yavsc/doc/dev-tracking/client-editor-overhaul.md

# Client editor overhaul — Yavsc.Org administration

## Goal

Bring the OAuth2 client administration UI (`/Client/Edit/{id}` and friends)
in Yavsc.Org to feature parity with the IdentityServer8 `Client` entity
model. Today the editor only exposes a handful of scalar fields and a few
single-line inputs for collections; the bulk of the entity and its
related collections are unreachable from the UI.

## Inventory — current state

### Properties exposed by `Views/Client/Edit.cshtml`

| Field                    | Type        | Notes                              |
| ------------------------ | ----------- | ---------------------------------- |
| `ClientId`               | string      | hidden, identifier                 |
| `Enabled`                | bool        | checkbox                           |
| `ClientName`             | string      | display name                       |
| `FrontChannelLogoutUri`  | string      | only front-channel, no back-channel |
| `RedirectUris`           | collection  | rendered as a single text input    |
| `IdentityTokenLifetime`  | int         | seconds                            |
| `AbsoluteRefreshTokenLifetime` | int   | seconds                            |
| `ClientSecrets`          | collection  | rendered as a single text input    |
| `AccessTokenType`        | enum        | dropdown (custom `SetAppTypesInputValues`) |

### Properties of `IdentityServer8.EntityFramework.Entities.Client` **NOT** in the editor

Core scalars (16 fields missing):

- `Description`
- `ClientUri`
- `LogoUri`
- `RequireConsent`
- `RequirePkce`
- `RequireRequestObject`
- `RequireClientSecret`
- `AllowPlainTextPkce`
- `AllowOfflineAccess`
- `AllowRememberConsent`
- `AlwaysIncludeUserClaimsInIdToken`
- `AlwaysSendClientClaims`
- `AuthorizationCodeLifetime`
- `BackChannelLogoutUri`
- `BackChannelLogoutSessionRequired`
- `CibaLifetime`
- `ClientClaimsPrefix`
- `ConsentLifetime`
- `Created`
- `DeviceCodeLifetime`
- `EnableLocalLogin`
- `Enabled`
- `FrontChannelLogoutSessionRequired`
- `IncludeJwtId`
- `LastAccessed`
- `LogoUri`
- `NonEditable`
- `PairwiseSubjectSalt`
- `PollingInterval`
- `ProtocolType`
- `RefreshTokenExpiration`
- `RefreshTokenUsage`
- `SlidingRefreshTokenLifetime`
- `UpdateAccessTokenClaimsOnRefresh`
- `Updated`
- `UserCodeType`
- `UserSsoLifetime`

Collections (8 missing — currently either not exposed at all, or jammed
into a single-line text input that doesn't work for an IEnumerable):

- `AllowedGrantTypes`        → `ClientGrantType` (GrantType)
- `AllowedScopes`            → `ClientScope` (Scope)
- `RedirectUris`             → `ClientRedirectUri` (RedirectUri) — exposed but broken
- `PostLogoutRedirectUris`   → `ClientPostLogoutRedirectUri` (PostLogoutRedirectUri)
- `AllowedCorsOrigins`       → `ClientCorsOrigin` (Origin)
- `IdentityProviderRestrictions` → `ClientIdPRestriction` (Provider)
- `Claims`                   → `ClientClaim` (Type, Value)
- `Properties`               → `ClientProperty` (Key, Value)
- `ClientSecrets`            → `ClientSecret` (Type, Value, Description, Created, Expiration) — exposed but broken
- `AllowedSigningAlgorithms` → scalar string collection on Client itself

## Pages to add

Pattern: one Razor page per collection under
`Views/Client/Edit{Collection}.cshtml`. Each page lists existing rows,
offers an "Add" form with the relevant fields, and a per-row
remove button. The main `Edit.cshtml` becomes a hub page with links
to each subpage plus the scalar fields it already has.

| Page                                  | Route                                      | Form fields                                       |
| ------------------------------------- | ------------------------------------------ | ------------------------------------------------- |
| `Edit.cshtml`                         | `GET /Client/Edit/{id}` (existing)         | scalar fields + nav links                         |
| `EditRedirectUris.cshtml`             | `GET /Client/EditRedirectUris/{id}`        | `RedirectUri`                                     |
| `EditPostLogoutRedirectUris.cshtml`   | `GET /Client/EditPostLogoutRedirectUris/{id}` | `PostLogoutRedirectUri`                         |
| `EditScopes.cshtml`                   | `GET /Client/EditScopes/{id}`              | `Scope` (with select of known scopes)             |
| `EditGrantTypes.cshtml`               | `GET /Client/EditGrantTypes/{id}`          | `GrantType` (with select of known types)          |
| `EditCorsOrigins.cshtml`              | `GET /Client/EditCorsOrigins/{id}`         | `Origin`                                          |
| `EditIdPRestrictions.cshtml`          | `GET /Client/EditIdPRestrictions/{id}`     | `Provider`                                        |
| `EditClaims.cshtml`                   | `GET /Client/EditClaims/{id}`              | `Type`, `Value`                                   |
| `EditProperties.cshtml`               | `GET /Client/EditProperties/{id}`          | `Key`, `Value`                                    |
| `EditSecrets.cshtml` (replacement)    | `GET /Client/EditSecrets/{id}`             | `Type`, `Value`, `Description`, `Expiration`      |

Partial view `_EditableList.cshtml` factored once and consumed by all
of the above.

