        }
 
        private async Task RemoveLegalIdAttachmentHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString AttachmentId = XML.Attribute(e.Query, "attachmentId");
 
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Only accounts on the broker can remove attachments.", "en");
                    return;
                }
 
                Attachment Attachment = await Database.FindFirstDeleteRest<Attachment>(new FilterFieldEqualTo("Id", AttachmentId));
                if (Attachment is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Attachment not found.", "en");
                    return;
                }
 
                if (!CaseInsensitiveString.IsNullOrEmpty(Attachment.ContractId))
                {
                    await e.IqErrorItemNotFound(e.To, "Attachment not assigned to legal identity.", "en");
                    return;
                }
 
                using Semaphore Semaphore = await Semaphores.BeginWrite("iotid:" + Attachment.UploaderLegalId.LowerCase);
                LegalIdentity Identity = await GetLocalLegalIdentity(Attachment.UploaderLegalId);
                if (Identity is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Associated Legal identity not found.", "en");
                    return;
                }
 
                if (Identity.Account != e.From.Account)
                {
                    await e.IqErrorForbidden(e.To, "Only allowed to remove attachments from your own legal identities.", "en");
                    return;
                }
 
                if (Identity.State != Legal.Identity.IdentityState.Created)
                {
                    await e.IqErrorForbidden(e.To, "Attachments can only be removed from newly created identities before they are approved.", "en");
                    return;
                }
 
                if (File.Exists(Attachment.LocalFileName))
                    File.Delete(Attachment.LocalFileName);
 
                if (!(Identity.Attachments is null))
                {
                    List<AttachmentReference> Attachments = new List<AttachmentReference>();
 
                    foreach (AttachmentReference Ref in Identity.Attachments)
                    {
                        if (Ref.Id != AttachmentId)
                            Attachments.Add(Ref);
                    }
 
                    Identity.Attachments = Attachments.ToArray();
                    Identity.Sign(this);
 
                    await Database.Update(Identity);
                }
 
                await Database.Delete(Attachment);
 
                StringBuilder Xml = new StringBuilder();
                Identity.Serialize(Xml, true, true, true, true, true, true, true, null, this);
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal async Task<KeyValuePair<byte[], string>> GetAttachment(string AttachmentId,
            string AttachmentUrl, DateTime Expires)
        {
            Expires = Expires.ToUniversalTime();
 
            AttachmentCacheItem Item = await AttachmentCache.TryGetAttachment(AttachmentId);
            string ContentType;
            byte[] Data;
 
            if (!(Item is null))
            {
                if (Expires > Item.Expires)
                {
                    Item.Expires = Expires;
                    await Database.Update(Item);
                }
 
                Data = await Item.LoadContent();
                return new KeyValuePair<byte[], string>(Data, Item.ContentType);
            }
 
            int i = AttachmentId.IndexOf('@');
 
            if (i > 0)
            {
                string AttachmentDomain = AttachmentId[(i + 1)..];
                AttachmentId = AttachmentId[..i];
 
                if (!this.IsComponentDomain(AttachmentDomain, true))
                {
                    KeyValuePair<string, TemporaryFile> P = await Gateway.ContractsClient.GetAttachmentAsync(AttachmentUrl,
                        Networking.XMPP.Contracts.SignWith.LatestApprovedId, 30000);
                    using TemporaryFile File = P.Value;
 
                    File.Position = 0;
 
                    ContentType = P.Key;
                    Data = await File.ReadAllAsync();
 
                    await AttachmentCache.AddRemoteAttachment(AttachmentId,
                        Expires, Data, ContentType, this);
 
                    return new KeyValuePair<byte[], string>(Data, ContentType);
                }
            }
 
            Attachment Attachment = await Database.TryLoadObject<Attachment>(AttachmentId)
                ?? throw new NotFoundException("Attachment not found.");
 
            ContentType = Attachment.ContentType;
 
            using FileStream AttachmentFile = File.OpenRead(Attachment.LocalFileName);
            Aes Aes = Aes.Create();
 
            Aes.BlockSize = 128;
            Aes.KeySize = 256;
            Aes.Mode = CipherMode.CBC;
            Aes.Padding = PaddingMode.Zeros;
 
            byte[] Key = new byte[32];
            byte[] IV = new byte[16];
 
            Buffer.BlockCopy(Attachment.Salt, 0, Key, 0, 32);
            Buffer.BlockCopy(Attachment.Salt, 32, IV, 0, 16);
 
            using ICryptoTransform Decryptor = Aes.CreateDecryptor(Key, IV);
            using (CryptoStream DecryptedAttachmentFile = new CryptoStream(AttachmentFile, Decryptor, CryptoStreamMode.Read))
            {
                Data = await DecryptedAttachmentFile.ReadAllAsync((int)Attachment.Size);
            }
 
            await AttachmentCache.AddLocalAttachment(Attachment, Expires);
 
            return new KeyValuePair<byte[], string>(Data, ContentType);
        }
 
        internal async Task<ClientInformation> GetNetworkIdentity(CaseInsensitiveString Id, bool CanBeLegal, bool CanBeJid, NamespaceSet Version)
        {
            XmppAddress Address = new XmppAddress(Id);
 
            if (this.IsComponentDomain(Address.Domain, true))
            {
                if (!CanBeLegal)
                    throw new Exception("Expected server domain, not a component domain: " + Address.Domain);
 
                LegalIdentity Identity = await GetLocalLegalIdentity(Id)
                    ?? throw new Exception("Legal Identity not found: " + Id.Value);
 
                CaseInsensitiveString BareJid = Identity[PersonalInformation.JidTag];
 
                if (CaseInsensitiveString.IsNullOrEmpty(BareJid))
                {
                    if (Address.Domain.StartsWith(this.SubdomainSuffixed, StringComparison.CurrentCultureIgnoreCase))
                        BareJid = Identity.Account + "@" + Address.Domain.Substring(this.SubdomainSuffixed.Length);
                    else
                        BareJid = Identity.Account + "@" + this.Server.Domain;
                }
 
                if (!this.Server.TryGetClientConnections(BareJid, out IClientConnection[] Connections))
                    Connections = null;
 
                return new ClientInformation()
                {
                    Jid = BareJid,
                    Connections = this.RemoveDisconnected(Connections)
                };
            }
            else if (this.Server.IsServerDomain(Address.Domain, true))
            {
                if (!CanBeJid)
                    throw new Exception("Expected legal component domain, not server domain: " + Address.Domain);
 
                IClientConnection[] Connections;
 
                if (Address.IsFullJID)
                {
                    if (this.Server.TryGetClientConnection(Address.Address, out IClientConnection Connection))
                        Connections = new IClientConnection[] { Connection };
                    else
                        Connections = null;
                }
                else if (Address.IsBareJID)
                {
                    if (!this.Server.TryGetClientConnections(Address.BareJid, out Connections))
                        Connections = null;
                }
                else
                    Connections = null;
 
                return new ClientInformation()
                {
                    Jid = Address.BareJid,
                    Connections = this.RemoveDisconnected(Connections)
                };
            }
            else
            {
                TaskCompletionSource<ClientInformation> Result = new TaskCompletionSource<ClientInformation>();
                StringBuilder Xml = new StringBuilder();
                string Namespace = NamespaceLegalIdentity(Version);
 
                Xml.Append("<getNetworkIdentity xmlns='");
                Xml.Append(Namespace);
                Xml.Append("' id='");
                Xml.Append(XML.Encode(Id));
                Xml.Append("'/>");
 
                await this.Server.SendIqRequest("get", this.MainDomain.Address, Address.Domain, string.Empty, Xml.ToString(), true, (sender2, e2) =>
                {
                    if (e2.Ok)
                    {
                        XmlElement E = e2.FirstElement;
 
                        if (!(E is null) && E.LocalName == "networkIdentity" && E.NamespaceURI == Namespace)
                        {
                            string Jid = XML.Attribute(E, "jid");
                            List<ClientConnectionInformation> Connections = new List<ClientConnectionInformation>();
 
                            foreach (XmlNode N in E.ChildNodes)
                            {
                                if (N is XmlElement E2 &&
                                    E2.LocalName == "connection" &&
                                    E2.NamespaceURI == Namespace)
                                {
                                    Connections.Add(new ClientConnectionInformation()
                                    {
                                        Endpoint = XML.Attribute(E2, "clientEp"),
                                        LastPresenceTimestamp = XML.Attribute(E2, "ts", DateTimeOffset.MinValue)
                                    });
                                }
                            }
 
                            Result.TrySetResult(new ClientInformation()
                            {
                                Jid = Jid,
                                Connections = Connections.ToArray()
                            });
                        }
                        else
                            Result.TrySetException(new Exception("Unexpected response received."));
                    }
                    else
                        Result.TrySetException(new Exception(string.IsNullOrEmpty(e2.ErrorText) ? "Unable to get network identity." : e2.ErrorText));
 
                    return Task.CompletedTask;
                }, null);
 
                return await Result.Task;
            }
        }
 
        private ClientConnectionInformation[] RemoveDisconnected(IClientConnection[] Connections)
        {
            if (Connections is null)
                return Array.Empty<ClientConnectionInformation>();
 
            List<ClientConnectionInformation> Result = new List<ClientConnectionInformation>();
 
            foreach (IClientConnection Connection in Connections)
            {
                if (!Connection.CheckLive())
                    continue;
 
                if (string.IsNullOrEmpty(Connection.RemoteEndPoint))
                    continue;
 
                if (Connection.LastPresence is null)
                    continue;
 
                Result.Add(new ClientConnectionInformation()
                {
                    Endpoint = Connection.RemoteEndPoint,
                    LastPresenceTimestamp = Connection.LastPresence.Timestamp
                });
            }
 
            return Result.ToArray();
        }
 
        internal class ClientInformation
        {
            public CaseInsensitiveString Jid { get; set; }
            public ClientConnectionInformation[] Connections { get; set; }
 
            public string MostRecentEndpoint
            {
                get
                {
                    DateTimeOffset Best = DateTimeOffset.MinValue;
                    string Endpoint = null;
 
                    if (!(this.Connections is null))
                    {
                        foreach (ClientConnectionInformation Info in this.Connections)
                        {
                            if (Info.LastPresenceTimestamp > Best)
                            {
                                Best = Info.LastPresenceTimestamp;
                                Endpoint = Info.Endpoint;
                            }
                        }
                    }
 
                    return Endpoint;
                }
            }
        }
 
        internal class ClientConnectionInformation
        {
            public string Endpoint { get; set; }
            public DateTimeOffset LastPresenceTimestamp { get; set; }
        }
 
        private Task GetNetworkLegalIdentityHandler(object Sender, IqEventArgs e)
        {
            return this.GetNetworkIdentityHandler(e, true);
        }
 
        private Task GetNetworkXmppIdentityHandler(object Sender, IqEventArgs e)
        {
            return this.GetNetworkIdentityHandler(e, false);
        }
 
        private async Task GetNetworkIdentityHandler(IqEventArgs e, bool ToLegalComponent)
        {
            try
            {
                if (!e.From.IsDomain)
                {
                    await e.IqErrorForbidden(e.To, "Service only provided to federated servers.", "en");
                    return;
                }
 
                CaseInsensitiveString Id = XML.Attribute(e.Query, "id");
                if (CaseInsensitiveString.IsNullOrEmpty(Id))
                {
                    await e.IqErrorBadRequest(e.To, "No ID reference provided.", "en");
                    return;
                }
 
                CaseInsensitiveString NetworkIdentity;
                IClientConnection[] Connections;
                XmppAddress IdAddress = new XmppAddress(Id);
 
                if (this.IsComponentDomain(IdAddress.Domain, true))
                {
                    if (!ToLegalComponent)
                    {
                        await e.IqErrorBadRequest(e.To, "Request must be made to legal component.", "en");
                        return;
                    }
 
                    if (!IdAddress.IsBareJID)
                    {
                        await e.IqErrorBadRequest(e.To, "Invalid Legal ID.", "en");
                        return;
                    }
 
                    using Semaphore Semaphore = await Semaphores.BeginRead("iotid:" + Id.LowerCase);
                    LegalIdentity Identity = await GetLocalLegalIdentity(Id);
                    if (Identity is null)
                    {
                        await e.IqErrorItemNotFound(e.To, "Identity not found.", "en");
                        return;
                    }
 
                    if (IdAddress.Domain.StartsWith(this.SubdomainSuffixed, StringComparison.CurrentCultureIgnoreCase))
                        NetworkIdentity = Identity.Account + "@" + IdAddress.Domain.Substring(this.SubdomainSuffixed.Length);
                    else
                        NetworkIdentity = Identity.Account + "@" + this.Server.Domain;
 
                    if (!this.Server.TryGetClientConnections(NetworkIdentity, out Connections))
                        Connections = null;
                }
                else if (this.Server.IsServerDomain(IdAddress.Domain, true))
                {
                    if (ToLegalComponent)
                    {
                        await e.IqErrorBadRequest(e.To, "Request must be made to server.", "en");
                        return;
                    }
 
                    if (IdAddress.IsBareJID)
                    {
                        NetworkIdentity = IdAddress.Address;
 
                        if (!this.Server.TryGetClientConnections(NetworkIdentity, out Connections))
                            Connections = null;
                    }
                    else if (IdAddress.IsFullJID)
                    {
                        NetworkIdentity = IdAddress.BareJid;
 
                        if (this.Server.TryGetClientConnection(IdAddress.Address, out IClientConnection Connection))
                            Connections = new IClientConnection[] { Connection };
                        else
                            Connections = null;
                    }
                    else
                    {
                        await e.IqErrorBadRequest(e.To, "Invalid JID.", "en");
                        return;
                    }
                }
                else
                {
                    await e.IqErrorForbidden(e.To, "Identity not hosted by this neuron.", "en");
                    return;
                }
 
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
                StringBuilder Xml = new StringBuilder();
 
                Xml.Append("<networkIdentity xmlns='");
                Xml.Append(NamespaceLegalIdentity(QueryVersion));
                Xml.Append("' jid='");
                Xml.Append(XML.Encode(NetworkIdentity));
                Xml.Append("'>");
 
                foreach (ClientConnectionInformation ClientInfo in this.RemoveDisconnected(Connections))
                {
                    Xml.Append("<connection clientEp='");
                    Xml.Append(XML.Encode(ClientInfo.Endpoint));
                    Xml.Append("' ts='");
                    Xml.Append(XML.Encode(ClientInfo.LastPresenceTimestamp));
                    Xml.Append("'/>");
                }
 
                Xml.Append("</networkIdentity>");
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task GetIdentityReferencesHandler(object Sender, IqEventArgs e)
        {
            try
            {
                if (!e.From.IsDomain)
                {
                    await e.IqErrorForbidden(e.To, "Service only provided to federated servers.", "en");
                    return;
                }
 
                CaseInsensitiveString Jid = XML.Attribute(e.Query, "jid");
                if (CaseInsensitiveString.IsNullOrEmpty(Jid))
                {
                    await e.IqErrorBadRequest(e.To, "No JID reference provided.", "en");
                    return;
                }
 
                XmppAddress Address = new XmppAddress(Jid);
                if (!Address.IsBareJID)
                {
                    await e.IqErrorBadRequest(e.To, "JID not a Bare JID.", "en");
                    return;
                }
 
                if (!this.Server.IsServerDomain(Address.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "JID domain part not a domain name of the broker.", "en");
                    return;
                }
 
                IAccount Account = await XmppServerModule.GetAccountAsync(Address.Account);
                if (Account is null)
                {
                    await e.IqErrorItemNotFound(e.To, "JID not found.", "en");
                    return;
                }
 
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
                StringBuilder Xml = new StringBuilder();
                DateTime UtcNow = DateTime.UtcNow;
 
                Xml.Append("<identityReferences xmlns='");
                Xml.Append(NamespaceLegalIdentity(QueryVersion));
                Xml.Append("'>");
 
                foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                    new FilterFieldEqualTo("Account", Account.UserName),
                    new FilterFieldEqualTo("State", Legal.Identity.IdentityState.Approved),
                    new FilterFieldLesserOrEqualTo("From", UtcNow),
                    new FilterFieldGreaterOrEqualTo("To", UtcNow)), "-Created"))
                {
                    Xml.Append("<identityReference>");
                    Xml.Append(XML.Encode(ID.Id.Value));
                    Xml.Append("</identityReference>");
                }
 
                Xml.Append("</identityReferences>");
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal async Task<string[]> GetIdentityReferences(XmppAddress Jid)
        {
            string BareJid = Jid.BareJid;
            string Key = BareJid + "|idRefs";
 
            if (this.remoteComponents.TryGetValue(Key, out object Obj) && Obj is string[] CachedResult)
                return CachedResult;
 
            ChunkedList<string> References = new ChunkedList<string>();
 
            if (this.Server.IsServerDomain(Jid.Domain, true))
            {
                DateTime UtcNow = DateTime.UtcNow;
 
                foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                    new FilterFieldEqualTo("Account", Jid.Account),
                    new FilterFieldEqualTo("State", Legal.Identity.IdentityState.Approved),
                    new FilterFieldLesserOrEqualTo("From", UtcNow),
                    new FilterFieldGreaterOrEqualTo("To", UtcNow)), "-Created"))
                {
                    References.Add(ID.Id);
                }
 
                CachedResult = References.ToArray();
                this.remoteComponents[Key] = CachedResult;
 
                return CachedResult;
            }
 
            if (!Gateway.HasDomain)
                return Array.Empty<string>();
 
            TaskCompletionSource<string[]> Result = new TaskCompletionSource<string[]>();
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<identityReferences xmlns='");
            Xml.Append(NamespaceLegalIdentity(NamespaceSet.Current));
            Xml.Append("' jid='");
            Xml.Append(XML.Encode(BareJid));
            Xml.Append("'/>");
 
            await this.Server.SendIqRequest("get", this.Server.Domain, Jid.Domain, null,
                Xml.ToString(), (sender, e) =>
                {
                    XmlElement E;
 
                    if (!e.Ok)
                        Result.TrySetException(XmppClient.GetExceptionObject(e.ErrorElement));
                    else if ((E = e.FirstElement) is null ||
                        E.LocalName != "identityReferences" ||
                        !IsNamespaceLegalIdentity(E.NamespaceURI))
                    {
                        Result.TrySetException(new Exception("Unable to get the legal identity references for " +
                            BareJid + ". Invalid response returned."));
                    }
                    else
                    {
                        foreach (XmlNode N in E.ChildNodes)
                        {
                            if (N is XmlElement E2 &&
                                E2.LocalName == "identityReference" &&
                                IsNamespaceLegalIdentity(E2.NamespaceURI))
                            {
                                References.Add(E2.InnerText);
                            }
                        }
 
                        CachedResult = References.ToArray();
                        this.remoteComponents[Key] = CachedResult;
                        Result.TrySetResult(CachedResult);
                    }
 
                    return Task.CompletedTask;
                }, null);
 
            return await Result.Task;
        }
 
        internal bool TryGetItemFromCache(string Key, out object Obj)
        {
            return this.remoteComponents.TryGetValue(Key, out Obj);
        }
 
        internal void AddItemToCache(string Key, object Obj)
        {
            this.remoteComponents[Key] = Obj;
        }
 
        internal bool RemoveItemFromCache(string Key)
        {
            return this.remoteComponents.Remove(Key);
        }
 
        private async Task CanSignAsHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ReferenceId = XML.Attribute(e.Query, "referenceId");
                if (CaseInsensitiveString.IsNullOrEmpty(ReferenceId))
                {
                    await e.IqErrorBadRequest(e.To, "No Reference ID provided.", "en");
                    return;
                }
 
                CaseInsensitiveString SignatoryId = XML.Attribute(e.Query, "signatoryId");
                if (CaseInsensitiveString.IsNullOrEmpty(SignatoryId))
                {
                    await e.IqErrorBadRequest(e.To, "No Signatory ID provided.", "en");
                    return;
                }
 
                XmppAddress ReferenceAddress = new XmppAddress(ReferenceId);
                XmppAddress SignatoryAddress = new XmppAddress(SignatoryId);
 
                if (ReferenceAddress.Domain != SignatoryAddress.Domain)
                {
                    await e.IqErrorBadRequest(e.To, "Reference and Signatory domain mismatch.", "en");
                    return;
                }
 
                bool IncludeDetailedErrorMessage = e.From.IsDomain;
 
                if (!this.IsComponentDomain(ReferenceAddress.Domain, true))
                {
                    await e.IqErrorBadRequest(e.To, IncludeDetailedErrorMessage ? "Reference identity not hosted by broker." : string.Empty, "en");
                    return;
                }
 
                LegalIdentity ReferenceIdentity = await GetLocalLegalIdentity(ReferenceId);
                if (ReferenceIdentity is null)
                {
                    await e.IqErrorItemNotFound(e.To, IncludeDetailedErrorMessage ? "Reference ID not found." : string.Empty, "en");
                    return;
                }
 
                switch (ReferenceIdentity.State)
                {
                    case Legal.Identity.IdentityState.Created:
                        await e.IqErrorForbidden(e.To, IncludeDetailedErrorMessage ? "Reference ID never approved." : string.Empty, "en");
                        return;
 
                    case Legal.Identity.IdentityState.Approved:
                        await e.IqErrorForbidden(e.To, IncludeDetailedErrorMessage ? "Reference ID still approved." : string.Empty, "en");
                        return;
                }
 
                CaseInsensitiveString BareJid = ReferenceIdentity[PersonalInformation.JidTag];
                if (CaseInsensitiveString.IsNullOrEmpty(BareJid))
                {
                    await e.IqErrorForbidden(e.To, IncludeDetailedErrorMessage ? "Reference ID lacks encoded JID." : string.Empty, "en");
                    return;
                }
 
                CaseInsensitiveString PersonalNumber = ReferenceIdentity[PersonalInformation.PersonalNumberTag];
                if (CaseInsensitiveString.IsNullOrEmpty(PersonalNumber))
                {
                    await e.IqErrorForbidden(e.To, IncludeDetailedErrorMessage ? "Reference ID lacks encoded Personal Number." : string.Empty, "en");
                    return;
                }
 
                CaseInsensitiveString Country = ReferenceIdentity[PersonalInformation.CountryTag];
                if (CaseInsensitiveString.IsNullOrEmpty(Country))
                {
                    await e.IqErrorForbidden(e.To, IncludeDetailedErrorMessage ? "Reference ID lacks encoded Country." : string.Empty, "en");
                    return;
                }
 
                LegalIdentity SignatoryIdentity = await GetLocalLegalIdentity(SignatoryId);
                if (SignatoryIdentity is null)
                {
                    await e.IqErrorItemNotFound(e.To, IncludeDetailedErrorMessage ? "Signatory ID not found." : string.Empty, "en");
                    return;
                }
 
                if (SignatoryIdentity.State != Legal.Identity.IdentityState.Approved)
                {
                    await e.IqErrorForbidden(e.To, IncludeDetailedErrorMessage ? "Signatory ID not in an approved state." : string.Empty, "en");
                    return;
                }
 
                if (SignatoryIdentity[PersonalInformation.JidTag] != BareJid)
                {
                    await e.IqErrorForbidden(e.To, IncludeDetailedErrorMessage ? "JID mismatch." : string.Empty, "en");
                    return;
                }
 
                if (SignatoryIdentity[PersonalInformation.PersonalNumberTag] != PersonalNumber)
                {
                    await e.IqErrorForbidden(e.To, IncludeDetailedErrorMessage ? "Personal Number mismatch." : string.Empty, "en");
                    return;
                }
 
                if (SignatoryIdentity[PersonalInformation.CountryTag] != Country)
                {
                    await e.IqErrorForbidden(e.To, IncludeDetailedErrorMessage ? "Country mismatch." : string.Empty, "en");
                    return;
                }
 
                await e.IqResult(string.Empty, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal async Task<bool> CanSignAs(CaseInsensitiveString ReferenceId, CaseInsensitiveString SignatoryId)
        {
            XmppAddress ReferenceAddress = new XmppAddress(ReferenceId);
            XmppAddress SignatoryAddress = new XmppAddress(SignatoryId);
 
            if (ReferenceAddress.Domain != SignatoryAddress.Domain)
                return false;
 
            if (this.IsComponentDomain(ReferenceAddress.Domain, true))
            {
                LegalIdentity ReferenceIdentity = await GetLocalLegalIdentity(ReferenceId);
                if (ReferenceIdentity is null)
                    return false;
 
                switch (ReferenceIdentity.State)
                {
                    case Legal.Identity.IdentityState.Created:
                    case Legal.Identity.IdentityState.Approved:
                        return false;       // Reference must no longer be valid.
                }
 
                CaseInsensitiveString BareJid = ReferenceIdentity[PersonalInformation.JidTag];
                CaseInsensitiveString PersonalNumber = ReferenceIdentity[PersonalInformation.PersonalNumberTag];
                CaseInsensitiveString Country = ReferenceIdentity[PersonalInformation.CountryTag];
 
                if (CaseInsensitiveString.IsNullOrEmpty(BareJid) ||
                    CaseInsensitiveString.IsNullOrEmpty(PersonalNumber) ||
                    CaseInsensitiveString.IsNullOrEmpty(Country))
                {
                    return false;
                }
 
                LegalIdentity SignatoryIdentity = await GetLocalLegalIdentity(SignatoryId);
                if (SignatoryIdentity is null)
                    return false;
 
                if (SignatoryIdentity.State != Legal.Identity.IdentityState.Approved)
                    return false;
 
                if (SignatoryIdentity[PersonalInformation.JidTag] != BareJid ||
                    SignatoryIdentity[PersonalInformation.PersonalNumberTag] != PersonalNumber ||
                    SignatoryIdentity[PersonalInformation.CountryTag] != Country)
                {
                    return false;
                }
 
                return true;
            }
            else
            {
                TaskCompletionSource<bool> Result = new TaskCompletionSource<bool>();
                StringBuilder Xml = new StringBuilder();
                string Namespace = NamespaceLegalIdentity(NamespaceSet.Current);
 
                Xml.Append("<canSignAs xmlns='");
                Xml.Append(Namespace);
                Xml.Append("' referenceId='");
                Xml.Append(XML.Encode(ReferenceId));
                Xml.Append("' signatoryId='");
                Xml.Append(XML.Encode(SignatoryId));
                Xml.Append("'/>");
 
                await this.Server.SendIqRequest("get", this.MainDomain.Address, ReferenceAddress.Domain, string.Empty, Xml.ToString(), true, (sender2, e2) =>
                {
                    Result.TrySetResult(e2.Ok);
                    return Task.CompletedTask;
                }, null);
 
                return await Result.Task;
            }
        }
 
        private async Task AuthorizeAccessToIdHandler(object Sender, IqEventArgs e)
        {
            try
            {
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Service only available to local accounts.", "en");
                    return;
                }
 
                CaseInsensitiveString Id = XML.Attribute(e.Query, "id");
 
                if (CaseInsensitiveString.IsNullOrEmpty(Id))
                {
                    await e.IqErrorBadRequest(e.To, "No Legal ID specified.", "en");
                    return;
                }
 
                XmppAddress IdAddress = new XmppAddress(Id);
 
                if (!IdAddress.IsBareJID)
                {
                    await e.IqErrorBadRequest(e.To, "Invalid Legal ID.", "en");
                    return;
                }
 
                if (!this.IsComponentDomain(IdAddress.Domain, true))
                {
                    await e.IqErrorBadRequest(e.To, "Not a local Legal ID.", "en");
                    return;
                }
 
                CaseInsensitiveString RemoteId = XML.Attribute(e.Query, "remoteId");
                bool Authorized = XML.Attribute(e.Query, "auth", true);
 
                if (CaseInsensitiveString.IsNullOrEmpty(RemoteId))
                {
                    await e.IqErrorBadRequest(e.To, "No Remote ID specified.", "en");
                    return;
                }
 
                XmppAddress RemoteAddress = new XmppAddress(RemoteId);
                if (!RemoteAddress.IsBareJID)
                {
                    await e.IqErrorBadRequest(e.To, "Invalid Remote ID.", "en");
                    return;
                }
 
                using Semaphore Semaphore = await Semaphores.BeginRead("iotid:" + Id.LowerCase);
                LegalIdentity Identity = await GetLocalLegalIdentity(Id);
                if (Identity is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Legal identity not found.", "en");
                    return;
                }
 
                if (e.From.Account != Identity.Account)
                {
                    await e.IqErrorForbidden(e.To, "Not your identity.", "en");
                    return;
                }
 
                ClientInformation ClientInfo = await this.GetNetworkIdentity(RemoteId, true, true, Identity.Version);
                CaseInsensitiveString RemoteJid = ClientInfo.Jid;
                this.IdentityAuthorization(RemoteJid, e.From.BareJid, Id, Authorized);
 
                await e.IqResult(string.Empty, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task ReadyForApprovalHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString Id = XML.Attribute(e.Query, "id");
                using Semaphore Semaphore = await Semaphores.BeginWrite("iotid:" + Id.LowerCase);
 
                IAccount Account = await XmppServerModule.GetAccountAsync(e.From.Account);
                if (Account is null)
                {
                    await e.IqErrorForbidden(e.To, "Account not found.", "en");
                    return;
                }
 
                if (!Account.Enabled)
                {
                    await e.IqErrorForbidden(e.To, "Account has been disabled.", "en");
                    return;
                }
 
                KeyValuePair<LegalIdentity, bool> P = await GetLocalLegalIdentity(Id, true);
                LegalIdentity Identity = P.Key;
                bool Preview = P.Value;
 
                if (Identity is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Legal identity not found.", "en");
                    return;
                }
 
                if (e.From.Account != Identity.Account || !this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "You can only mark your own identity applications for approval.", "en");
                    return;
                }
 
                await e.IqResult(string.Empty, e.To);
 
                this.CheckAuthenticityOfIdentity(Identity, Identity.GetTags(), e.To, e.From,
                    Account as Account, Preview, (IdentityReviewXml, Identity2) =>
                    {
                        // Store in cache, as a means to pre-approve attachment that might
                        // be added to the Identity, albeit in an approved state when request
                        // arrives.
                        this.remoteComponents?.Add(Identity2.Id + "|identityReview", IdentityReviewXml);
 
