04.4 — Mobil Uygulamalar (iOS & Android)

[Mobil Uygulama] ---> ASWebAuthenticationSession / Custom Tabs ---> [TALOST ID Giriş Ekranı]
                                                                            |
[Mobil Uygulama] <--- Custom Scheme (myapp://oauth/callback?code=...) <----+

import Foundation
import AuthenticationServices
import CryptoKit

class AuthManager: NSObject, ASWebAuthenticationPresentationContextProviding {
    var webAuthSession: ASWebAuthenticationSession?
    
    func startLogin() {
        // 1. PKCE üretimi
        let verifier = generateRandomBase64Url(length: 32)
        let challenge = computeSha256Base64Url(input: verifier)
        let state = UUID().uuidString
        
        let issuer = "https://id.talost.com"
        let clientId = "cli_dev_xxxxxxxxxxxx"
        let redirectUri = "talostdemo://oauth/callback"
        
        guard let authUrl = URL(string: "\(issuer)/oauth/authorize?response_type=code&client_id=\(clientId)&redirect_uri=\(redirectUri)&scope=openid%20profile%20email&state=\(state)&code_challenge=\(challenge)&code_challenge_method=S256") else { return }
        
        // 2. ASWebAuthenticationSession Başlat
        webAuthSession = ASWebAuthenticationSession(url: authUrl, callbackURLScheme: "talostdemo") { callbackURL, error in
            guard error == nil, let callbackURL = callbackURL else {
                print("Giriş iptal edildi veya hata: \(String(describing: error))")
                return
            }
            
            // 3. Callback parametrelerini ayıkla
            if let components = URLComponents(url: callbackURL, resolvingAgainstBaseURL: false),
               let code = components.queryItems?.first(where: { $0.name == "code" })?.value {
                self.exchangeCodeForTokens(code: code, verifier: verifier, redirectUri: redirectUri)
            }
        }
        
        webAuthSession?.presentationContextProvider = self
        webAuthSession?.prefersEphemeralWebBrowserSession = false
        webAuthSession?.start()
    }
    
    func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor {
        return UIApplication.shared.windows.first { $0.isKeyWindow } ?? ASPresentationAnchor()
    }
    
    private func exchangeCodeForTokens(code: string, verifier: string, redirectUri: string) {
        // POST /oauth/token isteği atıp token'ları Keychain'e yazın
    }
}