OAuth2Environment.cs

using System;
using System.IO;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Threading.Tasks;
using Waher.Content;
using Waher.Events;
using Waher.Networking.HTTP.OAuth.Events;
using Waher.Networking.HTTP.OAuth.Interfaces;
using Waher.Runtime.Inventory;
using Waher.Security;
using Waher.Security.JWT;
 
namespace Waher.Networking.HTTP.OAuth
{
    public class OAuth2Environment : IDisposable
    {
        private static readonly RandomNumberGenerator rnd = RandomNumberGenerator.Create();
 
        private OAuthAuthorizeResource? authorizeResource = null;
        private OAuthTokenResource? tokenResource = null;
        private OAuthRegistrationResource? registrationResource = null;
        private OAuthManagementResource? managementResource = null;
        private OAuthDeviceAuthorizationResource? deviceAuthorizationResource = null;
        private OAuthIntrospectionResource? introspectionResource = null;
        private AuthorizationServerMetaData? serverMetaDataResource = null;
        private ProtectedResourceMetaData? resourceMetaData = null;
        private IUserSource? userSource = null;
        private IDynamicUserSource? dynamicUserSource = null;
        private IThingRegistryUserSource? thingRegistryUserSource = null;
        private JwtFactory? jwtFactory;
        private event EventHandlerAsync<CustomizeMarkdownEventArgs>? customizeLoginForm;
        private event EventHandlerAsync<CustomizeMarkdownEventArgs>? customizeDeviceLoginForm;
        private event EventHandlerAsync<CustomizeMarkdownEventArgs>? customizeDeviceLoginReceipt;
        private string? loginMasterFileName;
        private string? realm;
        private int minStrength;
        private bool encrypted;
        private bool locked = false;
        private bool disposed = false;
 
        public OAuth2Environment()
        {
            if (!Types.TryGetModuleParameter("Users", out IUserSource UserSource))
                UserSource = Security.Users.Users.Source; // Default users source
 
            this.Register(UserSource);
        }
 
        public bool Disposed => this.disposed;
 
        public void Dispose()
        {
            this.disposed = true;
        }
 
        public bool HasAuthorizeResource => !(this.authorizeResource is null);
 
        public bool HasTokenResource => !(this.tokenResource is null);
 
        public bool HasRegistrationResource => !(this.registrationResource is null);
 
        public bool HasManagementResource => !(this.managementResource is null);
 
        public bool HasDeviceAuthorizationResource => !(this.deviceAuthorizationResource is null);
 
        public bool HasIntrospectionResource => !(this.introspectionResource is null);
 
        public bool HasServerMetaDataResource => !(this.serverMetaDataResource is null);
 
        public bool HasResourceMetaData => !(this.resourceMetaData is null);
 
        public bool HasUserSource => !(this.userSource is null);
 
        public bool HasDynamicUserSource => !(this.dynamicUserSource is null);
 
        public bool HasThingRegistryUserSource => !(this.thingRegistryUserSource is null);
 
        public bool HasLoginMasterFileName => !string.IsNullOrEmpty(this.loginMasterFileName);
 
        public OAuthAuthorizeResource AuthorizeResource
        {
            get
            {
                if (this.authorizeResource is null)
                    throw new InvalidOperationException("No authorize resource has been registered.");
 
                return this.authorizeResource;
            }
        }
 
        public OAuthTokenResource TokenResource
        {
            get
            {
                if (this.tokenResource is null)
                    throw new InvalidOperationException("No token resource has been registered.");
 
                return this.tokenResource;
            }
        }
 
        public OAuthRegistrationResource RegistrationResource
        {
            get
            {
                if (this.registrationResource is null)
                    throw new InvalidOperationException("No registration resource has been registered.");
 
                return this.registrationResource;
            }
        }
 
        public OAuthManagementResource ManagementResource
        {
            get
            {
                if (this.managementResource is null)
                    throw new InvalidOperationException("No management resource has been registered.");
 
                return this.managementResource;
            }
        }
 
        public OAuthDeviceAuthorizationResource DeviceAuthorizationResource
        {
            get
            {
                if (this.deviceAuthorizationResource is null)
                    throw new InvalidOperationException("No device authorization resource has been registered.");
 
