QuickLoginRemoteAuthentication.cs

using Paiwise;
using System;
using System.Collections.Generic;
using System.Text;
using System.Threading.Tasks;
using Waher.Events;
using Waher.IoTGateway;
using Waher.Networking.XMPP.Server;
using Waher.Security;
using Waher.Security.JWT;
 
namespace Waher.Service.IoTBroker.Legal.MFA
{
    internal class QuickLoginRemoteAuthentication : IRemoteAuthentication
    {
        private readonly string sessionId;
        private readonly bool usesChallengeUri;
        private XmppAddress address;
        private string serviceId;
        private string[] domainParts;
        private string jid;
        private string legalId;
        private string domain;
        private string subject;
        private bool hasLegalId;
        private bool hasJid;
        private EventHandlerAsync<RemoteAuthenticationEventArgs> callback;
        private object state;
 
        public QuickLoginRemoteAuthentication(string Jid, string LegalId)
        {
            this.jid = Jid;
            this.legalId = LegalId;
 
            this.hasLegalId = !string.IsNullOrEmpty(this.legalId);
            this.hasJid = !string.IsNullOrEmpty(this.jid);
            this.usesChallengeUri = !(this.hasLegalId || this.hasJid);
 
            if (this.hasLegalId)
            {
                this.sessionId = this.legalId;
                this.serviceId = null;
            }
            else if (this.hasJid)
            {
                this.sessionId = this.jid;
                this.serviceId = null;
            }
            else
            {
                this.sessionId = Guid.NewGuid().ToString();
                this.serviceId = QuickLogin.GetServiceID(this.sessionId);
            }
        }
 
        public string Key => this.sessionId;
 
        public Task<bool> IsValidAddress()
        {
            if (this.usesChallengeUri)
                return Task.FromResult(true);
 
            if (!(this.hasLegalId || this.hasJid))
                return Task.FromResult(false);
 
            this.address = new XmppAddress(this.hasLegalId ? this.legalId : this.jid);
            if (!this.address.IsBareJID)
                return Task.FromResult(false);
 
            this.domain = this.address.Domain;
 
            int i = this.domain.IndexOf('.');
            if (i < 0 || i >= this.domain.Length - 1)
                return Task.FromResult(false);
 
            if (this.hasLegalId)
            {
                if (!Guid.TryParse(this.address.Account, out _))
                    return Task.FromResult(false);
 
                this.domain = this.domain[(i + 1)..];
                this.subject = this.legalId;
            }
            else
                this.subject = this.jid;
 
            this.domainParts = this.domain.Split('.');
 
            return Task.FromResult(true);
        }
 
        public async Task<bool> IsLegalIdAvailable()
        {
            if (this.usesChallengeUri)
                return true;
 
            if (this.hasLegalId)
                return true;
 
            if (this.address is null)
                return false;
 
            string[] Identities = await XmppServerModule.Legal.GetIdentityReferences(this.address);
            if (Identities.Length == 0)
                return false;
 
            this.legalId = Identities[0];
            this.hasLegalId = true;
 
            return true;
        }
 
        public Task<bool> IsPermitted(IUser User)
        {
            if (this.usesChallengeUri)
                return Task.FromResult(true);
 
            int i, c = this.domainParts?.Length ?? 0;
 
            StringBuilder sb = new StringBuilder();
            sb.Append(nameof(RemoteLogin));
            sb.Append(".Domain");
 
            for (i = c - 1; i >= 0; i--)
            {
                sb.Append('.');
                sb.Append(this.domainParts[i]);
            }
 
            string Privilege = sb.ToString();
 
            return Task.FromResult(User.HasPrivilege(Privilege));
        }
 
        public Task<Uri> GetChallengeUri(string Purpose, string RemoteEndPoint)
        {
            if (!this.usesChallengeUri)
                return Task.FromResult<Uri>(null);
 
            if (string.IsNullOrEmpty(this.serviceId))
                this.serviceId = QuickLogin.GetServiceID(this.sessionId);
 
            string TagSignUrl = QuickLogin.GetTagSignUri(string.Empty, 
                this.serviceId, Purpose, RemoteEndPoint, null, null, 
                this.QuickLoginCallback, null);
 
            if (string.IsNullOrEmpty(TagSignUrl))
                return null;
 
            string Url = Gateway.GetUrl("/QR/" + TagSignUrl);
 
            if (Uri.TryCreate(Url, UriKind.Absolute, out Uri Result))
                return Task.FromResult(Result);
            else
                return Task.FromResult<Uri>(null);
        }
 
        public async Task<string> Start(string Purpose, string RemoteEndPoint,
            EventHandlerAsync<RemoteAuthenticationEventArgs> Callback, object State)
        {
            if (this.usesChallengeUri)
            {
                this.callback = Callback;
                this.state = State;
 
                return this.sessionId;
            }
 
            string PetitionId = await QuickLogin.StartQuickLogin(this.legalId, Purpose,
                null, null, RemoteEndPoint, async (sender, e) =>
                {
                    RemoteAuthenticationEventArgs e2;
 
                    if (e.Ok)
                    {
                        if (e.Response && !(e.RequestedIdentity is null))
                        {
                            e2 = new RemoteAuthenticationEventArgs(e.State,
                                new KeyValuePair<string, object>(JwtClaims.ClientId, e.RequestedIdentity.Id),
                                new KeyValuePair<string, object>(JwtClaims.Subject, this.subject));
 
                            if (!this.hasJid)
                            {
                                string Jid = e.RequestedIdentity[PersonalInformation.JidTag];
 
                                if (!string.IsNullOrEmpty(Jid))
                                {
                                    this.jid = Jid;
                                    this.hasJid = true;
                                }
                            }
                        }
                        else
                            e2 = new RemoteAuthenticationEventArgs(e.State, "Remote API Login rejected.", true);
                    }
                    else
                    {
                        e2 = new RemoteAuthenticationEventArgs(e.State, "Remote API Login failed: " + e.ErrorText,
                            !(e.StanzaError is Networking.XMPP.StanzaErrors.RecipientUnavailableException));
                    }
 
                    await Callback.Raise(this, e2);
 
                }, State);
 
            return PetitionId;
        }
 
        private async Task QuickLoginCallback(object Sender, QuickLoginResponseEventArgs e)
        {
            EventHandlerAsync<RemoteAuthenticationEventArgs> Callback = this.callback;
            RemoteAuthenticationEventArgs e2;
            object State = this.state;
 
            if (Callback is null)
                return;
 
            this.callback = null;
            this.state = null;
 
            if (e.Ok)
            {
                if (e.Response && !(e.RequestedIdentity is null))
                {
                    this.subject = e.RequestedIdentity.Id;
 
                    e2 = new RemoteAuthenticationEventArgs(e.State,
                        new KeyValuePair<string, object>(JwtClaims.ClientId, e.RequestedIdentity.Id),
                        new KeyValuePair<string, object>(JwtClaims.Subject, this.subject));
 
                    if (!this.hasJid)
                    {
                        string Jid = e.RequestedIdentity[PersonalInformation.JidTag];
 
                        if (!string.IsNullOrEmpty(Jid))
                        {
                            this.jid = Jid;
                            this.hasJid = true;
                        }
                    }
                }
                else
                    e2 = new RemoteAuthenticationEventArgs(e.State, "Remote API Login rejected.", true);
            }
            else
            {
                e2 = new RemoteAuthenticationEventArgs(e.State, "Remote API Login failed: " + e.ErrorText,
                    !(e.StanzaError is Networking.XMPP.StanzaErrors.RecipientUnavailableException));
            }
 
            await Callback.Raise(this, e2);
        }
    }
}