OAuth Servisi

public interface IOAuthClient<TUserInfo>
{
    // PKCE + state dahil authorize URL üretir
    Task<AuthorizationRequest> CreateAuthorizationRequestAsync(string state);

    // authorization code → token exchange
    Task<OAuthTokenResponse> ExchangeCodeAsync(string code, string codeVerifier);

    // access token ile provider'dan kullanıcı bilgisi çeker
    Task<TUserInfo> GetUserInfoAsync(string accessToken);
}

public class PkcePair
{
    public string CodeVerifier { get; }
    public string CodeChallenge { get; }

    public PkcePair()
    {
        CodeVerifier = Base64UrlEncode(RandomNumberGenerator.GetBytes(64));
        CodeChallenge = Base64UrlEncode(SHA256.HashData(Encoding.ASCII.GetBytes(CodeVerifier)));
    }
}

public async Task<GoogleTokenPayload> VerifyAsync(string idToken)
{
    var settings = new GoogleJsonWebSignature.ValidationSettings
    {
        Audience = new[] { _options.Google.Identity.ClientId }
    };

    var payload = await GoogleJsonWebSignature.ValidateAsync(idToken, settings);
    // ... Subject, Email, EmailVerified, Name, GivenName, FamilyName, Picture, Locale
}

private const string CacheKeyPrefix = "keycloak_pkce_";
private static readonly TimeSpan StateExpiry = TimeSpan.FromMinutes(10);

// CreateAuthorizationRequestAsync içinde:
await _cache.SetStringAsync(CacheKeyPrefix + state, pkce.CodeVerifier,
    new DistributedCacheEntryOptions { AbsoluteExpirationRelativeToNow = StateExpiry }, ct);

// ExchangeCodeAsync içinde:
var codeVerifier = await _cache.GetStringAsync(CacheKeyPrefix + state, ct);
await _cache.RemoveAsync(CacheKeyPrefix + state, ct);   // tek kullanım

private static readonly TimeSpan JwksCacheDuration = TimeSpan.FromMinutes(60);

// Token okunur → iss'ten realm bulunur → JWKS alınır → ValidateToken
var issuer = unverified.Issuer;
var scheme = ResolveScheme(issuer);              // Personel / Vatandas
var signingKeys = await GetSigningKeysAsync(scheme, forceRefresh: false, ct);

{
  "OAuth": {
    "Google": {
      "Identity": {
        "ClientId": "...apps.googleusercontent.com",
        "ClientSecret": "...",
        "AuthorizationEndpoint": "https://accounts.google.com/o/oauth2/v2/auth",
        "TokenEndpoint": "https://oauth2.googleapis.com/token",
        "RedirectUri": "https://api.example/auth/oauth/google/callback",
        "UserInfoEndpoint": "https://openidconnect.googleapis.com/v1/userinfo",
        "Scopes": [ "openid", "profile", "email" ]
      },
      "Integration": { "...": "geniş scope'lar (business.manage vb.)" }
    },
    "Meta": {
      "Identity":    { "...": "facebook.com/v19.0/dialog/oauth" },
      "Integration": { "...": "pages_*, instagram_*, whatsapp_*" }
    }
  },
  "Keycloak": {
    "Vatandas": { "Realm": "diyanet-vatandas-dev-realm", "ClientId": "diyanet-website", "...": "" },
    "Personel": { "Realm": "diyanet-yonetim-dev-realm", "ClientId": "diyanet-admin", "...": "" }
  }
}

public static IServiceCollection AddOAuthProviders(this IServiceCollection services, IConfiguration configuration)
{
    services.Configure<OAuthOptions>(o => configuration.GetSection("OAuth").Bind(o));

    // Google — HttpClient + Polly retry
    services.AddHttpClient<IGoogleIdentityOAuthClient, GoogleIdentityOAuthClient>().AddPolicyHandler(GetRetryPolicy());
    services.AddHttpClient<IGoogleIntegrationOAuthClient, GoogleIntegrationOAuthClient>().AddPolicyHandler(GetRetryPolicy());
    services.AddSingleton<IGoogleIdTokenVerifier, GoogleIdTokenVerifier>();

    // Keycloak
    services.Configure<KeycloakOptions>(configuration.GetSection("Keycloak"));
    services.AddMemoryCache();   // JWKS cache
    services.AddHttpClient<IKeycloakOAuthClient, KeycloakOAuthClient>().AddPolicyHandler(GetRetryPolicy());
    services.AddSingleton<IKeycloakTokenValidator, KeycloakTokenValidator>();

    return services;
}

// 3 retry, exponential backoff (2^attempt sn)
private static IAsyncPolicy<HttpResponseMessage> GetRetryPolicy() =>
    HttpPolicyExtensions.HandleTransientHttpError()
        .WaitAndRetryAsync(3, attempt => TimeSpan.FromSeconds(Math.Pow(2, attempt)));