User/Roles for webserver

ClientServerLib/ClientServerLib/CServer.cs

@@ -94,6 +94,45 @@ namespace ServerLib
         }
 
 
+        #endregion
+
+        #region user management
+
+        private static SetPasswordDelegate setPassword;
+        public static SetPasswordDelegate SetPassword
+        {
+            internal get { return CServer.setPassword; }
+            set { CServer.setPassword = value; }
+        }
+
+        private static ValidatePasswordDelegate validatePassword;
+        public static ValidatePasswordDelegate ValidatePassword
+        {
+            internal get { return CServer.validatePassword; }
+            set { CServer.validatePassword = value; }
+        }
+
+        private static GetUserRoleDelegate getUserRole;
+        public static GetUserRoleDelegate GetUserRole
+        {
+            internal get { return CServer.getUserRole; }
+            set { CServer.getUserRole = value; }
+        }
+
+        private static SetUserRoleDelegate setUserRole;
+        public static SetUserRoleDelegate SetUserRole
+        {
+            internal get { return CServer.setUserRole; }
+            set { CServer.setUserRole = value; }
+        }
+
+        private static GetUserIdFromUsernameDelegate getUserIdFromUsername;
+        public static GetUserIdFromUsernameDelegate GetUserIdFromUsername
+        {
+            internal get { return CServer.getUserIdFromUsername; }
+            set { CServer.getUserIdFromUsername = value; }
+        }
+
         #endregion
 
         public CServer(int port, bool encrypted)
@@ -101,6 +140,8 @@ namespace ServerLib
             init(port, encrypted);
         }
 
+        #region server control
+
         private void init(int port, bool encrypted)
         {
             string hostname = Dns.GetHostName();
@@ -178,7 +219,7 @@ namespace ServerLib
 
         private void registerUrlAndCert(int port)
         {
-            #if WIN
+#if WIN
 
             ProcessStartInfo info = new ProcessStartInfo();
             info.FileName = "WebserverInitalConfig.exe";
@@ -194,11 +235,14 @@ namespace ServerLib
                 p.Close();
             }
 
-            #else
+#else
 
             //Required?
 
-            #endif
+#endif
         }
+
+        #endregion
+
     }
 }

ClientServerLib/ClientServerLib/CWebservice.cs

@@ -6,6 +6,7 @@ using System.Text;
 using System.ServiceModel.Web;
 using System.Web.Services;
 using System.IO;
+using System.ServiceModel.Channels;
 
 namespace ServerLib
 {
@@ -20,6 +21,12 @@ namespace ServerLib
 
         #region profile
 
+        [OperationContract]
+        [WebInvoke(Method = "GET",
+            ResponseFormat = WebMessageFormat.Json,
+            UriTemplate = "/getOwnProfileId")]
+        int getOwnProfileId();
+
         [OperationContract]
         [WebInvoke(Method = "POST",
             ResponseFormat = WebMessageFormat.Json,
@@ -53,6 +60,12 @@ namespace ServerLib
 
         #region website
 
+        [OperationContract]
+        [WebInvoke(Method = "GET",
+            ResponseFormat = WebMessageFormat.Json,
+            UriTemplate = "/login?username={username}&password={password}")]
+        Guid login(string username, string password);
+
         [OperationContract]
         [WebInvoke(Method = "GET",
             ResponseFormat = WebMessageFormat.Json,
@@ -114,8 +127,35 @@ namespace ServerLib
         {
         }
 
+        private static Guid getSession()
+        {
+            Guid sessionKey = Guid.Empty;
+            string sessionHeader =
+                ((HttpRequestMessageProperty)OperationContext.Current.IncomingMessageProperties["httpRequest"]).Headers["session"];
+            if (sessionHeader == null || sessionHeader == "")
+            {
+                return sessionKey;
+            }
+            try
+            {
+                sessionKey = Guid.Parse(sessionHeader);
+            }
+            catch (Exception e)
+            {
+            }
+            return sessionKey;
+        }
+
         public bool sendKeyEvent(string key)
         {
+            Guid sessionKey = getSession();
+
+            if (sessionKey == Guid.Empty || !SessionControl.requestRight(sessionKey, UserRights.UseKeyboard))
+            {
+                WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden;
+                return false;
+            }
+
             if (CServer.SendKeyEvent == null)
             {
                 return false;
@@ -125,22 +165,58 @@ namespace ServerLib
 
