OAuthResource.cs

using System;
using System.Collections.Generic;
using System.Diagnostics.CodeAnalysis;
using System.Text;
using System.Threading.Tasks;
using Waher.Networking.HTTP.Authentication;
using Waher.Runtime.Inventory;
using Waher.Security;
using Waher.Security.JWT;
 
namespace Waher.Networking.HTTP.OAuth
{
    public abstract class OAuthResource : HttpSynchronousResource
    {
        public const string OAuthScopePrivilegePrefix = "OAUTH.Scope.";
 
        private readonly OAuth2Environment environment;
        private HttpAuthenticationScheme[]? authenticationSchemes = null;
 
        public OAuthResource(OAuth2Environment Environment, string ResourceName)
            : base(ResourceName)
        {
            this.environment = Environment;
        }
 
        public override bool UserSessions => false;
 
        public override bool HandlesSubPaths => false;
 
        public OAuth2Environment Environment => this.environment;
 
        public IUserSource? Users => this.environment.UserSource;
 
        public string? Realm => this.environment.Realm;
 
        public int MinStrength => this.environment.MinStrength;
 
        public bool Encrypted => this.environment.Encrypted;
 
        public HttpAuthenticationScheme[]? AuthenticationSchemes => this.authenticationSchemes;
 
        protected JwtFactory JwtFactory => this.environment.JwtFactory;
 
        public override HttpAuthenticationScheme[]? GetAuthenticationSchemes(HttpRequest Request)
        {
            string s;
 
            if (Request.Header.Authorization is null)
                return null;
 
            // If empty client_id is sent in a Basic Authorization header, do not consider
            // it an authentication attempt.
            if (!(Request.Header.Authorization is null) &&
                (s = Request.Header.Authorization.Value).StartsWith("Basic "))
            {
                s = Encoding.UTF8.GetString(Convert.FromBase64String(s[6..]));
                int i = s.IndexOf(':');
                if (i == s.Length - 1)
                    return null;
            }
 
            this.InitAuthentication();
 
            return this.authenticationSchemes;
        }
 
        protected bool InitAuthentication()
        {
            if (!(this.Users is null))
            {
                this.authenticationSchemes ??= this.CreateAuthenticationSchemes(
                    this.JwtFactory, this.Users);
            }
 
            return !(this.authenticationSchemes is null);
        }
 
        protected HttpAuthenticationScheme[] CreateAuthenticationSchemes(
            JwtFactory JwtFactory, IUserSource Users)
        {
            // Note: Restricted set of authentication schemes, as compared to
            // HttpModule.GetAuthenticationSchemes().
 
            List<HttpAuthenticationScheme> Schemes = new List<HttpAuthenticationScheme>();
 
            if (!(JwtFactory is null))
            {
                Schemes.Add(new JwtAuthentication(this.Encrypted, this.MinStrength,
                    this.Realm, Users, JwtFactory));
            }
 
            HttpServer Server = Types.TryGetModuleParameter<HttpServer>("HTTP");
 
            if (!(Server is null) && Server.ClientCertificates != ClientCertificates.NotUsed)
                Schemes.Add(new MutualTlsAuthentication(Users));
 
            Schemes.Add(new BasicAuthentication(this.Encrypted, this.MinStrength,
                this.Realm, Users));
 
            Schemes.Add(new DigestAuthentication(this.Encrypted, this.MinStrength,
                DigestAlgorithm.MD5, this.Realm, Users));
 
            Schemes.Add(new DigestAuthentication(this.Encrypted, this.MinStrength,
                DigestAlgorithm.SHA256, this.Realm, Users));
 
            Schemes.Add(new DigestAuthentication(this.Encrypted, this.MinStrength,
                DigestAlgorithm.SHA3_256, this.Realm, Users));
 
            if (!(Server is null))
                Schemes.Add(new SessionAuthentication(Server));
 
