Concierge.Auth.Client 1.1.1

Concierge.Auth.Client

Base package of the THISO Concierge.* .NET client SDK for AuthService. Owns configuration, DI registration, EF Core persistence, and the AES-GCM at-rest encryption primitive. Makes no HTTP calls to AuthService — that lives in the extension packages (Concierge.Auth.Client.Secrets, .Keys, .AspNetCore, .Profiles) built on top of this one.

This package ships no EF Core provider

Concierge.Auth.Client depends only on Microsoft.EntityFrameworkCore and Microsoft.EntityFrameworkCore.Relational — never Npgsql, never any other provider package. You, the consumer, are responsible for all four of the following:

1. Install your own EF Core provider (Npgsql.EntityFrameworkCore.PostgreSQL, Microsoft.EntityFrameworkCore.SqlServer, etc.) in your own project.
2. Set MigrationsHistoryTable("__EFMigrationsHistory", "concierge") in your provider configuration. This package cannot set it for you (that method lives on the provider-typed options builder). Startup throws if you don't — EF Core defaults every context to public.__EFMigrationsHistory, and if your own DbContext shares this database, each context would see the other's applied migrations as unknown rows.
3. Set MigrationsAssembly(...) to your own assembly. Without this, dotnet ef migrations add targets Concierge.Auth.Client's assembly, which you cannot write to (and which this package does not ship migrations from in the first place — see below).
4. Run your own dotnet ef migrations add / dotnet ef database update against ConciergeAuthDbContext. This package never creates or migrates its schema unbidden.

Install and register

services.AddConciergeAuthClient(
    configuration, // binds "Concierge:AuthClient": AuthServiceBaseUrl, ClientKey, EncryptionKey
    db => db.UseNpgsql(
        "Host=localhost;Port=5432;Database=thiso_platform;Username=...;Password=...",
        npgsql => npgsql.MigrationsHistoryTable("__EFMigrationsHistory", "concierge")));

// or, options configured programmatically:
services.AddConciergeAuthClient(
    options =>
    {
        options.AuthServiceBaseUrl = new Uri("https://auth.thiso.vn");
        options.ClientKey = "platform-service";
        options.EncryptionKey = "<base64 of exactly 32 bytes>";
    },
    db => db.UseNpgsql(
        "Host=localhost;Port=5432;Database=thiso_platform;Username=...;Password=...",
        npgsql => npgsql.MigrationsHistoryTable("__EFMigrationsHistory", "concierge")));

All three options are required; a missing or malformed EncryptionKey throws at host startup (fail-closed, no default/fallback/generated key). Startup also throws if the migrations-history table is left at the provider default (see point 2 above).

Persistence

ConciergeAuthDbContext, schema concierge, three tables — client_credentials, peer_keypairs, jwks_keys — kept separate because they are three distinct trust systems (contract §10, assumption #100). The entity configurations under Persistence/Configurations/ are this package's schema definition of record; this package ships the model, not migrations — generate your own with dotnet ef migrations add per the four steps above. A known-good Postgres migration reference is included at samples/postgres-initial-migration.cs.txt in this repo (libs/dotnet/samples/) for consumers who want a starting point.

Complete Postgres example, end to end:

dotnet ef migrations add InitialCreate \
  --project YourApp.Infrastructure \
  --startup-project YourApp.Api \
  --context Concierge.Auth.Client.Persistence.ConciergeAuthDbContext

dotnet ef database update \
  --project YourApp.Infrastructure \
  --startup-project YourApp.Api \
  --context Concierge.Auth.Client.Persistence.ConciergeAuthDbContext

(Your YourApp.Infrastructure project needs its own IDesignTimeDbContextFactory<ConciergeAuthDbContext>, or an AddDbContext<ConciergeAuthDbContext> registration reachable at design time, that applies UseNpgsql(...) with MigrationsAssembly("YourApp.Infrastructure") and the MigrationsHistoryTable call above.)

Encryption

ISecretProtector (AES-256-GCM, fresh 12-byte nonce per call, 16-byte tag). Register via AddConciergeAuthClient; consumers should never log a Protect/Unprotect input or output.

Caching abstraction

IConciergeCredentialCache (Concierge.Auth.Client.Caching) — a pluggable key/secret cache consumed by Concierge.Auth.Client.AuthGuard's API-key scheme. This package ships no implementation, only the interface; the host wires its own (in-memory, Redis, a database, ...), the same provider-agnosticism this package already applies to EF Core. Register your implementation against IConciergeCredentialCache directly — there is no Add... helper for it.

Out of scope here

HTTP calls to AuthService, Redis, RabbitMQ, ASP.NET Core middleware — see the extension packages.