04.2 — SPA ve PWA Uygulamaları (Public Client + BFF Önerisi)

ÖNERİLEN: Backend-for-Frontend (BFF) Modeli
[Tarayıcı: React/Vue]  <--- Şifreli HttpOnly Cookie --->  [BFF Sunucusu (Node/Next)]  <--- Token / Secret --->  [TALOST ID]

// pkce.ts
export async function generatePKCE() {
  const array = new Uint8Array(32);
  window.crypto.getRandomValues(array);
  const verifier = base64UrlEncode(array);

  const encoder = new TextEncoder();
  const data = encoder.encode(verifier);
  const hash = await window.crypto.subtle.digest("SHA-256", data);
  const challenge = base64UrlEncode(new Uint8Array(hash));
  
  const state = Math.random().toString(36).substring(2) + Date.now().toString(36);

  return { verifier, challenge, state };
}

function base64UrlEncode(buffer: Uint8Array): string {
  let str = "";
  for (let i = 0; i < buffer.byteLength; i++) {
    str += String.fromCharCode(buffer[i]);
  }
  return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
}

// Giriş Başlatma
export async function startLogin(issuer: string, clientId: string, redirectUri: string) {
  const { verifier, challenge, state } = await generatePKCE();

  // Geçici olarak sessionStorage'da sakla
  sessionStorage.setItem("talost_pkce_verifier", verifier);
  sessionStorage.setItem("talost_oauth_state", state);

  const authUrl = new URL(`${issuer}/oauth/authorize`);
  authUrl.searchParams.set("response_type", "code");
  authUrl.searchParams.set("client_id", clientId);
  authUrl.searchParams.set("redirect_uri", redirectUri);
  authUrl.searchParams.set("scope", "openid profile email");
  authUrl.searchParams.set("state", state);
  authUrl.searchParams.set("code_challenge", challenge);
  authUrl.searchParams.set("code_challenge_method", "S256");

  window.location.href = authUrl.toString();
}

// Callback Sayfasında Token Takası
export async function handleCallback(issuer: string, clientId: string, redirectUri: string) {
  const params = new URLSearchParams(window.location.search);
  const code = params.get("code");
  const state = params.get("state");

  const savedState = sessionStorage.getItem("talost_oauth_state");
  const verifier = sessionStorage.getItem("talost_pkce_verifier");

  if (!code || !state || state !== savedState || !verifier) {
    throw new Error("Geçersiz state veya PKCE verifier.");
  }

  // Token Takası (Public client olduğu için client_secret gönderilmez)
  const tokenRes = await fetch(`${issuer}/oauth/token`, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      client_id: clientId,
      code,
      redirect_uri: redirectUri,
      code_verifier: verifier,
    }),
  });

  sessionStorage.removeItem("talost_pkce_verifier");
  sessionStorage.removeItem("talost_oauth_state");

  const tokens = await tokenRes.json();
  if (!tokenRes.ok) throw new Error(tokens.error_description || "Token alınamadı.");

  return tokens;
}