Files
Antifraude.Net/Antifraude.Net/ApiDenuncias/Services/EncryptedDenunciaStore.cs
2026-06-08 12:58:30 +02:00

564 lines
21 KiB
C#

using System.Reflection;
using System.Security.Cryptography;
using System.Text;
using ApiDenuncias.Helpers;
using GestionaDenuncias.Shared.Models;
using ApiDenuncias.Services;
using Microsoft.AspNetCore.DataProtection;
namespace ApiDenuncias.Services;
public sealed class EncryptedDenunciaStore : IDenunciaStore, IFilteredDenunciaStore
{
private const string DataProtectionStringPrefix = "enc:v1:";
private const string KeyVaultStringPrefix = "enc:v2:";
private static readonly byte[] DataProtectionBytesPrefix = Encoding.ASCII.GetBytes("enc:v1:");
private static readonly byte[] KeyVaultBytesPrefix = Encoding.ASCII.GetBytes("enc:v2:");
private static readonly byte[] KeyVaultRawBytesPrefix = Encoding.ASCII.GetBytes("enc:v3:");
private const int AesGcmNonceSize = 12;
private const int AesGcmTagSize = 16;
private static readonly PropertyInfo[] ComplaintProperties = typeof(DenunciasGestiona)
.GetProperties(BindingFlags.Public | BindingFlags.Instance)
.Where(property => property.CanRead && property.CanWrite)
.ToArray();
private readonly MySqlDenunciaStore _inner;
private readonly IEnvelopeEncryptionKeyProvider _envelopeKeyProvider;
private readonly IEncryptionKeyProvider _legacyKeyProvider;
private readonly IDataProtector _protector;
private readonly ILogger<EncryptedDenunciaStore> _logger;
public EncryptedDenunciaStore(
MySqlDenunciaStore inner,
IEnvelopeEncryptionKeyProvider envelopeKeyProvider,
IEncryptionKeyProvider legacyKeyProvider,
IDataProtectionProvider dataProtectionProvider,
ILogger<EncryptedDenunciaStore> logger)
{
_inner = inner;
_envelopeKeyProvider = envelopeKeyProvider;
_legacyKeyProvider = legacyKeyProvider;
_protector = dataProtectionProvider.CreateProtector("ApiDenuncias.DatabaseSensitiveData.v1");
_logger = logger;
}
public Task EnsureSchemaAsync(CancellationToken cancellationToken = default)
=> _inner.EnsureSchemaAsync(cancellationToken);
public async Task<List<DenunciasGestiona>> GetAllDenunciasAsync(CancellationToken cancellationToken = default)
{
var denuncias = await _inner.GetAllDenunciasAsync(cancellationToken);
return await UnprotectComplaintsAsync(denuncias, skipPurgedRows: true, cancellationToken);
}
public async Task<List<DenunciasGestiona>> GetDenunciasByScopeAsync(
DenunciaListScope scope,
CancellationToken cancellationToken = default)
{
var denuncias = await _inner.GetDenunciasByScopeAsync(scope, cancellationToken);
return await UnprotectComplaintsAsync(denuncias, skipPurgedRows: true, cancellationToken);
}
public async Task<List<DenunciasGestiona>> GetDenunciasByIdsAsync(
IReadOnlyCollection<int> denunciaIds,
CancellationToken cancellationToken = default)
{
var denuncias = await _inner.GetDenunciasByIdsAsync(denunciaIds, cancellationToken);
return await UnprotectComplaintsAsync(denuncias, skipPurgedRows: true, cancellationToken);
}
public async Task<List<DenunciasGestiona>> GetDenunciasByIdsAsync(
IReadOnlyCollection<int> denunciaIds,
DenunciaListScope scope,
CancellationToken cancellationToken = default)
{
var denuncias = await _inner.GetDenunciasByIdsAsync(denunciaIds, scope, cancellationToken);
return await UnprotectComplaintsAsync(denuncias, skipPurgedRows: true, cancellationToken);
}
private async Task<List<DenunciasGestiona>> UnprotectComplaintsAsync(
List<DenunciasGestiona> denuncias,
bool skipPurgedRows,
CancellationToken cancellationToken)
{
var result = new List<DenunciasGestiona>(denuncias.Count);
var requestKeyCache = new Dictionary<DateOnly, byte[]>();
foreach (var denuncia in denuncias)
{
try
{
result.Add(await UnprotectComplaintAsync(denuncia, requestKeyCache, cancellationToken));
}
catch (EncryptedDataPurgedException ex) when (skipPurgedRows)
{
_logger.LogWarning(
"Se omite la denuncia {DenunciaId} en el listado porque sus datos estan purgados para la clave diaria {KeyDate}.",
denuncia.Id_Denuncia,
ex.KeyDate);
