RustApi/account_system.md

Aşağıdaki metni aynen VSCode Copilot’a (veya başka bir kod üretecine) ver — tek istekte tam bir Rust web projesi iskeleti oluşturacak şekilde ayrıntılı, ama gereksiz karmaşıklıktan kaçınan, dosyalar ayrı ayrı olacak ve PostgreSQL kullanacak bir hesap sistemi üretmesini istiyorum. ÖNEMLİ: Kesinlikle bir ORM ve bir web framework kullanılsın — SeaORM (ORM) ve Axum (web framework) kullanılacak. Kod istemiyorum — sadece bu metni Copilot'a yapıştır ve proje oluşturmasını bekle.

Ek değişiklikler / kesin gereksinimler:
- Database: PostgreSQL olacak (default DATABASE_URL örneği .env.example içinde postgres://user:pass@localhost:5432/dbname).
- Tüm API yolları /api/v1/ prefix'i altında olacak (ör. /api/v1/auth/register, /api/v1/users/me).
- Auth: access_token (short-lived) ve refresh_token (long-lived) olacak.
- Parola hash algoritması: Argon2 yerine BCryptSHA256PasswordHasher uygulanacak şekilde iste — yani parola önce SHA-256 ile ön-hash edilecek, sonra bcrypt ile hash edilecek (Rust tarafında sha2 crate ile pre-hash + bcrypt crate ile bcrypt uygulaması). Copilot'a açıkça "Implement BCrypt-SHA256: SHA256(password) then bcrypt on hex/base64 of digest" diye belirt.
- OAuth: Google ve GitHub OAuth2 desteklenecek.

İstek (kopyala-yapıştır için; İngilizce olarak verilecek çünkü Copilot daha iyi anlar):

"Generate a complete, minimal and well-structured Rust web project that implements a user account system with these exact characteristics:

Project-wide:
- Use async Rust with Tokio runtime.
- Use Axum as web framework and SeaORM as ORM (SeaORM entities / ActiveModels).
- Use tracing for structured logs.
- Default database: PostgreSQL (connection via DATABASE_URL). The project must be structured so switching DBs only requires changing DATABASE_URL and running migrations via sea-orm-migration / sea-orm-cli.
- All endpoints MUST be under the prefix /api/v1/.
- Load configuration and secrets from .env (use dotenvy or envy). Provide a .env.example.

Authentication & Security:
- Email/password registration + login using BCrypt-SHA256 password hasher:
  - Pre-hash the raw password with SHA-256 (use sha2 crate), then hash the resulting digest with bcrypt (use bcrypt crate).
  - Provide helper functions to verify password with the same process.
  - Document clearly in comments where to change to another hasher.
- Social login via Google and GitHub (OAuth2 flows using oauth2 crate; use reqwest or oauth2's HTTP client for provider calls).
- JWT access tokens and refresh tokens:
  - Use jsonwebtoken crate.
  - Sign tokens with SECRET_KEY from .env.
  - Respect ACCESS_TOKEN_EXPIRE_MINUTES and REFRESH_TOKEN_EXPIRE_DAYS settings.
  - Include both access_token and refresh_token in responses where applicable.
- Store refresh tokens in DB (store UUID string; include comment about switching to hashed storage if desired).
- Validate emails using a validator crate (e.g., validator).

Endpoints to implement (minimal but runnable):
- POST /api/v1/auth/register
  - Accept JSON { "email": "...", "password": "..." }
  - Validate email, pre-hash+bcrypt password, create user, create refresh token record, return { access_token, refresh_token, token_type, expires_in }.
- POST /api/v1/auth/login
  - Accept JSON { "email": "...", "password": "..." }
  - Verify credentials, return access + refresh tokens.
- POST /api/v1/auth/refresh
  - Accept JSON { "refresh_token": "..." }
  - Verify refresh token exists and not expired, return new access token (and optionally rotate refresh token).
- GET /api/v1/auth/oauth/{provider}
  - provider ∈ {"google","github"} — build provider auth URL with required scopes and redirect the client.
- GET /api/v1/auth/oauth/{provider}/callback
  - Exchange code for token, fetch user info (email), extract primary verified email, create/find user (hashed_password NULL, provider field set), create refresh token, return tokens (or redirect with tokens).
- POST /api/v1/auth/logout
  - Accept JSON { "refresh_token": "..." } (or use header), delete/invalidate the refresh token in DB.
- GET /api/v1/users/me
  - Protected with Authorization: Bearer <access_token>, returns current user info.

