Linbik.YARP 1.2.8

Linbik.YARP

YARP (Yet Another Reverse Proxy) integration for Linbik multi-service authentication. Provides automatic token injection, apps token provider, and typed apps HTTP client.

Delegated OpenAPI aggregation, proxy path migration and refresh/cache setup: OPENAPI.md.

📦 Installation

dotnet add package Linbik.YARP

🚀 Features

User-Context Proxy

• Automatic Token Injection — Inject service-specific JWT tokens into proxied requests from cookies
• Cookie-Based Storage — Integration tokens stored in HttpOnly cookies
• Per-Service Routing — /{packageName}/{**path} routes to integration service BaseUrl

Apps (Service-to-Service)

• IApplicationTokenProvider — Token caching, auto-refresh, config-based and dynamic targets
• IApplicationServiceClient — Full typed HTTP client (GET, POST, PUT, DELETE, PATCH) with automatic apps token injection
• LBaseResponse<T> Enforcement — Consistent response format
• Role-Based Tokens — Service (service-to-service) and Linbik (platform) roles

🔧 Configuration

Fluent Builder (Recommended)

// In Program.cs
builder.Services.AddLinbik()
    .AddLinbikJwtAuth()
    .AddLinbikYarp();

var app = builder.Build();
app.EnsureLinbik();

// Map user-context integration proxy: /{packageName}/{**path}
app.UseLinbikYarp();

// Map apps proxy endpoints (optional): /{routePrefix}/{packageName}/{**path}
// routePrefix defaults to "app" (UseLinbikApplication(string routePrefix = "app"))
app.UseLinbikApplication();

appsettings.json

{
  "Linbik": {
    "LinbikUrl": "https://api.linbik.com",
    "ServiceId": "your-service-guid",
    "ApiKey": "lnbk_your_api_key",
    "AppsTargetServices": {
      "payment-gateway": "guid-of-payment-service",
      "courier-service": "guid-of-courier-service"
    },
    "AppsAutoRefresh": true,
    "AppsRefreshThreshold": 0.75
  },
  "YARP": {
    "IntegrationServices": {
      "payment-gateway": {
        "SourcePath": "/payment-gateway",
        "TargetBaseUrl": "https://payment.example.com"
      },
      "survey-service": {
        "SourcePath": "/survey-service",
        "TargetBaseUrl": "https://survey.example.com"
      }
    }
  }
}

💻 User-Context Proxy (UseLinbikYarp)

How It Works

1. User authenticates → Integration tokens stored in cookies
   Cookie: integration_payment-gateway = "eyJhbG..."
   Cookie: integration_survey-service = "eyJhbG..."

2. Client request → /payment-gateway/api/charge

3. UseLinbikYarp():
   a. Extract {packageName} from URL → "payment-gateway"
   b. Read cookie: integration_payment-gateway
   c. Lookup BaseUrl from YARP:IntegrationServices config
   d. Proxy request with Authorization: Bearer {token}

4. Target service receives:
   GET /api/charge
   Authorization: Bearer eyJhbG...

Cookie Storage

Cookie: linbikRefreshToken = "refresh_abc..." (HttpOnly, Secure, 30 days)
Cookie: integration_payment-gateway = "eyJhbGci..." (HttpOnly, Secure, 1 hour)
Cookie: integration_courier-service = "eyJhbGci..." (HttpOnly, Secure, 1 hour)

💻 Application (Apps / Service-to-Service) Communication

ITokenProvider

public interface ITokenProvider
{
    Task<LinbikTokenResponse?> GetMultiServiceTokenAsync(
        string baseUrl, string authorizationCode, string apiKey);
    Task<LinbikTokenResponse?> RefreshTokensAsync(
        string baseUrl, string refreshToken, string apiKey, string serviceId);
    Task<string?> GetIntegrationTokenAsync(string integrationServicePackage);
    void CacheTokenResponse(LinbikTokenResponse tokenResponse);
    void ClearCache();
}