## Controller actions to add

For each collection `Foo`:

- `GET EditFoo(int id)` — load the client, render the page
- `POST AddFoo(int id, …)` — append a row, redirect to `EditFoo`
- `POST RemoveFoo(int id, int rowId)` — delete a row, redirect

## Verification

- `dotnet build src/Yavsc.Org/Yavsc.Org.csproj` → 0 errors
- No tests in `Yavsc.Org.Tests` exercise the controller today (per
  `find … -name "ClientController*" -not -path "*/bin/*"`). Smoke-test
  by logging in as admin, hitting `/Client/Edit/1`, then each
  `Edit*/1` page, and verifying the add/remove POSTs.
- Existing seed flow (`MigratePostItClientToPublic` in
  `HostingExtensions.cs`) must keep working — the editor changes are
  additive, not destructive.

## Out of scope

- Tests (no MVC test infrastructure currently exists for this controller)
- Migration of existing collection fields (the broken `RedirectUris`
  text input will simply be replaced by the new subpage)
- Per-collection authorization policies (the controller is already
  `[Authorize("AdministratorOnly")]`)
- Client cloning / templating / JSON import-export

## Status

2026-06-21 16:04 — kickoff. Inventory done. Pages not yet started.

2026-06-21 16:11 — first delivery, **build does not compile by design**
(per Paul: "Tu peux même me laisser un travail qui ne compile
pas"). The structural work is done; the residual errors are easy
fixes Paul will do in a debug session.

Files added (working tree, not yet committed):

- `src/Yavsc.Org/Controllers/Administration/ClientController.Collections.cs`
  — partial class with the per-collection GET / Add / Remove actions.
- `src/Yavsc.Org/Views/Client/EditRedirectUris.cshtml`
- `src/Yavsc.Org/Views/Client/EditPostLogoutRedirectUris.cshtml`
- `src/Yavsc.Org/Views/Client/EditScopes.cshtml`
- `src/Yavsc.Org/Views/Client/EditGrantTypes.cshtml`
- `src/Yavsc.Org/Views/Client/EditCorsOrigins.cshtml`
- `src/Yavsc.Org/Views/Client/EditIdPRestrictions.cshtml`
- `src/Yavsc.Org/Views/Client/EditClaims.cshtml`
- `src/Yavsc.Org/Views/Client/EditProperties.cshtml`
- `src/Yavsc.Org/Views/Client/EditSecrets.cshtml`
- `src/Yavsc.Org/Views/Client/_EditableStringList.cshtml`
  — partial consumed by the single-string-field collection pages.

Files modified:

- `src/Yavsc.Org/Controllers/Administration/ClientController.cs`
  — `class` → `partial class`; the `Edit(int id)` GET now uses
  `LoadClientAsync` to load all navigations (so the new Edit.cshtml
  can render counts in its nav links).
- `src/Yavsc.Org/Views/Client/Edit.cshtml`
  — significantly enriched: nav links to the 9 sub-pages, all the
  scalar fields split into fieldsets (Security, Logout, Tokens,
  Device / CIBA, Tokens-extra), ClientId / Id hidden.

### Known residual compile errors (4 errors total)

Paul is fixing these in a debug session. The structure is sound; the
errors are missing properties on the `Client` entity, a Razor
nullable quirk, and a `Localizer` injection miss.

1. `Edit.cshtml:249` — `PairwiseSubjectSalt` doesn't exist on
   `IdentityServer8.EntityFramework.Entities.Client`. **Fix**: drop
   the field from Edit.cshtml; IdentityServer8 likely uses a
   different property name (e.g. on a related entity) or doesn't
   expose it.
2. `Edit.cshtml:221` — `CibaLifetime` doesn't exist on `Client`.
   **Fix**: same as above. CIBA flow may be configured elsewhere
   (resource-level) or via a different property.
3. `ClientController.Collections.cs` lines 181, 217, 253, 304 —
   `Localizer` is not available in the partial class. **Fix**: inject
   `IStringLocalizer<ClientController>` via the constructor, or
   inline the strings ("BothTypeAndValueRequired", "KeyRequired",
   "ValueRequired", "SecretValueRequired").
4. `EditSecrets.cshtml:44` — `s.Expiration?.ToString("u")` on a
   `DateTime?`. **Fix**: just `s.Expiration?.ToString("u")` works
   if you write `s.Expiration.Value.ToString("u")`, or use
   `(s.Expiration is null ? "" : s.Expiration.Value.ToString("u"))`,
   or `s.Expiration?.ToString("u") ?? string.Empty`.