                return this.deviceAuthorizationResource;
            }
        }
 
        public OAuthIntrospectionResource IntrospectionResource
        {
            get
            {
                if (this.introspectionResource is null)
                    throw new InvalidOperationException("No introspection resource has been registered.");
 
                return this.introspectionResource;
            }
        }
 
        public AuthorizationServerMetaData ServerMetaDataResource
        {
            get
            {
                if (this.serverMetaDataResource is null)
                    throw new InvalidOperationException("No server meta-data resource has been registered.");
 
                return this.serverMetaDataResource;
            }
        }
 
        public ProtectedResourceMetaData ResourceMetaData
        {
            get
            {
                if (this.resourceMetaData is null)
                    throw new InvalidOperationException("No resource meta-data resource has been registered.");
 
                return this.resourceMetaData;
            }
        }
 
        public IUserSource UserSource
        {
            get
            {
                if (this.userSource is null)
                    throw new InvalidOperationException("No user source has been registered.");
 
                return this.userSource;
            }
        }
 
        public IDynamicUserSource DynamicUserSource
        {
            get
            {
                if (this.dynamicUserSource is null)
                    throw new InvalidOperationException("No dynamic user source has been registered.");
 
                return this.dynamicUserSource;
            }
        }
 
        public IThingRegistryUserSource ThingRegistryUserSource
        {
            get
            {
                if (this.thingRegistryUserSource is null)
                    throw new InvalidOperationException("No thing registry user source has been registered.");
 
                return this.thingRegistryUserSource;
            }
        }
 
        public JwtFactory JwtFactory
        {
            get
            {
                if (this.jwtFactory is null)
                {
                    if (Types.TryGetModuleParameter("JWT", out JwtFactory JwtFactory) &&
                        !JwtFactory.Disposed)
                    {
                        this.jwtFactory = JwtFactory;
                    }
                    else
                        this.jwtFactory = JwtFactory.CreateHmacSha256(this.realm);
                }
 
                return this.jwtFactory;
            }
        }
 
        public string? LoginMasterFileName
        {
            get => this.loginMasterFileName;
            set
            {
                this.AssertUnlocked();
 
                if (!string.IsNullOrEmpty(value) && !File.Exists(value))
                    throw new FileNotFoundException("Login master file not found.", value);
 
                this.loginMasterFileName = value;
            }
        }
 
        public bool Locked => this.locked;
 
        public string? Realm
        {
            get
            {
                this.CheckDomainParameters();
                return this.realm;
            }
        }
 
        public int MinStrength
        {
            get
            {
                this.CheckDomainParameters();
                return this.minStrength;
            }
        }
 
        public bool Encrypted
        {
            get
            {
                this.CheckDomainParameters();
                return this.encrypted;
            }
        }
 
        private void AssertUnlocked()
        {
            if (this.locked)
                throw new UnauthorizedAccessException("OAUTH 2 environment is locked and cannot be modified.");
        }
 
        public void Lock()
        {
            this.AssertUnlocked();
            this.locked = true;
        }
 
        public void Register(OAuthAuthorizeResource? AuthorizeResource)
        {
            this.AssertUnlocked();
            this.authorizeResource = AuthorizeResource;
        }
 
        public void Register(OAuthTokenResource? TokenResource)
        {
            this.AssertUnlocked();
            this.tokenResource = TokenResource;
        }
 
        public void Register(OAuthRegistrationResource? RegistrationResource)
        {
            this.AssertUnlocked();
            this.registrationResource = RegistrationResource;
        }
 
        public void Register(OAuthManagementResource? ManagementResource)
        {
            this.AssertUnlocked();
            this.managementResource = ManagementResource;
        }
 
        public void Register(OAuthDeviceAuthorizationResource? DeviceAuthorizationResource)
        {
            this.AssertUnlocked();
            this.deviceAuthorizationResource = DeviceAuthorizationResource;
        }
 
        public void Register(OAuthIntrospectionResource? IntrospectionResource)
        {
            this.AssertUnlocked();
            this.introspectionResource = IntrospectionResource;
        }
 
        public void Register(AuthorizationServerMetaData? ServerMetaDataResource)
        {
            this.AssertUnlocked();
            this.serverMetaDataResource = ServerMetaDataResource;
        }
 
