PetitionSignature.cs

using System;
using System.Collections.Generic;
using System.Text;
using System.Threading.Tasks;
using System.Xml;
using Waher.Content;
using Waher.Content.Xml;
using Waher.IoTGateway;
using Waher.Networking.HTTP;
using Waher.Networking.XMPP.Server;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Script;
using Waher.Script.Abstraction.Elements;
using Waher.Security;
using Waher.Service.IoTBroker.DataStorage;
using Waher.Service.IoTBroker.Legal;
using Waher.Service.IoTBroker.Legal.Identity;
using Waher.Service.IoTBroker.WebServices.Agent.Crypto;
 
namespace Waher.Service.IoTBroker.WebServices.Agent.Legal
{
    public class PetitionSignature : AgentPostResource
    {
        public PetitionSignature()
            : base("Legal/PetitionSignature",
                new KeyValuePair<Type, Expression>(typeof(Dictionary<string, object>), new Expression(jsonPattern)),
                new KeyValuePair<Type, Expression>(typeof(XmlDocument), new Expression(xmlPattern)))
        {
        }
 
        private static readonly string jsonPattern = Resources.LoadResourceAsText(typeof(PetitionSignature).Namespace + ".JSON.PetitionSignature.req");
        private static readonly string xmlPattern = Resources.LoadResourceAsText(typeof(PetitionSignature).Namespace + ".XML.PetitionSignature.req");
 
        public override async Task POST(HttpRequest Request, HttpResponse Response, Dictionary<string, IElement> Parameters)
        {
            AccountUser User = AssertUserAuthenticated(Request);
 
            string KeyId = (string)Parameters["PKeyId"].AssociatedObjectValue;
            if (string.IsNullOrEmpty(KeyId))
                throw new BadRequestException("Key ID cannot be empty.");
 
            CaseInsensitiveString LegalId = (string)Parameters["PLegalId"].AssociatedObjectValue;
            if (CaseInsensitiveString.IsNullOrEmpty(LegalId))
                throw new BadRequestException("No Legal ID specified.");
 
            XmppAddress LegalIdAddress = new XmppAddress(LegalId);
            if (!LegalIdAddress.IsBareJID)
                throw new BadRequestException("Invalid Legal ID.");
 
            if (!(XmppServerModule.Legal is null) && !XmppServerModule.Legal.IsComponentDomain(LegalIdAddress.Domain, true))
                throw new BadRequestException("Not a local Legal ID.");
 
            CaseInsensitiveString RemoteId = (string)Parameters["PRemoteId"].AssociatedObjectValue;
            if (CaseInsensitiveString.IsNullOrEmpty(RemoteId))
                throw new BadRequestException("No Remote ID specified.");
 
            XmppAddress RemoteAddress = new XmppAddress(RemoteId);
            if (!RemoteAddress.IsBareJID)
                throw new BadRequestException("Invalid Remote ID.");
            
            AgentKey AgentKey = await Database.FindFirstDeleteRest<AgentKey>(new FilterAnd(
                new FilterFieldEqualTo("Account", User.UserName),
                new FilterFieldEqualTo("Id", KeyId)))
                ?? throw new NotFoundException("Key not found.");
 
            string ContentBase64 = (string)Parameters["PContentBase64"].AssociatedObjectValue;
            byte[] Content;
            string PetitionId = (string)Parameters["PPetitionId"].AssociatedObjectValue;
            string Purpose = (string)Parameters["PPurpose"].AssociatedObjectValue;
            string KeySignature = (string)Parameters["PKeySignature"].AssociatedObjectValue;
            string RequestSignature = (string)Parameters["PRequestSignature"].AssociatedObjectValue;
 
            try
            {
                Content = Convert.FromBase64String(ContentBase64);
            }
            catch (Exception)
            {
                throw new BadRequestException("Invalid base64-encoded data.");
            }
 
            string s = Encoding.UTF8.GetString(Content);
            if (s.StartsWith("<identity") && s.EndsWith("</identity>"))
                throw new ForbiddenException("Use the PetitionPeerReview request to ask a peer to sign a legal identity.");
 
            StringBuilder sb = new StringBuilder();
 
            sb.Append(User.UserName);
            sb.Append(':');
            sb.Append(Request.Header.Host.Value);
            sb.Append(':');
            sb.Append(AgentKey.LocalName);
            sb.Append(':');
            sb.Append(AgentKey.Namespace);
            sb.Append(':');
            sb.Append(KeyId);
 
            //string s1 = sb.ToString();
 
            sb.Append(':');
            sb.Append(KeySignature);
 
            //string s2 = sb.ToString();
 
            sb.Append(':');
            sb.Append(PetitionId);
            sb.Append(':');
            sb.Append(Purpose);
            sb.Append(':');
            sb.Append(LegalId);
            sb.Append(':');
            sb.Append(RemoteId);
            sb.Append(':');
            sb.Append(ContentBase64);
 
            string s3 = sb.ToString();
 
            s = Convert.ToBase64String(
                Hashes.ComputeHMACSHA256Hash(
                    Encoding.UTF8.GetBytes(User.Account.Password),
                    Encoding.UTF8.GetBytes(s3)));
 
            if (s != RequestSignature)
            {
                string Msg = "Request Signature invalid.";
                throw new ForbiddenException(Msg);
            }
 
            LegalIdentity Identity = await LegalComponent.GetLocalLegalIdentity(LegalId)
                ?? throw new NotFoundException("Legal identity not found.");
 
            if (User.UserName != Identity.Account)
                throw new ForbiddenException("Not your identity.");
 
            if (!(XmppServerModule.Legal is null))
            {
                LegalComponent.ClientInformation ClientInfo = await XmppServerModule.Legal.GetNetworkIdentity(RemoteId, true, false, Identity.Version);
                CaseInsensitiveString RemoteJid = ClientInfo.Jid;
                CaseInsensitiveString From = User.UserName + "@" + Gateway.Domain;
                XmppServerModule.Legal.IdentityAuthorization(RemoteJid, From, LegalId, true);
                Dictionary<string, string> AttachmentUrls = XmppServerModule.Legal.GetAttachmentUrls(Identity);
 
                StringBuilder Msg = new StringBuilder();
 
                Msg.Append("<petitionSignatureMsg id=\"");
                Msg.Append(XML.Encode(RemoteId));
                Msg.Append("\" pid=\"");
                Msg.Append(XML.Encode(PetitionId));
                Msg.Append("\" from=\"");
                Msg.Append(XML.Encode(From));
                Msg.Append("\" purpose=\"");
                Msg.Append(XML.Encode(Purpose));
                Msg.Append("\" clientEp=\"");
                Msg.Append(XML.Encode(Request.RemoteEndPoint));
                Msg.Append("\" xmlns=\"");
                Msg.Append(LegalComponent.NamespaceLegalIdentity(Identity.Version));
                Msg.Append("\"><content>");
                Msg.Append(ContentBase64);
                Msg.Append("</content>");
                Identity.Serialize(Msg, false, true, true, true, true, true, true, AttachmentUrls, XmppServerModule.Legal);
                Msg.Append("</petitionSignatureMsg>");
 
                await XmppServerModule.Server.SendMessage(string.Empty, string.Empty, 
                    XmppServerModule.Legal.MainDomain.Address, RemoteJid, string.Empty, 
                    Msg.ToString());
            }
 
            await Response.Return(new NamedDictionary<string, object>("AckResponse", AgentNamespace));
        }
    }
}