### Suggested next session

Once the 4 compile errors are fixed and the pages render:

1. Smoke test by logging in as admin, hitting `/Client/Edit/1`,
   then each `Edit*/1` page, and verifying add/remove POSTs.
2. Add a confirmation prompt (or 2-step form) for Remove actions —
   removing a Redirect URI is destructive and one click is too easy.
3. Wire up some collection-level validation (e.g. redirect URI must
   be a valid URL) at the controller level.
4. Add tests — the project doesn't have MVC test infrastructure
   today; consider adding a `Yavsc.Org.Tests` project that drives
   the controller via `WebApplicationFactory<Program>`.


## Test bootstrap notes (session of 2026-06-21 17:00+)

When adding new integration tests against `WebServerFixture`:

1. **Skip `/Account/Login` roundtrip.** The fixture ships without
   `MapRazorPages()` (commented out in `HostingExtensions.ConfigurePipeline`),
   so `/Identity/Account/Login` is 404, and the custom
   `/Account/Login` route requires a complex antiforgery dance.
   Instead, build a `ClaimsPrincipal` for the test user via
   `UserManager` + `IUserClaimsPrincipalFactory<ApplicationUser>`,
   then call `IAuthenticationService.SignInAsync` on a synthetic
   `DefaultHttpContext` and replay the resulting `Set-Cookie` header
   into the test `HttpClient`. See
   `ClientControllerCollectionTests.IssueIdentityCookie`.

2. **Create the `Administrator` role before assigning it.** ASP.NET
   Identity stores roles in `AspNetRoles`; there is no automatic seed.
   The constant name is `YavscConstants.AdminGroupName` = `"Administrator"`.
   Use `RoleManager<IdentityRole>.CreateAsync(new IdentityRole("Administrator"))`
   before `AddToRoleAsync`.

3. **Use `InMemory` connection string to bypass the prod signing-cert
   requirement.** `HostingExtensions.AddIdentityServer` requires a
   PEM cert unless `builder.Environment.IsDevelopment()` OR
   `UsesInMemoryProvider(connectionString)`. The fixture already
   uses `InMemory`, so `AddDeveloperSigningCredential()` is called
   automatically — but only after we wired this check in (see
   commit history).

4. **Field-name gotchas** (from disassembling HigginsSoft
   IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9):
   - `PairWiseSubjectSalt` (capital W on "Wise"), not `PairwiseSubjectSalt`.
   - `CibaLifetime` and `PollingInterval` do NOT exist on `Client` in
     this version.
   - `ConsentLifetime` and `UserSsoLifetime` are `int?`.

5. **`MapStaticAssets()` fails on test projects.** Calling
   `MapStaticAssets()` resolves a manifest file
   (`<project>.staticwebassets.endpoints.json`) that test projects
   don't produce. Skip when `WebRootPath` points at the test
   assembly directory.

6. **Routing 404 on /Client/Edit/{id} via WebServerFixture.** As of
   this session, the GET endpoint returns 404 even with admin
   header. The route mapping is intact
   (`MapDefaultControllerRoute()`), so this is likely an MVC
   convention routing issue with the
   `Controllers/Administration/` subdirectory. To investigate
   next session: log middleware pipeline or hit `/Client` index
   first to see if any Client route resolves.

7. **`MapStaticAssets()` is unconditional in prod, but blocks tests.**
   `WebApplication.CreateBuilder` defaults `ContentRootPath` to
   `AppContext.BaseDirectory`. In test runs that resolves to
   `src/Yavsc.Org.Tests/bin/Debug/net10.0/`, where
   `Yavsc.Org.Tests.staticwebassets.endpoints.json` doesn't exist
   (it's generated only by projects with the Web SDK). The
   `app.MapStaticAssets()` call inside `ConfigurePipeline` then
   throws and the fixture fails to start — taking every test in
   the `[Collection("Yavsc Server")]` down with it.

   This is a pre-existing fragility of the WebServerFixture that
   the new test work surfaced. Fixing it cleanly requires either:
   (a) moving the test project to the Web SDK so it produces its
   own manifest, (b) copying the manifest at build time via an
   MSBuild target, or (c) routing `MapStaticAssets` through an
   assembly-resolution fallback. None attempted in this session —
   recorded for next session.