Internal Dream Consistency typed HTTP client package for AccessControl API communication, authentication flows, session validation, password reset operations, push token validation, and signed API-to-API requests.
DreamConsistency.AccessControl.Client is an internal typed HTTP client package
used by Dream Consistency backend services to communicate with the AccessControl API.
The package centralizes AccessControl API calls so consuming services do not duplicate authentication, session, password reset, push token, and AccessControl request logic.
| Property | Current Decision |
|---|---|
| Package ID | DreamConsistency.AccessControl.Client |
| Initial Release | 1.0.0 |
| Target Framework | .NET Standard 2.1 |
| NuGet Feed | https://nuget.dreamconsistency.com/v3/index.json |
| Package Hosting | BaGetter on Dream Consistency Hub server. |
| Release Pipeline | DreamConsistency.AccessControl.Client - NuGet Release |
| Jenkins Folder | DreamConsistency - Packages |
| Versioning | Semantic Versioning: MAJOR.MINOR.PATCH |
| Visibility | Internal Dream Consistency package. |
| Package | Version | Purpose |
|---|---|---|
DreamConsistency.Extensions |
1.0.2 |
Base client infrastructure and Dream Consistency service descriptor integration. |
DreamConsistency.Security.ServiceAuth |
1.0.1 |
Internal API-to-API HMAC request signing and service authentication. |
Microsoft.Extensions.Http |
6.0.0 |
HttpClient factory registration support. |
Microsoft.Extensions.DependencyInjection.Abstractions |
6.0.0 |
Dependency injection registration support. |
DreamConsistency.Security.ServiceAuth
so all AccessControl API calls can be signed as internal service-to-service requests.
The purpose of this package is to provide a reusable AccessControl client for internal Dream Consistency services.
| Area | Responsibility |
|---|---|
| Typed HTTP Client | Provides a strongly-typed wrapper around AccessControl API endpoints. |
| Authentication Calls | Wraps credential validation and authentication-related AccessControl operations. |
| Session Validation | Wraps calls used to validate user sessions and session-related state. |
| Password Reset | Wraps password reset token and password reset completion flows. |
| Push Token Validation | Wraps AccessControl calls related to push token validation. |
| Service Authentication | Uses DreamConsistency.Security.ServiceAuth to sign internal API-to-API requests. |
The package exposes dependency injection registration, a typed AccessControl HTTP client, a factory abstraction, and request/response models for AccessControl API operations.
This keeps AccessControl API integration consistent across Legislator, Hestino, and future Dream Consistency services.
The AccessControl API base URL is resolved from the Dream Consistency service descriptor.
The package also relies on the service descriptor indirectly through
DreamConsistency.Security.ServiceAuth, which uses the current service identity
when signing internal requests.
DreamConsistency_ServiceDescriptor, including the AccessControl API location.
Consuming projects must include the internal Dream Consistency NuGet feed.
Install the package:
Or add it directly to the project file:
Register the AccessControl client in the consuming service startup code.
The registration adds the AccessControl typed client, attaches the internal service auth handler, and registers the AccessControl client factory.
Use the factory or typed client from dependency injection in consuming services.
AccessControl client requests are signed by
DreamConsistency.Security.ServiceAuth. The package does not manually implement
HMAC signing. It delegates internal service authentication to the shared ServiceAuth package.
| Security Area | Decision |
|---|---|
| Transport | AccessControl calls should use HTTPS. |
| Service Authentication | Requests are signed through DreamConsistency.Security.ServiceAuth. |
| Service Identity | The calling service identity comes from DreamConsistency_ServiceDescriptor. |
| Secrets | Signing secrets must come from runtime configuration, not from this client package. |
| Password Handling | Password-related values and hashes should be treated as credentials and transmitted only over HTTPS. |
The package was prepared for .NET Standard 2.1 so it can be reused by more
Dream Consistency backend services without requiring a specific .NET runtime version.
| Previous State | Current State |
|---|---|
net6.0 |
netstandard2.1 |
| Project reference to ServiceAuth | Package reference to DreamConsistency.Security.ServiceAuth 1.0.0 |
| Implicit using support | Explicit using statements for package compatibility. |
init properties |
set properties for broader compatibility. |
| Allowed in Package | Not Allowed in Package |
|---|---|
| Typed AccessControl HTTP client methods | AccessControl server-side business logic |
| AccessControl request and response models | Database access or EntityManager usage |
| Dependency injection registration | Tenant permission evaluation logic |
| Factory abstraction for consuming services | Product-specific Legislator logic |
| ServiceAuth integration for signed requests | Product-specific Hestino logic |
| AccessControl endpoint constants | Real secrets, API keys, passwords, certificates, or private keys |
AccessControl.Client should remain focused on AccessControl API consumption. ServiceAuth owns internal service authentication, and Crypto owns low-level cryptographic primitives.
Package releases are done manually through Jenkins after changes are merged to master.
1.0.0 is already published, the next release must be 1.0.1,
1.1.0, or another valid SemVer version.
| Setting | Value |
|---|---|
| Jenkins Folder | DreamConsistency - Packages |
| Job Name | DreamConsistency.AccessControl.Client - NuGet Release |
| Repository | git@bitbucket.org:skyrocket_novisad/dreamconsistency.accesscontrol.client.git |
| Branch | master |
| Jenkinsfile | Jenkinsfile |
| Build Agent | mcr.microsoft.com/dotnet/sdk:10.0 |
| BaGetter Credential | dreamconsistency-nuget-api-key |
| Bitbucket Credential | Dream Consistency Core Architecture Project Access Key |
The package uses Semantic Versioning.
| Version Type | Example | Meaning |
|---|---|---|
| Patch | 1.0.1 |
Bug fix with no breaking changes. |
| Minor | 1.1.0 |
New AccessControl client method or model with no breaking changes. |
| Major | 2.0.0 |
Breaking change, such as removing or changing public client methods or models. |
| Phase | Action |
|---|---|
| Phase 1 | Publish DreamConsistency.AccessControl.Client 1.0.0. |
| Phase 2 | Replace project references with PackageReference in one service first. |
| Phase 3 | Verify AccessControl base URL from DreamConsistency_ServiceDescriptor. |
| Phase 4 | Test one AccessControl operation from a consuming service. |
| Phase 5 | Gradually update remaining consuming services. |
| Risk / Note | Decision |
|---|---|
| Incorrect AccessControl URL | Check DreamConsistency_ServiceDescriptor.Instance.RealmCoreMsLocations.AccessControl. |
| Missing ServiceAuth setup | The package registers the ServiceAuth handler, but the consuming service must have valid service descriptor and signing key configuration. |
| Password-related flows | Password values and password hashes should be treated as credentials. |
| API contract drift | If AccessControl API contracts change, update this client package and release a new version. |
| Scope creep | Keep this package focused on AccessControl API consumption only. |
Detailed developer documentation should be maintained in the repository README.md.
This Wiki page is the central operational reference for package ownership, dependencies,
release flow, migration rules, and usage decisions.
| Date | Change | Author |
|---|---|---|
| 2026-07-08 | Initial documentation page created for DreamConsistency.AccessControl.Client. |
Branko |
| 2026-07-08 | .NET Standard 2.1 package direction and NuGet release flow documented. |
Branko |