                        return Task.FromResult(Identity2);
                    });
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal async void CheckAuthenticityOfIdentity(LegalIdentity Identity,
            KeyValuePair<string, object>[] Claims, XmppAddress ComponentAddress,
            XmppAddress ClientJid, Account Account, bool Preview,
            Func<string, LegalIdentity, Task<LegalIdentity>> IdentityReviewCallback)
        {
            try
            {
                KeyValuePair<IPhoto[], XmlDocument[]> P = await GetPhotosAndDocuments(Identity, Preview);
                IdentityApplication Application = new IdentityApplication(Identity.Id,
                    NamespaceLegalIdentity(Identity.Version), Preview,
                    GetPersonalInformation(Identity), Claims,
                    P.Key, P.Value, Account);
 
                foreach (KeyValuePair<string, object> Claim in Claims)
                {
                    switch (Claim.Key)
                    {
                        case PersonalInformation.EMailTag:
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out string EMail) &&
                                EMail == Account.EMail &&
                                Account.EMailVerified.HasValue &&
                                DateTime.UtcNow.Subtract(Account.EMailVerified.Value.ToUniversalTime()).TotalDays < 3 * 365.2)
                            {
                                Application.ClaimValid(Claim.Key, this);
                            }
                            break;
 
                        case PersonalInformation.PhoneTag:
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out string Phone) &&
                                Phone == Account.PhoneNr &&
                                Account.PhoneNrVerified.HasValue &&
                                DateTime.UtcNow.Subtract(Account.PhoneNrVerified.Value.ToUniversalTime()).TotalDays < 3 * 365.25)
                            {
                                Application.ClaimValid(Claim.Key, this);
                            }
                            break;
 
                        case "ID":
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out string Id))
                            {
                                if (Id == Identity.Id)
                                    Application.ClaimValid(Claim.Key, this);
                                else
                                {
                                    Application.ClaimInvalid(Claim.Key,
                                        "Identifier does not correspond to created identifier.",
                                        "en", "IdMismatch", this);
                                }
                            }
                            break;
 
                        case PersonalInformation.JidTag:
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out string Jid))
                            {
                                if (Jid == ClientJid.BareJid)
                                    Application.ClaimValid(Claim.Key, this);
                                else
                                {
                                    Application.ClaimInvalid(Claim.Key,
                                        "JID does not correspond to client JID.",
                                        "en", "JidMismatch", this);
                                }
                            }
                            break;
 
                        case PersonalInformation.DomainTag:
                        case PersonalInformation.AgentTag:
                        case PersonalInformation.DeviceIdTag:
                            Application.ClaimValid(Claim.Key, this);
                            break;
 
                        case "Account":
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out string AccountName))
                            {
                                if (AccountName == Account.UserName)
                                    Application.ClaimValid(Claim.Key, this);
                                else
                                {
                                    Application.ClaimInvalid(Claim.Key,
                                        "Account name does not match account.",
                                        "en", "AccountMismatch", this);
                                }
                            }
                            break;
 
                        case "Provider":
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out string Provider))
                            {
                                if (this.IsComponentDomain(Provider, true))
                                    Application.ClaimValid(Claim.Key, this);
                                else
                                {
                                    Application.ClaimInvalid(Claim.Key,
                                        "Provider does not match legal component address.",
                                        "en", "ProviderMismatch", this);
                                }
                            }
                            break;
 
                        case "State":
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out Legal.Identity.IdentityState State))
                            {
                                if (State == Identity.State)
                                    Application.ClaimValid(Claim.Key, this);
                                else
                                {
                                    Application.ClaimInvalid(Claim.Key,
                                        "State does not match identity state.",
                                        "en", "StateMismatch", this);
                                }
                            }
                            break;
 
                        case "Created":
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out DateTime Created))
                            {
                                if (Created == Identity.Created)
                                    Application.ClaimValid(Claim.Key, this);
                                else
                                {
                                    Application.ClaimInvalid(Claim.Key,
                                        "Created does not match identity creation timestamp.",
                                        "en", "CreatedMismatch", this);
                                }
                            }
                            break;
 
                        case "Updated":
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out DateTime Updated))
                            {
                                if (Updated == Identity.Updated)
                                    Application.ClaimValid(Claim.Key, this);
                                else
                                {
                                    Application.ClaimInvalid(Claim.Key,
                                        "Updated does not match identity update timestamp.",
                                        "en", "UpdatedMismatch", this);
                                }
                            }
                            break;
 
                        case "From":
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out DateTime From))
                            {
                                if (From == Identity.From)
                                    Application.ClaimValid(Claim.Key, this);
                                else
                                {
                                    Application.ClaimInvalid(Claim.Key,
                                        "From does not match identity creation timestamp.",
                                        "en", "FromMismatch", this);
                                }
                            }
                            break;
 
                        case "To":
                            if (Application.TryGetValue(Claim.Key, Claim.Value, this, out DateTime To))
                            {
                                if (To == Identity.To)
                                    Application.ClaimValid(Claim.Key, this);
                                else
                                {
                                    Application.ClaimInvalid(Claim.Key,
                                        "To does not match identity creation timestamp.",
                                        "en", "ToMismatch", this);
                                }
                            }
                            break;
                    }
                }
 
                IIdentityAuthenticatorService[] Authenticators = Types.FindSupport<IIdentityAuthenticatorService, IIdentityApplication>(Application);
                if (Authenticators.Length == 0 && !Application.IsValid.HasValue)
                    return;
 
                foreach (IIdentityAuthenticatorService Authenticator in Authenticators)
                {
                    if (Application.IsValid.HasValue)
                        break;
 
                    try
                    {
                        await Authenticator.Validate(Application);
                        await RuntimeCounters.IncrementCounter("KyC." + Application.GetType().FullName);
                    }
                    catch (Exception ex)
                    {
                        Application.ReportError(ex.Message, string.Empty, string.Empty,
                            ValidationErrorType.Service, Authenticator);
                    }
                }
 
                if (!Application.Preview)
                    Application.LogResults();
 
                if ((!Application.IsValid.HasValue &&
                    (Application.HasValidatedClaims || Application.HasValidatedPhotos)) ||
                    (Application.IsValid.HasValue && Application.IsValid.Value))
                {
                    string Xml = Application.GetIdentityReviewXml();
 
                    Identity = await IdentityReviewCallback(Xml, Identity);
 
                    await this.Server.SendMessage(string.Empty, string.Empty, ComponentAddress,
                        ClientJid.ToBareJID(), string.Empty, Xml);
                }
 
                if (!Application.IsValid.HasValue)
                {
                    string Xml = Application.GetClientErrorMessageXml(out string Language,
                        "Unable to validate application automatically. The application needs to be validated manually, or by peer review.",
                        "ManualReview", "en");
 
                    await this.Server.SendMessage(string.Empty, string.Empty, ComponentAddress,
                        ClientJid.ToBareJID(), Language, Xml);
                }
                else
                {
                    KeyValuePair<string, object>[] Tags = Application.Tags;
                    string Url = Gateway.GetUrl("/LegalIdentity.md?Id=" + Identity.Id);
                    StringBuilder Name = new StringBuilder();
                    ChunkedList<string> Actors = new ChunkedList<string>();
                    int i = 0;
                    int c = Application.NrServices;
 
                    foreach (object Service in Application.Services)
                    {
                        if (i > 0)
                        {
                            if (i == c - 1)
                                Name.Append(" and ");
                            else
                                Name.Append(", ");
                        }
 
                        if (Service is global::Paiwise.IServiceProvider ServiceProvider)
                        {
                            Name.Append("**");
                            Name.Append(MarkdownDocument.Encode(ServiceProvider.Name));
                            Name.Append("**");
                        }
                        else
                        {
                            Name.Append('`');
                            Name.Append(Service.GetType().FullName);
                            Name.Append('`');
                        }
 
                        Actors.Add(Service.GetType().FullName);
                    }
 
                    if (Application.IsValid.Value)
                    {
                        // Valid application
 
                        if (Preview)
                        {
                            LoginAuditor.Success("Legal identity preview application has been automatically approved.", ClientJid.Account.Value,
                                ClientJid.BareJid.Value, "XMPP", Tags);
                        }
                        else
                        {
                            LoginAuditor.Success("Legal identity application has been automatically approved.", ClientJid.Account.Value,
                                ClientJid.BareJid.Value, "XMPP", Tags);
                        }
 
                        await this.UpdateState(Identity, Legal.Identity.IdentityState.Approved,
                            Actors.ToArray(), Account, Preview, true, Application);
 
                        if (!Application.Preview &&
                            (BrokerNotificationConfiguration.Instance?.LegalIdAutoApproved ?? false))
                        {
                            StringBuilder Markdown = new StringBuilder();
 
                            Markdown.Append("Legal identity application has been automatically approved: [`");
                            Markdown.Append(Identity.Id);
                            Markdown.Append("`](");
                            Markdown.Append(Url);
                            Markdown.Append(") (by ");
                            Markdown.Append(Name.ToString());
                            Markdown.AppendLine(")");
                            Markdown.AppendLine();
                            Output(Markdown, Tags);
 
                            await Gateway.SendNotification(Markdown.ToString());
                        }
                    }
                    else
                    {
                        // Invalid application
 
                        if (!Application.Preview)
                        {
                            if (Application.HasErrors)
                            {
                                foreach (ValidationError Error in Application.Errors)
                                {
                                    switch (Error.ErrorType)
                                    {
                                        case ValidationErrorType.Server:
                                        case ValidationErrorType.Service:
                                            Log.Error(Error.ErrorMessage, string.Empty,
                                                Error.Service.GetType().Namespace, Error.ErrorCode,
                                                Error.Tags);
                                            break;
 
                                        case ValidationErrorType.Client:
                                            Log.Warning(Error.ErrorMessage, string.Empty,
                                                Error.Service.GetType().Namespace, Error.ErrorCode,
                                                Error.Tags);
                                            break;
                                    }
                                }
                            }
                        }
 
                        await this.UpdateState(Identity, Legal.Identity.IdentityState.Rejected,
                            Actors.ToArray(), Account, Preview, true, Application);
 
                        string Xml = Application.GetClientErrorMessageXml(out string Language,
                            "Unable to validate application automatically. The application needs to be validated manually, or by peer review.",
                            "ManualReview", "en");
 
                        await this.Server.SendMessage(string.Empty, string.Empty, ComponentAddress,
                            ClientJid.ToBareJID(), Language, Xml);
 
                        LoginAuditor.Fail("Legal identity application has been automatically rejected.", ClientJid.Account.Value,
                            ClientJid.BareJid.Value, "XMPP", Tags);
 
                        if (!Application.Preview &&
                            (BrokerNotificationConfiguration.Instance?.LegalIdAutoRejected ?? false))
                        {
                            StringBuilder Markdown = new StringBuilder();
 
                            Markdown.Append("Legal identity application has been automatically rejected: [`");
                            Markdown.Append(Identity.Id);
                            Markdown.Append("`](");
                            Markdown.Append(Url);
                            Markdown.Append(") (by ");
                            Markdown.Append(Name.ToString());
                            Markdown.AppendLine(")");
                            Markdown.AppendLine();
                            Output(Markdown, Tags);
 
                            await Gateway.SendNotification(Markdown.ToString());
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                Log.Exception(ex);
            }
        }
 
        private async Task GetTrustChainHandler(object Sender, IqEventArgs e)
        {
            try
            {
                StringBuilder Xml = new StringBuilder();
 
                Xml.Append("<trustChain xmlns='");
                Xml.Append(XML.Encode(e.Query.NamespaceURI));
                Xml.Append("'>");
 
                if (!Gateway.IsDomain(Gateway.XmppClient.Domain, true))
                {
                    foreach (string Broker in await this.GetTrustChainAsync(Gateway.XmppClient.Domain))
                    {
                        Xml.Append("<broker domain='");
                        Xml.Append(XML.Encode(Broker));
                        Xml.Append("'/>");
                    }
                }
                else if (Gateway.XmppClient.Domain != e.To.Domain.Value)
                {
                    Xml.Append("<broker domain='");
                    Xml.Append(XML.Encode(Gateway.XmppClient.Domain));
                    Xml.Append("'/>");
                }
 
                Xml.Append("<broker domain='");
                Xml.Append(XML.Encode(e.To.Domain.Value));
                Xml.Append("'/>");
 
                Xml.Append("</trustChain>");
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        public async Task<string[]> GetTrustChainAsync(string Domain)
        {
            string Key = Domain + "|trustChain";
 
            if (this.remoteComponents.TryGetValue(Key, out object Obj) && Obj is string[] CachedResult)
                return CachedResult;
 
            if (!Gateway.HasDomain)
                return Array.Empty<string>();
 
            TaskCompletionSource<string[]> Result = new TaskCompletionSource<string[]>();
 
            await this.Server.SendIqRequest("get", Gateway.Domain.Value, Domain, null,
                "<getTrustChain xmlns='" + NamespaceLegalIdentity(NamespaceSet.Current) + "'/>",
                (sender2, e2) =>
                {
                    XmlElement E;
 
                    if (!e2.Ok)
                        Result.TrySetException(XmppClient.GetExceptionObject(e2.ErrorElement));
                    else if ((E = e2.FirstElement) is null ||
                        E.LocalName != "trustChain" ||
                        !IsNamespaceLegalIdentity(E.NamespaceURI))
                    {
                        Result.TrySetException(new Exception("Unable to get the trust chain from " +
                            Domain + ". Invalid response returned."));
                    }
                    else
                    {
                        ChunkedList<string> Brokers = new ChunkedList<string>();
 
                        foreach (XmlNode N in E.ChildNodes)
                        {
                            if (N is XmlElement E2 &&
                                E2.LocalName == "broker" &&
                                IsNamespaceLegalIdentity(E2.NamespaceURI))
                            {
                                Brokers.Add(XML.Attribute(E2, "domain"));
                            }
                        }
 
                        CachedResult = Brokers.ToArray();
                        this.remoteComponents[Key] = CachedResult;
                        Result.TrySetResult(CachedResult);
                    }
 
                    return Task.CompletedTask;
                }, null);
 
            return await Result.Task;
        }
 
        public async Task<string> GetTrustAnchor(string Domain)
        {
            string[] Chain = await this.GetTrustChainAsync(Domain);
            if ((Chain?.Length ?? 0) == 0)
                return null;
            else
                return Chain[0];
        }
 
        public async Task<bool> InSameTreeOfTrust(string Domain)
        {
            if (!Gateway.HasDomain)
                return Gateway.IsDomain(Domain, true);
 
            string Anchor1 = await this.GetTrustAnchor(Gateway.Domain.Value);
            string Anchor2 = await this.GetTrustAnchor(Domain);
 
            if (Anchor1 is null || Anchor2 is null)
                return false;
            else
                return Anchor1 == Anchor2;
        }
 
        #endregion
 
        #region Legal Identity references
 
        internal static async Task CheckLegalIdentityReferences()
        {
            string[] CollectionNames = await Database.GetCollections();
 
            if (Array.IndexOf(CollectionNames, "LegalIdentityReferences") < 0)
            {
                foreach (LegalIdentity Identity in await Database.Find<LegalIdentity>(
                    new FilterFieldEqualTo("State", Legal.Identity.IdentityState.Approved)))
                {
                    await UpdateLegalIdentityReference(Identity);
                }
            }
        }
 
        internal static async Task AddLegalIdentityReference(LegalIdentity Identity)
        {
            await Database.Insert(new LegalIdentityReference()
            {
                Country = Identity[PersonalInformation.CountryTag],
                PNr = Identity[PersonalInformation.PersonalNumberTag],
                LegalId = Identity.Id,
                Provider = Identity.Provider,
                ArchiveDays = CalcRefArchiveDays(Identity)
            });
        }
 
        public static async Task<LegalIdentityReference> FindLegalIdentityReference(string LegalId)
        {
            return await Database.FindFirstDeleteRest<LegalIdentityReference>(
                new FilterFieldEqualTo("LegalId", LegalId));
        }
 
        public static async Task<IEnumerable<LegalIdentityReference>> FindLegalIdentityReferences(string Country, string PNr)
        {
            return await Database.Find<LegalIdentityReference>(new FilterAnd(
                new FilterFieldEqualTo("Country", Country),
                new FilterFieldEqualTo("PNr", PNr)));
        }
 
        private static async Task UpdateLegalIdentityReference(LegalIdentity Identity)
        {
            LegalIdentityReference Ref = await FindLegalIdentityReference(Identity.Id);
 
            if (Ref is null)
                await AddLegalIdentityReference(Identity);
            else
            {
                string s = Identity[PersonalInformation.CountryTag];
                bool Updated = false;
 
                if (Ref.Country != s)
                {
                    Ref.Country = s;
                    Updated = true;
                }
 
                s = Identity[PersonalInformation.PersonalNumberTag];
                if (Ref.PNr != s)
                {
                    Ref.PNr = s;
                    Updated = true;
                }
 
                if (Ref.Provider != Identity.Provider)
                {
                    Ref.Provider = Identity.Provider;
                    Updated = true;
                }
 
                if (Updated)
                    await Database.Update(Ref);
            }
        }
 
        private static Task DeleteLegalIdentityReference(string LegalId)
        {
            return Database.Delete<LegalIdentityReference>(new FilterFieldEqualTo("LegalId", LegalId));
        }
 
        private static int CalcRefArchiveDays(LegalIdentity Identity)
        {
            DateTime Expires = Identity.To;
            if (Expires.Year >= 9999)
                return int.MaxValue;
 
            TimeSpan Span = Expires - DateTime.Now;
            double Days = Math.Ceiling(Span.TotalDays);
 
            if (Days < 0)
                return 0;
            else if (Days > int.MaxValue)
                return int.MaxValue;
            else
                return (int)Days;
        }
 
        #endregion
 
        #region Remote Legal Identity References
 
        private async Task LegalIdReferenceAddedHandler(object Sender, IqEventArgs e)
        {
            if (!e.From.IsDomain)
            {
                await e.IqErrorForbidden(e.To, "Not a broker.", "en");
                return;
            }
 
            string LegalId = XML.Attribute(e.Query, "legalId");
            LegalIdentity Identity = await GetLocalLegalIdentity(LegalId);
 
            if (Identity is null)
            {
                await e.IqErrorItemNotFound(e.To, "Legal Identity not found.", "en");
                return;
            }
 
            RemoteIdentityReference Ref = new RemoteIdentityReference()
            {
                LegalId = LegalId,
                RemoteDomain = e.From.Domain,
                Account = Identity.Account
            };
 
            await Database.Insert(Ref);
 
            await e.IqResult(string.Empty, e.To);
        }
 
        private async Task LegalIdReferenceRemovedHandler(object Sender, IqEventArgs e)
        {
            if (!e.From.IsDomain)
            {
                await e.IqErrorForbidden(e.To, "Not a broker.", "en");
                return;
            }
 
            string LegalId = XML.Attribute(e.Query, "legalId");
            LegalIdentity Identity = await GetLocalLegalIdentity(LegalId);
 
            if (Identity is null)
            {
                await e.IqErrorItemNotFound(e.To, "Legal Identity not found.", "en");
                return;
            }
 
            int Count = await Database.Delete<RemoteIdentityReference>(new FilterAnd(
                new FilterFieldEqualTo("Account", Identity.Account),
                new FilterFieldEqualTo("RemoteDomain", e.From.Domain),
                new FilterFieldEqualTo("LegalId", LegalId)));
 
            if (Count > 0)
                await e.IqResult(string.Empty, e.To);
            else
                await e.IqErrorItemNotFound(e.To, "Referene not found.", "en");
        }
 
        private async Task User_UpdatingUserLegalId(object Sender, Security.Users.UpdatingLegalIdEventArgs e)
        {
            if (!string.IsNullOrEmpty(e.OldLegalId))
            {
                XmppAddress Addr = new XmppAddress(e.OldLegalId);
                StringBuilder Xml = new StringBuilder();
 
                Xml.Append("<legalIdReferenceRemoved xmlns='");
                Xml.Append(QuickLogin.NamespaceTagSignature);
                Xml.Append("' legalId='");
                Xml.Append(XML.Encode(e.OldLegalId));
                Xml.Append("'/>");
 
                await this.Server.SendMessage(string.Empty, string.Empty, Gateway.Domain,
                    Addr.Domain, string.Empty, Xml.ToString());
            }
 
            if (!string.IsNullOrEmpty(e.NewLegalId))
            {
                XmppAddress Addr = new XmppAddress(e.NewLegalId);
                StringBuilder Xml = new StringBuilder();
 
                Xml.Append("<legalIdReferenceAdded xmlns='");
                Xml.Append(QuickLogin.NamespaceTagSignature);
                Xml.Append("' legalId='");
                Xml.Append(XML.Encode(e.NewLegalId));
                Xml.Append("'/>");
 
                await this.Server.SendMessage(string.Empty, string.Empty, Gateway.Domain,
                    Addr.Domain, string.Empty, Xml.ToString());
            }
        }
 
        #endregion
 
        #region Smart Contracts
 
        internal async Task<KeyValuePair<Contract, IqResultEventArgs>> GetContract(CaseInsensitiveString ContractId)
        {
            TaskCompletionSource<IqResultEventArgs> T = new TaskCompletionSource<IqResultEventArgs>();
            XmppAddress ContractAddress = new XmppAddress(ContractId);
 
            if (this.Server.IsServerDomain(ContractAddress.Domain, true) ||
                this.IsComponentDomain(ContractAddress.Domain, true))
            {
                Contract Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                return new KeyValuePair<Contract, IqResultEventArgs>(Contract, null);
            }
            else
            {
                if (!await this.Server.SendIqRequest("get", this.MainDomain, new XmppAddress(ContractAddress.Domain), string.Empty,
                    "<getContract xmlns='" + NamespaceSmartContracts(NamespaceSet.Current) + "' id='" + XML.Encode(ContractId) + "'/>", true,
                    (sender2, e2) =>
                    {
                        T.TrySetResult(e2);
                        return Task.CompletedTask;
                    }, null))
                {
                    return new KeyValuePair<Contract, IqResultEventArgs>(null, null);
                }
 
                await T.Task;
 
                IqResultEventArgs e3 = T.Task.Result;
                if (!e3.Ok || e3.FirstElement is null)
                    return new KeyValuePair<Contract, IqResultEventArgs>(null, e3);
 
                ParsedContract Parsed = await Contract.Parse(e3.FirstElement, this);
                return new KeyValuePair<Contract, IqResultEventArgs>(Parsed?.Contract, e3);
            }
        }
 
        private async Task PetitionContractHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ContractId = XML.Attribute(e.Query, "id");
                string PetitionId = XML.Attribute(e.Query, "pid");
                string Purpose = XML.Attribute(e.Query, "purpose");
                string Nonce = XML.Attribute(e.Query, "nonce");
                byte[] Signature = Convert.FromBase64String(XML.Attribute(e.Query, "s"));
                byte[] Data = Encoding.UTF8.GetBytes(PetitionId + ":" + ContractId + ":" + Purpose + ":" + Nonce + ":" + e.From.BareJid.LowerCase);
 
                if (!TryGetContext(e.Query, out XmlElement ContextXml, out string _,
                    out string[] Properties, out string[] Attachments))
                {
                    await e.IqErrorBadRequest(e.To, "Invalid context.", "en");
                    return;
                }
 
                (LegalIdentity ReqIdentity, Dictionary<string, string> ReqAttachmentUrls) = await this.ValidateSenderSignature(
                    e.From, new ExternalRequest(e), DateTime.Now, Data, Signature, null);    // TODO: Authorize access to requestor attachments
 
                if (ReqIdentity is null)
                    return;
 
                Contract Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                if (Contract is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                    return;
                }
 
                StringBuilder Msg = new StringBuilder();
 
                Msg.Append("<petitionContractMsg id=\"");
                Msg.Append(XML.Encode(ContractId));
                Msg.Append("\" pid=\"");
                Msg.Append(XML.Encode(PetitionId));
                Msg.Append("\" from=\"");
                Msg.Append(XML.Encode(e.From.Address.Value));
                Msg.Append("\" purpose=\"");
                Msg.Append(XML.Encode(Purpose));
 
                if (this.Server.TryGetClientConnection(e.From.Address, out IClientConnection Connection) &&
                    !string.IsNullOrEmpty(Connection.RemoteEndPoint))
                {
                    Msg.Append("\" clientEp=\"");
                    Msg.Append(XML.Encode(Connection.RemoteEndPoint));
                }
                else
                {
                    ClientInformation ClientInfo = await this.GetNetworkIdentity(ReqIdentity.Id, true, false, Contract.Version);
                    if (!(ClientInfo is null))
                    {
                        string ClientEndpoint = ClientInfo.MostRecentEndpoint;
 
                        if (!string.IsNullOrEmpty(ClientEndpoint))
                        {
                            Msg.Append("\" clientEp=\"");
                            Msg.Append(XML.Encode(ClientEndpoint));
                        }
                    }
                }
 
                Msg.Append("\" xmlns=\"");
                Msg.Append(NamespaceSmartContracts(Contract.Version));
                Msg.Append("\">");
 
                this.Append(Msg, Properties, Attachments, ContextXml,
                    null, ReqIdentity, Contract.Version, ReqAttachmentUrls);
 
                Msg.Append("</petitionContractMsg>");
 
                string Xml = Msg.ToString();
 
                if (!(Contract.ClientSignatures is null))
                {
                    foreach (ClientSignature ClientSignature in Contract.ClientSignatures)
                    {
                        await this.Server.SendMessage(string.Empty, string.Empty, e.To, new XmppAddress(ClientSignature.BareJid),
                            string.Empty, Xml);
                    }
                }
 
                await e.IqResult(string.Empty, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task PetitionContractResponseHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ContractId = XML.Attribute(e.Query, "id");
                string PetitionId = XML.Attribute(e.Query, "pid");
                XmppAddress RequestorFullJid = new XmppAddress(XML.Attribute(e.Query, "jid"));
                bool Response = XML.Attribute(e.Query, "response", false);
                Contract Contract;
                XmlElement ContextXml = null;
 
                foreach (XmlNode N in e.Query)
                {
                    if (!(N is XmlElement E))
                        continue;
 
                    if (ContextXml is null)
                        ContextXml = E;
                    else
                    {
                        await e.IqErrorBadRequest(e.To, "Invalid context.", "en");
                        return;
                    }
                }
 
                Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                if (Contract is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                    return;
                }
 
                this.ContractAuthorization(RequestorFullJid.BareJid, e.From.BareJid, ContractId, Response);
 
                StringBuilder Msg = new StringBuilder();
 
                Msg.Append("<petitionContractResponseMsg pid=\"");
                Msg.Append(XML.Encode(PetitionId));
                Msg.Append("\" response=\"");
                Msg.Append(CommonTypes.Encode(Response));
 
                if (this.Server.TryGetClientConnection(e.From.Address, out IClientConnection Connection) &&
                    !string.IsNullOrEmpty(Connection.RemoteEndPoint))
                {
                    Msg.Append("\" clientEp=\"");
                    Msg.Append(XML.Encode(Connection.RemoteEndPoint));
                }
 
                Msg.Append("\" xmlns=\"");
                Msg.Append(NamespaceSmartContracts(Contract.Version));
                Msg.Append("\">");
 
                if (!(Contract is null))
                    await Contract.Serialize(Msg, false, true, true, true, true, true, true, null, this);
 
                if (!(ContextXml is null))
                    Msg.Append(ContextXml.OuterXml);
 
                Msg.Append("</petitionContractResponseMsg>");
 
                await this.Server.SendMessage(string.Empty, string.Empty, e.To, RequestorFullJid, string.Empty, Msg.ToString());
 
                await e.IqResult(string.Empty, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal void ContractAuthorization(CaseInsensitiveString ToBareJid, CaseInsensitiveString FromBareJid,
            CaseInsensitiveString ContractId, bool Authorized)
        {
            this.Authorization("C:", ToBareJid, FromBareJid, ContractId, Authorized ? 1 : 0);
        }
 
        internal bool IsAccessToContractAuthorized(CaseInsensitiveString BareJid, CaseInsensitiveString ContractId)
        {
            CaseInsensitiveString Key = "C:" + ContractId + ":" + BareJid;
            return (this.petitions?.TryGetValue(Key, out int i) ?? false) && (i > 0);
        }
 
        private async Task CreateContractHandler(object Sender, IqEventArgs e)
        {
            Profiler Profiler = new Profiler();
            ProfilerThread CreateContractThread = Profiler.CreateThread("CreateContractHandler", ProfilerThreadType.StateMachine);
            ProfilerThread ParametersThread = Profiler.CreateThread("Parameters", ProfilerThreadType.StateMachine);
            Contract Contract = null;
 
            Profiler.Start();
            CreateContractThread.Start();
            ParametersThread.Start();
            try
            {
                CreateContractThread.NewState("Parsing");
 
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Only accounts on the broker can create new contracts.", "en");
                    return;
                }
 
                LinkedList<ClientSignature> SignaturesToTransfer = null;
                XmlElement E = null;
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
                Dictionary<CaseInsensitiveString, Parameter> Parameters = new Dictionary<CaseInsensitiveString, Parameter>();
                LinkedList<CaseInsensitiveString> ParameterOrder = new LinkedList<CaseInsensitiveString>();
                Dictionary<CaseInsensitiveString, Parameter> TransientParameters = null;
                bool ParametersChecked = false;
                bool HasTransientParameters = false;
 
                foreach (XmlNode N in e.Query.ChildNodes)
                {
                    E = N as XmlElement;
                    if (E is null)
                        continue;
 
                    switch (E.LocalName ?? string.Empty)
                    {
                        case "contract":
                            ParsedContract Parsed = await Contract.Parse(E, this);
                            Contract = Parsed?.Contract;
 
                            if (Contract is null)
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid contract.", "en");
                                return;
                            }
 
                            bool HasStatus = Parsed.HasStatus;
                            bool ParametersValid = Parsed.ParametersValid;
 
                            if (HasStatus)
                            {
                                await e.IqErrorBadRequest(e.To, "Status element not permitted when creating new contract.", "en");
                                return;
                            }
 
                            if (!CaseInsensitiveString.IsNullOrEmpty(Contract.ContractId))
                            {
                                await e.IqErrorBadRequest(e.To, "id attribute must not be set by client.", "en");
                                return;
                            }
 
