Authenticator Servisi (TOTP)

public interface IAuthenticationTotpService
{
    string GenerateSecret();
    string GenerateQrCodeUri(string accountName, string secret);
    bool   VerifyCode(string secret, string code, DateTime utcNow, out long timeStep);
}

public string GenerateSecret()
{
    var key = KeyGeneration.GenerateRandomKey(_options.SecretLength);
    return Base32Encoding.ToString(key);
}

return
    $"otpauth://totp/{encodedIssuer}:{encodedAccount}" +
    $"?secret={secret}" +
    $"&issuer={encodedIssuer}" +
    $"&algorithm={_options.Algorithm}" +   // SHA1
    $"&digits={_options.Digits}" +         // 6
    $"&period={_options.TimeStepSeconds}"; // 30

var totp = new Totp(secretBytes,
    step: _options.TimeStepSeconds,
    totpSize: _options.Digits,
    mode: _hashMode);

var window = new VerificationWindow(
    previous: _options.AllowedDriftSteps,
    future:   _options.AllowedDriftSteps);

return totp.VerifyTotp(code, out timeStep, window);

var plainSecret   = _totpService.GenerateSecret();
var encryptedSecret = TotpSecret.Create(encrypted: _secretProtector.Protect(plainSecret));

user.ConfigureTotp(encryptedSecret);                          // aggregate'e işle
var qrCodeUri = _totpService.GenerateQrCodeUri(user.Phone.Value, plainSecret);

await _unitOfWork.SaveEntitiesAsync(cancellationToken);
// dön: { ManualEntryKey = plainSecret, QrCodeUri = qrCodeUri }

{
  "Services": {
    "Authenticator": {
      "Issuer": "DiyanetCleanArchitecture",
      "TimeStepSeconds": 30,
      "AllowedDriftSteps": 1,
      "SecretLength": 20,
      "Algorithm": "SHA1",
      "Digits": 6
    }
  }
}

public static IServiceCollection AddAuthenticatorService(this IServiceCollection services, IConfiguration configuration)
{
    services.Configure<AuthenticatorServiceOptions>(o =>
        configuration.GetSection("Services:Authenticator").Bind(o));

    services.AddScoped<IAuthenticationTotpService, AuthenticationTotpService>();
    return services;
}