|   |  | 1 |  | // Copyright (c) Microsoft. All rights reserved. | 
|   |  | 2 |  | // Licensed under the MIT license. See LICENSE file in the project root for full license information. | 
|   |  | 3 |  |  | 
|   |  | 4 |  | namespace Microsoft.Azure.ServiceBus.Management | 
|   |  | 5 |  | { | 
|   |  | 6 |  |     using System; | 
|   |  | 7 |  |     using System.Collections.Generic; | 
|   |  | 8 |  |     using System.Linq; | 
|   |  | 9 |  |     using System.Security.Cryptography; | 
|   |  | 10 |  |     using System.Text; | 
|   |  | 11 |  |     using System.Web; | 
|   |  | 12 |  |     using System.Xml; | 
|   |  | 13 |  |     using System.Xml.Linq; | 
|   |  | 14 |  |     using Microsoft.Azure.ServiceBus.Primitives; | 
|   |  | 15 |  |  | 
|   |  | 16 |  |     /// <summary> | 
|   |  | 17 |  |     /// Defines the authorization rule for an entity using SAS. | 
|   |  | 18 |  |     /// </summary> | 
|   |  | 19 |  |     public class SharedAccessAuthorizationRule : AuthorizationRule | 
|   |  | 20 |  |     { | 
|   |  | 21 |  |         const int SupportedSASKeyLength = 44; | 
|   |  | 22 |  |         const string FixedClaimType = "SharedAccessKey"; | 
|   |  | 23 |  |  | 
|   |  | 24 |  |         private string internalKeyName; | 
|   |  | 25 |  |         private string internalPrimaryKey; | 
|   |  | 26 |  |         private string internalSecondaryKey; | 
|   |  | 27 |  |         private List<AccessRights> internalRights; | 
|   |  | 28 |  |  | 
|   | 0 | 29 |  |         internal SharedAccessAuthorizationRule() | 
|   |  | 30 |  |         { | 
|   | 0 | 31 |  |         } | 
|   |  | 32 |  |  | 
|   |  | 33 |  |         /// <summary>Initializes a new instance of the <see cref="SharedAccessAuthorizationRule" /> class.</summary> | 
|   |  | 34 |  |         /// <param name="keyName">The authorization rule key name.</param> | 
|   |  | 35 |  |         /// <param name="rights">The list of rights.</param> | 
|   |  | 36 |  |         public SharedAccessAuthorizationRule(string keyName, IEnumerable<AccessRights> rights) | 
|   | 0 | 37 |  |             : this(keyName, SharedAccessAuthorizationRule.GenerateRandomKey(), SharedAccessAuthorizationRule.GenerateRan | 
|   |  | 38 |  |         { | 
|   | 0 | 39 |  |         } | 
|   |  | 40 |  |  | 
|   |  | 41 |  |         /// <summary>Initializes a new instance of the <see cref="SharedAccessAuthorizationRule" /> class.</summary> | 
|   |  | 42 |  |         /// <param name="keyName">The authorization rule key name.</param> | 
|   |  | 43 |  |         /// <param name="primaryKey">The primary key for the authorization rule.</param> | 
|   |  | 44 |  |         /// <param name="rights">The list of rights.</param> | 
|   |  | 45 |  |         public SharedAccessAuthorizationRule(string keyName, string primaryKey, IEnumerable<AccessRights> rights) | 
|   | 0 | 46 |  |             : this(keyName, primaryKey, SharedAccessAuthorizationRule.GenerateRandomKey(), rights) | 
|   |  | 47 |  |         { | 
|   | 0 | 48 |  |         } | 
|   |  | 49 |  |  | 
|   |  | 50 |  |         /// <summary>Initializes a new instance of the <see cref="SharedAccessAuthorizationRule" /> class.</summary> | 
|   |  | 51 |  |         /// <param name="keyName">The authorization rule key name.</param> | 
|   |  | 52 |  |         /// <param name="primaryKey">The primary key for the authorization rule.</param> | 
