CreateWebForm.cs

using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Waher.Content;
using Waher.Content.Json;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.Counters;
using Waher.Security.JWT;
using Waher.Security.LoginMonitor;
using Waher.Service.IoTBroker.DataStorage;
using Waher.Service.IoTBroker.Legal;
 
namespace Waher.Service.IoTBroker.WebServices.Agent.Account
{
    public class CreateWebForm : AgentResource, IHttpPostMethod
    {
        public CreateWebForm()
            : base("Account/CreateWebForm")
        {
        }
 
        public override HttpAuthenticationScheme[] GetAuthenticationSchemes(HttpRequest Request)
        {
            base.GetAuthenticationSchemes(Request);     // Initialize factory property.
            return null;
        }
 
        public override bool UserSessions => true;
 
        public virtual bool AllowsPOST => true;
 
        public async Task POST(HttpRequest Request, HttpResponse Response)
        {
            await this.CheckBlocks(Request);
 
            if (this.Api is null)
            {
                await Response.SendResponse(new ServiceUnavailableException("API not available."));
                return;
            }
 
            if (!Request.HasData)
            {
                await Response.SendResponse(new BadRequestException("No content is request."));
                return;
            }
 
            ContentResponse Decoded = await Request.DecodeDataAsync();
 
            if (Decoded.HasError)
            {
                await Response.SendResponse(Decoded.Error);
                return;
            }
 
            if (!(Decoded.Decoded is Dictionary<string, string> Form))
            {
                await Response.SendResponse(new UnsupportedMediaTypeException("Content does not match specification."));
                return;
            }
 
            if (!Form.TryGetValue("UserName", out string UserName) || string.IsNullOrEmpty(UserName))
            {
                await Response.SendResponse(new BadRequestException("Missing user name."));
                return;
            }
 
            if (!Form.TryGetValue("EMail", out string EMail) || string.IsNullOrEmpty(EMail))
            {
                await Response.SendResponse(new BadRequestException("Missing e-mail address."));
                return;
            }
 
            if (!Form.TryGetValue("PhoneNr", out string PhoneNr))
                PhoneNr = string.Empty;
 
            if (!Form.TryGetValue("Language", out string Language))
                Language = string.Empty;
 
            if (!Form.TryGetValue("Password", out string Password) || string.IsNullOrEmpty(Password))
            {
                await Response.SendResponse(new BadRequestException("Missing password."));
                return;
            }
 
            if (!Form.TryGetValue("g-recaptcha-response", out string RecaptchaResponse) || string.IsNullOrEmpty(RecaptchaResponse))
            {
                await Response.SendResponse(new BadRequestException("Missing reCaptcha-response."));
                return;
            }
 
            if (!Form.TryGetValue("RedirectionUrl", out string RedirectionUrl) || string.IsNullOrEmpty(RedirectionUrl))
            {
                await Response.SendResponse(new BadRequestException("Missing redirection URL."));
                return;
            }
 
            if (!Form.TryGetValue("Seconds", out string s) || !int.TryParse(s, out int Seconds) || Seconds <= 0 || Seconds > 3600)
            {
                await Response.SendResponse(new BadRequestException("Invalid number of seconds."));
                return;
            }
 
            if (Gateway.HasDomain &&
                !await Feedback.SiteVerify(RecaptchaResponse, Request.RemoteEndPoint))
            {
                await Response.SendResponse(new ForbiddenException(Request, "Bot?"));
                return;
            }
 
            if (!string.IsNullOrEmpty(PhoneNr) && !Create.InternationalNumberFormat.IsMatch(PhoneNr))
            {
                await Response.SendResponse(new BadRequestException("Phone numbers must be provided using the international number format, starting with +, then the country code, then the number."));
                return;
            }
 
            if (!await Create.AssertUserNameValid(UserName, Response))
                return;
 
            ApiKey Key = await AgentApi.GetAgentApiApiKey();
            if (Key is null)
            {
                string Msg = "Resource disabled. No Agent API Key configured.";
                await Response.SendResponse(new ServiceUnavailableException(Msg));
                return;
            }
 
            bool SendEMailCode = !string.IsNullOrEmpty(EMail);
            bool SendPhoneCode = !string.IsNullOrEmpty(PhoneNr);
 
            DataStorage.Account Account = await Database.FindFirstIgnoreRest<DataStorage.Account>(
                new FilterFieldEqualTo("UserName", UserName));
 
            if (Account is null)
            {
                if (Key.NrCreated - Key.NrDeleted >= Key.MaxAccounts)
                {
                    await Response.SendResponse(new ServiceUnavailableException("API Key account limit reached."));
                    return;
                }
 
                Account = new DataStorage.Account()
                {
                    ApiKey = Key.Key,
                    UserName = UserName,
                    Password = Password,
                    EMail = EMail,
                    EMailVerified = null,
                    PhoneNr = PhoneNr,
                    PhoneNrVerified = null,
                    Enabled = false,
                    CanRelayMessages = false,
                    Created = DateTime.UtcNow
                };
 
                await Database.Insert(Account);
                await RuntimeCounters.IncrementCounter(DataStorage.Account.AccountCreatedCounterName);
 