                            if (!(Contract.ClientSignatures is null) && Contract.ClientSignatures.Length > 0)
                            {
                                await e.IqErrorBadRequest(e.To, "Predefined signatures not permitted.", "en");
                                return;
                            }
 
                            if (!(Contract.ServerSignature is null))
                            {
                                await e.IqErrorBadRequest(e.To, "Server signature cannot be provided by client.", "en");
                                return;
                            }
 
                            if (Contract.PartsMode == ContractParts.ExplicitlyDefined && (Contract.Parts is null || Contract.Parts.Length == 0))
                            {
                                await e.IqErrorBadRequest(e.To, "No explicit parts defined.", "en");
                                return;
                            }
 
                            if (!ParametersValid && Contract.PartsMode != ContractParts.TemplateOnly)
                            {
                                await e.IqErrorBadRequest(e.To, "Parameter " + Parsed.FirstParameterErrorName +
                                    " has invalid value: " + Parsed.FirstParameterError, "en");
                                return;
                            }
 
                            ParametersChecked = true;
                            Contract.State = ContractState.Proposed;
                            break;
 
                        case "template":
                            CaseInsensitiveString TemplateId = XML.Attribute(E, "id");
 
                            if (CaseInsensitiveString.IsNullOrEmpty(TemplateId) || TemplateId.IndexOf('@') < 0)
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid contract template identity.", "en");
                                return;
                            }
 
                            KeyValuePair<Contract, IqResultEventArgs> P2 = await this.GetContract(TemplateId);
                            Contract = P2.Key;
                            if (Contract is null)
                            {
                                if (string.IsNullOrEmpty(P2.Value?.ErrorText))
                                {
                                    await e.IqErrorItemNotFound(e.To, "Contract template not found: " +
                                        TemplateId, "en");
                                }
                                else
                                {
                                    await e.IqErrorItemNotFound(e.To, "Unable to get contract template " +
                                        TemplateId + ": " + P2.Value.ErrorText, "en");
                                }
 
                                return;
                            }
 
                            if (!Contract.CanActAsTemplate)
                            {
                                await e.IqErrorNotAcceptable(e.To, "Referenced contract cannot be used as a template.", "en");
                                return;
                            }
 
                            if (Contract.State == ContractState.Obsoleted ||
                                Contract.State == ContractState.Deleted ||
                                Contract.State == ContractState.Proposed ||
                                Contract.State == ContractState.Rejected ||
                                Contract.State == ContractState.Failed)
                            {
                                await e.IqErrorNotAcceptable(e.To, "Referenced contract not in an acceptable state.", "en");
                                return;
                            }
 
                            if (!await Contract.CanRead(e.From, this.Server, this))
                            {
                                await e.IqErrorForbidden(e.To, "Not authorized to access contract.", "en");
                                return;
                            }
 
                            if (!(Contract.ClientSignatures is null))
                            {
                                foreach (ClientSignature Signature in Contract.ClientSignatures)
                                {
                                    if (Signature.Transferable)
                                    {
                                        SignaturesToTransfer ??= new LinkedList<ClientSignature>();
                                        SignaturesToTransfer.AddLast(Signature);
                                    }
                                }
                            }
 
                            Contract = new Contract()
                            {
                                Version = QueryVersion,
                                ForMachines = Contract.ForMachines,
                                ForMachinesLocalName = Contract.ForMachinesLocalName,
                                ForMachinesNamespace = Contract.ForMachinesNamespace,
                                ForHumans = (HumanReadableText[])Contract.ForHumans?.Clone(),
                                Roles = (Role[])Contract.Roles?.Clone(),
                                Parameters = (Parameter[])Contract.Parameters?.Clone(),
                                State = ContractState.Approved,
                                TemplateId = CaseInsensitiveString.IsNullOrEmpty(Contract.TemplateId) ? TemplateId : Contract.TemplateId,
                                SignAfter = Contract.SignAfter,
                                SignBefore = Contract.SignBefore,
                                Nonce = null
                            };
 
                            if (HasSecondaryName(Contract, out string SecondaryName,
                                out string SecondaryNamespace, out SecondaryNameType NameType))
                            {
                                Contract.SecondaryType = NameType;
                                Contract.SecondaryLocalName = SecondaryName;
                                Contract.SecondaryNamespace = SecondaryNamespace;
                            }
                            else
                            {
                                Contract.SecondaryType = SecondaryNameType.None;
                                Contract.SecondaryLocalName = null;
                                Contract.SecondaryNamespace = null;
                            }
 
                            bool HasVisibility = false;
                            bool HasDuration = false;
                            bool HasArchiveReq = false;
                            bool HasArchiveOpt = false;
                            bool WellDefined = true;
 
                            foreach (XmlAttribute Attr in E.Attributes)
                            {
                                switch (Attr.Name)
                                {
                                    case "visibility":
                                        if (Enum.TryParse<ContractVisibility>(Attr.Value, out ContractVisibility Visibility))
                                        {
                                            Contract.Visibility = Visibility;
                                            HasVisibility = true;
                                        }
                                        else
                                            WellDefined = false;
                                        break;
 
                                    case "duration":
                                        if (Duration.TryParse(Attr.Value, out Duration D))
                                        {
                                            Contract.Duration = D;
                                            HasDuration = true;
                                        }
                                        else
                                            WellDefined = false;
                                        break;
 
                                    case "archiveReq":
                                        if (Duration.TryParse(Attr.Value, out D))
                                        {
                                            Contract.ArchiveRequired = D;
                                            HasArchiveReq = true;
                                        }
                                        else
                                            WellDefined = false;
                                        break;
 
                                    case "archiveOpt":
                                        if (Duration.TryParse(Attr.Value, out D))
                                        {
                                            Contract.ArchiveOptional = D;
                                            HasArchiveOpt = true;
                                        }
                                        else
                                            WellDefined = false;
                                        break;
 
                                    case "signAfter":
                                        if (XML.TryParse(Attr.Value, out DateTime TP))
                                            Contract.SignAfter = TP;
                                        else
                                            WellDefined = false;
                                        break;
 
                                    case "signBefore":
                                        if (XML.TryParse(Attr.Value, out TP))
                                            Contract.SignBefore = TP;
                                        else
                                            WellDefined = false;
                                        break;
 
                                    case "canActAsTemplate":
                                        if (CommonTypes.TryParse(Attr.Value, out bool b))
                                        {
                                            Contract.CanActAsTemplate = b;
                                            HasArchiveOpt = true;
                                        }
                                        else
                                            WellDefined = false;
                                        break;
 
                                    case "nonce":
                                        try
                                        {
                                            Contract.Nonce = Convert.FromBase64String(Attr.Value);
                                        }
                                        catch (Exception)
                                        {
                                            await e.IqErrorBadRequest(e.To, "Invalid nonce value.", "en");
                                            return;
                                        }
                                        break;
 
                                    case "xmlns":
                                    case "id":
                                        break;
 
                                    default:
                                        if (Attr.Prefix != "xmlns")
                                            WellDefined = false;
                                        break;
                                }
                            }
 
                            if (!(WellDefined && HasVisibility && HasDuration && HasArchiveReq && HasArchiveOpt))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid request, missing attributes.", "en");
                                return;
                            }
 
                            if (Contract.SignBefore <= Contract.SignAfter)
                            {
                                await e.IqErrorBadRequest(e.To, "Signature timepoints invalid.", "en");
                                return;
                            }
 
                            foreach (XmlNode N2 in E.ChildNodes)
                            {
                                if (N2 is XmlElement E2)
                                {
                                    switch (E2.LocalName)
                                    {
                                        case "parts":
                                            List<Part> Parts = null;
                                            ContractParts? Mode = null;
 
                                            foreach (XmlNode N3 in E2.ChildNodes)
                                            {
                                                if (N3 is XmlElement E3)
                                                {
                                                    switch (E3.LocalName)
                                                    {
                                                        case "open":
                                                            if (Mode.HasValue)
                                                            {
                                                                await e.IqErrorBadRequest(e.To, "Part mode inconsistency.", "en");
                                                                return;
                                                            }
 
                                                            Mode = ContractParts.Open;
                                                            break;
 
                                                        case "templateOnly":
                                                            if (Mode.HasValue)
                                                            {
                                                                await e.IqErrorBadRequest(e.To, "Part mode inconsistency.", "en");
                                                                return;
                                                            }
 
                                                            Mode = ContractParts.TemplateOnly;
                                                            break;
 
                                                        case "part":
                                                            if (Mode.HasValue)
                                                            {
                                                                if (Mode.Value != ContractParts.ExplicitlyDefined)
                                                                {
                                                                    await e.IqErrorBadRequest(e.To, "Part mode inconsistency.", "en");
                                                                    return;
                                                                }
                                                            }
                                                            else
                                                                Mode = ContractParts.ExplicitlyDefined;
 
                                                            CaseInsensitiveString LegalId = null;
                                                            CaseInsensitiveString RoleRef = null;
 
                                                            foreach (XmlAttribute Attr in E3.Attributes)
                                                            {
                                                                switch (Attr.Name)
                                                                {
                                                                    case "legalId":
                                                                        LegalId = Attr.Value;
                                                                        break;
 
                                                                    case "role":
                                                                        RoleRef = Attr.Value;
                                                                        break;
 
                                                                    case "xmlns":
                                                                        break;
 
                                                                    default:
                                                                        if (Attr.Prefix != "xmlns")
                                                                            WellDefined = false;
                                                                        break;
                                                                }
                                                            }
 
                                                            if (CaseInsensitiveString.IsNullOrEmpty(LegalId) || CaseInsensitiveString.IsNullOrEmpty(RoleRef))
                                                            {
                                                                await e.IqErrorBadRequest(e.To, "Invalid part definition.", "en");
                                                                return;
                                                            }
 
                                                            bool RoleFound = false;
 
                                                            if (!(Contract.Roles is null))
                                                            {
                                                                foreach (Role Role2 in Contract.Roles)
                                                                {
                                                                    if (Role2.Name == RoleRef)
                                                                    {
                                                                        RoleFound = true;
                                                                        break;
                                                                    }
                                                                }
                                                            }
 
                                                            if (!RoleFound)
                                                            {
                                                                await e.IqErrorBadRequest(e.To, "Undefined role.", "en");
                                                                return;
                                                            }
 
                                                            Parts ??= new List<Part>();
                                                            Parts.Add(new Part()
                                                            {
                                                                LegalId = LegalId,
                                                                Role = RoleRef
                                                            });
 
                                                            break;
 
                                                        default:
                                                            WellDefined = false;
                                                            break;
                                                    }
                                                }
                                            }
 
                                            if (!WellDefined || !Mode.HasValue)
                                            {
                                                await e.IqErrorBadRequest(e.To, "Parts not well-defined.", "en");
                                                return;
                                            }
 
                                            Contract.PartsMode = Mode.Value;
                                            Contract.Parts = Parts?.ToArray();
                                            break;
 
                                        case "parameters":
                                            if (Contract.Parameters is null)
                                            {
                                                await e.IqErrorBadRequest(e.To, "Referenced contract does not have parameters.", "en");
                                                return;
                                            }
 
                                            foreach (Parameter P3 in Contract.Parameters)
                                            {
                                                if (!Parameters.ContainsKey(P3.Name))
                                                {
                                                    Parameters[P3.Name] = P3;
                                                    ParameterOrder.AddLast(P3.Name);
                                                }
                                            }
 
                                            foreach (XmlNode N3 in E2.ChildNodes)
                                            {
                                                if (N3 is XmlElement E3)
                                                {
                                                    CaseInsensitiveString Name = XML.Attribute(E3, "name");
                                                    if (CaseInsensitiveString.IsNullOrEmpty(Name))
                                                    {
                                                        await e.IqErrorBadRequest(e.To, "Missing parameter name.", "en");
                                                        return;
                                                    }
 
                                                    if (!Parameters.TryGetValue(Name, out Parameter OrgParameter))
                                                    {
                                                        await e.IqErrorBadRequest(e.To, "Parameter does not exist in original contract: " + Name, "en");
                                                        return;
                                                    }
 
                                                    Parameter ParameterDefinition = await this.TryParseParameter(E3, e, Name, OrgParameter);
                                                    if (ParameterDefinition is null)
                                                        return;
 
                                                    Parameters[Name] = ParameterDefinition;
                                                }
                                            }
 
                                            if (!Contract.HasTransientParameters)
                                            {
                                                CreateContractThread.NewState("Parameters");
 
                                                ParametersChecked = true;
                                                KeyValuePair<Parameter, string> P3 = await Contract.CheckParameters(Parameters.Values,
                                                    Contract.Duration, this, true, Contract.FirstSignatureAt, ParametersThread);
 
                                                Parameter FailingParameter = P3.Key;
                                                if (!(FailingParameter is null))
                                                {
                                                    await e.IqErrorBadRequest(e.To, "Contract parameter " + FailingParameter.Name + " contains invalid value: " + P3.Value, "en");
                                                    return;
                                                }
                                            }
 
                                            int c = Parameters.Count;
                                            int i = 0;
                                            Parameter[] NewParameters = new Parameter[c];
 
                                            foreach (string Name in ParameterOrder)
                                                NewParameters[i++] = Parameters[Name];
 
                                            Contract.Parameters = NewParameters;
                                            break;
 
                                        default:
                                            await e.IqErrorBadRequest(e.To, "Invalid request.", "en");
                                            return;
                                    }
                                }
                            }
                            break;
 
                        case "transient":
                            if (Contract.Parameters is null)
                            {
                                await e.IqErrorBadRequest(e.To, "Referenced contract does not have parameters.", "en");
                                return;
                            }
 
                            if (ParameterOrder.First is null)
                            {
                                foreach (Parameter P3 in Contract.Parameters)
                                {
                                    if (!Parameters.ContainsKey(P3.Name))
                                    {
                                        Parameters[P3.Name] = P3;
                                        ParameterOrder.AddLast(P3.Name);
                                    }
                                }
                            }
 
                            foreach (XmlNode N3 in E.ChildNodes)
                            {
                                if (N3 is XmlElement E3)
                                {
                                    CaseInsensitiveString Name = XML.Attribute(E3, "name");
                                    if (CaseInsensitiveString.IsNullOrEmpty(Name))
                                    {
                                        await e.IqErrorBadRequest(e.To, "Missing parameter name.", "en");
                                        return;
                                    }
 
                                    if (!Parameters.TryGetValue(Name, out Parameter OrgParameter))
                                    {
                                        await e.IqErrorBadRequest(e.To, "Parameter does not exist in original contract: " + Name, "en");
                                        return;
                                    }
 
                                    Parameter ParameterDefinition = await this.TryParseParameter(E3, e, Name, OrgParameter);
                                    if (ParameterDefinition is null)
                                        return;
 
                                    TransientParameters ??= new Dictionary<CaseInsensitiveString, Parameter>();
                                    TransientParameters[Name] = ParameterDefinition;
                                }
                            }
 
                            if (!(TransientParameters is null))
                            {
                                foreach (Parameter TransientParameter in TransientParameters.Values)
                                {
                                    if (Contract.TryGetParameter(TransientParameter.Name, out Parameter ContractParamteter))
                                    {
                                        ContractParamteter.StringValue = TransientParameter.StringValue;
                                        ContractParamteter.ProtectedValue = TransientParameter.ProtectedValue;
                                    }
                                }
                            }
 
                            if (Contract.PartsMode != ContractParts.TemplateOnly)
                            {
                                CreateContractThread.NewState("Parameters");
 
                                KeyValuePair<Parameter, string> P4 = await Contract.CheckParameters(Parameters.Values,
                                    Contract.Duration, this, true, Contract.FirstSignatureAt, ParametersThread);
 
                                Parameter FailingParameter2 = P4.Key;
                                if (!(FailingParameter2 is null))
                                {
                                    await e.IqErrorBadRequest(e.To, "Contract parameter " + FailingParameter2.Name + " contains invalid value: " + P4.Value, "en");
                                    return;
                                }
                            }
 
                            ParametersChecked = true;
                            HasTransientParameters = true;
                            break;
 
                        default:
                            await e.IqErrorBadRequest(e.To, "Invalid request.", "en");
                            return;
                    }
                }
 
                if (Contract is null)
                {
                    await e.IqErrorBadRequest(e.To, "No contract provided.", "en");
                    return;
                }
 
                if (Contract.Duration <= Duration.Zero)
                {
                    await e.IqErrorBadRequest(e.To, "Contract duration must be positive.", "en");
                    return;
                }
 
                if (!ParametersChecked)
                {
                    CreateContractThread.NewState("Parameters");
 
                    KeyValuePair<Parameter, string> P5 = await Contract.CheckParameters(Parameters.Values, Contract.Duration,
                        this, true, Contract.FirstSignatureAt, ParametersThread);
 
                    Parameter FailingParameter3 = P5.Key;
                    if (!(FailingParameter3 is null))
                    {
                        await e.IqErrorBadRequest(e.To, "Contract parameter " + FailingParameter3.Name + " contains invalid value: " + P5.Value, "en");
                        return;
                    }
                }
 
                Contract.Provider = e.To.Address;
                Contract.Account = e.From.Account;
                Contract.Created = UtcNowSecond;
                Contract.Updated = DateTime.MinValue;
 
                CreateContractThread.NewState("Integrity");
 
                KeyValuePair<ContentIntegrity, string> P = await Contract.CheckContentIntegrity(this);
                string IntegrityParameter = P.Value;
 
                switch (P.Key)
                {
                    case ContentIntegrity.Ok:
                        break;
 
                    case ContentIntegrity.RolesNotDefined:
                        await e.IqErrorBadRequest(e.To, "No roles have been defined.", "en");
                        return;
 
                    case ContentIntegrity.PartsNotDefined:
                        await e.IqErrorBadRequest(e.To, "Part definition expected.", "en");
                        return;
 
                    case ContentIntegrity.RoleCountsMismatch:
                        await e.IqErrorBadRequest(e.To, "Role counts are incorrect for role " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.DuplicateRoleDefinition:
                        await e.IqErrorBadRequest(e.To, "Duplicate role definition for role " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.DuplicateParameterDefinition:
                        await e.IqErrorBadRequest(e.To, "Duplicate parameter definition for parameter " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.InvalidLegalIdReference:
                        await e.IqErrorBadRequest(e.To, "Invalid Legal ID reference: " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.InvalidRoleReference:
                        await e.IqErrorBadRequest(e.To, "Invalid role reference: " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.TooFewPartsOfRole:
                        await e.IqErrorBadRequest(e.To, "Too few parts for role " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.TooManyPartsOfRole:
                        await e.IqErrorBadRequest(e.To, "Too many parts for role " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.InvalidRoleIndex:
                        await e.IqErrorBadRequest(e.To, "Role index is invalid for role reference parameter " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.MissingRoleProperty:
                        await e.IqErrorBadRequest(e.To, "Missing property reference for role reference parameter " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.InvalidMachineReadable:
                        await e.IqErrorBadRequest(e.To, "Machine-readable information is missing or is invalid.", "en");
                        return;
 
                    case ContentIntegrity.MissingRoleHumanReadable:
                        await e.IqErrorBadRequest(e.To, "Missing human-readable information for role " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.MissingParameterHumanReadable:
                        await e.IqErrorBadRequest(e.To, "Missing human-readable information for parameter " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.ParameterValidationExpressionError:
                        await e.IqErrorBadRequest(e.To, "Validation expression error for parameter " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.InvalidParameterReference:
                        await e.IqErrorBadRequest(e.To, "An undefined parameter is referenced: " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.MissingHumanReadable:
                        await e.IqErrorBadRequest(e.To, "Missing human-readable information.", "en");
                        return;
 
                    case ContentIntegrity.DuplicateLocalization:
                        await e.IqErrorBadRequest(e.To, "Duplication language reference for human-readable text for contract: " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.DuplicateRoleLocalization:
                        await e.IqErrorBadRequest(e.To, "Duplication language reference for human-readable text for role: " + IntegrityParameter, "en");
                        return;
 
                    case ContentIntegrity.DuplicateParameterLocalization:
                        await e.IqErrorBadRequest(e.To, "Duplication language reference for human-readable text for parameter: " + IntegrityParameter, "en");
                        return;
 
                    default:
                        await e.IqErrorServiceUnavailable(e.To, "Contract integrity check failed for unknown reasons.", "en");
                        return;
                }
 
                CreateContractThread.NewState("Legal ID");
 
                LegalIdentity Identity = await this.GetCurrentApprovedLegalIdentityAsync(e.From.Account);
                if (Identity is null)
                {
                    await e.IqErrorForbidden(e.To, "No current approved legal identity found for account.", "en");
                    return;
                }
 
                CreateContractThread.NewState("Content");
 
                ProfilerThread SchemaProfiler = Profiler?.CreateThread("Schemas", ProfilerThreadType.StateMachine);
                SchemaProfiler?.Start();
 
                try
                {
                    string Errors = await this.ValidateContent(Contract, SchemaProfiler);
                    if (!string.IsNullOrEmpty(Errors))
                    {
                        await e.IqErrorBadRequest(e.To, Errors, "en");
                        return;
                    }
                }
                finally
                {
                    SchemaProfiler?.Idle();
                    SchemaProfiler?.Stop();
                }
 
                StringBuilder Xml = new StringBuilder();
 
                if (!(SignaturesToTransfer is null))
                {
                    CreateContractThread.NewState("Signature Transfer");
 
                    Dictionary<string, int> RoleCounters = new Dictionary<string, int>();
                    List<ClientSignature> Transfered = null;
 
                    await Contract.Serialize(Xml, false, false, false, false, false, false, false, null, this);
                    byte[] Data = Encoding.UTF8.GetBytes(Xml.ToString());
 
                    foreach (ClientSignature Signature in SignaturesToTransfer)
                    {
                        Dictionary<string, string> AttachmentUrls;
 
                        (Identity, AttachmentUrls) = await this.ValidateSenderSignature(
                            new XmppAddress(Signature.BareJid), null, Signature.Timestamp,
                            Data, Signature.DigitalSignature, null);   // TODO: Authorize access to requestor attachments
 
                        if (!(Identity is null))
                        {
                            if (!RoleCounters.TryGetValue(Signature.Role, out int RoleIndex))
                                RoleIndex = 0;
 
                            RoleIndex++;
                            if (await Contract.TrySetRoleParameters(Signature.Role, RoleIndex,
                                Identity, Signature.Timestamp, Signature.DigitalSignature,
                                AttachmentUrls, this) is null)
                            {
                                Transfered ??= new List<ClientSignature>();
                                Transfered.Add(Signature);
                                RoleCounters[Signature.Role] = RoleIndex;
                            }
                        }
                    }
 
                    Contract.ClientSignatures = Transfered?.ToArray();
 
                    Xml.Clear();
                }
 
                if (HasTransientParameters)
                {
                    CreateContractThread.NewState("Transient Parameters");
                    Contract.ProtectTransientParameters();
                }
 
                CreateContractThread.NewState("Object ID");
 
                await Database.Insert(Contract);
 
                CreateContractThread.NewState("Sign");
 
                Contract.ContractId = Contract.ObjectId + "@" + e.To.Address;
                await Contract.Sign(this);
 
                if (Contract.CanActAsTemplate)
                    await RuntimeCounters.IncrementCounter("Legal.Template." + Contract.State.ToString());
                else
                    await RuntimeCounters.IncrementCounter("Legal.Contract." + Contract.State.ToString());
 
                CreateContractThread.NewState("Store");
 
                await Database.Update(Contract);
 
                if (HasTransientParameters)
                {
                    CreateContractThread.NewState("Transient");
                    this.AddTransientParameters(Contract.ContractId, TransientParameters);
                }
 
                CreateContractThread.NewState("Tags");
 
                KeyValuePair<string, object>[] Tags = Contract.GetTags();
 
                switch (Contract.State)
                {
                    case ContractState.Proposed:
                        Log.Informational("Contract proposal registered.",
                            Contract.ContractId.Value, e.From.BareJid.Value, "ContractRegistered", Tags);
                        break;
 
                    case ContractState.Approved:
                        Log.Informational("Contract registered and automatically approved.",
                            Contract.ContractId.Value, e.From.BareJid.Value, "ContractRegistered", Tags);
                        break;
 
                    default:
                        Log.Informational("Contract registered.",
                            Contract.ContractId.Value, e.From.BareJid.Value, "ContractRegistered", Tags);
                        break;
                }
 
                CreateContractThread.NewState("Return Response");
 
                this.ContractAuthorization(e.From.BareJid, e.From.BareJid, Contract.ContractId, true);
 
                await Contract.Serialize(Xml, true, true, true, true, true, true, true, null, this);
                string ContractXml = Xml.ToString();
 
                await e.IqResult(ContractXml, e.To);
 
                if (Contract.State == ContractState.Proposed &&
                    (BrokerNotificationConfiguration.Instance?.ContractProposalReceived ?? false))
                {
                    CreateContractThread.NewState("Notifications");
 
                    StringBuilder Markdown = new StringBuilder();
 
                    Markdown.Append("Contract proposal received: [");
                    Markdown.Append(MarkdownDocument.Encode(Contract.ContractId));
                    Markdown.Append("](");
                    Markdown.Append(Gateway.GetUrl("/Contract.md?ID=" + Contract.ContractId));
                    Markdown.AppendLine(")");
                    Markdown.AppendLine();
                    Output(Markdown, Tags);
 
                    await Gateway.SendNotification(Markdown.ToString());
                }
 
                CreateContractThread.NewState("Event");
 
                await this.SendContractUpdatedEvent(Contract, true);
            }
            catch (Exception ex)
            {
                CreateContractThread.Exception(ex);
                await e.IqError(ex, e.To);
            }
            finally
            {
                CreateContractThread.Stop();
                ParametersThread.Stop();
                Profiler.Stop();
 
                if (Profiler.ElapsedSeconds > 2)
                {
                    string Uml = Profiler.ExportPlantUml(TimeUnit.Seconds);
 
                    Log.Debug("Slow contract creation:\r\n\r\n```uml\r\n" + Uml + "```",
                        new KeyValuePair<string, object>("From", e.From.Address),
                        new KeyValuePair<string, object>("To", e.To.Address),
                        new KeyValuePair<string, object>("ContractId", Contract?.ContractId),
                        new KeyValuePair<string, object>("TemplateId", Contract?.TemplateId));
                }
            }
        }
 
        internal static bool HasSecondaryName(Contract Contract, out string LocalName,
            out string Namespace, out SecondaryNameType NameType)
        {
            LocalName = null;
            Namespace = null;
            NameType = SecondaryNameType.None;
 
            if (Contract.ForMachinesLocalName != "Create" ||
                Contract.ForMachinesNamespace != NeuroFeaturesProcessor.NeuroFeaturesNamespace ||
                Contract.ForMachinesParsed.DocumentElement is null)
            {
                return false;
            }
 
            try
            {
                foreach (XmlNode N in Contract.ForMachinesParsed.DocumentElement.ChildNodes)
                {
                    if (N is XmlElement E &&
                        E.LocalName == "Definition" &&
                        E.NamespaceURI == NeuroFeaturesProcessor.NeuroFeaturesNamespace)
                    {
                        foreach (XmlNode N2 in E.ChildNodes)
                        {
                            if (N2 is XmlElement E2)
                            {
                                LocalName = E2.LocalName;
                                Namespace = E2.NamespaceURI;
                                NameType = SecondaryNameType.TokenCreation;
                                return true;
                            }
                        }
 