|   |  | 53 |  |         /// <param name="secondaryKey">The secondary key for the authorization rule.</param> | 
|   |  | 54 |  |         /// <param name="rights">The list of rights.</param> | 
|   | 0 | 55 |  |         public SharedAccessAuthorizationRule(string keyName, string primaryKey, string secondaryKey, IEnumerable<AccessR | 
|   |  | 56 |  |         { | 
|   | 0 | 57 |  |             this.PrimaryKey = primaryKey; | 
|   | 0 | 58 |  |             this.SecondaryKey = secondaryKey; | 
|   | 0 | 59 |  |             this.Rights = new List<AccessRights>(rights); | 
|   | 0 | 60 |  |             this.KeyName = keyName; | 
|   | 0 | 61 |  |         } | 
|   |  | 62 |  |  | 
|   | 0 | 63 |  |         public override string ClaimType => FixedClaimType; | 
|   |  | 64 |  |  | 
|   | 0 | 65 |  |         internal override string ClaimValue => "None"; | 
|   |  | 66 |  |  | 
|   |  | 67 |  |         /// <summary>Gets or sets the authorization rule key name.</summary> | 
|   |  | 68 |  |         /// <value>The authorization rule key name.</value> | 
|   |  | 69 |  |         public override sealed string KeyName | 
|   |  | 70 |  |         { | 
|   | 0 | 71 |  |             get { return this.internalKeyName; } | 
|   |  | 72 |  |             set | 
|   |  | 73 |  |             { | 
|   | 0 | 74 |  |                 if (string.IsNullOrWhiteSpace(value)) | 
|   |  | 75 |  |                 { | 
|   | 0 | 76 |  |                     throw new ArgumentNullException(nameof(KeyName)); | 
|   |  | 77 |  |                 } | 
|   |  | 78 |  |  | 
|   | 0 | 79 |  |                 if (value.Length > SharedAccessSignatureToken.MaxKeyNameLength) | 
|   |  | 80 |  |                 { | 
|   | 0 | 81 |  |                     throw new ArgumentOutOfRangeException( | 
|   | 0 | 82 |  |                         nameof(KeyName), $"The argument cannot exceed {SharedAccessSignatureToken.MaxKeyNameLength} char | 
|   |  | 83 |  |                 } | 
|   |  | 84 |  |  | 
|   | 0 | 85 |  |                 if (!string.Equals(value, HttpUtility.UrlEncode(value))) | 
|   |  | 86 |  |                 { | 
|   | 0 | 87 |  |                     throw new ArgumentException("The key name specified contains invalid characters"); | 
|   |  | 88 |  |                 } | 
|   |  | 89 |  |  | 
|   | 0 | 90 |  |                 this.internalKeyName = value; | 
|   | 0 | 91 |  |             } | 
|   |  | 92 |  |         } | 
|   |  | 93 |  |  | 
|   |  | 94 |  |         /// <summary>Gets or sets the primary key for the authorization rule.</summary> | 
|   |  | 95 |  |         /// <value>The primary key for the authorization rule.</value> | 
|   |  | 96 |  |         public string PrimaryKey | 
|   |  | 97 |  |         { | 
|   | 0 | 98 |  |             get { return this.internalPrimaryKey; } | 
|   |  | 99 |  |             set | 
|   |  | 100 |  |             { | 
|   | 0 | 101 |  |                 if (string.IsNullOrWhiteSpace(value)) | 
|   |  | 102 |  |                 { | 
|   | 0 | 103 |  |                     throw new ArgumentNullException(nameof(PrimaryKey)); | 
|   |  | 104 |  |                 } | 
|   |  | 105 |  |  | 
|   | 0 | 106 |  |                 if (Encoding.ASCII.GetByteCount(value) != SupportedSASKeyLength) | 
|   |  | 107 |  |                 { | 