IApplicationTokenProvider

Manages PASETO application token caching, automatic refresh, and thread-safe access:

public interface IApplicationTokenProvider
{
    // Config-based (package name)
    Task<string?> GetApplicationTokenAsync(string integrationPackageName, CancellationToken cancellationToken = default);
    Task<IReadOnlyDictionary<string, string>> GetApplicationTokensAsync(
        IEnumerable<string> integrationPackageNames, CancellationToken cancellationToken = default);
    Task<LinbikApplicationIntegration?> GetApplicationIntegrationAsync(
        string integrationPackageName, CancellationToken cancellationToken = default);

    // Dynamic (service ID) — for callbacks/webhooks, no config entry required
    Task<LinbikApplicationIntegration?> GetApplicationIntegrationByIdAsync(
        Guid targetServiceId, CancellationToken cancellationToken = default);
    Task<IReadOnlyDictionary<Guid, LinbikApplicationIntegration>> GetApplicationIntegrationsByIdAsync(
        IEnumerable<Guid> targetServiceIds, CancellationToken cancellationToken = default);

    // Cache management
    Task RefreshApplicationTokensAsync(CancellationToken cancellationToken = default);
    void ClearCache();
    TimeSpan? GetTimeUntilExpiry();
}

IApplicationServiceClient

Typed HTTP client with automatic application-token injection and LBaseResponse<T> format:

Config-Based Targets (Package Name)

public class MyController : ControllerBase
{
    private readonly IApplicationServiceClient _applicationClient;

    public async Task<IActionResult> SyncWithPayment()
    {
        var result = await _applicationClient.PostAsync<SyncRequest, SyncResponse>(
            "payment-gateway",           // package name from config
            "/api/integration/app/sync",
            new SyncRequest { EntityType = "order", EntityId = "123" }
        );

        return result.IsSuccess ? Ok(result.Data) : BadRequest(result.FriendlyMessage);
    }
}

Dynamic Targets (Service ID) — Callbacks/Webhooks

public class PaymentController : ControllerBase
{
    private readonly IApplicationServiceClient _applicationClient;

    public async Task<IActionResult> NotifyMerchant(Order order)
    {
        var result = await _applicationClient.PostByIdAsync<PaymentNotification, NotifyResponse>(
            order.MerchantLinbikServiceId,   // dynamic service ID
            "/api/webhooks/payment",
            new PaymentNotification
            {
                OrderId = order.Id.ToString(),
                Status = "completed",
                Amount = order.Amount
            }
        );

        return result.IsSuccess ? Ok() : StatusCode(500);
    }
}

Available HTTP Methods

Application Proxy Endpoints (UseLinbikApplication)

UseLinbikApplication(string routePrefix = "app") maps one route per configured IntegrationServices entry: /{routePrefix}/{packageName}/{**path} → {TargetBaseUrl}{TargetPath}/{path}, injecting the application PASETO token as Authorization: Bearer {token} (no user context/cookie required). An unavailable token means a 503 service_unavailable response. TargetPath is the optional downstream prefix; do not repeat it in the incoming request path.

YARPOptions.ApplicationTimeoutSeconds configures the IApplicationServiceClient's HTTP timeout.

YARP Route Configuration (Advanced)

For fine-grained control with YARP reverse proxy routes (user-context token injection via ITokenProvider):

// Add Linbik token transform to YARP
builder.Services.AddReverseProxy()
    .LoadFromConfig()
    .AddLinbikTokenTransform();

📖 Documentation

• Full Documentation
• YARP Documentation
• Examples
• Linbik.Core
• Linbik.JwtAuthManager
• Linbik.PasetoAuthManager
• Linbik.Server
• Linbik.Slices

📄 License

MIT License

Contact: info@linbik.com

Version: 1.2.0
Platform: ASP.NET Core 10.0 (net10.0)
Last Updated: 9 Eylül 2026