Personel Girişi

[AllowAnonymous]
[HttpPost("keycloak/session")]
public async Task<IActionResult> KeycloakSession([FromBody] KeycloakSessionRequest request, CancellationToken ct)
{
    var payload = await _keycloakValidator.ValidateAsync(request.AccessToken, ct); // JWKS
    Response.AppendKcToken(request.AccessToken, accessExpiry, SecureCookie);
    if (!string.IsNullOrEmpty(request.RefreshToken))
        Response.AppendRefreshToken(request.RefreshToken, refreshExpiry, SecureCookie);
    // → provisioning (sonraki adım)
}

// 1) sub ile mevcut Keycloak linki var mı?
var bySub = await _userRepository.FirstOrDefaultAsync(
    new UserByIdentityProviderSpecification(AuthProviderType.Keycloak, request.Subject), ct);
if (bySub is not null) {
    if (bySub.IsBlocked) throw new ExternalLoginNotAllowedException("...", "account_blocked");
    bySub.AddOrUpdateKeycloakLogin(request.Subject, displayName);
    wasFirstLogin = bySub.ActivateOnExternalLogin();   // Draft/Pending → Active
    // ... save + commit
}
// 2) email ile önceden davet edilmiş (pre-created) kullanıcı?
//    byEmail.AddOrUpdateKeycloakLogin + ActivateOnExternalLogin
// 3) hiçbir eşleşme yok → reddet
throw new ExternalLoginNotAllowedException(
    "Yönetim paneli erişim yetkiniz bulunmuyor. ...", "not_invited");

catch (ExternalLoginNotAllowedException ex)
{
    Response.DeleteKcToken();
    Response.DeleteRefreshToken();
    return StatusCode(StatusCodes.Status403Forbidden, new { message = ex.Message, reason = ex.Reason });
}

GET /api/admin/me  →  GetAdminMeQuery  →  GetAdminMeQueryHandler