|   | 0 | 108 |  |                     throw new ArgumentOutOfRangeException(nameof(PrimaryKey), $"{nameof(SharedAccessAuthorizationRule)}  | 
|   |  | 109 |  |                 } | 
|   |  | 110 |  |  | 
|   | 0 | 111 |  |                 if (!CheckBase64(value)) | 
|   |  | 112 |  |                 { | 
|   | 0 | 113 |  |                     throw new ArgumentException(nameof(PrimaryKey), $"{nameof(SharedAccessAuthorizationRule)} only suppo | 
|   |  | 114 |  |                 } | 
|   |  | 115 |  |  | 
|   | 0 | 116 |  |                 this.internalPrimaryKey = value; | 
|   | 0 | 117 |  |             } | 
|   |  | 118 |  |         } | 
|   |  | 119 |  |  | 
|   |  | 120 |  |         /// <summary>Gets or sets the secondary key for the authorization rule.</summary> | 
|   |  | 121 |  |         /// <value>The secondary key for the authorization rule.</value> | 
|   |  | 122 |  |         public string SecondaryKey | 
|   |  | 123 |  |         { | 
|   | 0 | 124 |  |             get { return this.internalSecondaryKey; } | 
|   |  | 125 |  |             set | 
|   |  | 126 |  |             { | 
|   | 0 | 127 |  |                 if (string.IsNullOrWhiteSpace(value)) | 
|   |  | 128 |  |                 { | 
|   | 0 | 129 |  |                     throw new ArgumentNullException(nameof(SecondaryKey)); | 
|   |  | 130 |  |                 } | 
|   |  | 131 |  |  | 
|   | 0 | 132 |  |                 if (Encoding.ASCII.GetByteCount(value) != SupportedSASKeyLength) | 
|   |  | 133 |  |                 { | 
|   | 0 | 134 |  |                     throw new ArgumentOutOfRangeException(nameof(SecondaryKey), $"{nameof(SharedAccessAuthorizationRule) | 
|   |  | 135 |  |                 } | 
|   |  | 136 |  |  | 
|   | 0 | 137 |  |                 if (!CheckBase64(value)) | 
|   |  | 138 |  |                 { | 
|   | 0 | 139 |  |                     throw new ArgumentException(nameof(SecondaryKey), $"{nameof(SharedAccessAuthorizationRule)} only sup | 
|   |  | 140 |  |                 } | 
|   |  | 141 |  |  | 
|   | 0 | 142 |  |                 this.internalSecondaryKey = value; | 
|   | 0 | 143 |  |             } | 
|   |  | 144 |  |         } | 
|   |  | 145 |  |  | 
|   |  | 146 |  |         public override List<AccessRights> Rights | 
|   |  | 147 |  |         { | 
|   | 0 | 148 |  |             get => this.internalRights; | 
|   |  | 149 |  |             set | 
|   |  | 150 |  |             { | 
|   | 0 | 151 |  |                 if (value == null || value.Count < 0 || value.Count > ManagementClientConstants.SupportedClaimsCount) | 
|   |  | 152 |  |                 { | 
|   | 0 | 153 |  |                     throw new ArgumentException($"Rights cannot be null, empty or greater than {ManagementClientConstant | 
|   |  | 154 |  |                 } | 
|   |  | 155 |  |  | 
|   | 0 | 156 |  |                 HashSet<AccessRights> dedupedAccessRights = new HashSet<AccessRights>(value); | 
|   | 0 | 157 |  |                 if (value.Count != dedupedAccessRights.Count) | 
|   |  | 158 |  |                 { | 
|   | 0 | 159 |  |                     throw new ArgumentException("Access rights on an authorization rule must be unique"); | 
|   |  | 160 |  |                 } | 
|   |  | 161 |  |  | 
|   | 0 | 162 |  |                 if (value.Contains(AccessRights.Manage) && value.Count != 3) | 
|   |  | 163 |  |                 { | 