                        return false;
                    }
                }
            }
            catch (Exception ex)
            {
                Log.Exception(ex);
            }
 
            return false;
        }
 
        internal void AddTransientParameters(CaseInsensitiveString ContractId,
            Dictionary<CaseInsensitiveString, Parameter> TransientParameters)
        {
            this.transientParameters?.Add(ContractId, TransientParameters);
        }
 
        private async Task<Parameter> TryParseParameter(XmlElement E3, IqEventArgs e, CaseInsensitiveString Name, Parameter OrgParameter)
        {
            byte[] ProtectedValue = null;
 
            if (E3.HasAttribute("guide") && XML.Attribute(E3, "guide") != OrgParameter.Guide)
            {
                await e.IqErrorBadRequest(e.To, "Not allowed to change parameter guide strings.", "en");
                return null;
            }
 
            if (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression)
            {
                await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                return null;
            }
 
            if (E3.HasAttribute("protection"))
            {
                if (XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OrgParameter.Protection)
                {
                    await e.IqErrorBadRequest(e.To, "Not allowed to change parameter protection rules.", "en");
                    return null;
                }
            }
 
            if (E3.HasAttribute("protected"))
            {
                try
                {
                    ProtectedValue = Convert.FromBase64String(XML.Attribute(E3, "protected"));
                }
                catch (Exception)
                {
                    await e.IqErrorBadRequest(e.To, "Invalid base64-encoded protected value.", "en");
                    return null;
                }
            }
            else if (OrgParameter.Protection == ProtectionLevel.Transient)
                ProtectedValue = OrgParameter.ProtectedValue;
 
            switch (E3.LocalName)
            {
                case "stringParameter":
                    if (!(OrgParameter is StringParameter OldStringParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("regEx") && XML.Attribute(E3, "regEx") != OldStringParameter.RegEx) ||
                        (E3.HasAttribute("min") && XML.Attribute(E3, "min") != OldStringParameter.Min) ||
                        (E3.HasAttribute("max") && XML.Attribute(E3, "max") != OldStringParameter.Max) ||
                        (E3.HasAttribute("minIncluded") && XML.Attribute(E3, "minIncluded", true) != OldStringParameter.MinIncluded) ||
                        (E3.HasAttribute("maxIncluded") && XML.Attribute(E3, "maxIncluded", true) != OldStringParameter.MaxIncluded) ||
                        (E3.HasAttribute("minLength") && XML.Attribute(E3, "minLength", 0) != OldStringParameter.MinLength) ||
                        (E3.HasAttribute("maxLength") && XML.Attribute(E3, "maxLength", 0) != OldStringParameter.MaxLength) ||
                        (E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldStringParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new StringParameter()
                    {
                        Name = Name,
                        Value = XML.Attribute(E3, "value"),
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        RegEx = OldStringParameter.RegEx,
                        Min = OldStringParameter.Min,
                        Max = OldStringParameter.Max,
                        MinIncluded = OldStringParameter.MinIncluded,
                        MaxIncluded = OldStringParameter.MaxIncluded,
                        MinLength = OldStringParameter.MinLength,
                        MaxLength = OldStringParameter.MaxLength,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "numericalParameter":
                    if (!(OrgParameter is NumericalParameter OldNumericalParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("min") && XML.Attribute(E3, "min", 0.0m) != OldNumericalParameter.Min) ||
                        (E3.HasAttribute("max") && XML.Attribute(E3, "max", 0.0m) != OldNumericalParameter.Max) ||
                        (E3.HasAttribute("minIncluded") && XML.Attribute(E3, "minIncluded", true) != OldNumericalParameter.MinIncluded) ||
                        (E3.HasAttribute("maxIncluded") && XML.Attribute(E3, "maxIncluded", true) != OldNumericalParameter.MaxIncluded) ||
                        (E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldNumericalParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new NumericalParameter()
                    {
                        Name = Name,
                        Value = E3.HasAttribute("value") ? XML.Attribute(E3, "value", 0.0m) : (decimal?)null,
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Min = OldNumericalParameter.Min,
                        Max = OldNumericalParameter.Max,
                        MinIncluded = OldNumericalParameter.MinIncluded,
                        MaxIncluded = OldNumericalParameter.MaxIncluded,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "booleanParameter":
                    if (!(OrgParameter is BooleanParameter OldBooleanParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldBooleanParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new BooleanParameter()
                    {
                        Name = Name,
                        Value = E3.HasAttribute("value") ? XML.Attribute(E3, "value", false) : (bool?)null,
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "dateParameter":
                    if (!(OrgParameter is DateParameter OldDateParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("min") && XML.Attribute(E3, "min", DateTime.MinValue) != OldDateParameter.Min) ||
                        (E3.HasAttribute("max") && XML.Attribute(E3, "max", DateTime.MinValue) != OldDateParameter.Max) ||
                        (E3.HasAttribute("minIncluded") && XML.Attribute(E3, "minIncluded", true) != OldDateParameter.MinIncluded) ||
                        (E3.HasAttribute("maxIncluded") && XML.Attribute(E3, "maxIncluded", true) != OldDateParameter.MaxIncluded) ||
                        (E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldDateParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new DateParameter()
                    {
                        Name = Name,
                        Value = E3.HasAttribute("value") ? XML.Attribute(E3, "value", DateTime.MinValue).Date : (DateTime?)null,
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Min = OldDateParameter.Min,
                        Max = OldDateParameter.Max,
                        MinIncluded = OldDateParameter.MinIncluded,
                        MaxIncluded = OldDateParameter.MaxIncluded,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "dateTimeParameter":
                    if (!(OrgParameter is DateTimeParameter OldDateTimeParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("min") && XML.Attribute(E3, "min", DateTime.MinValue) != OldDateTimeParameter.Min) ||
                        (E3.HasAttribute("max") && XML.Attribute(E3, "max", DateTime.MinValue) != OldDateTimeParameter.Max) ||
                        (E3.HasAttribute("minIncluded") && XML.Attribute(E3, "minIncluded", true) != OldDateTimeParameter.MinIncluded) ||
                        (E3.HasAttribute("maxIncluded") && XML.Attribute(E3, "maxIncluded", true) != OldDateTimeParameter.MaxIncluded) ||
                        (E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldDateTimeParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new DateTimeParameter()
                    {
                        Name = Name,
                        Value = E3.HasAttribute("value") ? XML.Attribute(E3, "value", DateTime.MinValue) : (DateTime?)null,
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Min = OldDateTimeParameter.Min,
                        Max = OldDateTimeParameter.Max,
                        MinIncluded = OldDateTimeParameter.MinIncluded,
                        MaxIncluded = OldDateTimeParameter.MaxIncluded,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "timeParameter":
                    if (!(OrgParameter is TimeParameter OldTimeParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("min") && XML.Attribute(E3, "min", TimeSpan.Zero) != OldTimeParameter.Min) ||
                        (E3.HasAttribute("max") && XML.Attribute(E3, "max", TimeSpan.Zero) != OldTimeParameter.Max) ||
                        (E3.HasAttribute("minIncluded") && XML.Attribute(E3, "minIncluded", true) != OldTimeParameter.MinIncluded) ||
                        (E3.HasAttribute("maxIncluded") && XML.Attribute(E3, "maxIncluded", true) != OldTimeParameter.MaxIncluded) ||
                        (E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldTimeParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new TimeParameter()
                    {
                        Name = Name,
                        Value = E3.HasAttribute("value") ? XML.Attribute(E3, "value", TimeSpan.Zero) : (TimeSpan?)null,
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Min = OldTimeParameter.Min,
                        Max = OldTimeParameter.Max,
                        MinIncluded = OldTimeParameter.MinIncluded,
                        MaxIncluded = OldTimeParameter.MaxIncluded,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "durationParameter":
                    if (!(OrgParameter is DurationParameter OldDurationParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("min") && XML.Attribute(E3, "min", Duration.Zero) != OldDurationParameter.Min) ||
                        (E3.HasAttribute("max") && XML.Attribute(E3, "max", Duration.Zero) != OldDurationParameter.Max) ||
                        (E3.HasAttribute("minIncluded") && XML.Attribute(E3, "minIncluded", true) != OldDurationParameter.MinIncluded) ||
                        (E3.HasAttribute("maxIncluded") && XML.Attribute(E3, "maxIncluded", true) != OldDurationParameter.MaxIncluded) ||
                        (E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldDurationParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new DurationParameter()
                    {
                        Name = Name,
                        Value = E3.HasAttribute("value") ? XML.Attribute(E3, "value", Duration.Zero) : (Duration?)null,
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Min = OldDurationParameter.Min,
                        Max = OldDurationParameter.Max,
                        MinIncluded = OldDurationParameter.MinIncluded,
                        MaxIncluded = OldDurationParameter.MaxIncluded,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "geoParameter":
                    if (!(OrgParameter is GeoParameter OldGeoParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("min") && GeoParameter.GeoPositionAttribute(E3, "min") != OldGeoParameter.Min) ||
                        (E3.HasAttribute("max") && GeoParameter.GeoPositionAttribute(E3, "max") != OldGeoParameter.Max) ||
                        (E3.HasAttribute("minIncluded") && XML.Attribute(E3, "minIncluded", true) != OldGeoParameter.MinIncluded) ||
                        (E3.HasAttribute("maxIncluded") && XML.Attribute(E3, "maxIncluded", true) != OldGeoParameter.MaxIncluded) ||
                        (E3.HasAttribute("altitude") && XML.Attribute(E3, "altitude", AltitudeUse.Optional) != OldGeoParameter.Altitude) ||
                        (E3.HasAttribute("contractLocation") && XML.Attribute(E3, "contractLocation", false) != OldGeoParameter.ContractLocation) ||
                        (E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldGeoParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new GeoParameter()
                    {
                        Name = Name,
                        Value = GeoParameter.GeoPositionAttribute(E3, "value"),
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Min = OldGeoParameter.Min,
                        Max = OldGeoParameter.Max,
                        MinIncluded = OldGeoParameter.MinIncluded,
                        MaxIncluded = OldGeoParameter.MaxIncluded,
                        Altitude = OldGeoParameter.Altitude,
                        ContractLocation = OldGeoParameter.ContractLocation,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "calcParameter":
                    if (!(OrgParameter is CalcParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression)
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new CalcParameter()
                    {
                        Name = Name,
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "roleParameter":
                    if (!(OrgParameter is RoleParameter OldRoleParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("role") && XML.Attribute(E3, "role") != OldRoleParameter.Role) ||
                        (E3.HasAttribute("index") && XML.Attribute(E3, "index", 0) != OldRoleParameter.Index) ||
                        (E3.HasAttribute("property") && XML.Attribute(E3, "property") != OldRoleParameter.Property) ||
                        (E3.HasAttribute("required") && XML.Attribute(E3, "required", false) != OldRoleParameter.Required) ||
                        (E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldRoleParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new RoleParameter()
                    {
                        Name = Name,
                        Role = OldRoleParameter.Role,
                        Index = OldRoleParameter.Index,
                        Property = OldRoleParameter.Property,
                        Required = OldRoleParameter.Required,
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "contractReferenceParameter":
                    if (!(OrgParameter is ContractReferenceParameter OldContractReferenceParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("localName") && XML.Attribute(E3, "localName") != OldContractReferenceParameter.LocalName) ||
                        (E3.HasAttribute("namespace") && XML.Attribute(E3, "namespace") != OldContractReferenceParameter.Namespace) ||
                        (E3.HasAttribute("templateId") && XML.Attribute(E3, "templateId") != OldContractReferenceParameter.TemplateId) ||
                        (E3.HasAttribute("provider") && XML.Attribute(E3, "provider") != OldContractReferenceParameter.Provider) ||
                        (E3.HasAttribute("creatorRole") && XML.Attribute(E3, "creatorRole") != OldContractReferenceParameter.CreatorRole) ||
                        (E3.HasAttribute("required") && XML.Attribute(E3, "required", false) != OldContractReferenceParameter.Required) ||
                        (E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldContractReferenceParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new ContractReferenceParameter()
                    {
                        Name = Name,
                        Value = XML.Attribute(E3, "value"),
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Descriptions = OrgParameter.Descriptions,
                        Labels = OldContractReferenceParameter.Labels,
                        LocalName = OldContractReferenceParameter.LocalName,
                        Namespace = OldContractReferenceParameter.Namespace,
                        TemplateId = OldContractReferenceParameter.TemplateId,
                        Provider = OldContractReferenceParameter.Provider,
                        CreatorRole = OldContractReferenceParameter.CreatorRole,
                        Required = OldContractReferenceParameter.Required,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                case "attachmentParameter":
                    if (!(OrgParameter is AttachmentParameter OldAttachmentParameter))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter types.", "en");
                        return null;
                    }
 
                    if ((E3.HasAttribute("required") && XML.Attribute(E3, "required", false) != OldAttachmentParameter.Required) ||
                        (E3.HasAttribute("contentType") && XML.Attribute(E3, "contentType") != OldAttachmentParameter.ContentType) ||
                        (E3.HasAttribute("minSize") && XML.Attribute(E3, "minSize", 0) != OldAttachmentParameter.MinSize) ||
                        (E3.HasAttribute("maxSize") && XML.Attribute(E3, "maxSize", 0) != OldAttachmentParameter.MaxSize) ||
                        (E3.HasAttribute("minWidth") && XML.Attribute(E3, "minWidth", 0) != OldAttachmentParameter.MinWidth) ||
                        (E3.HasAttribute("maxWidth") && XML.Attribute(E3, "maxWidth", 0) != OldAttachmentParameter.MaxWidth) ||
                        (E3.HasAttribute("minHeight") && XML.Attribute(E3, "minHeight", 0) != OldAttachmentParameter.MinHeight) ||
                        (E3.HasAttribute("maxHeight") && XML.Attribute(E3, "maxHeight", 0) != OldAttachmentParameter.MaxHeight) ||
                        (E3.HasAttribute("protection") && XML.Attribute(E3, "protection", ProtectionLevel.Normal) != OldAttachmentParameter.Protection) ||
                        (E3.HasAttribute("exp") && XML.Attribute(E3, "exp") != OrgParameter.Expression))
                    {
                        await e.IqErrorBadRequest(e.To, "Not allowed to change parameter validation rules.", "en");
                        return null;
                    }
 
                    return new AttachmentParameter()
                    {
                        Name = Name,
                        Value = XML.Attribute(E3, "value"),
                        Guide = OrgParameter.Guide,
                        Expression = OrgParameter.Expression,
                        Required = OldAttachmentParameter.Required,
                        ContentType = OldAttachmentParameter.ContentType,
                        MinSize = OldAttachmentParameter.MinSize,
                        MaxSize = OldAttachmentParameter.MaxSize,
                        MinWidth = OldAttachmentParameter.MinWidth,
                        MaxWidth = OldAttachmentParameter.MaxWidth,
                        MinHeight = OldAttachmentParameter.MinHeight,
                        MaxHeight = OldAttachmentParameter.MaxHeight,
                        Descriptions = OrgParameter.Descriptions,
                        Protection = OrgParameter.Protection,
                        ProtectedValue = ProtectedValue
                    };
 
                default:
                    await e.IqErrorBadRequest(e.To, "Invalid request.", "en");
                    return null;
            }
        }
 
        internal async Task<string> CheckContentIntegrity(Contract Contract)
        {
            KeyValuePair<ContentIntegrity, string> P = await Contract.CheckContentIntegrity(this);
            string IntegrityParameter = P.Value;
 
            return P.Key switch
            {
                ContentIntegrity.Ok => null,
                ContentIntegrity.RolesNotDefined => "No roles have been defined.",
                ContentIntegrity.PartsNotDefined => "Part definition expected.",
                ContentIntegrity.RoleCountsMismatch => "Role counts are incorrect for role " + IntegrityParameter,
                ContentIntegrity.DuplicateRoleDefinition => "Duplicate role definition for role " + IntegrityParameter,
                ContentIntegrity.DuplicateParameterDefinition => "Duplicate parameter definition for parameter " + IntegrityParameter,
                ContentIntegrity.InvalidLegalIdReference => "Invalid Legal ID reference: " + IntegrityParameter,
                ContentIntegrity.InvalidRoleReference => "Invalid role reference: " + IntegrityParameter,
                ContentIntegrity.TooFewPartsOfRole => "Too few parts for role " + IntegrityParameter,
                ContentIntegrity.TooManyPartsOfRole => "Too many parts for role " + IntegrityParameter,
                ContentIntegrity.InvalidRoleIndex => "Role index is invalid for role reference parameter " + IntegrityParameter,
                ContentIntegrity.MissingRoleProperty => "Missing property reference for role reference parameter " + IntegrityParameter,
                ContentIntegrity.InvalidMachineReadable => "Machine-readable information is missing or is invalid.",
                ContentIntegrity.MissingRoleHumanReadable => "Missing human-readable information for role " + IntegrityParameter,
                ContentIntegrity.MissingParameterHumanReadable => "Missing human-readable information for parameter " + IntegrityParameter,
                ContentIntegrity.ParameterValidationExpressionError => "Validation expression error for parameter " + IntegrityParameter,
                ContentIntegrity.InvalidParameterReference => "An undefined parameter is referenced: " + IntegrityParameter,
                ContentIntegrity.MissingHumanReadable => "Missing human-readable information.",
                ContentIntegrity.DuplicateLocalization => "Duplication language reference for human-readable text for contract: " + IntegrityParameter,
                ContentIntegrity.DuplicateRoleLocalization => "Duplication language reference for human-readable text for role: " + IntegrityParameter,
                ContentIntegrity.DuplicateParameterLocalization => "Duplication language reference for human-readable text for parameter: " + IntegrityParameter,
                _ => "Contract integrity check failed for unknown reasons.",
            };
        }
 
        internal async Task<string> ValidateContent(Contract Contract, ProfilerThread Profiler)
        {
            Contract.ContentSchemaDigest = null;
            Contract.ContentSchemaHashFunction = HashFunction.SHA256;
 
            if (string.IsNullOrEmpty(Contract.ForMachines))
                return "No machine-readable content.";
 
            XmlDocument Doc;
 
            try
            {
                Doc = Contract.ForMachinesParsed;
 
                if (Doc.DocumentElement is null)
                    return "Invalid machine-readable XML: No root element.";
            }
            catch (XmlException ex)
            {
                ex = XML.AnnotateException(ex, Contract.ForMachines);
                return "Invalid machine-readable XML: " + ex.Message;
            }
            catch (Exception ex)
            {
                return "Invalid machine-readable XML: " + ex.Message;
            }
 
            (string ErrorMessage, Dictionary<string, ValidationSchema> Schemas) = await this.ValidateContent(Doc, Profiler);
            if (!string.IsNullOrEmpty(ErrorMessage))
                return ErrorMessage;
 
            int NrSchemas = Schemas.Count;
            if (NrSchemas == 0 || !Schemas.ContainsKey(Contract.ForMachinesNamespace))
                return "Machine-readable content not defined by schemas.";
 
            int i = 0;
            int c = Schemas.Count;
            SchemaReference[] References = new SchemaReference[c];
 
            foreach (ValidationSchema Schema2 in Schemas.Values)
            {
                References[i++] = new SchemaReference()
                {
                    Namespace = Schema2.Namespace,
                    Digest = Convert.FromBase64String(Schema2.HashBase64),
                    Algorithm = Schema2.Function
                };
            }
 
            Contract.SchemaReferences = References;
 
            if (Contract.TryGetSchemaReference(Contract.ForMachinesNamespace, out SchemaReference Ref))
            {
                Contract.ContentSchemaDigest = Ref.Digest;
                Contract.ContentSchemaHashFunction = Ref.Algorithm;
            }
            else
                return "M2M content schema not found.";
 
            return null;
        }
 
        internal async Task<(string, Dictionary<string, ValidationSchema>)> ValidateContent(XmlDocument Doc, ProfilerThread Profiler)
        {
            Profiler?.NewState("Checking");
 
            Dictionary<string, ValidationSchema> Schemas = new Dictionary<string, ValidationSchema>();
            ChunkedList<XmlElement> ToCheck = new ChunkedList<XmlElement>
            {
                Doc.DocumentElement
            };
            XmlElement E;
            string LastNamespace = null;
            string Namespace;
 
            while (ToCheck.HasFirstItem)
            {
                E = ToCheck.RemoveFirst();
                Namespace = E.NamespaceURI;
                if (!string.IsNullOrEmpty(Namespace) && Namespace != LastNamespace)
                {
                    Schemas[Namespace] = null;
                    LastNamespace = Namespace;
                }
 
                if (E.HasAttributes)
                {
                    foreach (XmlAttribute Attr in E.Attributes)
                    {
                        Namespace = Attr.NamespaceURI;
 
                        if (!string.IsNullOrEmpty(Namespace) &&
                            Namespace != LastNamespace &&
                            Namespace != "http://www.w3.org/XML/1998/namespace" &&
                            Namespace != "http://www.w3.org/2000/xmlns/")
                        {
                            Schemas[Namespace] = null;  // Only change LastNamespace when element namespaces change.
                        }
                    }
                }
 
                foreach (XmlNode N in E.ChildNodes)
                {
                    if (N is XmlElement E2)
                        ToCheck.Add(E2);
                }
            }
 
            int NrSchemas = Schemas.Count;
            ValidationSchema Schema;
            string ErrorMsg;
            Dictionary<string, bool> Loaded = new Dictionary<string, bool>();
            string[] Namespaces;
            bool Added;
 
            do
            {
                Added = false;
 
                Namespaces = new string[NrSchemas];
                Schemas.Keys.CopyTo(Namespaces, 0);
 
                foreach (string Namespace2 in Namespaces)
                {
                    if (Loaded.ContainsKey(Namespace2))
                        continue;
 
                    Profiler?.NewState(Namespace2);
 
                    Schema = await Database.FindFirstIgnoreRest<ValidationSchema>(new FilterFieldEqualTo("Namespace", Namespace2), "-Created");
 
                    if (Schema is null)
                    {
                        (Schema, ErrorMsg) = await this.LoadSchema(Namespace2, null);
                        if (!string.IsNullOrEmpty(ErrorMsg))
                            return (ErrorMsg, null);
 
                        Loaded[Namespace2] = true;
                    }
 
                    Schemas[Namespace2] = Schema;
 
                    string[] Imports = GetImports(Schema.Parsed);
 
                    foreach (string Import in Imports)
                    {
                        if (!Schemas.ContainsKey(Import))
                        {
                            Schemas[Import] = null;
                            NrSchemas++;
                            Added = true;
                        }
                    }
                }
            }
            while (Added);
 
            Profiler?.NewState("Validating");
 
            ErrorMsg = this.ValidateXml(Schemas.Values, Doc);
            if (!string.IsNullOrEmpty(ErrorMsg))
            {
                bool Changed = false;
 
                foreach (string Namespace2 in Namespaces)
                {
                    if (Loaded.ContainsKey(Namespace2))
                        continue;
 
                    Schema = Schemas[Namespace2];
                    (ValidationSchema Schema2, string ErrorMsg2) = await this.LoadSchema(Namespace2, Schema);
                    if (!string.IsNullOrEmpty(ErrorMsg2))
                        return (ErrorMsg2, null);
 
                    if (Schema2 != Schema)
                    {
                        Schemas[Namespace2] = Schema2;
                        Changed = true;
                    }
                }
 
                if (!Changed)
                    return (ErrorMsg, null);
 
                ErrorMsg = this.ValidateXml(Schemas.Values, Doc);
                if (!string.IsNullOrEmpty(ErrorMsg))
                    return (ErrorMsg, null);
            }
 
            return (null, Schemas);
        }
 
        private static string[] GetImports(XmlSchema Schema)
        {
            Dictionary<string, bool> Result = null;
            ChunkedList<XmlSchemaObject> ToCheck = new ChunkedList<XmlSchemaObject>();
 
            foreach (XmlSchemaObject Obj in Schema.Includes)
                ToCheck.Add(Obj);
 
            while (ToCheck.HasFirstItem)
            {
                XmlSchemaObject Obj = ToCheck.RemoveFirst();
 
                if (Obj is XmlSchemaExternal External)
                {
                    if (!(External.Schema is null))
                    {
                        foreach (XmlSchemaObject Obj2 in External.Schema.Includes)
                            ToCheck.Add(Obj2);
                    }
 
                    if (Obj is XmlSchemaImport Import)
                    {
                        Result ??= new Dictionary<string, bool>();
                        Result[Import.Namespace] = true;
                    }
                }
            }
 
            if (Result is null)
                return Array.Empty<string>();
 
            string[] Result2 = new string[Result.Count];
            Result.Keys.CopyTo(Result2, 0);
 
            return Result2;
        }
 
        private async Task<(ValidationSchema, string)> LoadSchema(string Namespace, ValidationSchema PrevSchema)
        {
            Stream File;
            string ContentType;
 
            switch (Namespace)
            {
                case "http://www.w3.org/XML/1998/namespace":
                    Type T = typeof(Networking.XMPP.Contracts.ContractsClient);
                    Assembly A = T.Assembly;
                    File = A.GetManifestResourceStream(T.Namespace + ".Schema.Xml.xsd");
                    ContentType = XmlCodec.SchemaContentType;
                    break;
 
                case "http://www.w3.org/2000/xmlns/":
                    T = typeof(Networking.XMPP.Contracts.ContractsClient);
                    A = T.Assembly;
                    File = A.GetManifestResourceStream(T.Namespace + ".Schema.Xmlns.xsd");
                    ContentType = XmlCodec.SchemaContentType;
                    break;
 
                default:
                    Uri Uri = new Uri(Namespace);
 
                    if (!InternetContent.CanGet(Uri, out Grade _, out IContentGetter Getter))
                        return (null, "Schema not downloadable: " + Namespace);
 
                    try
                    {
                        ContentStreamResponse P = await Getter.GetTempStreamAsync(Uri, null, null, 10000,
                            new KeyValuePair<string, string>("Accept", "application/xml, text/xml"),
                            new KeyValuePair<string, string>("Accept-Charset", "utf-8"));
 
                        if (P.HasError)
                            return (null, "Unable to get schema file " + Namespace + ". The following error was reported: " + P.Error.Message);
 
                        File = P.Encoded;
                        ContentType = P.ContentType;
                    }
                    catch (Exception ex)
                    {
                        return (null, "Unable to get schema file " + Namespace + ". The following error was reported: " + ex.Message);
                    }
                    break;
            }
 
            try
            {
                if (File.Length > int.MaxValue)
                    throw new OutOfMemoryException("Schema file too large.");
 
                File.Position = 0;
 
                byte[] Bin = await File.ReadAllAsync();
 
                string Digest = Convert.ToBase64String(Hashes.ComputeHash(HashFunction.SHA384, Bin));
 
                if (!(PrevSchema is null) && Digest == PrevSchema.HashBase64)
                    return (PrevSchema, null);
 
                ValidationSchema Schema = new ValidationSchema()
                {
                    Namespace = Namespace,
                    Function = HashFunction.SHA384,
                    HashBase64 = Digest,
                    Created = UtcNowSecond,
                    XmlSchema = Bin,
                    ContentType = ContentType
                };
 
                await Database.Insert(Schema);
 
                return (Schema, null);
            }
            finally
            {
                File.Dispose();
            }
        }
 
        private string ValidateXml(IEnumerable<ValidationSchema> Schemas, XmlDocument Xml)
        {
            StringBuilder Errors = null;
            StringBuilder Warnings = null;
 
            try
            {
                if (Xml.Schemas.Count > 0)
                {
                    LinkedList<XmlSchema> ToRemove = new LinkedList<XmlSchema>();
 
                    foreach (XmlSchema Schema in Xml.Schemas.Schemas())
                        ToRemove.AddLast(Schema);
 
                    foreach (XmlSchema Schema in ToRemove)
                        Xml.Schemas.Remove(Schema);
                }
 
                foreach (ValidationSchema Schema in Schemas)
                    Xml.Schemas.Add(Schema.Parsed);
 
                Xml.Validate((sender2, e2) =>
                {
                    switch (e2.Severity)
                    {
                        case XmlSeverityType.Error:
                            Errors ??= new StringBuilder();
                            Errors.AppendLine(e2.Message);
                            break;
 
                        case XmlSeverityType.Warning:
                            Warnings ??= new StringBuilder();
                            Warnings.AppendLine(e2.Message);
                            break;
                    }
                });
            }
            catch (Exception ex)
            {
                Errors ??= new StringBuilder();
                Errors.AppendLine(ex.Message);
            }
 
            if (!(Errors is null) || !(Warnings is null))
            {
                StringBuilder Report = new StringBuilder();
 
                if (!(Errors is null))
                {
                    Report.AppendLine("Errors found during validation:");
                    Report.AppendLine(new string('-', 40));
                    Report.Append(Errors.ToString());
 
                    if (!(Warnings is null))
                        Report.AppendLine();
                }
 
                if (!(Warnings is null))
                {
                    Report.AppendLine("Warnings found during validation:");
                    Report.AppendLine(new string('-', 40));
                    Report.Append(Warnings.ToString());
                }
 
                return Report.ToString();
            }
 
            return null;
        }
 
        public static async Task<Tuple<byte[], XmlSchema>> LoadSchema(string Url)
        {
            try
            {
                HttpRequestMessage Request = null;
                HttpResponseMessage Response = null;
                HttpClient Client = new HttpClient();
 
                try
                {
                    Client.Timeout = TimeSpan.FromMilliseconds(30000);
                    Client.DefaultRequestHeaders.ExpectContinue = false;
 
                    Uri Uri = new Uri(Url);
                    Request = new HttpRequestMessage(HttpMethod.Head, Uri);
                    Request.Headers.Add("Accept", "application/xml, text/xml");
                    Request.Headers.Add("Accept-Charset", "utf-8");
 
                    Response = await Client.SendAsync(Request);
                    if (!Response.IsSuccessStatusCode)
                        return null;
 
                    Request.Dispose();
                    Response.Dispose();
 
                    Request = new HttpRequestMessage(HttpMethod.Get, Uri);
                    Request.Headers.Add("Accept", "application/xml, text/xml");
                    Request.Headers.Add("Accept-Charset", "utf-8");
 
                    Response = await Client.SendAsync(Request);
                    if (!Response.IsSuccessStatusCode)
                        return null;
 
                    string ContentType = null;
 
                    if (Response.Headers.TryGetValues("Content-Type", out IEnumerable<string> Values))
                    {
                        foreach (string s in Values)
                        {
                            ContentType = s;
                            break;
                        }
                    }
 
                    ContentType ??= XmlCodec.DefaultContentType;
 
                    byte[] Data = await Response.Content.ReadAsByteArrayAsync();
                    ContentResponse Decoded = await InternetContent.DecodeAsync(ContentType, Data, Uri);
 
                    if (Decoded.HasError)
                    {
                        Log.Exception(Decoded.Error);
                        return null;
                    }
 
                    if (!(Decoded.Decoded is XmlDocument Doc))
                        return null;
 
                    using XmlReader r = XmlReader.Create(new MemoryStream(Data));
                    XmlSchema Schema = XmlSchema.Read(r, null);
                    return new Tuple<byte[], XmlSchema>(Data, Schema);
                }
                finally
                {
                    Request?.Dispose();
                    Response?.Dispose();
                    Client.Dispose();
                }
            }
            catch (Exception ex)
            {
                Log.Exception(ex);
            }
 
            return null;
        }
 
        private async Task GetCreatedContractsHandler(object Sender, IqEventArgs e)
        {
            try
            {
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Not an account on the broker.", "en");
                    return;
                }
 
                int Offset = XML.Attribute(e.Query, "offset", 0);
                int MaxCount = XML.Attribute(e.Query, "maxCount", int.MaxValue);
                bool References = XML.Attribute(e.Query, "references", true);
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
 
                IEnumerable<Contract> Contracts = await Database.Find<Contract>(Offset, MaxCount,
                    new FilterFieldEqualTo("Account", e.From.Account), "Created");
 
                string Xml = await this.SerializeContractReferences(Contracts, References, QueryVersion);
 
                await e.IqResult(Xml, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal async Task<string> SerializeContractReferences(IEnumerable<IContractReference> Contracts, bool References, NamespaceSet Version)
        {
            StringBuilder Xml = new StringBuilder();
 
            if (References)
                Xml.Append("<contractReferences xmlns='");
            else
                Xml.Append("<contracts xmlns='");
 
