BuildingBlocks.Keycloak

public static IServiceCollection AddKeycloak(
    this IServiceCollection services,
    IConfiguration          configuration)
{
    var opts = configuration.GetSection("Keycloak").Get<KeycloakOptions>()
        ?? throw new InvalidOperationException("'Keycloak' yapılandırma bölümü eksik.");

    services.Configure<KeycloakOptions>(configuration.GetSection("Keycloak"));

    // Current user + claims transformation zinciri
    services.AddHttpContextAccessor();
    services.AddScoped<ICurrentUserService, CurrentUserService>();
    services.AddScoped<KeycloakRoleClaimsTransformation>();   // realm/resource roller → ClaimTypes.Role
    services.AddScoped<UserContextClaimsTransformation>();    // tenant_id + permissions claim'leri
    services.AddScoped<IClaimsTransformation, CompositeClaimsTransformation>();
    services.TryAddScoped<IUserContextProvider, NullUserContextProvider>();

    // İki JwtBearer şeması — her biri kendi realm'ından doğrular (RS256, JWKS otomatik)
    services.AddAuthentication(KeycloakSchemeNames.Personel)
        .AddJwtBearer(KeycloakSchemeNames.Vatandas, o => ConfigureScheme(o, opts.Vatandas))
        .AddJwtBearer(KeycloakSchemeNames.Personel, o => ConfigureScheme(o, opts.Personel));

    services.AddAuthorization();

    // Her iki realm'ın OIDC discovery endpoint'i için health check (Degraded)
    services.AddHealthChecks()
        .AddUrlGroup(new Uri(opts.Vatandas.DiscoveryEndpoint), "keycloak-vatandas", HealthStatus.Degraded, ...)
        .AddUrlGroup(new Uri(opts.Personel.DiscoveryEndpoint), "keycloak-personel", HealthStatus.Degraded, ...);

    return services;
}

{
  "Keycloak": {
    "Vatandas": {
      "BaseUrl": "http://localhost:8080",
      "PublicBaseUrl": "http://localhost:8080",
      "Realm": "diyanet-vatandas-dev-realm",
      "ClientId": "diyanet-website",
      "RequireHttpsMetadata": false,
      "ValidateAudience": true,
      "CookieName": "kc_vatandas_token"
    },
    "Personel": {
      "BaseUrl": "http://localhost:8080",
      "PublicBaseUrl": "http://localhost:8080",
      "Realm": "diyanet-yonetim-dev-realm",
      "ClientId": "diyanet-admin",
      "RequireHttpsMetadata": false,
      "ValidateAudience": true,
      "CookieName": "kc_personel_token"
    }
  }
}

// Sadece vatandaş
[Authorize(AuthenticationSchemes = KeycloakSchemeNames.Vatandas)]
[HttpGet("api/website/profile")]
public async Task<IActionResult> GetCitizenProfile()
{
    var userId = _currentUser.UserId;
    return Ok(await _mediator.Send(new GetCitizenProfileQuery(userId)));
}

// Sadece personel
[Authorize(AuthenticationSchemes = KeycloakSchemeNames.Personel)]
[HttpGet("api/admin/dashboard")]
public async Task<IActionResult> GetAdminDashboard()
    => Ok(await _mediator.Send(new GetAdminDashboardQuery()));

// Her iki realm
[Authorize(AuthenticationSchemes = KeycloakSchemeNames.Any)]
[HttpGet("api/website/notifications")]
public async Task<IActionResult> GetNotifications()
    => Ok(await _mediator.Send(new GetNotificationsQuery(_currentUser.UserId)));