Evo.Grpc.Client.Common

Shared base for the Evo gRPC client libraries. The clients bring it in transitively.

Contents

• GrpcClientBase — builds an authenticated, retrying GrpcChannel whose per-call authorization header comes from an ICallTokenProvider, allows call credentials over plaintext (h2c) targets and disposes the channels it creates.
• KeycloakRefreshingTokenProvider — refreshes an access token before expiry, rotating the refresh token. Throws once a refresh fails.
• NativeBearerCallTokenProvider — adapts a token owned by the calling process. No login, no refresh.
• UuidConverterExtensions — Guid ↔ the wire Uuid of custom_types.proto.

Exactly one ICallTokenProvider may be registered; both registrations below throw when another is already present.

AddNativeKeycloakAuth

For a process that performs its own Authorization Code + PKCE login. Seed the tokens from the login response, then the provider keeps them fresh:

services.AddNativeKeycloakAuth(o =>
{
    o.TokenEndpoint = "https://auth.praxx.me/realms/henara/protocol/openid-connect/token";
    o.ClientId      = "henara-main-sso";
});

var auth = provider.GetRequiredService<KeycloakRefreshingTokenProvider>();
auth.Initialize(accessToken, refreshToken, expiresInSeconds);

AddNativeBearerAuth

For a process that already owns a Keycloak session and manages the token itself:

services.AddNativeBearerAuth((sp, ct) =>
    sp.GetRequiredService<ITokenSource>().GetAccessTokenAsync(ct));

The resolver runs per RPC on a background thread and must return a raw access token without the Bearer prefix, or an empty string to call unauthenticated. It may only read or refresh an existing session, never start an interactive login.

Custom provider

Any ICallTokenProvider works — a web application's user token, a static server token:

services.AddScoped<ICallTokenProvider, MyTokenProvider>();