            Xml.Append(NamespaceSmartContracts(Version));
            Xml.Append("'>");
 
            foreach (IContractReference Contract in Contracts)
            {
                if (References)
                {
                    Xml.Append("<ref id='");
                    Xml.Append(XML.Encode(Contract.ContractId));
                    Xml.Append("'/>");
                }
                else if (Contract is Contract Contract2)
                    await Contract2.Serialize(Xml, Contract2.Version != Version, true, true, true, true, true, true, null, this);
                else
                {
                    KeyValuePair<Contract, IqResultEventArgs> P = await this.GetContract(Contract.ContractId);
                    Contract2 = P.Key;
 
                    if (Contract2 is null)
                    {
                        Xml.Append("<ref id='");
                        Xml.Append(XML.Encode(Contract.ContractId));
                        Xml.Append("'/>");
                    }
                    else
                        await Contract2.Serialize(Xml, Contract2.Version != Version, true, true, true, true, true, true, null, this);
                }
            }
 
            if (References)
                Xml.Append("</contractReferences>");
            else
                Xml.Append("</contracts>");
 
            return Xml.ToString();
        }
 
        public async Task<CaseInsensitiveString> GetComponent(CaseInsensitiveString ServerDomain, string Feature)
        {
            KeyValuePair<CaseInsensitiveString, string> P = await this.GetComponent(ServerDomain, new string[] { Feature });
            return P.Key;
        }
 
        public async Task<KeyValuePair<CaseInsensitiveString, string>> GetComponent(CaseInsensitiveString ServerDomain, params string[] Features)
        {
            if (!Gateway.HasDomain && !(Gateway.XmppClient is null) &&
                !XmppServer.IsRemoteDomainRegistered(ServerDomain))   // S2S not possible in developer environment, use C2S.
            {
                KeyValuePair<string, string> P = await Gateway.XmppClient.FindComponentAsync(ServerDomain, Features);
                return new KeyValuePair<CaseInsensitiveString, string>(P.Key, P.Value);
            }
 
            foreach (string Feature in Features)
            {
                string Key = ServerDomain + "#" + Feature;
 
                if (this.remoteComponents.TryGetValue(Key, out object Obj) &&
                    Obj is CaseInsensitiveString JID)
                {
                    return new KeyValuePair<CaseInsensitiveString, string>(JID, Feature);
                }
            }
 
            TaskCompletionSource<KeyValuePair<CaseInsensitiveString, string>> Result =
                new TaskCompletionSource<KeyValuePair<CaseInsensitiveString, string>>();
 
            await this.Server.SendIqRequest("get", new XmppAddress(this.Server.Domain), new XmppAddress(ServerDomain), string.Empty,
                "<query xmlns='http://jabber.org/protocol/disco#items'/>", true, async (Sender, e) =>
                {
                    if (e.Ok && !(e.FirstElement is null))
                    {
                        List<CaseInsensitiveString> JIDs = new List<CaseInsensitiveString>() { ServerDomain };
                        object SynchObject = new object();
 
                        foreach (XmlNode N in e.FirstElement)
                        {
                            if (N is XmlElement E && E.LocalName == "item")
                            {
                                CaseInsensitiveString JID = XML.Attribute(E, "jid");
                                if (!CaseInsensitiveString.IsNullOrEmpty(JID))
                                    JIDs.Add(JID);
                            }
                        }
 
                        int Count = JIDs.Count;
 
                        foreach (CaseInsensitiveString JID2 in JIDs)
                        {
                            await this.Server.SendIqRequest("get", new XmppAddress(this.Server.Domain), new XmppAddress(JID2), string.Empty,
                                "<query xmlns='http://jabber.org/protocol/disco#info'/>", true, (sender2, e2) =>
                                {
                                    if (e2.Ok)
                                    {
                                        foreach (XmlNode N2 in e2.FirstElement)
                                        {
                                            if (!(N2 is XmlElement E2) || E2.LocalName != "feature")
                                                continue;
 
                                            string Var = XML.Attribute(E2, "var");
 
                                            foreach (string Feature in Features)
                                            {
                                                if (Var == Feature)
                                                {
                                                    lock (SynchObject)
                                                    {
                                                        if (Count > 0)
                                                            Count = -1;
                                                        else
                                                            break;
                                                    }
 
                                                    CaseInsensitiveString s = (CaseInsensitiveString)e2.State;
                                                    string Key = ServerDomain + "#" + Feature;
 
                                                    this.remoteComponents[Key] = s;
                                                    Result.TrySetResult(new KeyValuePair<CaseInsensitiveString, string>(s, Feature));
 
                                                    return Task.CompletedTask;
                                                }
                                            }
                                        }
                                    }
 
                                    lock (SynchObject)
                                    {
                                        Count--;
                                        if (Count != 0)
                                            return Task.CompletedTask;
                                    }
 
                                    Result.TrySetResult(new KeyValuePair<CaseInsensitiveString, string>(null, null));
 
                                    return Task.CompletedTask;
                                }, JID2);
                        }
                    }
                    else
                        Result.TrySetResult(new KeyValuePair<CaseInsensitiveString, string>(null, null));
                }, null);
 
            return await Result.Task;
        }
 
        private async Task SignContractHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ContractId = null;
                CaseInsensitiveString Role = null;
                byte[] Signature = null;
                bool Transferable = false;
 
                foreach (XmlAttribute Attr in e.Query.Attributes)
                {
                    switch (Attr.Name)
                    {
                        case "id":
                            ContractId = Attr.Value;
                            break;
 
                        case "role":
                            Role = Attr.Value;
                            break;
 
                        case "s":
                            Signature = Convert.FromBase64String(Attr.Value);
                            break;
 
                        case "transferable":
                            if (CommonTypes.TryParse(Attr.Value, out bool b))
                                Transferable = b;
                            else
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid transferable value.", "en");
                                return;
                            }
                            break;
                    }
                }
 
                if (ContractId is null || Role is null || Signature is null)
                {
                    await e.IqErrorBadRequest(e.To, "Attributes missing.", "en");
                    return;
                }
 
                using Semaphore Semaphore = await Semaphores.BeginWrite("iotsc:" + ContractId.LowerCase);
                Contract Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                if (Contract is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                    return;
                }
 
                if (Contract.PartsMode == ContractParts.TemplateOnly)
                {
                    await e.IqErrorForbidden(e.To, "Contract is a template only, and cannot be signed.", "en");
                    return;
                }
 
                switch (Contract.State)
                {
                    case ContractState.Obsoleted:
                        await e.IqErrorForbidden(e.To, "Contract is obsoleted.", "en");
                        return;
 
                    case ContractState.Deleted:
                        await e.IqErrorForbidden(e.To, "Contract is deleted.", "en");
                        return;
 
                    case ContractState.Proposed:
                        await e.IqErrorForbidden(e.To, "Contract is not yet approved to be signed.", "en");
                        return;
 
                    case ContractState.Rejected:
                        await e.IqErrorForbidden(e.To, "Contract proposal has been rejected.", "en");
                        return;
 
                    case ContractState.Failed:
                        await e.IqErrorForbidden(e.To, "Contract proposal has failed.", "en");
                        return;
                }
 
                DateTime UtcNow = DateTime.UtcNow;
                if (Contract.SignAfter.HasValue && UtcNow < Contract.SignAfter.Value.ToUniversalTime())
                {
                    await e.IqErrorForbidden(e.To, "Contract will be open for signatures after " + Contract.SignAfter.Value.ToUniversalTime().ToString() + " (UTC)", "en");
                    return;
                }
 
                if (Contract.SignBefore.HasValue && UtcNow > Contract.SignBefore.Value.ToUniversalTime())
                {
                    await e.IqErrorForbidden(e.To, "Contract closed for signatures as of " + Contract.SignBefore.Value.ToUniversalTime().ToString() + " (UTC)", "en");
                    return;
                }
 
                if (!Contract.HasTransientParameters && !Contract.HasEncryptedParameters)
                {
                    KeyValuePair<Parameter, string> P = await Contract.CheckParameters(this, false);
                    Parameter FailingParameter = P.Key;
 
                    if (!(FailingParameter is null))
                    {
                        await e.IqErrorResourceConstraint(e.To, "Contract parameter " + FailingParameter.Name + " contains invalid value: " + P.Value, "en");
                        return;
                    }
                }
 
                int NrSignaturesForRole = 0;
                bool RoleFound = false;
 
                if (!(Contract.ClientSignatures is null))
                {
                    foreach (ClientSignature ClientSignature in Contract.ClientSignatures)
                    {
                        if (ClientSignature.Role == Role)
                            NrSignaturesForRole++;
                    }
                }
 
                if (!(Contract.Roles is null))
                {
                    foreach (Role Role2 in Contract.Roles)
                    {
                        if (Role2.Name == Role)
                        {
                            if (NrSignaturesForRole >= Role2.MaxCount)
                            {
                                await e.IqErrorForbidden(e.To, "No more signatures of specified role allowed.", "en");
                                return;
                            }
 
                            RoleFound = true;
                            break;
                        }
                    }
                }
 
                if (!RoleFound)
                {
                    await e.IqErrorForbidden(e.To, "No such role defined in contract.", "en");
                    return;
                }
 
                StringBuilder Xml = new StringBuilder();
                await Contract.Serialize(Xml, false, false, false, false, false, false, false, null, this);
                byte[] Data = Encoding.UTF8.GetBytes(Xml.ToString());
 
                (LegalIdentity Identity, Dictionary<string, string> AttachmentUrls) =
                    await this.ValidateSenderSignature(e.From, new ExternalRequest(e),
                    UtcNow, Data, Signature, null); // TODO: Authorize access to requestor attachments
 
                if (Identity is null)
                    return;
 
                if (Contract.PartsMode == ContractParts.ExplicitlyDefined)
                {
                    bool InList = false;
 
                    if (!(Contract.Parts is null))
                    {
                        foreach (Part Part in Contract.Parts)
                        {
                            if (Part.LegalId == Identity.Id && Part.Role == Role)
                            {
                                InList = true;
                                break;
                            }
                        }
 
                        if (!InList)
                        {
                            XmppAddress SignatoryId = new XmppAddress(Identity.Id);
 
                            foreach (Part Part in Contract.Parts)
                            {
                                if (Part.Role != Role)
                                    continue;
 
                                XmppAddress PartId = new XmppAddress(Part.LegalId);
                                if (SignatoryId.Domain != PartId.Domain)
                                    continue;
 
                                bool HasSigned = false;
 
                                if (!(Contract.ClientSignatures is null))
                                {
                                    foreach (ClientSignature ClientSignature in Contract.ClientSignatures)
                                    {
                                        if (ClientSignature.LegalId == Part.LegalId)
                                        {
                                            HasSigned = true;
                                            break;
                                        }
                                    }
                                }
 
                                if (HasSigned)
                                    continue;
 
                                if (!await this.CanSignAs(Part.LegalId, Identity.Id))
                                    continue;
 
                                InList = true;
                                break;
                            }
                        }
                    }
 
                    if (!InList)
                    {
                        await e.IqErrorForbidden(e.To, "Legal identity not in explicitly defined list of parts in contract.", "en");
                        return;
                    }
                }
 
                if (!(Contract.ClientSignatures is null))
                {
                    foreach (ClientSignature ClientSignature in Contract.ClientSignatures)
                    {
                        if (ClientSignature.LegalId == Identity.Id && ClientSignature.Role == Role)
                        {
                            // Contract already signed. Return successful response without altering the contract.
 
                            Xml.Clear();
                            await Contract.Serialize(Xml, true, true, true, true, true, true, true, null, this);
                            await e.IqResult(Xml.ToString(), e.To);
 
                            return;
                        }
                    }
                }
 
                DateTime SignatureTimestamp = DateTime.UtcNow;
                string s = await Contract.TrySetRoleParameters(Role, NrSignaturesForRole + 1,
                    Identity, SignatureTimestamp, Signature, AttachmentUrls, this);
 
                if (!string.IsNullOrEmpty(s))
                {
                    await e.IqErrorForbidden(e.To, "Legal identity does not have required property " + s + " defined.", "en");
                    return;
                }
 
                int c = (Contract.ClientSignatures?.Length ?? 0) + 1;
                ClientSignature[] Signatures = new ClientSignature[c];
 
                Contract.ClientSignatures?.CopyTo(Signatures, 0);
                Signatures[c - 1] = new ClientSignature()
                {
                    BareJid = e.From.BareJid,
                    LegalId = Identity.Id,
                    Role = Role,
                    DigitalSignature = Signature,
                    Timestamp = SignatureTimestamp,
                    Transferable = Transferable
                };
 
                bool GeoPublish = false;
                bool Signed = false;
 
                Contract.ClientSignatures = Signatures;
 
                if (Contract.From == DateTime.MinValue)
                {
                    if (await Contract.IsLegallyBinding(false, true, this))
                    {
                        Contract.State = ContractState.Signed;
                        Contract.From = Contract.Created;
 
                        if (Contract.Duration.HasValue)
                            Contract.To = Contract.From + Contract.Duration.Value;
                        else
                            Contract.To = Contract.From;
 
                        GeoPublish = true;
                        Signed = true;
                    }
                    else
                        Contract.State = ContractState.BeingSigned;
                }
 
                await Contract.Sign(this);
 
                await Database.Update(Contract);
 
                if (Contract.CanActAsTemplate)
                    await RuntimeCounters.IncrementCounter("Legal.Template." + Contract.State.ToString());
                else
                    await RuntimeCounters.IncrementCounter("Legal.Contract." + Contract.State.ToString());
 
                ContractSignature ContractSignature = new ContractSignature()
                {
                    ContractId = Contract.ContractId,
                    LegalId = Identity.Id,
                    BareJid = e.From.BareJid
                };
 
                await Database.Insert(ContractSignature);
 
                Log.Informational("Contract signed as " + Role.Value + ".",
                    Contract.ContractId.Value, Identity.Id.Value, "ContractSigned",
                    new KeyValuePair<string, object>("BareJid", e.From.BareJid.Value),
                    new KeyValuePair<string, object>("Role", Role.Value),
                    new KeyValuePair<string, object>("Transferable", Transferable));
 
                Xml.Clear();
                await Contract.Serialize(Xml, true, true, true, true, true, true, true, null, this);
                string ContractXml = Xml.ToString();
                await e.IqResult(ContractXml, e.To);
 
                if (GeoPublish && !(this.geo is null))
                    await this.geo.Publish(Contract);
 
                await this.SendContractSignedNotification(Contract, Identity, Role, Signed, e.From, e.To);
 
                await StateMachineProcessor.ContractSignature(Contract, Role, Identity.Id);
 
                if (Signed)
                    await StateMachineProcessor.ContractSigned(Contract);
 
                try
                {
                    await this.ContractSigned(Contract, true, this.eDaler, this.pubsub);
                }
                catch (Exception ex)
                {
                    Log.Exception(ex, Contract.ContractId.Value, e.From.BareJid.Value);
                }
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal async Task<Contract> SignContract(Contract Contract, bool ContractIsLocked, CaseInsensitiveString Role, bool Transferable,
            byte[] Signature, XmppAddress SignerJid)
        {
            if (Contract.PartsMode == ContractParts.TemplateOnly)
                throw new Exception("Contract is a template only, and cannot be signed.");
 
            switch (Contract.State)
            {
                case ContractState.Obsoleted:
                    throw new Exception("Contract is obsoleted.");
 
                case ContractState.Deleted:
                    throw new Exception("Contract is deleted.");
 
                case ContractState.Proposed:
                    throw new Exception("Contract is not yet approved to be signed.");
 
                case ContractState.Rejected:
                    throw new Exception("Contract proposal has been rejected.");
 
                case ContractState.Failed:
                    throw new Exception("Contract proposal has failed.");
            }
 
            DateTime UtcNow = DateTime.UtcNow;
            if (Contract.SignAfter.HasValue && UtcNow < Contract.SignAfter.Value.ToUniversalTime())
                throw new Exception("Contract will be open for signatures after " + Contract.SignAfter.Value.ToUniversalTime().ToString() + " (UTC)");
 
            if (Contract.SignBefore.HasValue && UtcNow > Contract.SignBefore.Value.ToUniversalTime())
                throw new Exception("Contract closed for signatures as of " + Contract.SignBefore.Value.ToUniversalTime().ToString() + " (UTC)");
 
            KeyValuePair<Parameter, string> P = await Contract.CheckParameters(this, false);
            Parameter FailingParameter = P.Key;
 
            if (!(FailingParameter is null))
                throw new Exception("Contract parameter " + FailingParameter.Name + " contains invalid value: " + P.Value);
 
            int NrSignaturesForRole = 0;
            bool RoleFound = false;
 
            if (!(Contract.ClientSignatures is null))
            {
                foreach (ClientSignature ClientSignature in Contract.ClientSignatures)
                {
                    if (ClientSignature.Role == Role)
                        NrSignaturesForRole++;
                }
            }
 
            if (!(Contract.Roles is null))
            {
                foreach (Role Role2 in Contract.Roles)
                {
                    if (Role2.Name == Role)
                    {
                        if (NrSignaturesForRole >= Role2.MaxCount)
                            throw new Exception("No more signatures of specified role allowed.");
 
                        RoleFound = true;
                        break;
                    }
                }
            }
 
            if (!RoleFound)
                throw new Exception("No such role defined in contract.");
 
            StringBuilder Xml = new StringBuilder();
            await Contract.Serialize(Xml, false, false, false, false, false, false, false, null, this);
            byte[] Data = Encoding.UTF8.GetBytes(Xml.ToString());
 
            InternalProcessing Request = new InternalProcessing(string.Empty);
            (LegalIdentity Identity, Dictionary<string, string> AttachmentUrls) =
                await this.ValidateSenderSignature(SignerJid, Request, UtcNow, Data,
                Signature, null); // TODO: Authorize access to requestor attachments
 
            if (Identity is null)
            {
                string Msg = Request.ErrorMessage;
                if (string.IsNullOrEmpty(Msg))
                    Msg = "Unable to validate sender signature.";
 
                throw new Exception(Msg);
            }
 
            if (Contract.PartsMode == ContractParts.ExplicitlyDefined)
            {
                bool InList = false;
 
                if (!(Contract.Parts is null))
                {
                    foreach (Part Part in Contract.Parts)
                    {
                        if (Part.LegalId == Identity.Id && Part.Role == Role)
                        {
                            InList = true;
                            break;
                        }
                    }
                }
 
                if (!InList)
                    throw new Exception("Legal identity not in explicitly defined list of parts in contract.");
            }
 
            if (!(Contract.ClientSignatures is null))
            {
                foreach (ClientSignature ClientSignature in Contract.ClientSignatures)
                {
                    if (ClientSignature.LegalId == Identity.Id && ClientSignature.Role == Role)
                        return Contract; // Contract already signed. Return successful response without altering the contract.
                }
            }
 
            DateTime SignatureTimestamp = DateTime.UtcNow;
            string s = await Contract.TrySetRoleParameters(Role, NrSignaturesForRole + 1,
                Identity, SignatureTimestamp, Signature, AttachmentUrls, this);
 
            if (!string.IsNullOrEmpty(s))
                throw new Exception("Legal identity does not have required property " + s + " defined.");
 
            int c = (Contract.ClientSignatures?.Length ?? 0) + 1;
            ClientSignature[] Signatures = new ClientSignature[c];
 
            Contract.ClientSignatures?.CopyTo(Signatures, 0);
            Signatures[c - 1] = new ClientSignature()
            {
                BareJid = SignerJid.BareJid,
                LegalId = Identity.Id,
                Role = Role,
                DigitalSignature = Signature,
                Timestamp = SignatureTimestamp,
                Transferable = Transferable
            };
 
            Contract.ClientSignatures = Signatures;
 
            bool GeoPublish = false;
            bool Signed = false;
 
            if (Contract.From == DateTime.MinValue)
            {
                if (await Contract.IsLegallyBinding(false, true, this))
                {
                    Contract.State = ContractState.Signed;
                    Contract.From = Contract.Created;
 
                    if (Contract.Duration.HasValue)
                        Contract.To = Contract.From + Contract.Duration.Value;
                    else
                        Contract.To = Contract.From;
 
                    GeoPublish = true;
                    Signed = true;
                }
                else
                    Contract.State = ContractState.BeingSigned;
            }
 
            await Contract.Sign(this);
 
            await Database.Update(Contract);
 
            if (Contract.CanActAsTemplate)
                await RuntimeCounters.IncrementCounter("Legal.Template." + Contract.State.ToString());
            else
                await RuntimeCounters.IncrementCounter("Legal.Contract." + Contract.State.ToString());
 
            ContractSignature ContractSignature = new ContractSignature()
            {
                ContractId = Contract.ContractId,
                LegalId = Identity.Id,
                BareJid = SignerJid.BareJid
            };
 
            await Database.Insert(ContractSignature);
 
            Log.Informational("Contract signed as " + Role.Value + ".",
                Contract.ContractId.Value, Identity.Id.Value, "ContractSigned",
                new KeyValuePair<string, object>("BareJid", SignerJid.BareJid.Value),
                new KeyValuePair<string, object>("Role", Role.Value),
                new KeyValuePair<string, object>("Transferable", Transferable));
 
            if (GeoPublish && !(this.geo is null))
                await this.geo.Publish(Contract);
 
            await this.SendContractSignedNotification(Contract, Identity, Role, Signed, SignerJid, this.MainDomain);
 
            await StateMachineProcessor.ContractSignature(Contract, Role, Identity.Id);
 
            if (Signed)
                await StateMachineProcessor.ContractSigned(Contract);
 
            try
            {
                await this.ContractSigned(Contract, ContractIsLocked, this.eDaler, this.pubsub);
            }
            catch (Exception ex)
            {
                Log.Exception(ex, Contract.ContractId.Value, SignerJid.BareJid.Value);
            }
 
            return Contract;
        }
 
        private async Task SendContractSignedNotification(Contract Contract, LegalIdentity Identity,
            string Role, bool Signed, XmppAddress SignerJid, XmppAddress Sender)
        {
            try
            {
                string ContractNamespace = NamespaceSmartContracts(Contract.Version);
                Dictionary<CaseInsensitiveString, KeyValuePair<string, bool>> StatusRecipients = new Dictionary<CaseInsensitiveString, KeyValuePair<string, bool>>()
                {
                    { Contract.Account + "@" + this.Server.Domain, new KeyValuePair<string, bool>(ContractNamespace, false) }
                };
 
                XmppAddress Addr = new XmppAddress(Contract.TemplateId);
 
                if (!this.Server.IsServerDomain(Addr.Domain, true))
                {
                    KeyValuePair<CaseInsensitiveString, string> P2 = await this.GetComponent(Addr.Domain, NamespacesSmartContracts);
                    CaseInsensitiveString Component = P2.Key;
                    if (!CaseInsensitiveString.IsNullOrEmpty(Component))
                        StatusRecipients[Component] = new KeyValuePair<string, bool>(P2.Value, true);
                }
 
                if (!(Contract.Parameters is null))
                {
                    foreach (Parameter Parameter in Contract.Parameters)
                    {
                        if (Parameter is ContractReferenceParameter ContractReferenceParameter &&
                            !CaseInsensitiveString.IsNullOrEmpty(ContractReferenceParameter.Value))
                        {
                            Addr = new XmppAddress(ContractReferenceParameter.Value);
 
                            if (!this.Server.IsServerDomain(Addr.Domain, true))
                            {
                                KeyValuePair<CaseInsensitiveString, string> P2 = await this.GetComponent(Addr.Domain, NamespacesSmartContracts);
                                CaseInsensitiveString Component = P2.Key;
                                if (!CaseInsensitiveString.IsNullOrEmpty(Component))
                                    StatusRecipients[Component] = new KeyValuePair<string, bool>(P2.Value, true);
                            }
                        }
                    }
                }
 
                if (!(Contract.ClientSignatures is null))
                {
                    foreach (ClientSignature ClientSignature in Contract.ClientSignatures)
                    {
                        StatusRecipients[ClientSignature.BareJid] = new KeyValuePair<string, bool>(ContractNamespace, false);
 
                        Addr = new XmppAddress(ClientSignature.BareJid);
 
                        if (!this.Server.IsServerDomain(Addr.Domain, true))
                        {
                            KeyValuePair<CaseInsensitiveString, string> P2 = await this.GetComponent(Addr.Domain, NamespacesSmartContracts);
                            CaseInsensitiveString Component = P2.Key;
                            if (!CaseInsensitiveString.IsNullOrEmpty(Component))
                                StatusRecipients[Component] = new KeyValuePair<string, bool>(P2.Value, true);
                        }
                    }
                }
 
                if (StatusRecipients.Count > 0)
                {
                    StringBuilder Xml = new StringBuilder();
                    await Contract.Serialize(Xml, false, true, true, true, true, true, true, null, this);
                    string ContractXml = Xml.ToString();
 
                    foreach (KeyValuePair<CaseInsensitiveString, KeyValuePair<string, bool>> P3 in StatusRecipients)
                    {
                        CaseInsensitiveString StatusRecipient = P3.Key;
                        string Namespace = P3.Value.Key;
                        bool IsComponent = P3.Value.Value;
                        Xml.Clear();
 
                        Xml.Append("<contractSigned xmlns='");
                        Xml.Append(Namespace);
                        Xml.Append("' contractId='");
                        Xml.Append(XML.Encode(Contract.ContractId));
                        Xml.Append("' legalId='");
                        Xml.Append(XML.Encode(Identity.Id));
                        Xml.Append("' role='");
                        Xml.Append(XML.Encode(Role));
 
                        if (Signed)
                            Xml.Append("' signed='true");
 
                        Xml.Append("'>");
                        Xml.Append(ContractXml);
                        Xml.Append("</contractSigned>");
 
                        string Event = Xml.ToString();
 
                        try
                        {
                            if (IsComponent)
                            {
                                await this.Server.SendIqRequest("set", Sender, new XmppAddress(StatusRecipient),
                                    string.Empty, Event, false, (_, e) =>
                                    {
                                        if (e.Ok &&
                                            !(e.FirstElement is null) &&
                                            e.FirstElement.LocalName == "authorizeJid" &&
                                            IsNamespaceSmartContract(e.FirstElement.NamespaceURI))
                                        {
                                            string Jid = XML.Attribute(e.FirstElement, "jid");
 
                                            if (!string.IsNullOrEmpty(Jid))
                                            {
                                                this.ContractAuthorization(Jid, SignerJid.BareJid,
                                                    Contract.ContractId, true);
 
                                                if (!(Contract.ClientSignatures is null))
                                                {
                                                    foreach (ClientSignature Signature in Contract.ClientSignatures)
                                                    {
                                                        XmppAddress Addr = new XmppAddress(Signature.LegalId);
 
                                                        if (this.IsComponentDomain(Addr.Domain, true))
                                                            this.IdentityAuthorization(Jid, SignerJid.BareJid, Signature.LegalId, true);
                                                    }
                                                }
                                            }
                                        }
 
                                        return Task.CompletedTask;
                                    }, null);
                            }
                            else
                            {
                                this.ContractAuthorization(StatusRecipient, SignerJid.BareJid,
                                    Contract.ContractId, true);
 
                                if (!(Contract.ClientSignatures is null))
                                {
                                    foreach (ClientSignature Signature in Contract.ClientSignatures)
                                    {
                                        XmppAddress Addr2 = new XmppAddress(Signature.LegalId);
 
                                        if (this.IsComponentDomain(Addr2.Domain, true))
                                            this.IdentityAuthorization(StatusRecipient, SignerJid.BareJid, Signature.LegalId, true);
                                    }
                                }
 
                                await this.Server.SendMessage(string.Empty, string.Empty, Sender, new XmppAddress(StatusRecipient),
                                    string.Empty, Event);
                            }
                        }
                        catch (Exception ex)
                        {
                            Log.Exception(ex, Contract.ContractId.Value, SignerJid.BareJid.Value);
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                Log.Exception(ex, Contract.ContractId.Value, SignerJid.BareJid.Value);
            }
        }
 
        private async Task ContractSigned(Contract Contract, bool ContractIsLocked,
            EDalerComponent EDaler, PubSubComponent PubSub)
        {
            if (!(this.transientParameters?.TryGetValue(Contract.ContractId,
                out Dictionary<CaseInsensitiveString, Parameter> TransientParameters) ?? false))
            {
                TransientParameters = null;
            }
 
            switch (Contract.ForMachinesNamespace)
            {
                case MarketplaceProcessor.MarketplaceNamespace:
                    await MarketplaceProcessor.ContractSigned(Contract, ContractIsLocked,
                        TransientParameters, this, EDaler, PubSub);
                    break;
 
                case NeuroFeaturesProcessor.NeuroFeaturesNamespace:
                    await NeuroFeaturesProcessor.ContractSigned(Contract, ContractIsLocked,
                        TransientParameters, this, EDaler);
                    break;
 
                case PaiwiseProcessor.PaymentInstructionsNamespace:
                    await PaiwiseProcessor.ContractSigned(Contract, ContractIsLocked,
                        TransientParameters, this, EDaler);
                    break;
            }
 
            if (Contract.State == ContractState.Signed)
            {
                foreach (Payment Payment in await Database.Find<Payment>(
                    new FilterFieldEqualTo("ConditionContractId", Contract.ContractId)))
                {
                    if (!Payment.Processed.HasValue)
                        PaiwiseProcessor.QueueForProcessing(Payment, EDaler);
                }
            }
        }
 
        internal async Task<LegalIdentity> ValidateLocalSenderSignature(XmppAddress Sender, IqEventArgs e, DateTime Timestamp, Stream Data, byte[] Signature)
        {
            if (this.Server.IsServerDomain(Sender.Domain, true))
            {
                foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                    new FilterFieldEqualTo("Account", Sender.Account),
                    new FilterFieldEqualTo("State", Legal.Identity.IdentityState.Approved),
                    new FilterFieldLesserOrEqualTo("From", Timestamp),
                    new FilterFieldGreaterOrEqualTo("To", Timestamp)), "-Created"))
                {
                    if (ID.ValidateSignature(Data, Signature))
                        return ID;
                }
 
                e?.IqErrorForbidden(e.To, "Signature proving access to private keys not correct.", "en");
            }
            else
                e?.IqErrorForbidden(e.To, "Sender must correspond to an account on the local machine.", "en");
 
            return null;
        }
 
        internal async Task<(LegalIdentity, Dictionary<string, string>)> ValidateSenderSignature(XmppAddress Sender,
            EDalerUriState Request, DateTime Timestamp, byte[] Data, byte[] Signature, string ForBareJid)
        {
            LegalIdentity Identity = null;
            Dictionary<string, string> AttachmentUrls = null;
 
            if (this.Server.IsServerDomain(Sender.Domain, true))
            {
                bool IdFound = false;
 
                foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                    new FilterFieldEqualTo("Account", Sender.Account),
                    new FilterFieldEqualTo("State", Legal.Identity.IdentityState.Approved),
                    new FilterFieldLesserOrEqualTo("From", Timestamp.ToUniversalTime()),
                    new FilterFieldGreaterOrEqualTo("To", Timestamp.ToUniversalTime())), "-Created"))
                {
                    IdFound = true;
 
                    if (ID.ValidateSignature(Data, Signature))
                    {
                        if (!string.IsNullOrEmpty(ForBareJid))
                            this.IdentityAuthorization(ForBareJid, Sender.BareJid, ID.Id, true);
 
