Struct UserDirectoryClient 

pub struct UserDirectoryClient<T> { /* private fields */ }

UserDirectory — the authoritative user/identity control plane.

Owns investor accounts and their profile metadata. This is the identity plane: money lives in the separate banking plane and is NEVER mirrored here. Every RPC is authorized from the verified access-token Claims injected by the inbound auth layer; self-service RPCs act on the caller’s own sub, admin RPCs are gated by the admin allowlist (config).

Implementations

impl UserDirectoryClient<Channel>

pub async fn connect<D>(dst: D) -> Result<UserDirectoryClient<Channel>, Error>

where D: TryInto<Endpoint>, <D as TryInto<Endpoint>>::Error: Into<Box<dyn Error + Sync + Send>>,

Attempt to create a new client by connecting to a given endpoint.

impl<T> UserDirectoryClient<T>

where T: GrpcService<Body>, <T as GrpcService<Body>>::Error: Into<Box<dyn Error + Sync + Send>>, <T as GrpcService<Body>>::ResponseBody: Body<Data = Bytes> + Send + 'static, <<T as GrpcService<Body>>::ResponseBody as Body>::Error: Into<Box<dyn Error + Sync + Send>> + Send,

pub fn new(inner: T) -> UserDirectoryClient<T>

pub fn with_origin(inner: T, origin: Uri) -> UserDirectoryClient<T>

pub fn with_interceptor<F>( inner: T, interceptor: F, ) -> UserDirectoryClient<InterceptedService<T, F>>

where F: Interceptor, <T as GrpcService<Body>>::ResponseBody: Default, T: Service<Request<Body>, Response = Response<<T as GrpcService<Body>>::ResponseBody>>, <T as Service<Request<Body>>>::Error: Into<Box<dyn Error + Sync + Send>> + Send + Sync,

pub fn send_compressed( self, encoding: CompressionEncoding, ) -> UserDirectoryClient<T>

Compress requests with the given encoding.

This requires the server to support it otherwise it might respond with an error.

pub fn accept_compressed( self, encoding: CompressionEncoding, ) -> UserDirectoryClient<T>

Enable decompressing responses.

pub fn max_decoding_message_size(self, limit: usize) -> UserDirectoryClient<T>

Limits the maximum size of a decoded message.

Default: 4MB

pub fn max_encoding_message_size(self, limit: usize) -> UserDirectoryClient<T>

Limits the maximum size of an encoded message.

Default: usize::MAX

pub async fn get_me( &mut self, request: impl IntoRequest<GetMeRequest>, ) -> Result<Response<UserProfile>, Status>

The calling user’s own identity (resolved from the access-token sub).

pub async fn update_profile( &mut self, request: impl IntoRequest<UpdateProfileRequest>, ) -> Result<Response<UserProfile>, Status>

Update the caller’s own editable profile fields (full-replace of the set in UpdateProfileRequest). Identity/auth fields (email, status) are not editable here.

pub async fn revoke_tokens( &mut self, request: impl IntoRequest<RevokeTokensRequest>, ) -> Result<Response<RevokeTokensResponse>, Status>

Admin (allowlist): bump a user’s token_version so all their outstanding access tokens are rejected. The token-revocation control surface.

pub async fn disable_user( &mut self, request: impl IntoRequest<DisableUserRequest>, ) -> Result<Response<DisableUserResponse>, Status>

👎Deprecated

DEPRECATED — always refuses, naming HoldUser or GovernanceService.OpenUserSuspension.

The verb was ambiguous in the one way that mattered: it was both the emergency brake (the frozen flag the money plane re-reads at dispatch, which stops a withdrawal already in the queue) and a permanent judgement on an account, decided by one person with no record of why. Those need opposite treatments — the first must stay instant, the second must not be one person’s to make — so the caller now has to say which one they mean. Kept in the contract rather than deleted so an older console gets an explanatory refusal instead of an UNIMPLEMENTED.

pub async fn hold_user( &mut self, request: impl IntoRequest<HoldUserRequest>, ) -> Result<Response<HoldUserResponse>, Status>

Admin (UserSuspend): the emergency brake. Freezes the account NOW and lapses on its own after 24h unless the owners ratify it with OpenUserSuspension. One actor may stop money temporarily; one actor may never stop it permanently. Emits SUSPENDED across the cross-plane bridge, and REINSTATED again when it lapses.

pub async fn reinstate_user( &mut self, request: impl IntoRequest<ReinstateUserRequest>, ) -> Result<Response<ReinstateUserResponse>, Status>

Admin (allowlist): re-enable a disabled user, lifting the sign-in/refresh freeze. Emits REINSTATED across the cross-plane bridge.