            Schemes.Add(new OAuthClientCredentialsAuthentication(this.Encrypted, 
                this.MinStrength, Users));
 
            return Schemes.ToArray();
        }
 
        public override Task<object> DefaultErrorContent(int StatusCode)
        {
            return Task.FromResult<object>(new Dictionary<string, object>()
            {
                { "error", "invalid_client" },
                { "error_description", "Unauthorized access prohibited." }
            });
        }
 
        protected static Task ReturnError(HttpResponse Response, string ErrorCode,
            string ErrorDescription, int StatusCode, string StatusMessage)
        {
            Response.StatusCode = StatusCode;
            Response.StatusMessage = StatusMessage;
            Response.SetHeader("Cache-Control", "max-age=0, no-cache, no-store");
            Response.SetHeader("Pragma", "no-cache");
 
            return Response.Return(ErrorResponse(ErrorCode, ErrorDescription));
        }
 
        private static Dictionary<string, object> ErrorResponse(string ErrorCode,
            string ErrorDescription)
        {
            Dictionary<string, object> Result = new Dictionary<string, object>()
            {
                { "error", ErrorCode },
                { "error_description", ErrorDescription }
            };
 
            return Result;
        }
 
        protected static Task BadRequest(HttpResponse Response, string ErrorCode,
            string ErrorDescription)
        {
            return ReturnError(Response, ErrorCode, ErrorDescription,
                BadRequestException.Code, BadRequestException.StatusMessage);
        }
 
        protected static Task Forbidden(HttpResponse Response, string ErrorCode,
            string ErrorDescription)
        {
            return ReturnError(Response, ErrorCode, ErrorDescription,
                ForbiddenException.Code, ForbiddenException.StatusMessage);
        }
 
        protected static Task Unauthorized(HttpResponse Response, string ErrorCode,
            string ErrorDescription, string[] Challenges)
        {
            Response.SetHeader("Cache-Control", "max-age=0, no-cache, no-store");
            Response.SetHeader("Pragma", "no-cache");
 
            return Response.SendResponse(new UnauthorizedException(
                ErrorResponse(ErrorCode, ErrorDescription), Challenges));
        }
 
        protected static Task NotFound(HttpResponse Response, string ErrorCode,
            string ErrorDescription)
        {
            return ReturnError(Response, ErrorCode, ErrorDescription,
                NotFoundException.Code, NotFoundException.StatusMessage);
        }
 
        protected static Task ServiceUnavailable(HttpResponse Response, string ErrorCode,
            string ErrorDescription)
        {
            return ReturnError(Response, ErrorCode, ErrorDescription,
                ServiceUnavailableException.Code, ServiceUnavailableException.StatusMessage);
        }
 
        protected static bool IsValidScope(string Scope)
        {
            if (string.IsNullOrEmpty(Scope))
                return false; // For an individual supplied value. Omitted scope is different.
 
            string[] Tokens = Scope.Split(' ');
 
            foreach (string Token in Tokens)
            {
                if (Token.Length == 0)
                    return false;
 
                foreach (char ch in Token)
                {
                    if (ch == 0x21)
                        continue;
 
                    if (ch >= 0x23 && ch <= 0x5B)
                        continue;
 
                    if (ch >= 0x5D && ch <= 0x7E)
                        continue;
 
                    return false;
                }
            }
 
            return true;
        }
 
        public static bool HasScopePrivileges(string Scopes, IUser User,
            [NotNullWhen(false)] out string? MissingPrivilege)
        {
            return HasScopePrivileges(
                Scopes.Split(' ', StringSplitOptions.RemoveEmptyEntries),
                User, out MissingPrivilege);
        }
 
        public static bool HasScopePrivileges(string[] Scopes, IUser User,
            [NotNullWhen(false)] out string? MissingPrivilege)
        {
            foreach (string Scope in Scopes)
            {
                string Privilege = OAuthScopePrivilegePrefix + Scope.Replace(':', '.');
                if (!User.HasPrivilege(Privilege))
                {
                    MissingPrivilege = Privilege;
                    return false;
                }
            }
 
            MissingPrivilege = null;
            return true;
        }
    }
}