                        Identity = ID;
                        AttachmentUrls = this.GetAttachmentUrls(ID);
                        break;
                    }
                }
 
                if (!IdFound)
                {
                    Request?.Error(EDalerUriErrorType.ServiceUnavailable, "No approved legal identities found for " +
                        Sender.BareJid + ".", false);
 
                    return (null, null);
                }
            }
            else
            {
                KeyValuePair<CaseInsensitiveString, string> P = await this.GetComponent(Sender.Domain, NamespacesLegalIdentity);
                CaseInsensitiveString RemoteLegalComponent = P.Key;
                string RemoteNamespace = P.Value;
                NamespaceSet RemoteVersion = XmppServerModule.GetVersion(RemoteNamespace);
 
                if (CaseInsensitiveString.IsNullOrEmpty(RemoteLegalComponent))
                {
                    Request?.Error(EDalerUriErrorType.ServiceUnavailable, this.MainDomain.Address + " could not find legal component of " + Sender.Domain + ", to validate signature.", false);
                    return (null, null);
                }
 
                if (!Gateway.HasDomain && !(Gateway.ContractsClient is null))   // Development mode. S2S connections not available. Need to perform validation using C2S.
                {
                    Networking.XMPP.Contracts.LegalIdentity Identity2 = await Gateway.ContractsClient.ValidateSignatureAsync(string.Empty, Data, Signature);
                    if (Identity2 is null)
                    {
                        Request?.Error(EDalerUriErrorType.Forbidden, "Signature does not match any of the approved legal identities of " +
                            Sender.BareJid + ".", false);
                    }
 
                    StringBuilder sb = new StringBuilder();
                    Identity2.Serialize(sb, true, true, true, true, true, true, true);
 
                    XmlDocument Doc = XML.ParseXml(sb.ToString(), true);
 
                    Identity = LegalIdentity.Parse(Doc.DocumentElement, out _, out AttachmentUrls);
                }
                else
                {
                    IqResultEventArgs e2 = await this.ValidateRemoteSignature(RemoteLegalComponent, Sender.BareJid, Data, Signature, ForBareJid, RemoteVersion);
                    if (e2 is null)
                    {
                        Request?.Error(EDalerUriErrorType.ServiceUnavailable, this.MainDomain.Address + " was unable to validate remote signature.", false);
                        return (null, null);
                    }
 
                    if (!e2.Ok || e2.FirstElement is null)
                    {
                        Request?.Error(e2.ErrorTypeString, e2.ErrorElement?.OuterXml ?? string.Empty, e2.ErrorText);
                        return (null, null);
                    }
 
                    Identity = LegalIdentity.Parse(e2.FirstElement, out bool _, out AttachmentUrls);
                }
            }
 
            if (Identity is null)
            {
                Request?.Error(EDalerUriErrorType.Forbidden, "Signature does not match any of the approved legal identities of " +
                    Sender.BareJid + ".", false);
            }
 
            return (Identity, AttachmentUrls);
        }
 
        internal Dictionary<string, string> GetAttachmentUrls(LegalIdentity Identity)
        {
            if (Identity.Attachments is null)
                return null;
 
            Dictionary<string, string> Urls = new Dictionary<string, string>();
 
            foreach (AttachmentReference Ref in Identity.Attachments)
                Urls[Ref.Id] = Gateway.GetUrl("/Attachments/" + Ref.Id.Value, this.HttpServer);
 
            return Urls;
        }
 
        internal async Task<(LegalIdentity, Dictionary<string, string>)> ValidateSignature(XmppAddress Signatory, DateTime Timestamp, byte[] Data,
            byte[] Signature)
        {
            LegalIdentity Identity = null;
            Dictionary<string, string> AttachmentUrls;
 
            if (this.Server.IsServerDomain(Signatory.Domain, true))
            {
                foreach (LegalIdentity ID in await Database.Find<LegalIdentity>(new FilterAnd(
                    new FilterFieldEqualTo("Account", Signatory.Account),
                    new FilterFieldEqualTo("State", Legal.Identity.IdentityState.Approved),
                    new FilterFieldLesserOrEqualTo("From", Timestamp),
                    new FilterFieldGreaterOrEqualTo("To", Timestamp)), "-Created"))
                {
                    if (ID.ValidateSignature(Data, Signature))
                    {
                        Identity = ID;
                        AttachmentUrls = this.GetAttachmentUrls(ID);
                        break;
                    }
                }
 
                AttachmentUrls = null;
            }
            else
            {
                KeyValuePair<CaseInsensitiveString, string> P = await this.GetComponent(Signatory.Domain, NamespacesLegalIdentity);
                CaseInsensitiveString RemoteLegalComponent = P.Key;
 
                if (CaseInsensitiveString.IsNullOrEmpty(RemoteLegalComponent))
                    return (null, null);
 
                NamespaceSet RemoteVersion = XmppServerModule.GetVersion(RemoteLegalComponent);
 
                IqResultEventArgs e2 = await this.ValidateRemoteSignature(RemoteLegalComponent, Signatory.BareJid, Data, Signature, null, RemoteVersion);
                if (e2 is null || !e2.Ok || e2.FirstElement is null)
                    return (null, null);
 
                Identity = LegalIdentity.Parse(e2.FirstElement, out _, out AttachmentUrls);
            }
 
            return (Identity, AttachmentUrls);
        }
 
        private async Task<IqResultEventArgs> ValidateRemoteSignature(string RemoteLegalComponent, string BareJid, byte[] Data, byte[] Signature,
            string ForBareJid, NamespaceSet Version)
        {
            TaskCompletionSource<IqResultEventArgs> T = new TaskCompletionSource<IqResultEventArgs>();
            StringBuilder Xml = new StringBuilder();
 
            Xml.Clear();
            Xml.Append("<validateSignature data=\"");
            Xml.Append(Convert.ToBase64String(Data));
            Xml.Append("\" s=\"");
            Xml.Append(Convert.ToBase64String(Signature));
            Xml.Append("\" bareJid=\"");
            Xml.Append(XML.Encode(BareJid));
 
            if (!string.IsNullOrEmpty(ForBareJid))
            {
                Xml.Append("\" for=\"");
                Xml.Append(XML.Encode(ForBareJid));
            }
 
            Xml.Append("\" xmlns=\"");
            Xml.Append(NamespaceLegalIdentity(Version));
            Xml.Append("\"/>");
 
            if (!await this.Server.SendIqRequest("get", this.MainDomain, new XmppAddress(RemoteLegalComponent), string.Empty,
                Xml.ToString(), true, (sender2, e2) =>
                {
                    T.TrySetResult(e2);
                    return Task.CompletedTask;
                }, null))
            {
                return null;
            }
 
            return await T.Task;
        }
 
        private async Task ContractSignedHandler(object Sender, IqEventArgs e)
        {
            CaseInsensitiveString ContractId = XML.Attribute(e.Query, "contractId");
            CaseInsensitiveString LegalId = XML.Attribute(e.Query, "legalId");
            string Role = XML.Attribute(e.Query, "role");
            bool Signed = XML.Attribute(e.Query, "signed", false);
 
            XmppAddress ContractAddress = new XmppAddress(ContractId);
 
            if (ContractAddress.Domain != e.From.Address)
            {
                await e.IqErrorForbidden(e.To, "Sender not responsible for contract.", "en");
                return;
            }
 
            XmppAddress LegalAddress = new XmppAddress(LegalId);
            bool LocalLegalId = this.IsComponentDomain(LegalAddress.Domain, true);
 
            Contract Contract = null;
 
            foreach (XmlNode N in e.Query.ChildNodes)
            {
                if (N is XmlElement E && E.LocalName == "contract" && IsNamespaceSmartContract(E.NamespaceURI))
                {
                    ParsedContract Parsed = await Contract.Parse(E, this);
                    Contract = Parsed?.Contract;
 
                    if (Contract is null)
                    {
                        await e.IqErrorBadRequest(e.To, "Unable to parse embedded contract.", "en");
                        return;
                    }
 
                    break;
                }
            }
 
            if (Contract is null)
            {
                KeyValuePair<Contract, IqResultEventArgs> P = await this.GetContract(ContractId);
                Contract = P.Key;
 
                if (Contract is null)
                {
                    if (string.IsNullOrEmpty(P.Value?.ErrorText))
                        await e.IqErrorItemNotFound(e.To, "Unable to get contract.", "en");
                    else
                        await e.IqErrorItemNotFound(e.To, "Unable to get contract: " + P.Value.ErrorText, "en");
 
                    return;
                }
            }
 
            if (Contract.ClientSignatures is null)
            {
                await e.IqErrorBadRequest(e.To, "No recorded client signatures in contract.", "en");
                return;
            }
 
            CaseInsensitiveString BareJid = null;
 
            foreach (ClientSignature Signature in Contract.ClientSignatures)
            {
                if (Signature.LegalId == LegalId)
                {
                    BareJid = Signature.BareJid;
                    break;
                }
            }
 
            if (BareJid is null)
            {
                await e.IqErrorForbidden(e.To, "Legal Identity not in list of client signatures.", "en");
                return;
            }
 
            if (Gateway.ContractsClient is null)
            {
                if (!await this.ValidateServerSignature(Contract))
                {
                    await e.IqErrorForbidden(e.To, "Server signature not valid.", "en");
                    return;
                }
 
                await e.IqResult(string.Empty, e.To);
                await this.ProcessContractSignature(LocalLegalId, Contract, LegalId, BareJid,
                    Role, Signed);
            }
            else
            {
                Networking.XMPP.Contracts.Contract ClientContract = await this.ToClientContract(Contract);
                if (ClientContract is null)
                {
                    await e.IqErrorBadRequest(e.To, "Unable to prepare embedded contract for validation.", "en");
                    return;
                }
 
                StringBuilder sb = new StringBuilder();
 
                sb.Append("<authorizeJid jid='");
                sb.Append(XML.Encode(Gateway.XmppClient.BareJID));
                sb.Append("' xmlns='");
                sb.Append(XML.Encode(e.Query.NamespaceURI));
                sb.Append("'/>");
 
                await e.IqResult(sb.ToString(), e.To);
 
                this.ContractSignedHandlerValidateContract(LocalLegalId, Contract, LegalId,
                    BareJid, Role, Signed, ClientContract);
            }
        }
 
        private async Task ProcessContractSignature(bool LocalLegalId, Contract Contract,
            CaseInsensitiveString LegalId, CaseInsensitiveString BareJid, string Role,
            bool Signed)
        {
            if (LocalLegalId)
            {
                ContractSignature ContractSignature = new ContractSignature()
                {
                    ContractId = Contract.ContractId,
                    LegalId = LegalId,
                    BareJid = BareJid
                };
 
                await Database.Insert(ContractSignature);
            }
 
            await StateMachineProcessor.ContractSignature(Contract, Role, LegalId);
 
            if (Signed)
                await StateMachineProcessor.ContractSigned(Contract);
        }
 
        private async void ContractSignedHandlerValidateContract(bool LocalLegalId,
            Contract Contract, CaseInsensitiveString LegalId, CaseInsensitiveString BareJid,
            string Role, bool Signed, Networking.XMPP.Contracts.Contract ClientContract)
        {
            try
            {
                Networking.XMPP.Contracts.EventArguments.ContractValidationEventArgs e2;
                Networking.XMPP.Contracts.ContractStatus Status;
                int DelayMs = 5000;
                bool First = true;
 
                do
                {
                    if (First)
                        First = false;
                    else
                    {
                        await Task.Delay(DelayMs);
 
                        if (DelayMs < 1000 * 60 * 60)   // 1h
                            DelayMs <<= 1;              // Max will be 1.422222... h
                    }
 
                    e2 = await Gateway.ContractsClient.ValidateAsync(ClientContract);
                    Status = e2.Status;
                }
                while (Status == Networking.XMPP.Contracts.ContractStatus.NoResponse);
 
                switch (Status)
                {
                    case Networking.XMPP.Contracts.ContractStatus.ContractUndefined:
                    case Networking.XMPP.Contracts.ContractStatus.NotApproved:
                    case Networking.XMPP.Contracts.ContractStatus.NotValidYet:
                    case Networking.XMPP.Contracts.ContractStatus.NotValidAnymore:
                    case Networking.XMPP.Contracts.ContractStatus.TemplateOnly:
                    case Networking.XMPP.Contracts.ContractStatus.HumanReadableNotWellDefined:
                    case Networking.XMPP.Contracts.ContractStatus.ParameterValuesNotValid:
                    case Networking.XMPP.Contracts.ContractStatus.MachineReadableNotWellDefined:
                    case Networking.XMPP.Contracts.ContractStatus.NoSchemaAccess:
                    case Networking.XMPP.Contracts.ContractStatus.CorruptSchema:
                    case Networking.XMPP.Contracts.ContractStatus.FraudulentSchema:
                    case Networking.XMPP.Contracts.ContractStatus.FraudulentMachineReadable:
                    case Networking.XMPP.Contracts.ContractStatus.NoClientSignatures:
                    case Networking.XMPP.Contracts.ContractStatus.ClientSignatureInvalid:
                    case Networking.XMPP.Contracts.ContractStatus.ClientSignatureNotValidated:
                    case Networking.XMPP.Contracts.ContractStatus.ClientIdentityInvalid:
                    case Networking.XMPP.Contracts.ContractStatus.AttachmentLacksUrl:
                    case Networking.XMPP.Contracts.ContractStatus.AttachmentUnavailable:
                    case Networking.XMPP.Contracts.ContractStatus.AttachmentInconsistency:
                    case Networking.XMPP.Contracts.ContractStatus.AttachmentSignatureInvalid:
                    case Networking.XMPP.Contracts.ContractStatus.NoTrustProvider:
                    case Networking.XMPP.Contracts.ContractStatus.NoProviderPublicKey:
                    case Networking.XMPP.Contracts.ContractStatus.NoProviderSignature:
                    case Networking.XMPP.Contracts.ContractStatus.ProviderSignatureInvalid:
                    case Networking.XMPP.Contracts.ContractStatus.ProviderKeyNotRecognized:
                    case Networking.XMPP.Contracts.ContractStatus.NoResponse:
                        Log.Warning("Client signature message ignored. Contract validation failed.",
                            e2.Tags.Join(
                                new KeyValuePair<string, object>("Status", Status),
                                new KeyValuePair<string, object>("ContractId", Contract.ContractId.Value),
                                new KeyValuePair<string, object>("LegalId", LegalId.Value),
                                new KeyValuePair<string, object>("LocalLegalId", LocalLegalId),
                                new KeyValuePair<string, object>("BareJid", BareJid.Value),
                                new KeyValuePair<string, object>("Role", Role),
                                new KeyValuePair<string, object>("Signed", Signed)));
                        return;
 
                    case Networking.XMPP.Contracts.ContractStatus.NotLegallyBinding:
                        if (Signed)
                        {
                            Log.Warning("Client signature message ignored. Contract validation failed.",
                                e2.Tags.Join(
                                    new KeyValuePair<string, object>("Status", Status),
                                    new KeyValuePair<string, object>("ContractId", Contract.ContractId.Value),
                                    new KeyValuePair<string, object>("LegalId", LegalId.Value),
                                    new KeyValuePair<string, object>("LocalLegalId", LocalLegalId),
                                    new KeyValuePair<string, object>("BareJid", BareJid.Value),
                                    new KeyValuePair<string, object>("Role", Role),
                                    new KeyValuePair<string, object>("Signed", Signed)));
                            return;
                        }
                        break;
 
                    case Networking.XMPP.Contracts.ContractStatus.Valid:
                        await this.ProcessContractSignature(LocalLegalId, Contract, LegalId, BareJid,
                            Role, Signed);
                        break;
                }
            }
            catch (Exception ex)
            {
                Log.Warning("Client signature message ignored. Contract validation failed: " + ex.Message);
                return;
            }
        }
 
        private async Task FailContractHandler(object Sender, MessageEventArgs e)
        {
            CaseInsensitiveString ContractId = XML.Attribute(e.Content, "contractId");
            string Reason = XML.Attribute(e.Content, "reason");
 
            if (!e.From.IsDomain)
            {
                Log.Warning("Contract failure message ignored. Sender not a broker.");
                return;
            }
 
            XmppAddress ContractAddress = new XmppAddress(ContractId);
 
            if (!this.IsComponentDomain(ContractAddress.Domain, true))
            {
                Log.Warning("Contract failure message ignored. Contract not hosted on broker.");
                return;
            }
 
            KeyValuePair<Contract, IqResultEventArgs> P = await this.GetContract(ContractId);
            Contract Contract = P.Key;
            if (Contract is null)
            {
                if (string.IsNullOrEmpty(P.Value?.ErrorText))
                    Log.Warning("Contract failure message ignored. Contract not found.");
                else
                    Log.Warning("Contract failure message ignored: " + P.Value.ErrorText);
 
                return;
            }
 
            bool LegitimateSender = false;
            XmppAddress Addr;
 
            if (!CaseInsensitiveString.IsNullOrEmpty(Contract.TemplateId))
            {
                Addr = new XmppAddress(Contract.TemplateId.Value);
                LegitimateSender = Addr.Domain == e.From.Address;
            }
 
            if (!LegitimateSender && !(Contract.Parameters is null))
            {
                foreach (Parameter Parameter in Contract.Parameters)
                {
                    if (Parameter is ContractReferenceParameter ContractReferenceParameter)
                    {
                        Addr = new XmppAddress(ContractReferenceParameter.Value.Value);
                        if (Addr.Domain == e.From.Address)
                        {
                            LegitimateSender = true;
                            break;
                        }
                    }
                }
            }
 
            if (!LegitimateSender && !(Contract.ClientSignatures is null))
            {
                foreach (ClientSignature Signature in Contract.ClientSignatures)
                {
                    Addr = new XmppAddress(Signature.LegalId);
                    if (Addr.Domain == e.From.Address)
                    {
                        LegitimateSender = true;
                        break;
                    }
                }
            }
 
            if (!LegitimateSender)
            {
                Log.Warning("Contract failure message ignored. Not a legitimate sender.");
                return;
            }
 
            await NeuroFeaturesProcessor.RejectContract(Contract, false, Reason, true, this, this.eDaler);
        }
 
        internal async Task<Networking.XMPP.Contracts.Contract> ToClientContract(Contract Contract)
        {
            StringBuilder sb = new StringBuilder();
            await Contract.Serialize(sb, true, true, true, true, true, true, true, null, this);
 
            string ContractXml = sb.ToString();
            XmlDocument Xml = XML.ParseXml(ContractXml, true);
 
            // Note: Call XmlElement overload to avoid XSL validation and namespace version conflicts.
            Networking.XMPP.Contracts.ParsedContract Parsed = await Networking.XMPP.Contracts.Contract.Parse(Xml.DocumentElement, Gateway.ContractsClient, true);
 
            return Parsed.Contract;
        }
 
        private async Task<bool> ValidateServerSignature(Contract Contract)
        {
            if (Contract.ServerSignature is null ||
                Contract.ServerSignature.DigitalSignature is null)
            {
                return false;
            }
 
            StringBuilder Xml = new StringBuilder();
            await Contract.Serialize(Xml, false, true, true, true, true, false, false, null, this);
            byte[] Data = Encoding.UTF8.GetBytes(Xml.ToString());
            XmppAddress ContractAddress = new XmppAddress(Contract.ContractId);
 
            return await this.ValidateServerSignature(ContractAddress.Domain, Data,
                Contract.ServerSignature.DigitalSignature,
                Contract.ServerSignature.Timestamp);
        }
 
        public async Task<bool> ValidateServerSignature(CaseInsensitiveString ServerDomain,
            byte[] Data, byte[] Signature, DateTime Timestamp)
        {
            if (this.IsComponentDomain(ServerDomain, true))
                return LedgerConfiguration.Verify(Data, Signature);
            else
            {
                IE2eEndpoint PubKey = await this.GetPublicKey(ServerDomain, Timestamp);
                return PubKey.Verify(Data, Signature);
            }
        }
 
        public async Task<IE2eEndpoint> GetPublicKey(string ServerDomain, DateTime Timestamp)
        {
            string Key = ServerDomain + "|pub";
 
            if (this.remoteComponents.TryGetValue(Key, out object Obj) &&
                Obj is PublicKeyRecords Records &&
                Records.TryGetRecord(Timestamp, out IE2eEndpoint PubKey))
            {
                return PubKey;
            }
 
            TaskCompletionSource<IE2eEndpoint> Result = new TaskCompletionSource<IE2eEndpoint>();
            string Namespace = NamespaceLegalIdentity(NamespaceSet.Current);
            StringBuilder sb = new StringBuilder();
 
            sb.Append("<getPublicKey xmlns=\"");
            sb.Append(Namespace);
            sb.Append("\" ts=\"");
            sb.Append(XML.Encode(Timestamp));
            sb.Append("\"/>");
 
            await this.Server.SendIqRequest("get", this.MainDomain, new XmppAddress(ServerDomain), string.Empty,
                sb.ToString(), true, (Sender, e) =>
                {
                    IE2eEndpoint ServerKey = null;
                    XmlElement E;
 
                    if (e.Ok &&
                        !((E = e.FirstElement) is null) &&
                        E.LocalName == "publicKey" &&
                        E.NamespaceURI == Namespace)
                    {
                        DateTime From = XML.Attribute(E, "from", DateTime.MinValue);
                        DateTime? To = E.HasAttribute("to") ?
                            XML.Attribute(E, "to", DateTime.MaxValue) : (DateTime?)null;
 
                        foreach (XmlNode N in E.ChildNodes)
                        {
                            if (N is XmlElement E2)
                            {
                                ServerKey = EndpointSecurity.ParseE2eKey(E2);
                                if (!(ServerKey is null))
                                {
                                    if (!this.remoteComponents.TryGetValue(Key, out object Obj) ||
                                        !(Obj is PublicKeyRecords Records))
                                    {
                                        Records = new PublicKeyRecords();
                                        this.remoteComponents[Key] = Records;
                                    }
 
                                    Records.Add(From, To ?? DateTime.UtcNow, ServerKey);
 
                                    Result.TrySetResult(ServerKey);
                                    return Task.CompletedTask;
                                }
                            }
                        }
                    }
 
                    Result.TrySetResult(null);
                    return Task.CompletedTask;
                }, null);
 
            await Result.Task;
 
            PubKey = Result.Task.Result;
 
            return PubKey;
        }
 
        private async Task GetSignedContractsHandler(object Sender, IqEventArgs e)
        {
            try
            {
                int Offset = XML.Attribute(e.Query, "offset", 0);
                int MaxCount = XML.Attribute(e.Query, "maxCount", int.MaxValue);
                bool References = XML.Attribute(e.Query, "references", true);
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
 
                IEnumerable<ContractSignature> Signatures = await Database.Find<ContractSignature>(Offset, MaxCount,
                    new FilterFieldEqualTo("BareJid", e.From.BareJid), "LegalId", "ContractId");
 
                string Xml = await this.SerializeContractReferences(Signatures, References, QueryVersion);
 
                await e.IqResult(Xml, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task GetContractHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ContractId = XML.Attribute(e.Query, "id");
 
                if (CaseInsensitiveString.IsNullOrEmpty(ContractId))
                {
                    await e.IqErrorBadRequest(e.To, "No Contract ID specified.", "en");
                    return;
                }
 
                // Note: Do not log the contract for reading for simply trying to get
                //       the current state. While the contract is locked for writing
                //       while being signed, external parties may need to get the contract
                //       to validate signatures, for example, for validating signatures
                //       perfor approving payments.
 
                //using (Semaphore Semaphore = await Semaphores.BeginRead("iotsc:" + ContractId.LowerCase))
                {
                    Contract Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                    if (Contract is null)
                    {
                        await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                        return;
                    }
 
                    if (!await Contract.CanRead(e.From, this.Server, this))
                    {
                        this.ContractAuthorization(e.From.BareJid, e.From.BareJid, ContractId, false);
                        await e.IqErrorForbidden(e.To, "Not authorized to access contract.", "en");
                        return;
                    }
 
                    this.ContractAuthorization(e.From.BareJid, e.From.BareJid, ContractId, true);
 
                    StringBuilder Xml = new StringBuilder();
                    await Contract.Serialize(Xml, true, true, true, true, true, true, true, null, this);
                    await e.IqResult(Xml.ToString(), e.To);
                }
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task GetContractsHandler(object Sender, IqEventArgs e)
        {
            try
            {
                StringBuilder Xml = new StringBuilder();
 
                Xml.Append("<contracts xmlns='");
                Xml.Append(e.Query.NamespaceURI);
                Xml.Append("'>");
 
                foreach (XmlNode N in e.Query.ChildNodes)
                {
                    if (N is XmlElement E && E.LocalName == "ref" && E.NamespaceURI == e.Query.NamespaceURI)
                    {
                        CaseInsensitiveString Id = XML.Attribute(E, "id");
                        Contract Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", Id), "Created");
 
                        if (!(Contract is null) &&
                            await Contract.CanRead(e.From, this.Server, this))
                        {
                            this.ContractAuthorization(e.From.BareJid, e.From.BareJid, Id, true);
                            await Contract.Serialize(Xml, true, true, true, true, true, true, true, null, this);
                        }
                        else
                        {
                            if (!(Contract is null))
                                this.ContractAuthorization(e.From.BareJid, e.From.BareJid, Id, false);
 
                            Xml.Append("<ref id='");
                            Xml.Append(XML.Encode(Id));
                            Xml.Append("'/>");
                        }
                    }
                }
 
                Xml.Append("</contracts>");
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task IsPartHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString BareJid = XML.Attribute(e.Query, "bareJid");
 
                if (CaseInsensitiveString.IsNullOrEmpty(BareJid))
                {
                    await e.IqErrorBadRequest(e.To, "No Bare JID specified.", "en");
                    return;
                }
 
                XmppAddress BareAddress = new XmppAddress(BareJid);
                if (!BareAddress.IsBareJID)
                {
                    await e.IqErrorBadRequest(e.To, "Invalid Bare JID.", "en");
                    return;
                }
 
                if (!this.Server.IsServerDomain(BareAddress.Domain, true))
                {
                    await e.IqErrorBadRequest(e.To, "Bare JID not registered on server.", "en");
                    return;
                }
 
                if (!e.From.IsDomain)
                {
                    await e.IqErrorForbidden(e.To, "Not authorized to execute request.", "en");
                    return;
                }
 
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
                KeyValuePair<CaseInsensitiveString, string> P = await this.GetComponent(e.From.Address, NamespacesLegalIdentity);
                CaseInsensitiveString Component = P.Key;
                string Namespace = P.Value;
 
                if (Component != e.From.Address)
                {
                    await e.IqErrorForbidden(e.To, "Not authorized to execute request.", "en");
                    return;
                }
 
                foreach (XmlNode N in e.Query.ChildNodes)
                {
                    if (N is XmlElement E && E.LocalName == "idRef")
                    {
                        CaseInsensitiveString LegalId = XML.Attribute(E, "id");
                        if (CaseInsensitiveString.IsNullOrEmpty(LegalId))
                            continue;
 
                        XmppAddress LegalIdAddress = new XmppAddress(LegalId);
                        if (!this.IsComponentDomain(LegalIdAddress.Domain, true))
                            continue;
 
                        using Semaphore Semaphore = await Semaphores.BeginRead("iotid:" + LegalId.LowerCase);
                        LegalIdentity Identity = await GetLocalLegalIdentity(LegalId);
                        if (Identity is null)
                            continue;
 
                        if (Identity.Account == BareAddress.Account)
                        {
                            await e.IqResult("<part xmlns='" + e.Query.NamespaceURI + "'>true</part>", e.To);
                            return;
                        }
                    }
                }
 
                await e.IqResult("<part xmlns='" + e.Query.NamespaceURI + "'>false</part>", e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task ObsoleteContractHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ContractId = XML.Attribute(e.Query, "id");
 
                using Semaphore Semaphore = await Semaphores.BeginWrite("iotsc:" + ContractId.LowerCase);
                Contract Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                if (Contract is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                    return;
                }
 
                switch (await Contract.CanRevoke(e.From, this.Server, this))
                {
                    case 0: // OK, creator, contract not legally biding.
                    case 1: // OK, role dictates part can revoke contract/consent.
                        break;
 
                    case 2:
                        await e.IqErrorForbidden(e.To, "Contract is legally binding and cannot be obsoleted.", "en");
                        return;
 
                    case 3:
                        await e.IqErrorForbidden(e.To, "Only the creator can obsolete a contract.", "en");
                        return;
 
                    case 4:
                        await e.IqErrorForbidden(e.To, "Not a part in the contract.", "en");
                        return;
 
                    case 5:
                        await e.IqErrorForbidden(e.To, "Your role cannot revoke signature/consent.", "en");
                        return;
                }
 
                Contract.State = ContractState.Obsoleted;
                await Contract.Sign(this);
 
                await Database.Update(Contract);
 
                if (Contract.CanActAsTemplate)
                    await RuntimeCounters.IncrementCounter("Legal.Template." + Contract.State.ToString());
                else
                    await RuntimeCounters.IncrementCounter("Legal.Contract." + Contract.State.ToString());
 
                Log.Informational("Contract obsoleted.", Contract.ContractId.Value, e.From.Address.Value, "ContractObsoleted");
 
