Crate evconcierge_client 

evconcierge_client — what a relying party (a direction’s backend: invest, admin, the Service-Arb panel) calls on concierge, the identity plane.

• Sign-in is concierge’s code flow with PKCE: PkceVerifier + random_state + Authorize::url send the browser to /api/auth/authorize; the callback redeems the code with ConciergeClient::exchange_code; ConciergeClient::refresh_client_token rotates the pair.
• ConciergeClient::get_me — the one RPC a relying party’s access token opens. It is also where the party re-reads permissions, the only thing it may gate on.
• ConciergeClient::publish_catalog (permissions and aliases) and ConciergeClient::publish_scope_catalog (approval kinds and notification topics).
• The direction’s own inbox (ScopeInboxService): reads by user_id under the client credential alone, writes with the user’s access token as well — see inbox.

The client secret authenticates the server-to-server calls: in the request body for the AuthService ones (their wire says so), as x-ev-client-id + authorization: Bearer metadata for ScopeCatalogService (docs/SCOPES-AND-APPROVALS.md §2 of concierge). It never reaches a browser.

The wire types are concierge’s own evconcierge_contracts, re-exported as proto for the messages this module takes as they are (a catalog’s aliases, approval kind specs).

let concierge = ConciergeClient::connect_lazy(ClientConfig::new(grpc_addr, "sa", secret))?;
let verifier = PkceVerifier::generate()?;
let state = random_state()?;
let location = Authorize { concierge_origin, client_id: "sa", redirect_uri, state: &state, verifier: &verifier, prompt: None }.url();
// … the browser comes back with `code` …
let tokens = concierge.exchange_code(&code, redirect_uri, &verifier).await?;
let me = concierge.get_me(&tokens.access_token).await?;

Re-exports

pub use inbox::DEFAULT_INBOX_LIMIT;

pub use inbox::InboxQuery;

pub use inbox::MarkRead;

Modules

inbox

The direction’s own inbox: ScopeInboxService, called by the direction’s backend on behalf of a user it knows from its own session (docs/SCOPES-AND-APPROVALS.md §6 of concierge).

proto

Structs

Authorize

Everything GET /auth/authorize takes. redirect_uri must be byte for byte the one later passed to exchange_code, and registered for the client at concierge.

Catalog

A tenant’s catalog for PublishCatalog: the permissions and aliases its namespace defines.

ClientConfig

Where concierge is and who this relying party is to it.

ClientTokens

A relying party’s token pair, as ExchangeCode and RefreshClientToken answer it. Expiries are unix seconds. The access token opens GetMe and nothing else; the refresh token is bound to this client and rotates on every use.

ConciergeClient

A cheaply cloneable handle on concierge for one relying party. Connects on first use, so the service boots (and serves what does not need concierge) while concierge is down.

Me

The signed-in user as GetMe tells a relying party. Deliberately narrower than the wire’s UserProfile: the identity-document fields (legal name, date of birth, address, nationality, tax residence, phone) and the KYC level are not the direction’s to hold, and concierge leaves them empty for a relying party anyway.

PkceVerifier

The secret half of PKCE. Kept server-side until the callback presents it to ConciergeClient::exchange_code; only its challenge goes to the browser.

ScopeCatalog

What PublishScopeCatalog takes: the namespace’s approval kinds and notification topics, whole — a kind or topic left out is withdrawn.

Enums

ConciergeError

What a failed call to concierge means to the relying party. Each arm is a different reaction: sign the user out, retry later, show the operator what was refused, or report a bug.

Prompt

Ask concierge to show its account picker even when the browser is already signed in.

Constants

DEFAULT_TIMEOUT

How long one call may take, connecting included, unless ClientConfig says otherwise. A sign-in callback is waiting on it, so seconds, not a minute.

Functions

random_state

An unguessable state for the authorize redirect. The callback compares it with the stored one in constant time and refuses a state it has seen before.