         #region profile
 
+        public int getOwnProfileId()
+        {
+            Guid sessionKey = getSession();
+            if (sessionKey == Guid.Empty)
+            {
+                WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden;
+                return -1;
+            }
+
+            return SessionControl.getUserIdFromSession(sessionKey);
+        }
+
         public bool sendProfile(ProfileData profile)
         {
-            if (CServer.SendProfileData == null)
+            Guid sessionKey = getSession();
+
+            if (sessionKey == Guid.Empty || (!SessionControl.requestRight(sessionKey, UserRights.EditAllProfiles) &&
+                SessionControl.getUserIdFromSession(sessionKey) != profile.ProfileId))
             {
+                WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden;
                 return false;
             }
+
+            if (CServer.SendProfileData == null)
+            {
+                WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.NotFound;
+                return false;
+            }
+
             return CServer.SendProfileData(profile);
         }
 
         public ProfileData getProfile(int profileId)
         {
+            Guid sessionKey = getSession();
+
+            if (sessionKey == Guid.Empty || (!SessionControl.requestRight(sessionKey, UserRights.ViewOtherProfiles) &&
+                SessionControl.getUserIdFromSession(sessionKey) != profileId))
+            {
+                WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden;
+                return new ProfileData();
+            }
+
             if (CServer.GetProfileData == null)
             {
                 return new ProfileData();
             }
-            return CServer.GetProfileData(profileId);
+
+            bool isReadonly = (!SessionControl.requestRight(sessionKey, UserRights.EditAllProfiles) &&
+                SessionControl.getUserIdFromSession(sessionKey) != profileId);
+
+            return CServer.GetProfileData(profileId, isReadonly);
         }
 
         public ProfileData[] getProfileList()
@@ -158,6 +234,13 @@ namespace ServerLib
 
         public bool sendPhoto(PhotoData photo)
         {
+            Guid sessionKey = getSession();
+            if (!SessionControl.requestRight(sessionKey, UserRights.UploadPhotos))
+            {
+                WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden;
+                return false;
+            }
+
             return CServer.SendPhoto(photo);
         }
 
@@ -165,6 +248,16 @@ namespace ServerLib
 
         #region website
 
+        public Guid login(string username, string password)
+        {
+            Guid sessionId = SessionControl.openSession(username, password);
+            if (sessionId == Guid.Empty)
+            {
+                WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden;
+            }
+            return sessionId;
+        }
+
         public Stream Index()
         {
             if (WebOperationContext.Current != null)
@@ -277,6 +370,5 @@ namespace ServerLib
         }
 
         #endregion
-        
     }
 }

ClientServerLib/ClientServerLib/DataStructs.cs

@@ -15,7 +15,7 @@ namespace ServerLib
 
     #region profile
 
-    public delegate ProfileData GetProfileDataDelegate(int profileId);
+    public delegate ProfileData GetProfileDataDelegate(int profileId, bool isReadonly);
     public delegate bool SendProfileDataDelegate(ProfileData profile);
     public delegate ProfileData[] GetProfileListDelegate();
 
@@ -121,4 +121,18 @@ namespace ServerLib
     }
 
     #endregion
+
+    #region user management
+
+    public delegate void SetPasswordDelegate(int profileId, string newPassword);
+
+    public delegate bool ValidatePasswordDelegate(int profileId, string password);
+
+    public delegate int GetUserRoleDelegate(int profileId);
+
+    public delegate void SetUserRoleDelegate(int profileId, int userRole);
+
+    public delegate int GetUserIdFromUsernameDelegate(string username);
+
+    #endregion
 }

ClientServerLib/ClientServerLib/ServerLib.csproj

@@ -52,6 +52,11 @@
     <Compile Include="CWebservice.cs" />
     <Compile Include="DataStructs.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
+    <Compile Include="Session.cs" />
+    <Compile Include="SessionControl.cs" />
+    <Compile Include="UserRights.cs" />
+    <Compile Include="UserRoleControl.cs" />
+    <Compile Include="UserRoles.cs" />
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 

