Api Resources seed

.vscode/settings.json

@@ -10,6 +10,7 @@
         "DESTDIR",
         "dotnet",
         "DOTNET",
+        "ecdsa",
         "envsubst",
         "Newtonsoft",
         "Npgsql",

src/PostIt/PostIt/App.axaml.cs

@@ -64,8 +64,6 @@ public partial class App : Application
                 DataContext = new MainPageViewModel(client, settings)
             };
         }
-        else
-            throw new NotSupportedException("ApplicationLifetime not supported.");
 
     }
 

src/PostIt/PostIt/Settings/Settings.cs

@@ -96,6 +96,20 @@ public partial class Settings : ObservableObject
     internal void Load()
     {
         if (Loaded) return;
+
+        // Trust an already-populated Authority: tests pre-fill Settings
+        // with the OIDC stub's random loopback port, and programmatic
+        // callers (CLI flags, integration tests) wire their own. If we
+        // fall through to the disk / embedded read here we'd silently
+        // overwrite their value with the bundled default
+        // (yavsc.pschneider.fr), break the stubbed discovery URL, and
+        // turn a passing login into an invalid_grant.
+        if (!string.IsNullOrWhiteSpace(Authentication?.Authority))
+        {
+            Loaded = true;
+            return;
+        }
+
         string configDir = Path.Combine(
     Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData),
     "PostIt"
@@ -109,16 +123,14 @@ public partial class Settings : ObservableObject
         if (!configFileInfo.Exists)
         {
             Console.Error.WriteLine($"🩎 Settings file not found at {configFileInfo.FullName}");
-            // Only fall back to the embedded default when the in-memory
-            // settings haven't been populated yet. This protects callers
-            // (notably tests) that pre-load Settings with explicit values
-            // from being silently overwritten by the bundled default.
-            if (string.IsNullOrWhiteSpace(this.Authentication?.Authority)
-                && !TryLoadEmbeddedFallback())
+            // No user-level config: fall back to the embedded default.
+            // We only get here when Authentication.Authority is empty
+            // (the early-return above) so the redundant guard is gone.
+            if (!TryLoadEmbeddedFallback())
             {
                 Console.Error.WriteLine("🩎 No embedded default settings; running with empty configuration.");
             }
-            return; // no user settings file
+            return;
         }
 
         Console.WriteLine($"🔎 Loading settings from {configFileInfo.FullName}");

src/Yavsc.Org/Contants.cs

@@ -1,7 +1,25 @@
 
+
+using IdentityServer8.EntityFramework.Entities;
+
 public static class Constants
 {
      public static readonly string[] BuildInApiScopes = {
         "profile", "openid", "offline_access",
-        "blogs", "admin", "moderation", "performer", "client" };
+        "admin", "moderation", "performer", "client" };
+
+    public static readonly ApiResourceScopeSpecification[] ApiResourcesScopes = {
+
+       new ApiResourceScopeSpecification { ScopeName = "admin", Description = "Admin access" },
+       new ApiResourceScopeSpecification { ScopeName = "moderation", Description = "Moderation access" },
+       new ApiResourceScopeSpecification { ScopeName = "performer", Description = "Performer access" },
+       new ApiResourceScopeSpecification { ScopeName = "client", Description = "Client access" },
+       new ApiResourceScopeSpecification { ScopeName = "blogs", Description = "Blogs access" }
+    };
+}
+
+public class ApiResourceScopeSpecification
+{
+    public string ScopeName { get; set; }
+    public string Description { get; set; }
 }

src/Yavsc.Org/Extensions/HostingExtensions.cs

@@ -438,7 +438,7 @@ public static class HostingExtensions
     {
         // Validate the cert is readable (used downstream for token
         // audience/subject validation; signing itself uses the key).
-        _ = new X509Certificate2(certPath);
+
         string keyPem = File.ReadAllText(keyPath);
 
         // BouncyCastle's PemReader accepts every flavour of unencrypted
@@ -471,7 +471,9 @@ public static class HostingExtensions
         {
             case RsaPrivateCrtKeyParameters rsa:
                 {
+#pragma warning disable CA1416 // Valider la compatibilité de la plateforme
                     var rsaDotNet = DotNetUtilities.ToRSA(rsa);
+#pragma warning restore CA1416 // Valider la compatibilité de la plateforme
                     var key = new RsaSecurityKey(rsaDotNet);
                     return new SigningCredentials(key, SecurityAlgorithms.RsaSha256);
                 }
@@ -549,17 +551,21 @@ public static class HostingExtensions
                 var profile = new IdentityResources.Profile().ToEntity();
                 identityResources.Add(profile);
             }
+            foreach (var scope in Constants.ApiResourcesScopes)
+            {
 
-        // ApiScope custom
-        if (!apiScopes.Any(s => s.Name == "blogs"))
+                if (!identityResources.Any(s => s.Name == scope.ScopeName))
                 {
-            apiScopes.Add(new IdentityServer8.EntityFramework.Entities.ApiScope
+                    identityResources.Add(
+                        new IdentityResources.Profile()
                         {
-                Name = "blogs",
-                DisplayName = "Yavsc Blogs API",
+                            Name = scope.ScopeName,
+                            DisplayName = scope.Description,
                             Enabled = true
-            });
+                        }.ToEntity());
                 }
+            }
+            context.SaveChanges();
         };
     }