        public void Register(ProtectedResourceMetaData? ResourceMetaData)
        {
            this.AssertUnlocked();
            this.resourceMetaData = ResourceMetaData;
        }
 
        public void Register(IUserSource? UserSource)
        {
            this.AssertUnlocked();
            this.userSource = UserSource;
            this.dynamicUserSource = UserSource as IDynamicUserSource;
            this.thingRegistryUserSource = UserSource as IThingRegistryUserSource;
        }
 
        public void Register(JwtFactory JwtFactory)
        {
            this.AssertUnlocked();
            this.jwtFactory = JwtFactory;
        }
 
        public void Register(string Realm, int MinStrength, bool Encrypted)
        {
            this.AssertUnlocked();
            this.realm = Realm;
            this.minStrength = MinStrength;
            this.encrypted = Encrypted;
        }
 
        private void CheckDomainParameters()
        {
            if (this.realm is null)
            {
                GetDomainParameters(out string? Domain, out int MinStrength, out bool Encrypted);
                this.realm = Domain;
                this.minStrength = MinStrength;
                this.encrypted = Encrypted;
            }
        }
 
        public static void GetDomainParameters(out string? Domain, out int MinStrength,
            out bool Encrypted)
        {
            if (!Types.TryGetModuleParameter("X509", out object Obj) ||
                !(Obj is X509Certificate Certificate))
            {
                if (Types.TryGetModuleParameter("Realm", out Obj) &&
                    Obj is string Realm)
                {
                    Domain = Realm;
                }
                else
                    Domain = null;
 
                Encrypted = false;
                MinStrength = 0;
            }
            else
            {
                Encrypted = true;
                Domain = BinaryTcpClient.GetDomainFromSubject(Certificate.Subject);
                MinStrength = 128;
            }
        }
 
        public static string GenerateRandomCode(int NrBytes)
        {
            byte[] Bin = new byte[NrBytes];
 
            lock (rnd)
            {
                rnd.GetBytes(Bin);
            }
 
            return Base64Url.Encode(Bin);
        }
 
        public event EventHandlerAsync<CustomizeMarkdownEventArgs>? CustomizeLoginForm
        {
            add
            {
                this.AssertUnlocked();
                this.customizeLoginForm += value;
            }
            remove
            {
                this.AssertUnlocked();
                this.customizeLoginForm -= value;
            }
        }
 
        public async Task<string> RaiseCustomizeLoginForm(string Markdown)
        {
            if (this.customizeLoginForm is null)
                return Markdown;
 
            CustomizeMarkdownEventArgs e = new CustomizeMarkdownEventArgs(Markdown);
            await this.customizeLoginForm.Raise(this, e);
            return e.Markdown;
        }
 
        public event EventHandlerAsync<CustomizeMarkdownEventArgs>? CustomizeDeviceLoginForm
        {
            add
            {
                this.AssertUnlocked();
                this.customizeDeviceLoginForm += value;
            }
            remove
            {
                this.AssertUnlocked();
                this.customizeDeviceLoginForm -= value;
            }
        }
 
        public async Task<string> RaiseCustomizeDeviceLoginForm(string Markdown)
        {
            if (this.customizeDeviceLoginForm is null)
                return Markdown;
 
            CustomizeMarkdownEventArgs e = new CustomizeMarkdownEventArgs(Markdown);
            await this.customizeDeviceLoginForm.Raise(this, e);
            return e.Markdown;
        }
 
        public event EventHandlerAsync<CustomizeMarkdownEventArgs>? CustomizeDeviceLoginReceipt
        {
            add
            {
                this.AssertUnlocked();
                this.customizeDeviceLoginReceipt += value;
            }
            remove
            {
                this.AssertUnlocked();
                this.customizeDeviceLoginReceipt -= value;
            }
        }
 
        public async Task<string> RaiseCustomizeDeviceLoginReceipt(string Markdown)
        {
            if (this.customizeDeviceLoginReceipt is null)
                return Markdown;
 
            CustomizeMarkdownEventArgs e = new CustomizeMarkdownEventArgs(Markdown);
            await this.customizeDeviceLoginReceipt.Raise(this, e);
            return e.Markdown;
        }
    }
}