BuildingBlocks.Otp

var code = OtpCode.Create("482913");
_logger.LogInformation("OTP: {Code}", code);   // → "OTP: ******"
string actual = code.Reveal();                  // → "482913" (yalnızca hash/SMS için)

public static IServiceCollection AddOtp(this IServiceCollection services, IConfiguration configuration)
{
    services.Configure<OtpOptions>(configuration.GetSection("Services:Otp"));

    services.AddSingleton<IOtpCodeGenerator, NumericOtpCodeGenerator>();
    services.AddSingleton<IOtpHashService, HmacOtpHashService>();
    services.AddSingleton<IOtpMessageFormatter, DefaultOtpMessageFormatter>();
    services.AddSingleton<IOtpService, OtpService>();   // orchestrator

    return services;
}

{
  "Services": {
    "Otp": {
      "CodeLength": 6,
      "ExpireMinutes": 3,
      "ThrottleSeconds": 60,
      "MaxRequestPerDay": 20,
      "MaxVerifyAttempt": 5,
      "MaxFailedVerifyPerDay": 50,
      "ChallengeRetentionMinutes": 15,
      "AllowResendWhileActive": false,
      "HashSecretSalt": "min-32-karakter-gizli-salt",
      "LoginSmsTemplate": "{code} giriş doğrulama kodunuzdur."
    }
  }
}

public class OtpLoginService(IOtpService otp, IOtpHashService hasher, IDistributedCache cache)
{
    // 1) Üret → SMS gönder → hash'i sakla (kodun kendisini DEĞİL)
    public async Task RequestAsync(string phone)
    {
        OtpCode code = otp.GenerateCode();
        string hash  = otp.Hash(code);                 // HMAC-SHA256 + salt
        string sms   = otp.CreateLoginSms(code);       // "482913 giriş doğrulama kodunuzdur."

        await cache.SetStringAsync($"otp:{phone}", hash,
            new() { AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(3) });

        await _smsService.SendAsync(phone, sms);       // OtpSmsService → NetGSM
    }

    // 2) Doğrula — girilen kodu hash'le, saklanan hash ile sabit-zamanlı karşılaştır
    public async Task<bool> VerifyAsync(string phone, string entered)
    {
        string? savedHash = await cache.GetStringAsync($"otp:{phone}");
        if (savedHash is null) return false;           // süresi dolmuş / hiç istenmemiş

        OtpCode code = OtpCode.Create(entered);
        return hasher.Verify(code, savedHash);         // HMAC eşitliği (FixedTimeEquals)
    }
}