Data models (SeaORM / DB schema):
- users table / User entity (UUID primary key):
  - id (UUID)
  - email (unique)
  - hashed_password (nullable for OAuth-only accounts)
  - provider (nullable text: "google", "github", or NULL)
  - is_active (boolean)
  - created_at (timestamp)
- refresh_tokens table / RefreshToken entity:
  - id (UUID)
  - user_id (UUID FK)
  - token (UUID string)
  - created_at
  - expires_at

Project layout (generator MUST create these files/modules — produce working Rust code for each):
- Cargo.toml (include: axum, tokio, sea-orm, sea-orm-migration, sea-orm-macros, dotenvy or envy, serde, serde_json, uuid, bcrypt, sha2, jsonwebtoken, oauth2, reqwest, chrono or time, validator, tracing, anyhow, thiserror)
- src/
  - main.rs (app startup, router composition with /api/v1 prefix, load config, init SeaORM DB connection and run migrations at startup option)
  - core/
    - config.rs (Config struct loading env vars; typed fields for secrets, expirations, DB URL, OAuth client ids/secrets, OAUTH_REDIRECT_BASE)
    - security.rs (BCrypt-SHA256 password helpers, JWT create/verify helpers, token payload types)
    - oauth.rs (provider configs and helper functions to build auth URLs and exchange codes)
  - db/
    - mod.rs (SeaORM Database connection setup, run migrations helper)
    - entities/ (SeaORM entities: users.rs, refresh_tokens.rs or a generated entities mod)
  - schemas/
    - mod.rs (request/response DTOs: RegisterRequest, LoginRequest, TokenResponse, RefreshRequest, UserResponse)
  - services/
    - auth_service.rs (register/login/refresh/oauth logic; create tokens; persist refresh tokens; rotate tokens if desired)
    - user_service.rs (basic user CRUD and lookup using SeaORM ActiveModels)
  - api/
    - deps.rs (extractors for DB connection, typed config, and current_user extractor/middleware)
    - routers/
      - auth.rs (auth endpoints)
      - users.rs (users/me)
  - errors.rs (custom error types and conversions to HTTP responses)
  - utils.rs (helpers e.g., time helpers, uuid helpers)
- migrations/
  - sea-orm compatible migrations (or raw SQL) to create users and refresh_tokens for PostgreSQL (include at least initial migration file).
- .env.example (include all required env vars and example values; for PostgreSQL example: DATABASE_URL=postgres://user:password@localhost:5432/your_db)
- README.md (how to install, set up environment, run migrations with sea-orm-cli or sea-orm-migration runner, run app, env variables, how to register OAuth apps for Google & GitHub and set callback URLs — note callbacks will like be `${OAUTH_REDIRECT_BASE}/api/v1/auth/oauth/google/callback` and similarly for github)
- tests/
  - integration_tests.rs (basic integration tests that register a user, login, and call /api/v1/users/me using the access token; minimal and runnable)

Config & env vars (must be in .env.example):
- DATABASE_URL=postgres://user:password@localhost:5432/dbname
- SECRET_KEY=some_long_random_value
- ACCESS_TOKEN_EXPIRE_MINUTES=15
- REFRESH_TOKEN_EXPIRE_DAYS=30
- GOOGLE_CLIENT_ID=
- GOOGLE_CLIENT_SECRET=
- GITHUB_CLIENT_ID=
- GITHUB_CLIENT_SECRET=
- OAUTH_REDIRECT_BASE=http://localhost:3000
- SERVER_HOST=127.0.0.1
- SERVER_PORT=3000

Developer notes for the code generator (be explicit):
- Use SeaORM entities / ActiveModel for DB operations; keep queries simple and idiomatic.
- Migrations: provide sea-orm-migration or migration SQL and README instructions using sea-orm-cli:
  - e.g., install: cargo install sea-orm-cli
  - run migrations: DATABASE_URL="postgres://..." sea-orm-cli migrate up
- Implement BCrypt-SHA256 password hasher: pre-hash the UTF-8 password with SHA-256 (sha2::Sha256), encode digest (hex or base64), then pass that string to bcrypt::hash with a configurable cost. Provide verify routine that repeats pre-hash + bcrypt::verify.
- For OAuth: use oauth2 crate to construct authorize URL and to exchange code; use reqwest to fetch user info (emails) if needed. Scopes: Google ["openid","email","profile"] and GitHub ["user:email"].
- JWT tokens: use jsonwebtoken; include standard claims and expiry. Use typed structs for token claims.
- For refresh tokens: generate UUID strings and store them in DB with expiry. Provide optional rotation logic (brief comment).
- Provide clear error handling using thiserror and map to HTTP responses (axum::response::IntoResponse with proper status codes).
- The app should mount routes under /api/v1/ (e.g., router.route("/api/v1/auth/register", post(...)) ).
- Tests: include at least one integration test that runs a test server, registers a user, logs in, and calls /api/v1/users/me with the access token.
- Keep functions small, typed, and well-documented with comments explaining major steps.

Output expectation from Copilot:
- Create all files listed above with working Rust code (no pseudocode) and comments.
- The resulting project must be runnable:
  - cargo build
  - set .env from .env.example
  - run sea-orm-cli migrate up (or provided migration runner)
  - cargo run
  - Test endpoints using curl/Postman at http://SERVER_HOST:SERVER_PORT with prefix /api/v1/
- README must explain how to switch DBs by changing DATABASE_URL and running migrations with appropriate flags (e.g., to switch to MySQL or Postgres, change features/driver).
- Language for generated code and docs: English (comments or README may include short Turkish notes if helpful)."

Not: Bu metni VSCode Copilot'a yapıştırdığımda tam bir Rust web projesi oluştursun; ben yalnızca prompt istedim — kod istemiyorum.