                StringBuilder Xml = new StringBuilder();
                await Contract.Serialize(Xml, true, true, true, true, true, true, true, null, this);
                await e.IqResult(Xml.ToString(), e.To);
 
                await this.SendContractUpdatedEvent(Contract, false);
 
                if (!(this.geo is null))
                    await this.geo.Delete(Contract);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal async Task SendContractUpdatedEvent(Contract Contract, bool Created)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<contract");
            Xml.Append(Created ? "Created" : "Updated");
            Xml.Append(" xmlns='");
            Xml.Append(NamespaceSmartContracts(Contract.Version));
            Xml.Append("' contractId='");
            Xml.Append(XML.Encode(Contract.ContractId));
            Xml.Append("'/>");
 
            string Event = Xml.ToString();
 
            foreach (string StatusRecipient in Contract.GetStakeholders(this.Server))
                await this.Server.SendMessage(string.Empty, string.Empty, Contract.Provider, StatusRecipient, string.Empty, Event);
        }
 
        private async Task DeleteContractHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ContractId = XML.Attribute(e.Query, "id");
 
                using Semaphore Semaphore = await Semaphores.BeginWrite("iotsc:" + ContractId.LowerCase);
                Contract Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                if (Contract is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                    return;
                }
 
                if (!Contract.IsCreator(e.From, this.Server))
                {
                    await e.IqErrorForbidden(e.To, "Only the creator can delete a contract.", "en");
                    return;
                }
 
                if (await Contract.IsLegallyBinding(true, false, this))
                {
                    await e.IqErrorForbidden(e.To, "Contract is legally binding and cannot be deleted.", "en");
                    return;
                }
 
                if (await Contract.IsLegallyBinding(false, false, this) && DateTime.Now < Contract.To + Contract.ArchiveRequired)
                {
                    await e.IqErrorForbidden(e.To, "Contract cannot be deleted before its required archivation period expires.", "en");
                    return;
                }
 
                Contract.State = ContractState.Deleted;
                await Contract.Sign(this);
 
                await Database.Delete(Contract);
                await this.DeleteAttachments(Contract.Attachments);
                Contract.Attachments = null;
 
                Log.Informational("Contract deleted.", Contract.ContractId.Value, e.From.Address.Value, "ContractDeleted");
 
                if (Contract.CanActAsTemplate)
                    await RuntimeCounters.IncrementCounter("Legal.Template." + Contract.State.ToString());
                else
                    await RuntimeCounters.IncrementCounter("Legal.Contract." + Contract.State.ToString());
 
                StringBuilder Xml = new StringBuilder();
                await Contract.Serialize(Xml, true, true, true, false, true, true, false, null, this);
                await e.IqResult(Xml.ToString(), e.To);
 
                await this.SendContractDeletedEvent(Contract);
 
                if (!(this.geo is null))
                    await this.geo.Delete(Contract);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task DeleteAttachments(params AttachmentReference[] AttachmentReferences)
        {
            if (!(AttachmentReferences is null))
            {
                foreach (AttachmentReference Ref in AttachmentReferences)
                {
                    Attachment Attachment = await Database.FindFirstDeleteRest<Attachment>(new FilterFieldEqualTo("Id", Ref.Id));
                    if (!(Attachment is null))
                    {
                        await Database.Delete(Attachment);
 
                        if (File.Exists(Attachment.LocalFileName))
                        {
                            try
                            {
                                File.Delete(Attachment.LocalFileName);
                            }
                            catch (Exception ex)
                            {
                                Log.Exception(ex);
                            }
                        }
                    }
                }
            }
        }
 
        private async Task SendContractDeletedEvent(Contract Contract)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<contractDeleted xmlns='");
            Xml.Append(NamespaceSmartContracts(Contract.Version));
            Xml.Append("' contractId='");
            Xml.Append(XML.Encode(Contract.ContractId));
            Xml.Append("'/>");
 
            string Event = Xml.ToString();
 
            foreach (string StatusRecipient in Contract.GetStakeholders(this.Server))
                await this.Server.SendMessage(string.Empty, string.Empty, Contract.Provider, StatusRecipient, string.Empty, Event);
        }
 
        private async Task UpdateContractHandler(object Sender, IqEventArgs e)
        {
            try
            {
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Only accounts on the broker can manage contracts on the broker.", "en");
                    return;
                }
 
                Contract UpdatedContract = null;
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
                string Namespace = NamespaceSmartContracts(QueryVersion);
 
                foreach (XmlNode N in e.Query.ChildNodes)
                {
                    if (N is XmlElement E && E.LocalName == "contract" && IsNamespaceSmartContract(E.NamespaceURI))
                    {
                        ParsedContract Parsed = await Contract.Parse(E, this);
                        UpdatedContract = Parsed?.Contract;
 
                        if (UpdatedContract is null)
                        {
                            await e.IqErrorBadRequest(e.To, "Invalid contract.", "en");
                            return;
                        }
 
                        bool HasStatus = Parsed.HasStatus;
                        bool ParametersValid = Parsed.ParametersValid;
 
                        if (HasStatus)
                        {
                            await e.IqErrorBadRequest(e.To, "Status element not permitted when updating contract.", "en");
                            return;
                        }
 
                        if (!ParametersValid)
                        {
                            await e.IqErrorBadRequest(e.To, "Contract parameter " + Parsed.FirstParameterErrorName +
                                " has invalid value: " + Parsed.FirstParameterError, "en");
                            return;
                        }
 
                        break;
                    }
                }
 
                if (UpdatedContract is null)
                {
                    await e.IqErrorBadRequest(e.To, "No contract.", "en");
                    return;
                }
 
                CaseInsensitiveString ContractId = UpdatedContract.ContractId;
                if (CaseInsensitiveString.IsNullOrEmpty(ContractId))
                {
                    await e.IqErrorBadRequest(e.To, "id attribute must be specified by client.", "en");
                    return;
                }
 
                if (!(UpdatedContract.ClientSignatures is null) && UpdatedContract.ClientSignatures.Length > 0)
                {
                    await e.IqErrorBadRequest(e.To, "Cannot update a contract with signatures.", "en");
                    return;
                }
 
                if (!(UpdatedContract.ServerSignature is null))
                {
                    await e.IqErrorBadRequest(e.To, "Server signature cannot be provided by client.", "en");
                    return;
                }
 
                using Semaphore Semaphore = await Semaphores.BeginWrite("iotsc:" + ContractId.LowerCase);
                Contract PrevContract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                if (PrevContract is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                    return;
                }
 
                if (!PrevContract.IsCreator(e.From, this.Server))
                {
                    await e.IqErrorForbidden(e.To, "Only the creator can update the contract.", "en");
                    return;
                }
 
                if (!(PrevContract.ClientSignatures is null) && PrevContract.ClientSignatures.Length > 0)
                {
                    await e.IqErrorBadRequest(e.To, "Cannot update a contract with signatures.", "en");
                    return;
                }
 
                switch (PrevContract.State)
                {
                    case ContractState.Proposed:
                    case ContractState.Rejected:
                    case ContractState.Approved:
                    case ContractState.Obsoleted:
                        break;
 
                    case ContractState.BeingSigned:
                    case ContractState.Deleted:
                    case ContractState.Signed:
                    case ContractState.Failed:
                    default:
                        await e.IqErrorForbidden(e.To, "Current state of the contract does not allow updates.", "en");
                        return;
                }
 
                LegalIdentity Identity = await this.GetCurrentApprovedLegalIdentityAsync(e.From.Account);
                if (Identity is null)
                {
                    await e.IqErrorForbidden(e.To, "No current approved legal identity found for account.", "en");
                    return;
                }
 
                string Errors = await this.ValidateContent(UpdatedContract, null);
                if (!string.IsNullOrEmpty(Errors))
                {
                    await e.IqErrorBadRequest(e.To, Errors, "en");
                    return;
                }
 
                UpdatedContract.ObjectId = PrevContract.ObjectId;
                UpdatedContract.TemplateId = PrevContract.TemplateId;
                UpdatedContract.Provider = PrevContract.Provider;
                UpdatedContract.Account = PrevContract.Account;
                UpdatedContract.Created = PrevContract.Created;
                UpdatedContract.Nonce = PrevContract.Nonce;
                UpdatedContract.Updated = UtcNowSecond;
                UpdatedContract.Version = QueryVersion;
 
                if (PrevContract.State == ContractState.Approved && !PrevContract.UpdateRequiresReview(UpdatedContract))
                    UpdatedContract.State = ContractState.Approved;
                else
                    UpdatedContract.State = ContractState.Proposed;
 
                await UpdatedContract.Sign(this);
 
                await Database.Update(UpdatedContract);
 
                Log.Informational("Contract updated.", UpdatedContract.ContractId.Value, e.From.Address.Value, "ContractUpdated");
 
                StringBuilder Xml = new StringBuilder();
                await UpdatedContract.Serialize(Xml, true, true, true, true, true, true, true, null, this);
                await e.IqResult(Xml.ToString(), e.To);
 
                await this.SendContractUpdatedEvent(UpdatedContract, false);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task GetSchemasHandler(object Sender, IqEventArgs e)
        {
            try
            {
                StringBuilder Xml = new StringBuilder();
                CaseInsensitiveString LastNamespace = null;
 
                Xml.Append("<schemas xmlns='");
                Xml.Append(e.Query.NamespaceURI);
                Xml.Append("'>");
 
                foreach (ValidationSchema Schema in await Database.Find<ValidationSchema>("Namespace", "HashBase64"))
                {
                    if (Schema.Namespace != LastNamespace)
                    {
                        if (!(LastNamespace is null))
                            Xml.Append("</schemaRef>");
 
                        LastNamespace = Schema.Namespace;
 
                        Xml.Append("<schemaRef namespace='");
                        Xml.Append(XML.Encode(LastNamespace));
                        Xml.Append("'>");
                    }
 
                    Xml.Append("<digest function='");
                    Xml.Append(Schema.Function.ToString());
                    Xml.Append("'>");
                    Xml.Append(Schema.HashBase64);
                    Xml.Append("</digest>");
                }
 
                if (!(LastNamespace is null))
                    Xml.Append("</schemaRef>");
 
                Xml.Append("</schemas>");
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task GetSchemaHandler(object Sender, IqEventArgs e)
        {
            try
            {
                HashFunction Function = HashFunction.SHA256;
                string DigestBase64 = null;
                CaseInsensitiveString Namespace = XML.Attribute(e.Query, "namespace");
 
                if (CaseInsensitiveString.IsNullOrEmpty(Namespace))
                {
                    await e.IqErrorBadRequest(e.To, "No namespace provided.", "en");
                    return;
                }
 
                foreach (XmlNode N in e.Query.ChildNodes)
                {
                    if (N is XmlElement E && E.LocalName == "digest" && E.NamespaceURI == e.Query.NamespaceURI)
                    {
                        DigestBase64 = E.InnerText;
                        if (!Enum.TryParse(XML.Attribute(E, "function"), out Function))
                        {
                            await e.IqErrorBadRequest(e.To, "Invalid hash function.", "en");
                            return;
                        }
                    }
                }
 
                ValidationSchema Schema;
 
                if (DigestBase64 is null)
                {
                    Schema = await Database.FindFirstIgnoreRest<ValidationSchema>(
                        new FilterFieldEqualTo("Namespace", Namespace), "-Created");
                }
                else
                {
                    Schema = await Database.FindFirstIgnoreRest<ValidationSchema>(new FilterAnd(
                        new FilterFieldEqualTo("Namespace", Namespace),
                        new FilterFieldEqualTo("HashBase64", DigestBase64),
                        new FilterFieldEqualTo("Function", Function)), "-Created");
                }
 
                if (Schema is null)
                {
                    string ErrorMsg;
 
                    (Schema, ErrorMsg) = await this.LoadSchema(Namespace, null);
                    if (!string.IsNullOrEmpty(ErrorMsg))
                        await e.IqErrorBadRequest(e.To, "Unable to download schema: " + ErrorMsg, "en");
 
                    if (Schema is null)
                    {
                        await e.IqErrorItemNotFound(e.To, "Schema not found.", "en");
                        return;
                    }
                }
 
                StringBuilder Xml = new StringBuilder();
 
                Xml.Append("<schema xmlns='");
                Xml.Append(e.Query.NamespaceURI);
                Xml.Append("'>");
                Xml.Append(Convert.ToBase64String(Schema.XmlSchema));
                Xml.Append("</schema>");
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task GetLegalIdentitiesOfContractHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ContractId = XML.Attribute(e.Query, "contractId");
                bool Current = XML.Attribute(e.Query, "current", false);
                bool Historic = XML.Attribute(e.Query, "historic", true);
 
                if (!(Current || Historic))
                {
                    await e.IqErrorBadRequest(e.To, "Both current and historic attributes cannot both be false.", "en");
                    return;
                }
 
                XmppAddress ContractAddress = new XmppAddress(ContractId);
                List<LegalIdentity> Identities = new List<LegalIdentity>();
                List<Dictionary<string, string>> AttachmentUrlss = new List<Dictionary<string, string>>();
                LegalIdentity Identity, CurrentIdentity;
                DateTime UtcNow = DateTime.UtcNow;
 
                if (this.IsComponentDomain(ContractAddress.Domain, true))
                {
                    Contract Contract;
 
                    using (Semaphore Semaphore = await Semaphores.BeginRead("iotsc:" + ContractId.LowerCase))
                    {
                        Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                        if (Contract is null)
                        {
                            await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                            return;
                        }
 
                        if (!await Contract.CanRead(e.From, this.Server, this))
                        {
                            await e.IqErrorForbidden(e.To, "Not authorized to access contract.", "en");
                            return;
                        }
                    }
 
                    if (!(Contract.ClientSignatures is null))
                    {
                        Dictionary<string, bool> Domains = null;
 
                        foreach (ClientSignature Signature in Contract.ClientSignatures)
                        {
                            XmppAddress LegalId = new XmppAddress(Signature.LegalId);
                            if (this.IsComponentDomain(LegalId.Domain, true))
                            {
                                Identity = await GetLocalLegalIdentity(Signature.LegalId);
 
                                if (Historic)
                                {
                                    Identities.Add(Identity);
                                    AttachmentUrlss.Add(null);
                                }
 
                                if (Current)
                                {
                                    CurrentIdentity = await this.GetApprovedLegalIdentityAsync(Identity.Account, UtcNow);
                                    if (CurrentIdentity.Id != Identity.Id)
                                    {
                                        Identities.Add(CurrentIdentity);
                                        AttachmentUrlss.Add(null);
                                    }
                                }
                            }
                            else
                            {
                                Domains ??= new Dictionary<string, bool>();
                                Domains[LegalId.Domain] = true;
                            }
                        }
 
                        if (!(Domains is null))
                        {
                            TaskCompletionSource<bool> Result = new TaskCompletionSource<bool>();
                            object SynchObj = new object();
                            int Count = Domains.Count;
                            StringBuilder Xml = new StringBuilder();
                            string ContractsNamespace = NamespaceSmartContracts(Contract.Version);
 
                            Xml.Append("<getLegalIdentities xmlns='");
                            Xml.Append(ContractsNamespace);
                            Xml.Append("' contractId='");
                            Xml.Append(XML.Encode(ContractId));
                            Xml.Append("' current='");
                            Xml.Append(CommonTypes.Encode(Current));
                            Xml.Append("' historic='");
                            Xml.Append(CommonTypes.Encode(Historic));
                            Xml.Append("'/>");
 
                            string Request = Xml.ToString();
                            bool Responded = false;
 
                            foreach (KeyValuePair<string, bool> ByDomain in Domains)
                            {
                                await this.Server.SendIqRequest("get", this.MainDomain,
                                    new XmppAddress(ByDomain.Key), string.Empty, Request, false, async (sender2, e2) =>
                                    {
                                        bool Last;
 
                                        lock (SynchObj)
                                        {
                                            Last = --Count == 0;
                                        }
 
                                        if (e2.Ok)
                                        {
                                            XmlElement E = e2.FirstElement;
 
                                            if (!(E is null) && E.LocalName == "identities")
                                            {
                                                foreach (XmlNode N in E.ChildNodes)
                                                {
                                                    if (N is XmlElement E2 && E2.LocalName == "identity")
                                                    {
                                                        Identity = LegalIdentity.Parse(E2, out bool HasStatus, out Dictionary<string, string> AttachmentUrls);
 
                                                        lock (Identities)
                                                        {
                                                            Identities.Add(Identity);
                                                            AttachmentUrlss.Add(AttachmentUrls);
                                                        }
                                                    }
                                                }
                                            }
 
                                            Result.TrySetResult(true);
                                        }
                                        else
                                        {
                                            if (Result.TrySetResult(false) && !Responded)
                                            {
                                                Responded = true;
                                                await e.IqError(e2.ErrorTypeString, e2.ErrorElement?.OuterXml ?? string.Empty, e2.To, e2.ErrorText, string.Empty);
                                            }
                                        }
                                    }, null);
                            }
 
                            if (!await Result.Task || Responded)
                                return;
                        }
                    }
                }
                else
                {
                    if (e.From.Address != ContractAddress.Domain)
                    {
                        await e.IqErrorForbidden(e.To, "Not authorized to access contract.", "en");
                        return;
                    }
 
                    IEnumerable<ContractSignature> Signatures = await Database.Find<ContractSignature>(
                        new FilterFieldEqualTo("ContractId", ContractId), "LegalId");
 
                    foreach (ContractSignature Signature in Signatures)
                    {
                        Identity = await GetLocalLegalIdentity(Signature.LegalId);
 
                        if (Historic)
                        {
                            Identities.Add(Identity);
                            AttachmentUrlss.Add(null);
                        }
 
                        if (Current)
                        {
                            CurrentIdentity = await this.GetApprovedLegalIdentityAsync(Identity.Account, UtcNow);
                            if (CurrentIdentity.Id != Identity.Id)
                            {
                                Identities.Add(CurrentIdentity);
                                AttachmentUrlss.Add(null);
                            }
                        }
                    }
                }
 
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
                string Response;
 
                lock (Identities)
                {
                    Response = this.SerializeIdentities(Identities, AttachmentUrlss, QueryVersion);
                }
 
                await e.IqResult(Response, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task GetNetworkIdentitiesHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ContractId = XML.Attribute(e.Query, "contractId");
 
                XmppAddress ContractAddress = new XmppAddress(ContractId);
                List<KeyValuePair<CaseInsensitiveString, CaseInsensitiveString>> Identities = new List<KeyValuePair<CaseInsensitiveString, CaseInsensitiveString>>();
 
                if (this.IsComponentDomain(ContractAddress.Domain, true))
                {
                    Contract Contract;
 
                    using (Semaphore Semaphore = await Semaphores.BeginRead("iotsc:" + ContractId.LowerCase))
                    {
                        Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                        if (Contract is null)
                        {
                            await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                            return;
                        }
 
                        if (!await Contract.CanRead(e.From, this.Server, this))
                        {
                            await e.IqErrorForbidden(e.To, "Not authorized to access contract.", "en");
                            return;
                        }
                    }
 
                    IqResultEventArgs ErrorResponse = await this.GetNetworkIdentities(Contract, Identities);
                    if (!(ErrorResponse is null))
                    {
                        await e.IqError(ErrorResponse.ErrorTypeString, ErrorResponse.ErrorElement?.OuterXml ?? string.Empty,
                            ErrorResponse.To, ErrorResponse.ErrorText, string.Empty);
                        return;
                    }
                }
                else
                {
                    if (e.From.Address != ContractAddress.Domain)
                    {
                        await e.IqErrorForbidden(e.To, "Not authorized to access contract.", "en");
                        return;
                    }
 
                    IEnumerable<ContractSignature> Signatures = await Database.Find<ContractSignature>(
                        new FilterFieldEqualTo("ContractId", ContractId), "LegalId");
 
                    foreach (ContractSignature Signature in Signatures)
                        Identities.Add(new KeyValuePair<CaseInsensitiveString, CaseInsensitiveString>(Signature.LegalId, Signature.BareJid));
                }
 
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
                StringBuilder Response = new StringBuilder();
 
                Response.Append("<networkIdentities xmlns='");
                Response.Append(NamespaceSmartContracts(QueryVersion));
                Response.Append("'>");
 
                lock (Identities)
                {
                    foreach (KeyValuePair<CaseInsensitiveString, CaseInsensitiveString> P in Identities)
                    {
                        Response.Append("<networkIdentity bareJid='");
                        Response.Append(XML.Encode(P.Value.Value));
                        Response.Append("' legalId='");
                        Response.Append(XML.Encode(P.Key.Value));
                        Response.Append("'/>");
                    }
                }
 
                Response.Append("</networkIdentities>");
 
                await e.IqResult(Response.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        internal async Task<IqResultEventArgs> GetNetworkIdentities(Contract Contract,
            List<KeyValuePair<CaseInsensitiveString, CaseInsensitiveString>> Identities)
        {
            if (!(Contract.ClientSignatures is null))
            {
                Dictionary<string, bool> Domains = null;
 
                foreach (ClientSignature Signature in Contract.ClientSignatures)
                {
                    XmppAddress LegalId = new XmppAddress(Signature.LegalId);
                    if (this.IsComponentDomain(LegalId.Domain, true))
                    {
                        int i = LegalId.Domain.IndexOf('.');
                        string JidDomain = i < 0 ? this.Server.Domain : LegalId.Domain.Substring(i + 1);
                        LegalIdentity Identity = await GetLocalLegalIdentity(Signature.LegalId);
                        Identities.Add(new KeyValuePair<CaseInsensitiveString, CaseInsensitiveString>(Identity.Id, Identity.Account + "@" + JidDomain));
                    }
                    else
                    {
                        Domains ??= new Dictionary<string, bool>();
                        Domains[LegalId.Domain] = true;
                    }
                }
 
                if (!(Domains is null))
                {
                    TaskCompletionSource<bool> Result = new TaskCompletionSource<bool>();
                    object SynchObj = new object();
                    int Count = Domains.Count;
                    StringBuilder Xml = new StringBuilder();
 
                    Xml.Append("<getNetworkIdentities xmlns='");
                    Xml.Append(NamespaceSmartContracts(Contract.Version));
                    Xml.Append("' contractId='");
                    Xml.Append(XML.Encode(Contract.ContractId));
                    Xml.Append("'/>");
 
                    string Request = Xml.ToString();
                    IqResultEventArgs ErrorResponse = null;
 
                    foreach (KeyValuePair<string, bool> ByDomain in Domains)
                    {
                        await this.Server.SendIqRequest("get", this.MainDomain,
                            new XmppAddress(ByDomain.Key), string.Empty, Request, false, (sender2, e2) =>
                            {
                                bool Last;
 
                                lock (SynchObj)
                                {
                                    Last = --Count == 0;
                                }
 
                                if (e2.Ok)
                                {
                                    XmlElement E = e2.FirstElement;
 
                                    if (!(E is null) && E.LocalName == "networkIdentities")
                                    {
                                        foreach (XmlNode N in E.ChildNodes)
                                        {
                                            if (N is XmlElement E2 && E2.LocalName == "networkIdentity")
                                            {
                                                lock (Identities)
                                                {
                                                    Identities.Add(new KeyValuePair<CaseInsensitiveString, CaseInsensitiveString>(
                                                        XML.Attribute(E2, "legalId"), XML.Attribute(E2, "bareJid")));
                                                }
                                            }
                                        }
                                    }
 
                                    Result.TrySetResult(true);
                                }
                                else
                                {
                                    if (ErrorResponse is null)
                                    {
                                        ErrorResponse = e2;
                                        Result.TrySetResult(false);
                                    }
                                }
 
                                return Task.CompletedTask;
                            }, null);
                    }
 
                    if (!await Result.Task)
                        return ErrorResponse;
                }
            }
 
            return null;
        }
 
        private async Task SearchPublicContractsHandler(object Sender, IqEventArgs e)
        {
            try
            {
                int Offset = XML.Attribute(e.Query, "offset", 0);
                int MaxCount = XML.Attribute(e.Query, "maxCount", int.MaxValue);
                List<CustomFilter> CustomFilters = new List<CustomFilter>();
                List<Filter> Filters = new List<Filter>()
                {
                    new FilterFieldEqualTo("Visibility", ContractVisibility.PublicSearchable)
                };
 
                foreach (XmlNode N in e.Query.ChildNodes)
                {
                    if (N is XmlElement E)
                    {
                        switch (E.LocalName)
                        {
                            case "localName":
                                if (!await this.AddStrFilter(E, e, Filters, "ForMachinesLocalName"))
                                    return;
                                break;
 
                            case "namespace":
                                if (!await this.AddStrFilter(E, e, Filters, "ForMachinesNamespace"))
                                    return;
                                break;
 
                            case "template":
                                if (!await this.AddStrFilter(E, e, Filters, "TemplateId"))
                                    return;
                                break;
 
                            case "role":
                                if (!await this.AddRoleFilter(E, e, CustomFilters))
                                    return;
                                break;
 
                            case "parameter":
                                if (!await this.AddParameterFilter(E, e, CustomFilters, XML.Attribute(E, "name")))
                                    return;
                                break;
 
                            case "created":
                                if (!await this.AddDateTimeFilter(E, e, Filters, "Created"))
                                    return;
                                break;
 
                            case "updated":
                                if (!await this.AddDateTimeFilter(E, e, Filters, "Updated"))
                                    return;
                                break;
 
                            case "from":
                                if (!await this.AddDateTimeFilter(E, e, Filters, "From"))
                                    return;
                                break;
 
                            case "to":
                                if (!await this.AddDateTimeFilter(E, e, Filters, "To"))
                                    return;
                                break;
 
                            case "duration":
                                if (!await this.AddDurationFilter(E, e, CustomFilters))
                                    return;
                                break;
 
                            default:
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return;
                        }
                    }
                }
 
                List<Contract> Result = new List<Contract>();
                Filter SearchFilter = Filters.Count == 1 ? Filters[0] : new FilterAnd(Filters.ToArray());
                bool HasCustomFilters = CustomFilters.Count > 0;
                IEnumerable<Contract> Contracts;
                bool More = false;
 
                if (HasCustomFilters)
                    Contracts = await Database.Find<Contract>(SearchFilter, "ContractId");
                else
                {
                    Contracts = await Database.Find<Contract>(Offset, MaxCount == int.MaxValue ? MaxCount : MaxCount + 1, SearchFilter, "ContractId");
                    Offset = 0;
                }
 
                foreach (Contract Contract in Contracts)
                {
                    if (HasCustomFilters)
                    {
                        bool Included = true;
 
                        foreach (CustomFilter Filter in CustomFilters)
                        {
                            if (!Filter.IsIncluded(Contract))
                            {
                                Included = false;
                                break;
                            }
                        }
 
                        if (!Included)
                            continue;
                    }
 
                    if (Offset > 0)
                    {
                        Offset--;
                        continue;
                    }
 
                    if (MaxCount > 0)
                        MaxCount--;
                    else
                    {
                        More = true;
                        break;
                    }
 
                    Result.Add(Contract);
                }
 
                NamespaceSet QueryVersion = XmppServerModule.GetVersion(e.Query.NamespaceURI);
                StringBuilder Xml = new StringBuilder();
 
                Xml.Append("<searchResult xmlns='");
                Xml.Append(NamespaceSmartContracts(QueryVersion));
                Xml.Append("' more='");
                Xml.Append(CommonTypes.Encode(More));
                Xml.Append("'>");
 
                foreach (IContractReference Contract in Result)
                {
                    Xml.Append("<ref id='");
                    Xml.Append(XML.Encode(Contract.ContractId));
                    Xml.Append("'/>");
                }
 
                Xml.Append("</searchResult>");
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task<bool> AddStrFilter(XmlElement E, IqEventArgs e, List<Filter> Filters, string Field)
        {
            foreach (XmlNode N2 in E.ChildNodes)
            {
                if (N2 is XmlElement E2)
                {
                    switch (E2.LocalName)
                    {
                        case "eq":
                            Filters.Add(new FilterFieldEqualTo(Field, E2.InnerText));
                            break;
 
                        case "like":
                            Filters.Add(new FilterFieldLikeRegEx(Field, E2.InnerText));
                            break;
 
                        default:
                            await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                            return false;
                    }
                }
            }
 
            return true;
        }
 
        private async Task<bool> AddRoleFilter(XmlElement E, IqEventArgs e, List<CustomFilter> Filters)
        {
            foreach (XmlNode N2 in E.ChildNodes)
            {
                if (N2 is XmlElement E2)
                {
                    switch (E2.LocalName)
                    {
                        case "eq":
                            Filters.Add(new RoleEqFilter()
                            {
                                Value = E2.InnerText
                            });
                            break;
 
                        case "like":
                            Filters.Add(new RoleLikeFilter()
                            {
                                Value = E2.InnerText
                            });
                            break;
 
                        default:
                            await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                            return false;
                    }
                }
            }
 
            return true;
        }
 
        private async Task<bool> AddParameterFilter(XmlElement E, IqEventArgs e, List<CustomFilter> Filters, string Name)
        {
            foreach (XmlNode N2 in E.ChildNodes)
            {
                if (N2 is XmlElement E2)
                {
                    switch (E2.LocalName)
                    {
                        case "eqStr":
                            Filters.Add(new StringParameterEqFilter()
                            {
                                Name = Name,
                                Value = E2.InnerText
                            });
                            break;
 
                        case "neqStr":
                            Filters.Add(new StringParameterNEqFilter()
                            {
                                Name = Name,
                                Value = E2.InnerText
                            });
                            break;
 
                        case "gtStr":
                            Filters.Add(new StringParameterGtFilter()
                            {
                                Name = Name,
                                Value = E2.InnerText
                            });
                            break;
 
                        case "gteStr":
                            Filters.Add(new StringParameterGteFilter()
                            {
                                Name = Name,
                                Value = E2.InnerText
                            });
                            break;
 
                        case "ltStr":
                            Filters.Add(new StringParameterLtFilter()
                            {
                                Name = Name,
                                Value = E2.InnerText
                            });
                            break;
 
                        case "lteStr":
                            Filters.Add(new StringParameterLteFilter()
                            {
                                Name = Name,
                                Value = E2.InnerText
                            });
                            break;
 
                        case "like":
                            Filters.Add(new StringParameterLikeFilter()
                            {
                                Name = Name,
                                Value = E2.InnerText
                            });
                            break;
 
                        case "eqNum":
                            if (!CommonTypes.TryParse(E2.InnerText, out decimal NumValue))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new NumericalParameterEqFilter()
                            {
                                Name = Name,
                                Value = NumValue
                            });
                            break;
 
                        case "neqNum":
                            if (!CommonTypes.TryParse(E2.InnerText, out NumValue))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new NumericalParameterNEqFilter()
                            {
                                Name = Name,
                                Value = NumValue
                            });
                            break;
 
                        case "gtNum":
                            if (!CommonTypes.TryParse(E2.InnerText, out NumValue))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new NumericalParameterGtFilter()
                            {
                                Name = Name,
                                Value = NumValue
                            });
                            break;
 
                        case "gteNum":
                            if (!CommonTypes.TryParse(E2.InnerText, out NumValue))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new NumericalParameterGteFilter()
                            {
                                Name = Name,
                                Value = NumValue
                            });
                            break;
 
