BuildingBlocks.Jwt

public class JwtOptions
{
    public BackofficeOptions Backoffice { get; set; }      // : JwtBase
    public OTPChallengeOptions OTPChallenge { get; set; }  // : JwtBase
}

public static IServiceCollection AddJwt(this IServiceCollection services, IConfiguration configuration)
{
    services.Configure<JwtOptions>(o => configuration.GetSection("Jwt").Bind(o));
    services.Configure<RefreshTokenOptions>(o => configuration.GetSection("RefreshToken:Backoffice").Bind(o));

    // İki şema için named JwtBearerOptions yapılandırması
    services.ConfigureOptions<ConfigureBackofficeJwtOptions>();
    services.ConfigureOptions<ConfigureOTPChallengeJwtOptions>();
    services.AddHttpContextAccessor();

    services.AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme    = JwtBearerDefaults.AuthenticationScheme;
        options.DefaultScheme             = JwtBearerDefaults.AuthenticationScheme;
    })
    .AddJwtBearer(AuthenticationSchemeTypes.BackofficeAuthenticationScheme, _ => { })
    .AddJwtBearer(AuthenticationSchemeTypes.OTPChallengeAuthenticationScheme, _ => { });

    return services;
}

{
  "Jwt": {
    "Backoffice": {
      "Secret": "<min-32-char>",
      "ValidAudience": "diyanet-api",
      "ValidIssuer": "diyanet",
      "Expires": 60,
      "ClockSkew": 60
    },
    "OTPChallenge": {
      "Secret": "<min-64-char>",
      "ValidAudience": "diyanet-api",
      "ValidIssuer": "diyanet",
      "Expires": 5,
      "ClockSkew": 30
    }
  }
}

// Token doğrulama
var validator = new JwtTokenValidator(secret, validateLifetime: true, issuer: "diyanet", audience: "diyanet-api");
if (!validator.ValidateToken(token)) return Unauthorized();
var sub = validator.GetClaim(token, "sub");

// Endpoint koruma — Backoffice
[Authorize(AuthenticationSchemes = AuthenticationSchemeTypes.BackofficeAuthenticationScheme)]
[HttpGet("api/admin/reports")]
public async Task<IActionResult> GetReports()
    => Ok(await _mediator.Send(new GetReportsQuery()));

// Endpoint koruma — OTPChallenge (sadece OTP doğrulama adımı)
[Authorize(AuthenticationSchemes = AuthenticationSchemeTypes.OTPChallengeAuthenticationScheme)]
[HttpPost("api/admin/auth/verify-otp")]
public async Task<IActionResult> VerifyOtp([FromBody] VerifyOtpRequest req)
    => Ok(await _mediator.Send(new VerifyOtpCommand(req.Code)));