}
}
return result;
}
public async Task<List<FicherosDenuncias>> GetAllFicherosAsync(CancellationToken cancellationToken = default)
{
var ficheros = await _inner.GetAllFicherosAsync(cancellationToken);
return await UnprotectAttachmentsAsync(ficheros, skipPurgedRows: true, cancellationToken);
}
public async Task<List<FicherosDenuncias>> GetFicherosByDenunciaIdsAsync(
IReadOnlyCollection<int> denunciaIds,
CancellationToken cancellationToken = default)
{
var ficheros = await _inner.GetFicherosByDenunciaIdsAsync(denunciaIds, cancellationToken);
return await UnprotectAttachmentsAsync(ficheros, skipPurgedRows: true, cancellationToken);
}
public async Task<List<FicherosDenuncias>> GetFicherosByDenunciaAsync(int denunciaId, CancellationToken cancellationToken = default)
{
var ficheros = await _inner.GetFicherosByDenunciaAsync(denunciaId, cancellationToken);
return await UnprotectAttachmentsAsync(ficheros, skipPurgedRows: false, cancellationToken);
}
private async Task<List<FicherosDenuncias>> UnprotectAttachmentsAsync(
List<FicherosDenuncias> ficheros,
bool skipPurgedRows,
CancellationToken cancellationToken)
{
var result = new List<FicherosDenuncias>(ficheros.Count);
var requestKeyCache = new Dictionary<DateOnly, byte[]>();
foreach (var fichero in ficheros)
{
try
{
result.Add(await UnprotectAttachmentAsync(fichero, requestKeyCache, cancellationToken));
}
catch (EncryptedDataPurgedException ex) when (skipPurgedRows)
{
_logger.LogWarning(
"Se omite el adjunto {AttachmentId} de la denuncia {DenunciaId} en el listado porque sus datos estan purgados para la clave diaria {KeyDate}.",
fichero.Id_Fichero,
fichero.Id_Denuncia,
ex.KeyDate);
}
}
return result;
}
public async Task<DenunciasGestiona?> GetDenunciaByIdAsync(int denunciaId, CancellationToken cancellationToken = default)
{
var denuncia = await _inner.GetDenunciaByIdAsync(denunciaId, cancellationToken);
return denuncia is null ? null : await UnprotectComplaintAsync(denuncia, [], cancellationToken);
}
public async Task UpsertDenunciaAsync(DenunciasGestiona denuncia, CancellationToken cancellationToken = default)
{
var key = await _envelopeKeyProvider.GetCurrentKeyAsync(cancellationToken);
await _inner.UpsertDenunciaAsync(ProtectComplaint(denuncia, key), cancellationToken);
}
public async Task UpsertFicherosAsync(IEnumerable<FicherosDenuncias> ficheros, CancellationToken cancellationToken = default)
{
var key = await _envelopeKeyProvider.GetCurrentKeyAsync(cancellationToken);
await _inner.UpsertFicherosAsync(ficheros.Select(fichero => ProtectAttachment(fichero, key)).ToArray(), cancellationToken);
}
public Task MarkFicherosAsUploadedAsync(
int denunciaId,
IEnumerable<string> fileNames,
DateTime uploadedAtUtc,
CancellationToken cancellationToken = default)
=> _inner.MarkFicherosAsUploadedAsync(denunciaId, fileNames, uploadedAtUtc, cancellationToken);
private DenunciasGestiona ProtectComplaint(DenunciasGestiona source, EncryptionKeyMaterial key)
{
var protectedComplaint = TransformComplaint(
ToPersistentComplaint(source),
value => ProtectString(value, key.Key));
protectedComplaint.KeyDate = key.KeyDate;
protectedComplaint.EncryptionScheme = key.Scheme;
protectedComplaint.EncryptedAtUtc = DateTime.UtcNow;
return protectedComplaint;
}
private async Task<DenunciasGestiona> UnprotectComplaintAsync(
DenunciasGestiona source,
Dictionary<DateOnly, byte[]> requestKeyCache,
CancellationToken cancellationToken)
{
var key = await ResolveReadKeyAsync(source.KeyDate, requestKeyCache, cancellationToken);
var decrypted = TransformComplaint(source, value => UnprotectString(value, key, source.KeyDate));
var rebuilt = RebuildComplaintFromPayload(decrypted);
rebuilt.KeyDate = source.KeyDate;
rebuilt.EncryptionScheme = source.EncryptionScheme;
rebuilt.EncryptedAtUtc = source.EncryptedAtUtc;
return rebuilt;
}
private static DenunciasGestiona ToPersistentComplaint(DenunciasGestiona source)
{
return new DenunciasGestiona
{
// Permanentes tecnicos y de trazabilidad.