                        case "ltNum":
                            if (!CommonTypes.TryParse(E2.InnerText, out NumValue))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new NumericalParameterLtFilter()
                            {
                                Name = Name,
                                Value = NumValue
                            });
                            break;
 
                        case "lteNum":
                            if (!CommonTypes.TryParse(E2.InnerText, out NumValue))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new NumericalParameterLteFilter()
                            {
                                Name = Name,
                                Value = NumValue
                            });
                            break;
 
                        case "eqB":
                            if (!CommonTypes.TryParse(E2.InnerText, out bool BoolValue))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new BooleanParameterEqFilter()
                            {
                                Name = Name,
                                Value = BoolValue
                            });
                            break;
 
                        case "neqB":
                            if (!CommonTypes.TryParse(E2.InnerText, out BoolValue))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new BooleanParameterNEqFilter()
                            {
                                Name = Name,
                                Value = BoolValue
                            });
                            break;
 
 
                        case "eqD":
                            if (!XML.TryParse(E2.InnerText, out DateTime TP) || TP.TimeOfDay != TimeSpan.Zero)
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateParameterEqFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "neqD":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateParameterNEqFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "gtD":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateParameterGtFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "gteD":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateParameterGteFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "ltD":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateParameterLtFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "lteD":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateParameterLteFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "eqDT":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateTimeParameterEqFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "neqDT":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateTimeParameterNEqFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "gtDT":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateTimeParameterGtFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "gteDT":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateTimeParameterGteFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "ltDT":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateTimeParameterLtFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "lteDT":
                            if (!XML.TryParse(E2.InnerText, out TP))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DateTimeParameterLteFilter()
                            {
                                Name = Name,
                                Value = TP
                            });
                            break;
 
                        case "eqT":
                            if (!TimeSpan.TryParse(E2.InnerText, out TimeSpan TS))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new TimeParameterEqFilter()
                            {
                                Name = Name,
                                Value = TS
                            });
                            break;
 
                        case "neqT":
                            if (!TimeSpan.TryParse(E2.InnerText, out TS))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new TimeParameterNEqFilter()
                            {
                                Name = Name,
                                Value = TS
                            });
                            break;
 
                        case "gtT":
                            if (!TimeSpan.TryParse(E2.InnerText, out TS))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new TimeParameterGtFilter()
                            {
                                Name = Name,
                                Value = TS
                            });
                            break;
 
                        case "gteT":
                            if (!TimeSpan.TryParse(E2.InnerText, out TS))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new TimeParameterGteFilter()
                            {
                                Name = Name,
                                Value = TS
                            });
                            break;
 
                        case "ltT":
                            if (!TimeSpan.TryParse(E2.InnerText, out TS))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new TimeParameterLtFilter()
                            {
                                Name = Name,
                                Value = TS
                            });
                            break;
 
                        case "lteT":
                            if (!TimeSpan.TryParse(E2.InnerText, out TS))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new TimeParameterLteFilter()
                            {
                                Name = Name,
                                Value = TS
                            });
                            break;
 
                        case "eqDr":
                            if (!Duration.TryParse(E2.InnerText, out Duration Dr))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DurationParameterEqFilter()
                            {
                                Name = Name,
                                Value = Dr
                            });
                            break;
 
                        case "neqDr":
                            if (!Duration.TryParse(E2.InnerText, out Dr))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DurationParameterNEqFilter()
                            {
                                Name = Name,
                                Value = Dr
                            });
                            break;
 
                        case "gtDr":
                            if (!Duration.TryParse(E2.InnerText, out Dr))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DurationParameterGtFilter()
                            {
                                Name = Name,
                                Value = Dr
                            });
                            break;
 
                        case "gteDr":
                            if (!Duration.TryParse(E2.InnerText, out Dr))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DurationParameterGteFilter()
                            {
                                Name = Name,
                                Value = Dr
                            });
                            break;
 
                        case "ltDr":
                            if (!Duration.TryParse(E2.InnerText, out Dr))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DurationParameterLtFilter()
                            {
                                Name = Name,
                                Value = Dr
                            });
                            break;
 
                        case "lteDr":
                            if (!Duration.TryParse(E2.InnerText, out Dr))
                            {
                                await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                                return false;
                            }
 
                            Filters.Add(new DurationParameterLteFilter()
                            {
                                Name = Name,
                                Value = Dr
                            });
                            break;
 
                        default:
                            await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                            return false;
                    }
                }
            }
 
            return true;
        }
 
        private async Task<bool> AddDateTimeFilter(XmlElement E, IqEventArgs e, List<Filter> Filters, string Field)
        {
            foreach (XmlNode N2 in E.ChildNodes)
            {
                if (N2 is XmlElement E2)
                {
                    if (!XML.TryParse(E2.InnerText, out DateTime TP))
                    {
                        await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                        return false;
                    }
 
                    switch (E2.LocalName)
                    {
                        case "eq":
                            Filters.Add(new FilterFieldEqualTo(Field, TP));
                            break;
 
                        case "neq":
                            Filters.Add(new FilterFieldNotEqualTo(Field, TP));
                            break;
 
                        case "gt":
                            Filters.Add(new FilterFieldGreaterThan(Field, TP));
                            break;
 
                        case "gte":
                            Filters.Add(new FilterFieldGreaterOrEqualTo(Field, TP));
                            break;
 
                        case "lt":
                            Filters.Add(new FilterFieldLesserThan(Field, TP));
                            break;
 
                        case "lte":
                            Filters.Add(new FilterFieldLesserOrEqualTo(Field, TP));
                            break;
 
                        default:
                            await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                            return false;
                    }
                }
            }
 
            return true;
        }
 
        private async Task<bool> AddDurationFilter(XmlElement E, IqEventArgs e, List<CustomFilter> Filters)
        {
            foreach (XmlNode N2 in E.ChildNodes)
            {
                if (N2 is XmlElement E2)
                {
                    if (!Duration.TryParse(E2.InnerText, out Duration Value))
                    {
                        await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                        return false;
                    }
 
                    switch (E2.LocalName)
                    {
                        case "eq":
                            Filters.Add(new DurationEqFilter()
                            {
                                Value = Value
                            });
                            break;
 
                        case "neq":
                            Filters.Add(new DurationNEqFilter()
                            {
                                Value = Value
                            });
                            break;
 
                        case "gt":
                            Filters.Add(new DurationGtFilter()
                            {
                                Value = Value
                            });
                            break;
 
                        case "gte":
                            Filters.Add(new DurationGteFilter()
                            {
                                Value = Value
                            });
                            break;
 
                        case "lt":
                            Filters.Add(new DurationLtFilter()
                            {
                                Value = Value
                            });
                            break;
 
                        case "lte":
                            Filters.Add(new DurationLteFilter()
                            {
                                Value = Value
                            });
                            break;
 
                        default:
                            await e.IqErrorBadRequest(e.To, "Invalid query.", "en");
                            return false;
                    }
                }
            }
 
            return true;
        }
 
        private async Task AddContractAttachmentHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ContractId = XML.Attribute(e.Query, "contractId");
                string GetUrl = XML.Attribute(e.Query, "getUrl");
                byte[] Signature = Convert.FromBase64String(XML.Attribute(e.Query, "s"));
 
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Only accounts on the broker can add attachments.", "en");
                    return;
                }
 
                if (!Uri.TryCreate(GetUrl, UriKind.Absolute, out Uri GetUri))
                {
                    await e.IqErrorBadRequest(e.To, "Invalid Get URL.", "en");
                    return;
                }
 
                IAccount Account = await XmppServerModule.GetAccountAsync(e.From.Account);
                if (Account is null)
                {
                    await e.IqErrorForbidden(e.To, "Account not found.", "en");
                    return;
                }
 
                if (!Account.Enabled)
                {
                    await e.IqErrorForbidden(e.To, "Account has been disabled.", "en");
                    return;
                }
 
                if (!(Account is Account Account2))
                {
                    await e.IqErrorForbidden(e.To, "Forbidden to add attachments.", "en");
                    return;
                }
 
                using Semaphore Semaphore = await Semaphores.BeginWrite("iotsc:" + ContractId.LowerCase);
                Contract Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", ContractId), "Created");
                if (Contract is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                    return;
                }
 
                if (!Contract.IsCreator(e.From, this.Server))
                {
                    await e.IqErrorForbidden(e.To, "Only allowed to add attachments to your own contracts.", "en");
                    return;
                }
 
                if (Contract.State != ContractState.Proposed && Contract.State != ContractState.Approved)
                {
                    await e.IqErrorForbidden(e.To, "Attachments can only be added to proposed or approved contracts, before they are signed.", "en");
                    return;
                }
 
                if (!(Contract.Attachments is null))
                {
                    string s = Convert.ToBase64String(Signature);
 
                    foreach (AttachmentReference Ref in Contract.Attachments)
                    {
                        if (Convert.ToBase64String(Ref.Signature) == s)
                        {
                            await e.IqErrorForbidden(e.To, "Attachment already assigned to contract.", "en");
                            return;
                        }
                    }
                }
 
                using ContentStreamResponse P = await LocalContent.GetTempStreamAsync(GetUri);
 
                if (P.HasError)
                {
                    await e.IqError(P.Error, e.To);
                    return;
                }
 
                string ContentType = P.ContentType;
 
                using TemporaryStream File = P.Encoded;
                File.Position = 0;
 
                LegalIdentity UploadingIdentity = await this.ValidateLocalSenderSignature(e.From, null, DateTime.Now, File, Signature);
                if (UploadingIdentity is null)
                {
                    await e.IqErrorForbidden(e.To, "Attachment signature is invalid.", "en");
                    return;
                }
 
                KeyValuePair<Attachment, AttachmentReference> A = await this.CreateAttachment(GetUri,
                    UploadingIdentity, Signature, File, ContentType, Account2, ContractId,
                    Contract.Expires.ToUniversalTime(), false);
                List<AttachmentReference> References = new List<AttachmentReference>();
 
                if (!(Contract.Attachments is null))
                    References.AddRange(Contract.Attachments);
 
                References.Add(A.Value);
 
                Contract.Attachments = References.ToArray();
                await Contract.Sign(this);
 
                await Database.Update(Contract);
 
                StringBuilder Xml = new StringBuilder();
                await Contract.Serialize(Xml, true, true, true, true, true, true, true, null, this);
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task RemoveContractAttachmentHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString AttachmentId = XML.Attribute(e.Query, "attachmentId");
 
                if (!this.Server.IsServerDomain(e.From.Domain, true))
                {
                    await e.IqErrorForbidden(e.To, "Only accounts on the broker can remove attachments.", "en");
                    return;
                }
 
                Attachment Attachment = await Database.FindFirstDeleteRest<Attachment>(new FilterFieldEqualTo("Id", AttachmentId));
                if (Attachment is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Attachment not found.", "en");
                    return;
                }
 
                if (CaseInsensitiveString.IsNullOrEmpty(Attachment.ContractId))
                {
                    await e.IqErrorItemNotFound(e.To, "Attachment not assigned to contract.", "en");
                    return;
                }
 
                using Semaphore Semaphore = await Semaphores.BeginWrite("iotsc:" + Attachment.ContractId.LowerCase);
                Contract Contract = await Database.FindFirstDeleteRest<Contract>(new FilterFieldEqualTo("ContractId", Attachment.ContractId), "Created");
                if (Contract is null)
                {
                    await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                    return;
                }
 
                if (!Contract.IsCreator(e.From, this.Server))
                {
                    await e.IqErrorForbidden(e.To, "Only allowed to remove attachments to your own contracts.", "en");
                    return;
                }
 
                if (Contract.State != ContractState.Proposed && Contract.State != ContractState.Approved)
                {
                    await e.IqErrorForbidden(e.To, "Attachments can only be removed to proposed or approved contracts, before they are signed.", "en");
                    return;
                }
 
                if (File.Exists(Attachment.LocalFileName))
                    File.Delete(Attachment.LocalFileName);
 
                if (!(Contract.Attachments is null))
                {
                    List<AttachmentReference> Attachments = new List<AttachmentReference>();
 
                    foreach (AttachmentReference Ref in Contract.Attachments)
                    {
                        if (Ref.Id != AttachmentId)
                            Attachments.Add(Ref);
                    }
 
                    Contract.Attachments = Attachments.ToArray();
                    await Contract.Sign(this);
 
                    await Database.Update(Contract);
                }
 
                await Database.Delete(Attachment);
 
                StringBuilder Xml = new StringBuilder();
                await Contract.Serialize(Xml, true, true, true, true, true, true, true, null, this);
 
                await e.IqResult(Xml.ToString(), e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        private async Task AuthorizeAccessToContractHandler(object Sender, IqEventArgs e)
        {
            try
            {
                CaseInsensitiveString ContractId = XML.Attribute(e.Query, "id");
 
                if (CaseInsensitiveString.IsNullOrEmpty(ContractId))
                {
                    await e.IqErrorBadRequest(e.To, "No Contract ID specified.", "en");
                    return;
                }
 
                XmppAddress ContractIdAddress = new XmppAddress(ContractId);
 
                if (!ContractIdAddress.IsBareJID)
                {
                    await e.IqErrorBadRequest(e.To, "Invalid Contract ID.", "en");
                    return;
                }
 
                if (!this.IsComponentDomain(ContractIdAddress.Domain, true))
                {
                    await e.IqErrorBadRequest(e.To, "Not a local Contract ID.", "en");
                    return;
                }
 
                CaseInsensitiveString RemoteId = XML.Attribute(e.Query, "remoteId");
                bool Authorized = XML.Attribute(e.Query, "auth", true);
 
                if (CaseInsensitiveString.IsNullOrEmpty(RemoteId))
                {
                    await e.IqErrorBadRequest(e.To, "No Remote ID specified.", "en");
                    return;
                }
 
                XmppAddress RemoteAddress = new XmppAddress(RemoteId);
                if (!RemoteAddress.IsBareJID)
                {
                    await e.IqErrorBadRequest(e.To, "Invalid Remote ID.", "en");
                    return;
                }
 
                using (Semaphore Semaphore = await Semaphores.BeginRead("iotsc:" + ContractId.LowerCase))
                {
                    KeyValuePair<Contract, IqResultEventArgs> P = await this.GetContract(ContractId);
                    Contract Contract = P.Key;
 
                    if (Contract is null)
                    {
                        if (string.IsNullOrEmpty(P.Value?.ErrorText))
                            await e.IqErrorItemNotFound(e.To, "Contract not found.", "en");
                        else
                        {
                            await e.IqErrorItemNotFound(e.To, "Unable to get contract: " +
                                P.Value.ErrorText, "en");
                        }
 
                        return;
                    }
 
                    if (!await Contract.CanRead(e.From, this.Server, this))
                    {
                        await e.IqErrorForbidden(e.To, "You do not have access rights to contract.", "en");
                        return;
                    }
 
                    ClientInformation ClientInfo = await this.GetNetworkIdentity(RemoteId, true, true, Contract.Version);
                    CaseInsensitiveString RemoteJid = ClientInfo.Jid;
 
                    this.ContractAuthorization(RemoteJid, e.From.BareJid, ContractId, Authorized);
                }
 
                await e.IqResult(string.Empty, e.To);
            }
            catch (Exception ex)
            {
                await e.IqError(ex, e.To);
            }
        }
 
        #endregion
 
        #region Third-party peer reviews
 
        private async Task GetReviewIdProvidersHandler(object Sender, IqEventArgs e)
        {
            if (!this.Server.IsServerDomain(e.From.Domain, true) || !e.From.HasAccount)
            {
                await e.IqErrorForbidden(e.To, "Access to service providers only granted to accounts on broker.", "en");
                return;
            }
 
            CaseInsensitiveString AccountName = e.From.Account;
            IAccount Account = await XmppServerModule.GetAccountAsync(AccountName);
            if (Account is null)
            {
                await e.IqErrorForbidden(e.To, "Access to service providers only granted to accounts on broker.", "en");
                return;
            }
 
            if (!Account.Enabled)
            {
                await e.IqErrorForbidden(e.To, "Account has been disabled.", "en");
                return;
            }
 
            LegalIdentity IdentityApplication = await Database.FindFirstIgnoreRest<LegalIdentity>(new FilterAnd(
                new FilterFieldEqualTo("Account", AccountName),
                new FilterFieldEqualTo("State", Legal.Identity.IdentityState.Created)), "-Created");
 
            if (IdentityApplication is null)
            {
                await e.IqErrorForbidden(e.To, "No Identity Application found.", "en");
                return;
            }
 
            KeyValuePair<string, object>[] Tags = IdentityApplication.GetTags();
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<providers xmlns='");
            Xml.Append(e.Query.NamespaceURI);
            Xml.Append("'>");
 
            foreach (IPeerReviewService Service in await this.GetPeerReviewServices(Tags, true, true))
            {
                Xml.Append("<provider id='");
                Xml.Append(XML.Encode(Service.Id));
                Xml.Append("' type='");
                Xml.Append(XML.Encode(Service.PeerReviewServiceProvider.GetType().FullName));
                Xml.Append("' name='");
                Xml.Append(XML.Encode(Service.Name));
                Xml.Append("' legalId='");
                Xml.Append(XML.Encode(Service.PeerReviewerLegalId));
                Xml.Append("' external='");
                Xml.Append(CommonTypes.Encode(Service.External));
 
                if (!string.IsNullOrEmpty(Service.IconUrl))
                {
                    Xml.Append("' iconUrl='");
                    Xml.Append(XML.Encode(Service.IconUrl));
                    Xml.Append("' iconWidth='");
                    Xml.Append(Service.IconWidth.ToString());
                    Xml.Append("' iconHeight='");
                    Xml.Append(Service.IconHeight.ToString());
                }
 
                Xml.Append("'/>");
            }
 
            Xml.Append("</providers>");
 
            await e.IqResult(Xml.ToString(), e.To);
        }
 
        private async Task SelectReviewServiceHandler(object Sender, IqEventArgs e)
        {
            if (!this.Server.IsServerDomain(e.From.Domain, true) || !e.From.HasAccount)
            {
                await e.IqErrorForbidden(e.To, "Access to service providers only granted to accounts on broker.", "en");
                return;
            }
 
            CaseInsensitiveString AccountName = e.From.Account;
            IAccount Account = await XmppServerModule.GetAccountAsync(AccountName);
            if (Account is null)
            {
                await e.IqErrorForbidden(e.To, "Access to service providers only granted to accounts on broker.", "en");
                return;
            }
 
            if (!Account.Enabled)
            {
                await e.IqErrorForbidden(e.To, "Account has been disabled.", "en");
                return;
            }
 
            string ServiceProvider = XML.Attribute(e.Query, "provider");
            string ServiceId = XML.Attribute(e.Query, "serviceId");
 
            Type T = Types.GetType(ServiceProvider);
 
            if (T is null)
            {
                await e.IqErrorItemNotFound(e.To, "Service provider not found.", "en");
                return;
            }
 
            if (!typeof(IPeerReviewServiceProvider).IsAssignableFrom(T))
            {
                await e.IqErrorBadRequest(e.To, "Invalid service provider.", "en");
                return;
            }
 
            LegalIdentity IdentityApplication = await Database.FindFirstIgnoreRest<LegalIdentity>(new FilterAnd(
                new FilterFieldEqualTo("Account", AccountName),
                new FilterFieldEqualTo("State", Legal.Identity.IdentityState.Created)), "-Created");
 
            if (IdentityApplication is null)
            {
                await e.IqErrorForbidden(e.To, "No Identity Application found.", "en");
                return;
            }
 
            KeyValuePair<string, object>[] Tags = IdentityApplication.GetTags();
            IPeerReviewServiceProvider Provider = (IPeerReviewServiceProvider)Types.Instantiate(T);
            IPeerReviewService Service = await Provider.GetServiceForPeerReview(ServiceId, Tags);
 
            if (Service is null)
            {
                await e.IqErrorItemNotFound(e.To, "Peer-review service not found.", "en");
                return;
            }
 
            this.SelectServiceProvider(AccountName, Service);
 
            await e.IqResult(string.Empty, e.To);
        }
 
        internal void SelectServiceProvider(string AccountName, IPeerReviewService Service)
        {
            lock (this.selectedServicePerAccount)
            {
                this.selectedServicePerAccount[AccountName] = Service;
            }
        }
 
        private readonly Dictionary<CaseInsensitiveString, IPeerReviewService> selectedServicePerAccount = new Dictionary<CaseInsensitiveString, IPeerReviewService>();
 
        internal async Task<IPeerReviewService[]> GetPeerReviewServices(KeyValuePair<string, object>[] Tags, bool IncludeInternal, bool IncludeExternal)
        {
            List<IPeerReviewService> Result = new List<IPeerReviewService>();
            Type[] ServiceTypes = Types.GetTypesImplementingInterface(typeof(IPeerReviewServiceProvider));
 
            foreach (Type T in ServiceTypes)
            {
                ConstructorInfo CI = Types.GetDefaultConstructor(T);
                if (CI is null)
                    continue;
 
                IPeerReviewServiceProvider ServiceProvider = (IPeerReviewServiceProvider)CI.Invoke(Types.NoParameters);
                IPeerReviewService[] Services = await ServiceProvider.GetServicesForPeerReview(Tags);
 
                foreach (IPeerReviewService Service in Services)
                {
                    if (Service.External)
                    {
                        if (IncludeExternal)
                            Result.Add(Service);
                    }
                    else
                    {
                        if (IncludeInternal)
                            Result.Add(Service);
                    }
                }
            }
 
            return Result.ToArray();
        }
 
        private async Task ContractsClient_PetitionForPeerReviewIDReceived(object Sender,
            Networking.XMPP.Contracts.EventArguments.SignaturePetitionEventArgs e)
        {
            try
            {
                if (Gateway.ContractsClient is null)
                    return;
 
                KeyValuePair<string, object>[] Tags = e.RequestorIdentity.GetTags();
                XmppAddress From = new XmppAddress(e.RequestorFullJid);
 
                if (!From.HasAccount || !this.Server.IsServerDomain(From.Domain, true))
                {
                    Log.Warning("Peer-review request denied. Access to service providers only granted to accounts on broker.",
                        e.RequestorIdentity.Id, e.From, Tags);
 
                    await Gateway.ContractsClient.PetitionSignatureResponseAsync(e.SignatoryIdentityId, e.ContentToSign,
                        Array.Empty<byte>(), e.PetitionId, e.RequestorFullJid, false);
 
                    return;
                }
 
                CaseInsensitiveString AccountName = From.Account;
                IAccount Account = await XmppServerModule.GetAccountAsync(AccountName);
 
                if (Account is null)
                {
                    Log.Warning("Peer-review request denied. Access to service providers only granted to accounts on broker.",
                        e.RequestorIdentity.Id, e.From, Tags);
 
                    await Gateway.ContractsClient.PetitionSignatureResponseAsync(e.SignatoryIdentityId, e.ContentToSign,
                        Array.Empty<byte>(), e.PetitionId, e.RequestorFullJid, false);
 
                    return;
                }
 
                if (!Account.Enabled)
                {
                    Log.Warning("Peer-review request denied. Account has been disabled.",
                        e.RequestorIdentity.Id, e.From, Tags);
 
                    await Gateway.ContractsClient.PetitionSignatureResponseAsync(e.SignatoryIdentityId, e.ContentToSign,
                        Array.Empty<byte>(), e.PetitionId, e.RequestorFullJid, false);
 
                    return;
                }
 
                XmppAddress RequestorIdentityId = new XmppAddress(e.RequestorIdentity.Id);
                if (!this.IsComponentDomain(RequestorIdentityId.Domain, true))
                {
                    Log.Warning("Peer-review request denied. Requestor legal identity not on the server.",
                        e.RequestorIdentity.Id, e.From, Tags);
 
                    await Gateway.ContractsClient.PetitionSignatureResponseAsync(e.SignatoryIdentityId, e.ContentToSign,
                        Array.Empty<byte>(), e.PetitionId, e.RequestorFullJid, false);
 
                    return;
                }
 
                LegalIdentity LocalRequestorIdentity = await Database.FindFirstIgnoreRest<LegalIdentity>(
                    new FilterFieldEqualTo("Id", RequestorIdentityId));
 
                if (LocalRequestorIdentity is null)
                {
                    Log.Warning("Peer-review request denied. Proposed identity did not exist on server.",
                        e.RequestorIdentity.Id, e.From, Tags);
 
                    await Gateway.ContractsClient.PetitionSignatureResponseAsync(e.SignatoryIdentityId, e.ContentToSign,
                        Array.Empty<byte>(), e.PetitionId, e.RequestorFullJid, false);
 
                    return;
                }
 
                StringBuilder Xml1 = new StringBuilder();
                StringBuilder Xml2 = new StringBuilder();
 
                LocalRequestorIdentity.Serialize(Xml1, true, true, true, true, true, true, false, null, this);
                e.RequestorIdentity.Serialize(Xml2, true, true, true, true, true, true, false);
 
                if (Xml1.ToString() != Xml2.ToString())
                {
                    Log.Warning("Peer-review request denied. Requestor legal identity representation not the same as local version.",
                        e.RequestorIdentity.Id, e.From, Tags);
 
                    await Gateway.ContractsClient.PetitionSignatureResponseAsync(e.SignatoryIdentityId, e.ContentToSign,
                        Array.Empty<byte>(), e.PetitionId, e.RequestorFullJid, false);
 
                    return;
                }
 
                IPeerReviewService[] PeerReviewServices = await this.GetPeerReviewServices(Tags, true, false);
 
                if (PeerReviewServices.Length == 0)
                {
                    Log.Warning("Peer-review request denied. No local peer review services found.",
                        e.RequestorIdentity.Id, e.From, Tags);
 
                    await Gateway.ContractsClient.PetitionSignatureResponseAsync(e.SignatoryIdentityId, e.ContentToSign,
                        Array.Empty<byte>(), e.PetitionId, e.RequestorFullJid, false);
 
                    return;
                }
 
                IPeerReviewService PeerReviewService;
 
                lock (this.selectedServicePerAccount)
                {
                    if (!this.selectedServicePerAccount.TryGetValue(AccountName, out PeerReviewService))
                        PeerReviewService = null;
                }
 
                if (PeerReviewService is null)
                {
                    Log.Warning("Peer-review request denied. No selected peer review service provider.",
                        e.RequestorIdentity.Id, e.From, Tags);
 
                    await Gateway.ContractsClient.PetitionSignatureResponseAsync(e.SignatoryIdentityId, e.ContentToSign,
                        Array.Empty<byte>(), e.PetitionId, e.RequestorFullJid, false);
 
                    return;
                }
 
                string Namespace = NamespaceLegalIdentity(LocalRequestorIdentity.Version);
                KeyValuePair<IPhoto[], XmlDocument[]> P = await GetPhotosAndDocuments(LocalRequestorIdentity, false);
                IdentityReviewApplication Application = new IdentityReviewApplication(
                    e.RequestorIdentity.Id, Namespace, false,
                    GetPersonalInformation(LocalRequestorIdentity),
                    LocalRequestorIdentity.GetTags(),
                    P.Key, P.Value, Account, e.Purpose, e.ClientEndpoint);
 
                try
                {
                    await PeerReviewService.Validate(Application, async (sender, e2) =>
                    {
                        StringBuilder Message = new StringBuilder();
 
                        Message.Append("<petitionClientUrl xmlns='");
                        Message.Append(Namespace);
                        Message.Append("' pid='");
                        Message.Append(XML.Encode(e.PetitionId));
                        Message.Append("' url='");
                        Message.Append(XML.Encode(e2.Url));
                        Message.Append("'/>");
 
                        await this.Server.SendMessage(string.Empty, string.Empty, e.To, From.BareJid, string.Empty, Message.ToString());
                        // Note: Client may have a new XMPP connection at this point.
                    }, null);
                }
                catch (Exception ex)
                {
                    Application.ReportError(ex.Message, string.Empty, string.Empty,
                        ValidationErrorType.Service, PeerReviewService);
                }
 
                if (!Application.IsValid.HasValue)
                {
                    string Xml = Application.GetClientErrorMessageXml(out string Language,
                        "Unable to validate the review.", "UnableReview", "en");
 
                    await this.Server.SendMessage(string.Empty, string.Empty, e.To,
                        e.RequestorFullJid, Language, Xml);
                }
                else
                {
                    if (Application.IsValid.Value)
                    {
                        // Valid application
 
                        byte[] Signature = await Gateway.ContractsClient.SignAsync(e.ContentToSign,
                            Networking.XMPP.Contracts.SignWith.LatestApprovedId);
 
                        await Gateway.ContractsClient.PetitionSignatureResponseAsync(e.SignatoryIdentityId, e.ContentToSign,
                            Signature, e.PetitionId, e.RequestorFullJid, true);
                    }
                    else
                    {
                        // Invalid application
 
                        if (Application.HasErrors)
                        {
                            foreach (ValidationError Error in Application.Errors)
                            {
                                switch (Error.ErrorType)
                                {
                                    case ValidationErrorType.Server:
                                    case ValidationErrorType.Service:
                                        Log.Error(Error.ErrorMessage, string.Empty,
                                            Error.Service.GetType().Namespace, Error.ErrorCode,
                                            Error.Tags);
                                        break;
 
                                    case ValidationErrorType.Client:
                                        Log.Warning(Error.ErrorMessage, string.Empty,
                                            Error.Service.GetType().Namespace, Error.ErrorCode,
                                            Error.Tags);
                                        break;
                                }
                            }
                        }
 
                        string Xml = Application.GetClientErrorMessageXml(out string Language,
                            "Unable to validate the review.", "UnableReview", "en");
 
                        await this.Server.SendMessage(string.Empty, string.Empty, e.To,
                            e.RequestorFullJid, Language, Xml);
 
                        await Gateway.ContractsClient.PetitionSignatureResponseAsync(e.SignatoryIdentityId, e.ContentToSign,
                            Array.Empty<byte>(), e.PetitionId, e.RequestorFullJid, false);
                    }
                }
            }
            catch (Exception ex)
            {
                Log.Exception(ex);
            }
        }
 
        #endregion
 
        // TODO: Delete Account => Delete bareJid-portion of legal identities registered for 
        //          account, and delete legal identities not referenced in contracts.
    }
}