                Key.NrCreated++;
                await Database.Update(Key);
 
                await PersistenceLayer.AccountCreated(Account, Key, Gateway.Domain, Request.RemoteEndPoint);
            }
            else
            {
                if (Account.Password != Password)
                {
                    await Response.SendResponse(new ForbiddenException(Request, "Account already exists.", 
                        await Create.GetAlterntiveNameSuggestions(UserName)));
                    return;
                }
 
                bool Updated = false;
 
                if (Account.EMail == EMail)
                    SendEMailCode = !Account.EMailVerified.HasValue;
                else
                {
                    if (Account.Enabled && !CaseInsensitiveString.IsNullOrEmpty(Account.EMail))
                    {
                        await Response.SendResponse(new ForbiddenException(Request, "Not permitted to change e-mail address."));
                        return;
                    }
 
                    Account.EMail = EMail;
                    Account.EMailVerified = null;
 
                    Updated = true;
                }
 
                if (Account.PhoneNr == PhoneNr)
                    SendPhoneCode = !Account.PhoneNrVerified.HasValue;
                else
                {
                    if (Account.Enabled && !CaseInsensitiveString.IsNullOrEmpty(Account.PhoneNr))
                    {
                        await Response.SendResponse(new ForbiddenException(Request, "Not permitted to change phone number."));
                        return;
                    }
 
                    Account.PhoneNr = PhoneNr;
                    Account.PhoneNrVerified = null;
 
                    Updated = true;
                }
 
                if (Updated)
                {
                    Account.Updated = DateTime.UtcNow;
                    await Database.Update(Account);
                    await XmppServerModule.PersistenceLayer.AccountUpdated(UserName);
                }
 
                await Account.LoggedIn(Request.RemoteEndPoint);
            }
 
            LoginAuditor.Success("Successful Agent API account created.", UserName, Request.RemoteEndPoint, "HTTPS");
 
            if (!Account.Enabled)
            {
                string OnboardingDomainName = await LegalComponent.GetOnboardingNeuronDomainName();
 
                if (SendEMailCode)
                {
                    ContentResponse ContentResponse = await InternetContent.PostAsync(
                    new Uri("https://" + OnboardingDomainName + "/ID/SendVerificationMessage.ws"),
                    new Dictionary<string, object>()
                    {
                        { "EMail", Account.EMail.Value },
                        { "Language", Language }
                    },
                    new KeyValuePair<string, string>("Accept", JsonCodec.DefaultContentType));
 
                    if (ContentResponse.HasError)
                    {
                        await Response.SendResponse(ContentResponse.Error);
                        return;
                    }
 
                    if (!(ContentResponse.Decoded is Dictionary<string, object> EMailResult))
                    {
                        await Response.SendResponse(new ServiceUnavailableException("Unable to send verification mail. Unexpected result"));
                        return;
                    }
 
                    if (!EMailResult.TryGetValue("Status", out object Obj) || !(Obj is bool Status) || !Status)
                    {
                        if (EMailResult.TryGetValue("Message", out Obj) && Obj is string Message)
                            await Response.SendResponse(new ServiceUnavailableException("Unable to send verification mail. Error reported: " + Message));
                        else
                            await Response.SendResponse(new ServiceUnavailableException("Unable to send verification mail. Check e-mail address provided."));
 
                        return;
                    }
                }
 
                if (SendPhoneCode)
                {
                    ContentResponse ContentResponse = await InternetContent.PostAsync(
                        new Uri("https://" + OnboardingDomainName + "/ID/SendVerificationMessage.ws"),
                        new Dictionary<string, object>()
                        {
                            { "Nr", Account.PhoneNr.Value },
                            { "Language", Language }
                        },
                        new KeyValuePair<string, string>("Accept", JsonCodec.DefaultContentType));
 
                    if (ContentResponse.HasError)
                    {
                        await Response.SendResponse(ContentResponse.Error);
                        return;
                    }
 
                    if (!(ContentResponse.Decoded is Dictionary<string, object> SmsResult))
                    {
                        await Response.SendResponse(new ServiceUnavailableException("Unable to send verification mail. Unexpected result"));
                        return;
                    }
 
                    if (!SmsResult.TryGetValue("Status", out object Obj) || !(Obj is bool Status2) || !Status2)
                    {
                        if (SmsResult.TryGetValue("Message", out Obj) && Obj is string Message)
                            await Response.SendResponse(new ServiceUnavailableException("Unable to send verification SMS. Error reported: " + Message));
                        else
                            await Response.SendResponse(new ServiceUnavailableException("Unable to send verification SMS. Check phone number provided."));
 
                        return;
                    }
                }
            }
 
            int IssuedAt = (int)Math.Round(DateTime.UtcNow.Subtract(JSON.UnixEpoch).TotalSeconds);
            int Expires = IssuedAt + (int)Seconds;
 
            string Token = Factory.Create(
                new KeyValuePair<string, object>(JwtClaims.JwtId, Convert.ToBase64String(Gateway.NextBytes(32))),
                new KeyValuePair<string, object>(JwtClaims.Issuer, Gateway.Domain?.Value ?? string.Empty),
                new KeyValuePair<string, object>(JwtClaims.Subject, Account.UserName.Value + "@" + (Gateway.Domain?.Value ?? string.Empty)),
                new KeyValuePair<string, object>(JwtClaims.IssueTime, IssuedAt),
                new KeyValuePair<string, object>(JwtClaims.ExpirationTime, Expires));
 
            Request.Session[SessionTokenInfoVariableName] = new SessionTokenInfo()
            {
                Account = Account,
                Token = Token,
                Expires = Expires,
                Seconds = Seconds
            };
 
            await Response.SendResponse(new TemporaryRedirectException(RedirectionUrl));
        }
 
        public const string SessionTokenInfoVariableName = " AgentAPI.SessionTokenInfo ";
    }
}