Id_RegistroDenuncia = source.Id_RegistroDenuncia,
Id_Denuncia = source.Id_Denuncia,
Fecha = source.Fecha,
Expediente_Gestiona = source.Expediente_Gestiona,
CodigoExpedienteGestiona = source.CodigoExpedienteGestiona,
Id_Persona_Gestiona = source.Id_Persona_Gestiona,
Etiqueta = source.Etiqueta,
Estado = source.Estado,
Confidencial = source.Confidencial,
EsActualizacion = source.EsActualizacion,
ProcedureId = source.ProcedureId,
GroupId = source.GroupId,
NombreDenuncia = source.NombreDenuncia,
EstadoDenuncia = source.EstadoDenuncia,
ArchivoElegido = source.ArchivoElegido,
FechaSubidaAGestiona = source.FechaSubidaAGestiona,
EnGestiona = source.EnGestiona,
EnRechazada = source.EnRechazada,
// Payload temporal cifrado. Los campos funcionales se derivan de aqui al leer.
CamposFormularioJson = source.CamposFormularioJson,
TextoOriginalReport = source.TextoOriginalReport
};
}
private static DenunciasGestiona RebuildComplaintFromPayload(DenunciasGestiona stored)
{
var rebuilt = TryParseStoredReport(stored) ?? new DenunciasGestiona();
if (rebuilt.Id_Denuncia == 0)
{
rebuilt.Id_Denuncia = stored.Id_Denuncia;
}
if (rebuilt.Fecha == DateTime.MinValue)
{
rebuilt.Fecha = stored.Fecha;
}
if (string.IsNullOrWhiteSpace(rebuilt.CamposFormularioJson))
{
rebuilt.CamposFormularioJson = stored.CamposFormularioJson;
}
rebuilt.TextoOriginalReport = stored.TextoOriginalReport;
ApplyPersistentTechnicalFields(rebuilt, stored);
return rebuilt;
}
private static DenunciasGestiona? TryParseStoredReport(DenunciasGestiona stored)
{
if (string.IsNullOrWhiteSpace(stored.TextoOriginalReport))
{
return null;
}
try
{
return ReportParser.ParseReport(stored.TextoOriginalReport);
}
catch
{
return null;
}
}
private static void ApplyPersistentTechnicalFields(DenunciasGestiona target, DenunciasGestiona stored)
{
target.Id_RegistroDenuncia = stored.Id_RegistroDenuncia;
target.Id_Denuncia = stored.Id_Denuncia == 0 ? target.Id_Denuncia : stored.Id_Denuncia;
target.Expediente_Gestiona = stored.Expediente_Gestiona;
target.CodigoExpedienteGestiona = stored.CodigoExpedienteGestiona;
target.Id_Persona_Gestiona = stored.Id_Persona_Gestiona;
target.Etiqueta = stored.Etiqueta;
target.Estado = stored.Estado;
target.Confidencial = stored.Confidencial || target.Confidencial;
target.EsActualizacion = stored.EsActualizacion;
target.ProcedureId = stored.ProcedureId;
target.GroupId = stored.GroupId;
target.NombreDenuncia = stored.NombreDenuncia;
target.EstadoDenuncia = stored.EstadoDenuncia;
target.ArchivoElegido = stored.ArchivoElegido;
target.FechaSubidaAGestiona = stored.FechaSubidaAGestiona;
target.EnGestiona = stored.EnGestiona;
target.EnRechazada = stored.EnRechazada;
}
private static DenunciasGestiona TransformComplaint(DenunciasGestiona source, Func<string, string> transformString)
{
var target = new DenunciasGestiona();
foreach (var property in ComplaintProperties)
{
var value = property.GetValue(source);
if (property.PropertyType == typeof(string))
{
property.SetValue(target, transformString((string?)value ?? string.Empty));
}
else
{