|   | 0 | 164 |  |                     throw new ArgumentException(nameof(Rights), "Manage permission should also include Send and Listen") | 
|   |  | 165 |  |                 } | 
|   |  | 166 |  |  | 
|   | 0 | 167 |  |                 this.internalRights = value; | 
|   | 0 | 168 |  |             } | 
|   |  | 169 |  |         } | 
|   |  | 170 |  |  | 
|   |  | 171 |  |         /// <summary>Returns the hash code for this instance.</summary> | 
|   |  | 172 |  |         public override int GetHashCode() | 
|   |  | 173 |  |         { | 
|   | 0 | 174 |  |             int hash = 13; | 
|   |  | 175 |  |             unchecked | 
|   |  | 176 |  |             { | 
|   | 0 | 177 |  |                 hash = (hash * 7) + this.KeyName?.GetHashCode() ?? 0; | 
|   | 0 | 178 |  |                 hash = (hash * 7) + this.PrimaryKey?.GetHashCode() ?? 0; | 
|   | 0 | 179 |  |                 hash = (hash * 7) + this.SecondaryKey?.GetHashCode() ?? 0; | 
|   | 0 | 180 |  |                 hash = (hash * 7) + this.Rights.GetHashCode(); | 
|   |  | 181 |  |             } | 
|   |  | 182 |  |  | 
|   | 0 | 183 |  |             return hash; | 
|   |  | 184 |  |         } | 
|   |  | 185 |  |  | 
|   |  | 186 |  |         public override bool Equals(object obj) | 
|   |  | 187 |  |         { | 
|   | 0 | 188 |  |             var other = obj as AuthorizationRule; | 
|   | 0 | 189 |  |             return this.Equals(other); | 
|   |  | 190 |  |         } | 
|   |  | 191 |  |  | 
|   |  | 192 |  |         /// <summary>Determines whether the specified object is equal to the current object.</summary> | 
|   |  | 193 |  |         /// <param name="other">The object to compare with the current object.</param> | 
|   |  | 194 |  |         /// <returns>true if the specified object is equal to the current object; otherwise, false.</returns> | 
|   |  | 195 |  |         public override bool Equals(AuthorizationRule other) | 
|   |  | 196 |  |         { | 
|   | 0 | 197 |  |             if (!(other is SharedAccessAuthorizationRule)) | 
|   |  | 198 |  |             { | 
|   | 0 | 199 |  |                 return false; | 
|   |  | 200 |  |             } | 
|   |  | 201 |  |  | 
|   | 0 | 202 |  |             SharedAccessAuthorizationRule comparand = (SharedAccessAuthorizationRule)other; | 
|   | 0 | 203 |  |             if (!string.Equals(this.KeyName, comparand.KeyName, StringComparison.OrdinalIgnoreCase) || | 
|   | 0 | 204 |  |                 !string.Equals(this.PrimaryKey, comparand.PrimaryKey, StringComparison.Ordinal) || | 
|   | 0 | 205 |  |                 !string.Equals(this.SecondaryKey, comparand.SecondaryKey, StringComparison.Ordinal)) | 
|   |  | 206 |  |             { | 
|   | 0 | 207 |  |                 return false; | 
|   |  | 208 |  |             } | 
|   |  | 209 |  |  | 
|   | 0 | 210 |  |             if ((this.Rights != null && comparand.Rights == null) || | 
|   | 0 | 211 |  |                 (this.Rights == null && comparand.Rights != null)) | 
|   |  | 212 |  |             { | 
|   | 0 | 213 |  |                 return false; | 
|   |  | 214 |  |             } | 
|   |  | 215 |  |  | 
|   | 0 | 216 |  |             if (this.Rights != null && comparand.Rights != null) | 
|   |  | 217 |  |             { | 
|   | 0 | 218 |  |                 HashSet<AccessRights> thisRights = new HashSet<AccessRights>(this.Rights); | 
