Henara.Grpc.Client.Common

Shared base for the Henara gRPC client libraries (Henara.Grpc.Client.Dakota, Henara.Grpc.Client.Imagelink, Henara.Grpc.Client.DakotaSlim). The domain clients bring it in transitively — you normally don't reference it directly.

It provides:

• GrpcClientBase — builds an authenticated, retrying GrpcChannel whose per-call authorization header comes from an ICallTokenProvider. Allows call credentials over plaintext (http/h2c) targets and disposes the channels it creates.
• KeycloakRefreshingTokenProvider — an ICallTokenProvider for native clients. Seed it with the tokens from an Authorization Code + PKCE login via Initialize(...); it refreshes the access token before expiry (rotating the refresh token) and throws when refresh fails (re-login required).
• AddNativeKeycloakAuth(...) — registers the provider above as the singleton ICallTokenProvider. Throws if an ICallTokenProvider is already registered — there must be exactly one token authority.

Native auth wire-up

services.AddNativeKeycloakAuth(o =>
{
    o.TokenEndpoint = "https://auth.praxx.me/realms/henara/protocol/openid-connect/token";
    o.ClientId      = "henara-main-sso";
});
services.AddDakotaExternalGrpcClients(); // or AddImageLinkDomainExternalGrpcClients()

// after the login completes, seed the tokens from the login response:
var auth = provider.GetRequiredService<KeycloakRefreshingTokenProvider>();
auth.Initialize(accessToken, refreshToken, expiresInSeconds);

For a host that already owns a Keycloak session (e.g. SmartVO), do not use this provider — use Henara.Grpc.Client.DakotaSlim, which adapts the host's existing token.

Supplying your own token provider

Any ICallTokenProvider works — register it before the domain clients to authenticate calls with a token you already have (a web app's user token, a static server token, …):

services.AddScoped<ICallTokenProvider, MyTokenProvider>();
services.AddDakotaExternalGrpcClients();