Vatandaş Kaydı

[AllowAnonymous]
[HttpPost("sign-up")]
public async Task<IActionResult> SignUp([FromBody] SignUpUserCommand command)
{
    var result = await _mediator.Send(command);
    return result.IsSuccess ? Created("", result.Response) : BadRequest(result.Response);
}

var existingUserByPhone = await _userRepository
    .FirstOrDefaultAsync(new UserByPhoneNumberSpecification(phone), cancellationToken);

if (existingUserByPhone is not null)
{
    if (existingUserByPhone.IsPhoneNumberVerified == false)
        throw new DomainException("... zaten mevcut fakat üyelik onayı yapılmamış. Lütfen giriş yapınız");
    throw new DomainException("Bu telefon numarasına sahip bir kullanıcı zaten mevcut");
}

var otpCode = OtpCode.Generate();              // 4 hane, 1000-9999
var otpType = phone != null ? OtpType.Sms : OtpType.Email;
user.AddOtpChallenge(otpCode, otpType);

public void AddOtpChallenge(OtpCode code, OtpType type)
{
    if (CanRequestOtp == false)
        throw new DomainException("Kullanıcı durumu giriş yapmaya uygun değil.");

    var validityMinutes = type == OtpType.Sms ? 1 : 2;
    var challenge = new UserOtpChallenge(this, GuidFactory.New(), code, type,
        DateTime.UtcNow.AddMinutes(validityMinutes));
    OtpChallenges.Add(challenge);
    AddDomainEvent(new UserOtpGeneratedDomainEvent(this, code, type, this.Phone, this.Email));
}

await _repository.AddAsync(user);
bool result = await _unitOfWork.SaveEntitiesAsync(cancellationToken);
if (!result)
    throw new ApplicationException("Kayıt işlemi sırasında bir sorun oluştu.");

public sealed class SendOtpSmsDomainEventHandler
    : INotificationHandler<UserOtpGeneratedDomainEvent>,
      INotificationHandler<UserOtpResentDomainEvent>
{
    private readonly IOtpSmsService _otpSmsService;

    private async Task SendIfSmsAsync(Phone? phone, OtpCode code, OtpType type)
    {
        if (phone is null || type != OtpType.Sms) return;   // guard
        await _otpSmsService.SendAsync(code, phone);        // NetGSM REST v2
    }
}

var challenge = user?.GetActiveOtpChallenge(otpType);
if (challenge is null) throw new DomainException("Aktif OTP doğrulama kodu bulunamadı");

var challengeToken = _authService.CreateOtpChallengeToken(user, otpType, challenge.Id);

return ResponseWrapper<OtpChallengeDto>.Success(new OtpChallengeDto
{
    ChallengeToken = challengeToken
});

[Authorize(AuthenticationSchemes = AuthenticationSchemeTypes.OTPChallengeAuthenticationScheme)]
[HttpPost("verify-otp")]
public async Task<IActionResult> VerifyOtp([FromBody] VerifyOtpCommand command, CancellationToken ct)
{
    var result = await _mediator.Send(command, ct);
    if (result.IsSuccess == false) return BadRequest(result);
    Response.AppendRefreshToken(result.Response.RefreshToken);   // HttpOnly cookie
    return Ok(new VerifyOtpResponse(result.Response.AccessToken, result.Response.User));
}

if (!user.VerifyChallenge(challengeId, request.Code))
    throw new ApplicationException("Geçersiz veya süresi dolmuş kod");
// ...
user.StartSession(refreshTokenInfo, request.IsTrustedDevice, deviceInfo, clientInfo);