Refuses with FAILED_PRECONDITION when the suspension was the owners’ verdict, naming GovernanceService.OpenUserReinstatement — otherwise one admin could overturn a consilium and the consilium would be advisory.

pub async fn set_kyc_level( &mut self, request: impl IntoRequest<SetKycLevelRequest>, ) -> Result<Response<SetKycLevelResponse>, Status>

Admin (allowlist): set a user’s KYC level. Emits KYC_CHANGED across the cross-plane bridge (so the money plane learns the new level). Echoes the level now in effect.

Refuses with PERMISSION_DENIED when user_id is the CALLER’s own account. KycManage is held by Admin as well as Owner, and tier 1 is the floor for withdrawals on the money plane, so without this an operator could lift their own money gate. A console must not offer this control on the operator’s own row: the refusal is decided from the session alone and belongs in front of the call. Raising your own level goes through the verification front door, which reaches tier 1; above that, and for any downgrade, another holder of KycManage acts.

pub async fn list_users( &mut self, request: impl IntoRequest<ListUsersRequest>, ) -> Result<Response<ListUsersResponse>, Status>

Admin (UserRead): list/search users for the operator console — paginated, with a free-text query and optional role/status filters (see ListUsersRequest). Returns lightweight summaries, not full profiles.

pub async fn get_user( &mut self, request: impl IntoRequest<GetUserRequest>, ) -> Result<Response<UserProfile>, Status>

Admin (UserRead): the full profile of ANY user by id (the admin sibling of the self-only GetMe), for the user-detail drawer.

pub async fn set_role( &mut self, request: impl IntoRequest<SetRoleRequest>, ) -> Result<Response<SetRoleResponse>, Status>

Admin (RoleGrant, Owner only): set a user’s platform access role. Emits ROLE_CHANGED across the cross-plane bridge so the money plane mirrors it. Echoes the role now in effect.

pub async fn grant_permission( &mut self, request: impl IntoRequest<GrantPermissionRequest>, ) -> Result<Response<GrantPermissionResponse>, Status>

Grant a user a target inside a tenant’s namespace: an alias (sa:operator), a permission (sa:work:leads:read) or a * pattern (sa:work:*). Nothing grants anything in the iam, concierge, bank or seat namespaces (INVALID_ARGUMENT), and nobody grants to their own account (PERMISSION_DENIED). A target the tenant’s catalog does not define grants nothing and is INVALID_ARGUMENT. Re-granting what is held is a no-op.

Who may: a seat holding iam:tenants:grant — any target. The holder of an alias the catalog lets delegate (delegations) — exactly the aliases it delegates, naming the user by account (an email or a username) only (a user_id is PERMISSION_DENIED: ids are visible in the roster, and granting one would reveal its owner’s address). Anyone else, or a target outside the delegation: PERMISSION_DENIED, before the user is looked up. An email names the accounts it is verified on or backs a password of; only when it names none is the handle read as a username.

To a seat: an unknown user or handle is NOT_FOUND; a handle naming several accounts, or a disabled/held account, is FAILED_PRECONDITION with the reason. To a delegate all three are the SAME FAILED_PRECONDITION (“this address cannot be granted access”), so a grant never tells them whether, or how, a handle is known. A delegate gets a budget of GrantPermission + RevokePermission calls per hour (refusals included); past it, RESOURCE_EXHAUSTED.

pub async fn revoke_permission( &mut self, request: impl IntoRequest<RevokePermissionRequest>, ) -> Result<Response<RevokePermissionResponse>, Status>

Take a grant away. Same authority as GrantPermission, either addressing form for a delegate too: the answer depends only on a grant they can already list. NOT_FOUND when the user holds no active grant of that target — including a handle naming nobody, or several accounts. Shares GrantPermission’s budget.

pub async fn list_grants( &mut self, request: impl IntoRequest<ListGrantsRequest>, ) -> Result<Response<ListGrantsResponse>, Status>

The active grants inside one tenant namespace, with each holder’s identity. A seat holding iam:tenants:grant, or a delegate of that namespace — who gets legal_name AND preferred_name empty: the team sees each other’s email, username and grant, and nothing that says who an address belongs to.

Trait Implementations

impl<T> Clone for UserDirectoryClient<T>

where T: Clone,

fn clone(&self) -> UserDirectoryClient<T>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T> Debug for UserDirectoryClient<T>

where T: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.