ClientServerLib/ClientServerLib/Session.cs

@@ -0,0 +1,35 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+
+namespace ServerLib
+{
+    internal class Session
+    {
+        Guid id;
+        public Guid Id
+        {
+            get { return id; }
+        }
+
+        int profileId;
+        public int ProfileId
+        {
+            get { return profileId; }
+        }
+
+        UserRoles roles;
+        internal UserRoles Roles
+        {
+            get { return roles; }
+        }
+
+        public Session(Guid id, int profileId, UserRoles roles)
+        {
+            this.id = id;
+            this.profileId = profileId;
+            this.roles = roles;
+        }
+    }
+}

ClientServerLib/ClientServerLib/SessionControl.cs

@@ -0,0 +1,65 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+
+namespace ServerLib
+{
+    internal static class SessionControl
+    {
+        private static Dictionary<Guid, Session> activeSessions = new Dictionary<Guid, Session>();
+
+        public static Guid openSession(string userName, string password)
+        {
+            if (!validateUserAndPassword(userName, password))
+            {
+                return Guid.Empty;
+            }
+
+            Guid newId = Guid.NewGuid();
+            int id = getProfileIdFormUsername(userName);
+            UserRoles roles = getUserRoles(id);
+            Session session = new Session(newId, id, roles);
+            invalidateSessions(id);
+            activeSessions.Add(newId, session);
+
+            return newId;
+        }
+
+        private static bool validateUserAndPassword(string userName, string password)
+        {
+            return CServer.ValidatePassword(getProfileIdFormUsername(userName), password);
+        }
+
+        private static int getProfileIdFormUsername(string username)
+        {
+            return CServer.GetUserIdFromUsername(username);
+        }
+
+        private static UserRoles getUserRoles(int profileId)
+        {
+            return (UserRoles)CServer.GetUserRole(profileId);
+        }
+
+        internal static void invalidateSessions(int profileId)
+        {
+            foreach (var s in (from kv in activeSessions
+                               where kv.Value.ProfileId == profileId
+                               select kv).ToList())
+            {
+                activeSessions.Remove(s.Key);
+            }
+
+        }
+
+        internal static bool requestRight(Guid sessionId, UserRights requestedRight)
+        {
+            return ((UserRoleControl.getUserRightsFromUserRole(activeSessions[sessionId].Roles) & requestedRight) != 0);
+        }
+
+        internal static int getUserIdFromSession(Guid sessionId)
+        {
+            return activeSessions[sessionId].ProfileId;
+        }
+    }
+}

ClientServerLib/ClientServerLib/UserRights.cs

@@ -0,0 +1,17 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+
+namespace ServerLib
+{
+    [Flags]
+    internal enum UserRights
+    {
+        None = 0x00,
+        EditAllProfiles = 0x01,
+        UploadPhotos = 0x02,
+        ViewOtherProfiles = 0x04,
+        UseKeyboard = 0x08
+    }
+}

ClientServerLib/ClientServerLib/UserRoleControl.cs

@@ -0,0 +1,35 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+
+namespace ServerLib
+{
+    internal static class UserRoleControl
+    {
+        private static Dictionary<UserRoles, UserRights> roleRightsMapping = new Dictionary<UserRoles, UserRights> {
+                                                                            {UserRoles.Administrator,
+                                                                                (UserRights.EditAllProfiles|
+                                                                                UserRights.UploadPhotos|
+                                                                                UserRights.ViewOtherProfiles)|
+                                                                                UserRights.UseKeyboard},
+                                                                            {UserRoles.AuthenticatedUser,
+                                                                                (UserRights.UploadPhotos|
+                                                                                UserRights.ViewOtherProfiles|
+                                                                                UserRights.UseKeyboard)}
+                                                                        };
+
+
+        internal static UserRights getUserRightsFromUserRole(UserRoles userRole)
+        {
+            UserRights resultRights = UserRights.None;          
+
+            foreach (UserRights r in roleRightsMapping.Where(role => userRole.HasFlag(role.Key)).Select(role => role.Value))
+            {
+                resultRights |= r;
+            }
+
+            return resultRights;
+        }
+    }
+}

ClientServerLib/ClientServerLib/UserRoles.cs

@@ -0,0 +1,14 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+
+namespace ServerLib
+{
+    [Flags]
+    internal enum UserRoles
+    {
+        AuthenticatedUser = 0x00,
+        Administrator = 0x01
+    }
+}