04.1 — Web Sunucu Taraflı Giriş (Confidential Client + PKCE)

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using Microsoft.AspNetCore.Mvc;

[ApiController]
[Route("api/auth")]
public class AuthController : ControllerBase
{
    private readonly IConfiguration _config;
    private readonly IHttpClientFactory _httpClientFactory;

    public AuthController(IConfiguration config, IHttpClientFactory httpClientFactory)
    {
        _config = config;
        _httpClientFactory = httpClientFactory;
    }

    [HttpGet("login")]
    public IActionResult Login()
    {
        // 1. PKCE ve State üret
        var verifier = GenerateRandomBase64Url(32);
        var challenge = ComputeSha256Base64Url(verifier);
        var state = GenerateRandomBase64Url(16);

        // 2. Cookie'ye yaz
        var cookieOpts = new CookieOptions { HttpOnly = true, Secure = true, MaxAge = TimeSpan.FromMinutes(5) };
        Response.Cookies.Append("pkce_verifier", verifier, cookieOpts);
        Response.Cookies.Append("oauth_state", state, cookieOpts);

        // 3. Yönlendir
        var issuer = _config["Talost:Issuer"];
        var clientId = _config["Talost:ClientId"];
        var redirectUri = Uri.EscapeDataString(_config["Talost:RedirectUri"]!);

        var authUrl = $"{issuer}/oauth/authorize?response_type=code&client_id={clientId}&redirect_uri={redirectUri}&scope=openid%20profile%20email%20offline_access&state={state}&code_challenge={challenge}&code_challenge_method=S256";
        return Redirect(authUrl);
    }

    [HttpGet("callback")]
    public async Task<IActionResult> Callback([FromQuery] string code, [FromQuery] string state)
    {
        var savedState = Request.Cookies["oauth_state"];
        var verifier = Request.Cookies["pkce_verifier"];

        if (string.IsNullOrEmpty(state) || state != savedState || string.IsNullOrEmpty(verifier))
        {
            return BadRequest(new { error = "invalid_state", message = "Doğrulama başarısız." });
        }

        var client = _httpClientFactory.CreateClient();
        var issuer = _config["Talost:Issuer"];

        var tokenParams = new Dictionary<string, string>
        {
            { "grant_type", "authorization_code" },
            { "client_id", _config["Talost:ClientId"]! },
            { "client_secret", _config["Talost:ClientSecret"]! },
            { "code", code },
            { "redirect_uri", _config["Talost:RedirectUri"]! },
            { "code_verifier", verifier }
        };

        var response = await client.PostAsync($"{issuer}/oauth/token", new FormUrlEncodedContent(tokenParams));
        var content = await response.Content.ReadAsStringAsync();

        if (!response.IsSuccessStatusCode)
        {
            return StatusCode((int)response.StatusCode, content);
        }

        // Tokenları güvenli oturum çerezi olarak saklayıp panele yönlendir
        Response.Cookies.Delete("oauth_state");
        Response.Cookies.Delete("pkce_verifier");
        Response.Cookies.Append("app_session", content, new CookieOptions { HttpOnly = true, Secure = true });

        return Redirect("/dashboard");
    }

    private static string GenerateRandomBase64Url(int length)
    {
        var bytes = RandomNumberGenerator.GetBytes(length);
        return Convert.ToBase64String(bytes).Replace("+", "-").Replace("/", "_").TrimEnd('=');
    }

    private static string ComputeSha256Base64Url(string input)
    {
        var hash = SHA256.HashData(Encoding.ASCII.GetBytes(input));
        return Convert.ToBase64String(hash).Replace("+", "-").Replace("/", "_").TrimEnd('=');
    }
}