Authenticator.Domain.Shared 2.2.0

Pintern.Authenticator

ABP 10.6 tabanli merkezi Identity/Account/OpenIddict issuer ve selected-context authorization modulu.

Calisma kopyasi

Bu depo tek calisma dizininden yurur. git worktree kullanilmaz; her is kendi KBP-* dalinda ayni dizinde yapilir.

Sahiplik

• Login, registration, email confirmation, forgot/reset password, profile ve session: ABP Account + Identity.
• Authorization/token/application/scope store: ABP OpenIddict.
• User, role ve organization hierarchy: ABP Identity.
• Tenant ve named connection: ABP TenantManagement.
• Tenant feature value: ABP FeatureManagement.
• Selected-context membership, scoped role, operation karari ve evidence version: Authenticator domain.

Organization icin paralel entity/repository/API yoktur; tek kaynak ABP Identity OrganizationUnit modelidir. Platform rolleri SuperAdmin, TenantAdmin ve OrganizationAdmindir.

Guvenlik tabani

• Browser/native: authorization code + PKCE S256.
• Machine: least-privilege client credentials.
• Password ve implicit grant kapali.
• API yalniz dogrulanmis access token kabul eder.
• Production OpenIddict signing/encryption sertifikasi secret provider'dan gelir.
• Bootstrap admin varsayilan kapali ve tek kullanimliktir; source default parola yoktur.

Yapi

src/...Domain.Shared          Sabitler, hata kodlari, localization, shared module graph
src/...Domain                 Domain kurallari, manager/repository contract, seed
src/...Application.Contracts DTO, AppService contract, validation, permission
src/...Application           AppService orchestration ve Mapperly mapping
src/...EntityFrameworkCore   Tek DbContext, repository, migration
src/...HttpApi               Platform ve ABP HTTP yuzeyleri
host/...HttpApi.Host         OpenIddict server/validation, Account UI, composition root
test/...                     Domain, application, EF ve host integration testleri

Calistirma

dotnet restore Pintern.Authenticator.slnx
dotnet build Pintern.Authenticator.slnx --no-restore -clp:ErrorsOnly
dotnet test Pintern.Authenticator.slnx
docker compose up -d
dotnet run --project host/Pintern.Authenticator.HttpApi.Host

Migration host acilisinda Database:AutoMigrate ile uygulanir. Elle:

dotnet ef database update --project src/Pintern.Authenticator.EntityFrameworkCore

Ilk SuperAdmin ve production key islemleri icin RUNBOOK-0005, guncel kapsam icin CURRENT-0001 okunur.

Wiki dogrulama

powershell -ExecutionPolicy Bypass -File scripts/validate-wiki.ps1

First-party login istemcisi

Host, FirstPartyClient bolumu eksikse fail-fast kapanir. ClientId ve IssuerUrl appsettings.json icindedir; secret dosyaya yazilmaz (ADR-0007).

Gelistirme ortaminda bir kez:

dotnet user-secrets set "FirstPartyClient:ClientSecret" "<secret>" --project host/Pintern.Authenticator.HttpApi.Host

Production'da deger secret provider'dan (Vault/Key Vault) veya environment degiskeninden gelir; repoya hicbir ortam icin yazilmaz.

Ek resource server kaydi

Issuer varsayilan olarak yalniz kendi scope'unu kaydeder. Ayri deploy edilen bir API'nin token alabilmesi icin ResourceServers:Registrations listesine bir kayit girilir:

"ResourceServers": {
  "Registrations": [
    {
      "Scope": "<scope>",
      "Audience": "<audience>",
      "DisplayName": "<gorunen ad>",
      "MachineClientId": "<machine-client-id>"
    }
  ]
}

Audience, tuketen API'nin bearer dogrulamasinda bekledigi audience ile birebir ayni olmalidir; token'in aud claim'i bu degerden gelir. MachineClientId verilirse istemci confidential olur ve secret dosyaya yazilmaz:

dotnet user-secrets set "ResourceServers:Registrations:0:MachineClientSecret" "<secret>" --project host/Pintern.Authenticator.HttpApi.Host

Makine istemcisi yalniz client_credentials grant'ini ve kendi scope'unu tasir; password grant, refresh token ve kullanici scope'lari verilmez. Secret eksikse host acilmadan durur. Liste bos birakilabilir; o zaman yalniz issuer'in kendi scope'u kaydedilir.