property.SetValue(target, value);
}
}
return target;
}
private FicherosDenuncias ProtectAttachment(FicherosDenuncias source, EncryptionKeyMaterial key)
{
var content = source.Fichero ?? [];
var hash = string.IsNullOrWhiteSpace(source.ContentSha256)
? ComputeSha256Hex(content)
: source.ContentSha256.Trim().ToLowerInvariant();
return new FicherosDenuncias
{
Id_Fichero = source.Id_Fichero,
Id_Tipo = source.Id_Tipo,
Descripcion = ProtectString(source.Descripcion ?? string.Empty, key.Key),
Fecha = source.Fecha,
Observaciones = ProtectString(source.Observaciones ?? string.Empty, key.Key),
Id_Denuncia = source.Id_Denuncia,
NombreFichero = source.NombreFichero,
Fichero = ProtectBytes(content, key.Key),
Subido = source.Subido,
FechaSubida = source.FechaSubida,
ContentSha256 = hash,
KeyDate = key.KeyDate,
EncryptionScheme = key.Scheme,
EncryptedAtUtc = DateTime.UtcNow
};
}
private async Task<FicherosDenuncias> UnprotectAttachmentAsync(
FicherosDenuncias source,
Dictionary<DateOnly, byte[]> requestKeyCache,
CancellationToken cancellationToken)
{
var key = await ResolveReadKeyAsync(source.KeyDate, requestKeyCache, cancellationToken);
return new FicherosDenuncias
{
Id_Fichero = source.Id_Fichero,
Id_Tipo = source.Id_Tipo,
Descripcion = UnprotectString(source.Descripcion ?? string.Empty, key, source.KeyDate),
Fecha = source.Fecha,
Observaciones = UnprotectString(source.Observaciones ?? string.Empty, key, source.KeyDate),
Id_Denuncia = source.Id_Denuncia,
NombreFichero = source.NombreFichero,
Fichero = UnprotectBytes(source.Fichero ?? [], key, source.KeyDate),
Subido = source.Subido,
FechaSubida = source.FechaSubida,
ContentSha256 = source.ContentSha256,
KeyDate = source.KeyDate,
EncryptionScheme = source.EncryptionScheme,
EncryptedAtUtc = source.EncryptedAtUtc
};
}
private async Task<byte[]> ResolveReadKeyAsync(
DateOnly? keyDate,
Dictionary<DateOnly, byte[]> requestKeyCache,
CancellationToken cancellationToken)
{
if (keyDate.HasValue)
{
if (requestKeyCache.TryGetValue(keyDate.Value, out var cached))
{
return cached;
}
var key = await _envelopeKeyProvider.GetKeyForDateAsync(keyDate.Value, cancellationToken);
var copy = key.CopyKey();
requestKeyCache[keyDate.Value] = copy;
return copy;
}
return await _legacyKeyProvider.GetKeyAsync(cancellationToken);
}
private string ProtectString(string value, byte[] key)
{
if (string.IsNullOrWhiteSpace(value) ||
value.StartsWith(KeyVaultStringPrefix, StringComparison.Ordinal) ||
value.StartsWith(DataProtectionStringPrefix, StringComparison.Ordinal))
{
return value;
}
var encrypted = EncryptBytes(Encoding.UTF8.GetBytes(value), key);
return KeyVaultStringPrefix + Convert.ToBase64String(encrypted);
}
private string UnprotectString(string value, byte[] key, DateOnly? keyDate = null)
{
if (string.IsNullOrWhiteSpace(value))
{
return value;
}
if (value.StartsWith(KeyVaultStringPrefix, StringComparison.Ordinal))
{
try
{
var encrypted = Convert.FromBase64String(value[KeyVaultStringPrefix.Length..]);
return Encoding.UTF8.GetString(DecryptBytes(encrypted, key));
}
catch (Exception ex)
