Authentication

options.MapInboundClaims = false;             // sub/name/role auto-rename KAPALI
options.Authority = scheme.Authority;         // OIDC discovery → JWKS otomatik
options.RequireHttpsMetadata = scheme.RequireHttpsMetadata;

options.TokenValidationParameters = new TokenValidationParameters
{
    ValidateIssuer           = true,
    ValidIssuers             = validIssuers,            // internal + public issuer
    ValidateAudience         = scheme.ValidateAudience,
    ValidAudiences           = [scheme.ClientId, "account"],
    ValidateLifetime         = true,
    ClockSkew                = TimeSpan.FromSeconds(30),
    NameClaimType            = "preferred_username",
    RoleClaimType            = ClaimTypes.Role,
    ValidateIssuerSigningKey = true
    // IssuerSigningKey ayarlanmaz — JWKS OIDC discovery ile otomatik alınır
};

var validIssuers = scheme.Issuer == scheme.PublicIssuer
    ? new[] { scheme.Issuer }
    : new[] { scheme.Issuer, scheme.PublicIssuer };

Authority        = {BaseUrl}/realms/{Realm}
Issuer           = Authority
PublicIssuer     = {PublicBaseUrl}/realms/{Realm}   (boşsa Issuer ile aynı)
JwksUri          = {Authority}/protocol/openid-connect/certs

OnMessageReceived = ctx =>
{
    // 1) HTTP-only cookie (kc_vatandas_token / kc_personel_token)
    if (string.IsNullOrEmpty(ctx.Token) &&
        ctx.Request.Cookies.TryGetValue(scheme.CookieName, out var cookieToken) &&
        !string.IsNullOrEmpty(cookieToken))
    {
        ctx.Token = cookieToken;
        return Task.CompletedTask;
    }

    // 2) Authorization: Bearer header — framework otomatik okur (Swagger, servis-arası)

    // 3) Query string access_token — yalnız /hubs ve /files (SignalR/FileServer)
    var accessToken = ctx.Request.Query["access_token"];
    var path = ctx.HttpContext.Request.Path;
    if (!string.IsNullOrEmpty(accessToken) && path.HasValue &&
        (path.StartsWithSegments("/hubs") || path.StartsWithSegments("/files")))
    {
        ctx.Token = accessToken;
    }
    return Task.CompletedTask;
};

X-Auth-Fail-PersonelScheme: SecurityTokenExpiredException: ...
Token-Expired: true                 # token süresi dolduysa

if (!_options.TokenVersionValidation ||
    context.User?.Identity?.IsAuthenticated != true)
{
    await _next(context);
    return;
}
// JWT token_version ile DB User.TokenVersion karşılaştır
if (user == null || user.TokenVersion != tokenVersion)
{
    context.Response.StatusCode = StatusCodes.Status401Unauthorized;
    await context.Response.WriteAsync("Token geçersiz kılınmış.");
    return;
}