|   | 0 | 219 |  |                 if (comparand.Rights.Count != thisRights.Count) | 
|   |  | 220 |  |                 { | 
|   | 0 | 221 |  |                     return false; | 
|   |  | 222 |  |                 } | 
|   |  | 223 |  |  | 
|   | 0 | 224 |  |                 return thisRights.SetEquals(comparand.Rights); | 
|   |  | 225 |  |             } | 
|   |  | 226 |  |  | 
|   | 0 | 227 |  |             return true; | 
|   |  | 228 |  |         } | 
|   |  | 229 |  |  | 
|   |  | 230 |  |         public static bool operator ==(SharedAccessAuthorizationRule o1, SharedAccessAuthorizationRule o2) | 
|   |  | 231 |  |         { | 
|   | 0 | 232 |  |             if (ReferenceEquals(o1, o2)) | 
|   |  | 233 |  |             { | 
|   | 0 | 234 |  |                 return true; | 
|   |  | 235 |  |             } | 
|   |  | 236 |  |  | 
|   | 0 | 237 |  |             if (ReferenceEquals(o1, null) || ReferenceEquals(o2, null)) | 
|   |  | 238 |  |             { | 
|   | 0 | 239 |  |                 return false; | 
|   |  | 240 |  |             } | 
|   |  | 241 |  |  | 
|   | 0 | 242 |  |             return o1.Equals(o2); | 
|   |  | 243 |  |         } | 
|   |  | 244 |  |  | 
|   |  | 245 |  |         public static bool operator !=(SharedAccessAuthorizationRule o1, SharedAccessAuthorizationRule o2) | 
|   |  | 246 |  |         { | 
|   | 0 | 247 |  |             return !(o1 == o2); | 
|   |  | 248 |  |         } | 
|   |  | 249 |  |  | 
|   |  | 250 |  |         /// <summary>Generates the random key for the authorization rule.</summary> | 
|   |  | 251 |  |         private static string GenerateRandomKey() | 
|   |  | 252 |  |         { | 
|   | 0 | 253 |  |             byte[] key256 = new byte[32]; | 
|   | 0 | 254 |  |             using (var rngCryptoServiceProvider = new RNGCryptoServiceProvider()) | 
|   |  | 255 |  |             { | 
|   | 0 | 256 |  |                 rngCryptoServiceProvider.GetBytes(key256); | 
|   | 0 | 257 |  |             } | 
|   |  | 258 |  |  | 
|   | 0 | 259 |  |             return Convert.ToBase64String(key256); | 
|   |  | 260 |  |         } | 
|   |  | 261 |  |  | 
|   |  | 262 |  |         private static bool CheckBase64(string base64EncodedString) | 
|   |  | 263 |  |         { | 
|   |  | 264 |  |             try | 
|   |  | 265 |  |             { | 
|   | 0 | 266 |  |                 Convert.FromBase64String(base64EncodedString); | 
|   | 0 | 267 |  |                 return true; | 
|   |  | 268 |  |             } | 
|   | 0 | 269 |  |             catch (Exception) | 
|   |  | 270 |  |             { | 
|   | 0 | 271 |  |                 return false; | 
|   |  | 272 |  |             } | 
|   | 0 | 273 |  |         } | 
|   |  | 274 |  |  | 
|   |  | 275 |  |         internal static new SharedAccessAuthorizationRule ParseFromXElement(XElement xElement) | 
|   |  | 276 |  |         { | 
|   | 0 | 277 |  |             var rule = new SharedAccessAuthorizationRule(); | 
|   | 0 | 278 |  |             foreach (var element in xElement.Elements()) | 
|   |  | 279 |  |             { | 
|   | 0 | 280 |  |                 switch (element.Name.LocalName) | 
|   |  | 281 |  |                 { | 
|   |  | 282 |  |                     case "CreatedTime": | 
|   | 0 | 283 |  |                         rule.CreatedTime = XmlConvert.ToDateTime(element.Value, XmlDateTimeSerializationMode.Utc); | 