{
if (keyDate.HasValue)
{
throw CreatePurgedDataException(keyDate.Value, ex);
}
return value;
}
}
if (!value.StartsWith(DataProtectionStringPrefix, StringComparison.Ordinal))
{
return value;
}
try
{
return _protector.Unprotect(value[DataProtectionStringPrefix.Length..]);
}
catch
{
return value;
}
}
private byte[] ProtectBytes(byte[] value, byte[] key)
{
if (value.Length == 0 ||
StartsWith(value, KeyVaultBytesPrefix) ||
StartsWith(value, KeyVaultRawBytesPrefix) ||
StartsWith(value, DataProtectionBytesPrefix))
{
return value;
}
var encrypted = EncryptBytes(value, key);
return [.. KeyVaultRawBytesPrefix, .. encrypted];
}
private byte[] UnprotectBytes(byte[] value, byte[] key, DateOnly? keyDate = null)
{
if (value.Length == 0)
{
return value;
}
if (StartsWith(value, KeyVaultRawBytesPrefix))
{
try
{
return DecryptBytes(value[KeyVaultRawBytesPrefix.Length..], key);
}
catch (Exception ex)
{
if (keyDate.HasValue)
{
throw CreatePurgedDataException(keyDate.Value, ex);
}
return value;
}
}
if (StartsWith(value, KeyVaultBytesPrefix))
{
try
{
var base64 = Encoding.ASCII.GetString(value, KeyVaultBytesPrefix.Length, value.Length - KeyVaultBytesPrefix.Length);
return DecryptBytes(Convert.FromBase64String(base64), key);
}
catch (Exception ex)
{
if (keyDate.HasValue)
{
throw CreatePurgedDataException(keyDate.Value, ex);
}
return value;
}
}
if (!StartsWith(value, DataProtectionBytesPrefix))
{
return value;
}
try
{
var base64 = Encoding.ASCII.GetString(value, DataProtectionBytesPrefix.Length, value.Length - DataProtectionBytesPrefix.Length);
return _protector.Unprotect(Convert.FromBase64String(base64));
}
catch
{
return value;
}
}
private static byte[] EncryptBytes(byte[] plainBytes, byte[] key)
{
var nonce = RandomNumberGenerator.GetBytes(AesGcmNonceSize);
var cipherBytes = new byte[plainBytes.Length];
var tag = new byte[AesGcmTagSize];
using var aes = new AesGcm(key, AesGcmTagSize);
aes.Encrypt(nonce, plainBytes, cipherBytes, tag);
return [.. nonce, .. tag, .. cipherBytes];
}
private static byte[] DecryptBytes(byte[] encryptedBytes, byte[] key)
{
if (encryptedBytes.Length < AesGcmNonceSize + AesGcmTagSize)
{
throw new CryptographicException("Payload cifrado invalido.");
}
var nonce = encryptedBytes.AsSpan(0, AesGcmNonceSize);
var tag = encryptedBytes.AsSpan(AesGcmNonceSize, AesGcmTagSize);
var cipherBytes = encryptedBytes.AsSpan(AesGcmNonceSize + AesGcmTagSize);
var plainBytes = new byte[cipherBytes.Length];
using var aes = new AesGcm(key, AesGcmTagSize);
aes.Decrypt(nonce, cipherBytes, tag, plainBytes);
return plainBytes;
}
private static bool StartsWith(byte[] value, byte[] prefix)
{
if (value.Length < prefix.Length)
{
return false;
}
for (var i = 0; i < prefix.Length; i++)
{
if (value[i] != prefix[i])
{
return false;
}
}
return true;
}
private static string ComputeSha256Hex(byte[] content)
=> Convert.ToHexString(SHA256.HashData(content)).ToLowerInvariant();
private static EncryptedDataPurgedException CreatePurgedDataException(DateOnly keyDate, Exception innerException)
=> new(keyDate, innerException);
}