|   | 0 | 284 |  |                         break; | 
|   |  | 285 |  |                     case "ModifiedTime": | 
|   | 0 | 286 |  |                         rule.ModifiedTime = XmlConvert.ToDateTime(element.Value, XmlDateTimeSerializationMode.Utc); | 
|   | 0 | 287 |  |                         break; | 
|   |  | 288 |  |                     case "KeyName": | 
|   | 0 | 289 |  |                         rule.KeyName = element.Value; | 
|   | 0 | 290 |  |                         break; | 
|   |  | 291 |  |                     case "PrimaryKey": | 
|   | 0 | 292 |  |                         rule.PrimaryKey = element.Value; | 
|   | 0 | 293 |  |                         break; | 
|   |  | 294 |  |                     case "SecondaryKey": | 
|   | 0 | 295 |  |                         rule.SecondaryKey = element.Value; | 
|   | 0 | 296 |  |                         break; | 
|   |  | 297 |  |                     case "Rights": | 
|   | 0 | 298 |  |                         var rights = new List<AccessRights>(); | 
|   | 0 | 299 |  |                         var xRights = element.Elements(XName.Get("AccessRights", ManagementClientConstants.ServiceBusNam | 
|   | 0 | 300 |  |                         foreach (var xRight in xRights) | 
|   |  | 301 |  |                         { | 
|   | 0 | 302 |  |                             rights.Add((AccessRights)Enum.Parse(typeof(AccessRights), xRight.Value)); | 
|   |  | 303 |  |                         } | 
|   | 0 | 304 |  |                         rule.Rights = rights; | 
|   |  | 305 |  |                         break; | 
|   |  | 306 |  |                 } | 
|   |  | 307 |  |             } | 
|   |  | 308 |  |  | 
|   | 0 | 309 |  |             return rule; | 
|   |  | 310 |  |         } | 
|   |  | 311 |  |  | 
|   |  | 312 |  |         internal override XElement Serialize() | 
|   |  | 313 |  |         { | 
|   | 0 | 314 |  |             XElement rule = new XElement( | 
|   | 0 | 315 |  |                 XName.Get("AuthorizationRule", ManagementClientConstants.ServiceBusNamespace), | 
|   | 0 | 316 |  |                 new XAttribute(XName.Get("type", ManagementClientConstants.XmlSchemaInstanceNamespace), nameof(SharedAcc | 
|   | 0 | 317 |  |                 new XElement(XName.Get("ClaimType", ManagementClientConstants.ServiceBusNamespace), this.ClaimType), | 
|   | 0 | 318 |  |                 new XElement(XName.Get("ClaimValue", ManagementClientConstants.ServiceBusNamespace), this.ClaimValue), | 
|   | 0 | 319 |  |                 new XElement(XName.Get("Rights", ManagementClientConstants.ServiceBusNamespace), | 
|   | 0 | 320 |  |                     this.Rights.Select(right => new XElement(XName.Get("AccessRights", ManagementClientConstants.Service | 
|   | 0 | 321 |  |                 new XElement(XName.Get("KeyName", ManagementClientConstants.ServiceBusNamespace), this.KeyName), | 
|   | 0 | 322 |  |                 new XElement(XName.Get("PrimaryKey", ManagementClientConstants.ServiceBusNamespace), this.PrimaryKey), | 
|   | 0 | 323 |  |                 new XElement(XName.Get("SecondaryKey", ManagementClientConstants.ServiceBusNamespace), this.SecondaryKey | 
|   | 0 | 324 |  |             ); | 
|   |  | 325 |  |  | 
|   | 0 | 326 |  |             return rule; | 
|   |  | 327 |  |         } | 
|   |  | 328 |  |     } | 
|   |  | 329 |  | } |