fix(api): harden billing/blog validation and update rc14 changelog

src/Yavsc.Api.Test/Fixtures/ApiWebServerFixture.cs

@@ -204,6 +204,10 @@ public sealed class ApiWebServerFixture : WebHostFixture
             ClientId = "alice",
             PerformerId = "alice",
             Consent = true,
+            UserCreated = "alice",
+            UserModified = "alice",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
             EventDate = DateTime.UtcNow.AddDays(1),
             Location = location,
             Reason = "Initial rendez-vous",
@@ -293,6 +297,10 @@ public sealed class ApiWebServerFixture : WebHostFixture
             ClientId = "alice",
             PerformerId = "alice",
             Consent = true,
+            UserCreated = "alice",
+            UserModified = "alice",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
             EventDate = DateTime.UtcNow.AddDays(3),
             Location = location,
             PrestationId = prestation1.Id,
@@ -308,6 +316,10 @@ public sealed class ApiWebServerFixture : WebHostFixture
             ClientId = "alice",
             PerformerId = "alice",
             Consent = true,
+            UserCreated = "alice",
+            UserModified = "alice",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
             EventDate = DateTime.UtcNow.AddDays(4),
             Location = location,
             Prestations = new List<HairPrestationCollectionItem>

src/Yavsc.Api.Test/FrontOfficeApiControllerTests.cs

@@ -49,8 +49,9 @@ public sealed class FrontOfficeApiControllerTests : IClassFixture<ApiWebServerFi
 
         using var http = NewClient();
         var response = await http.PostAsync($"/api/v1/front/query/accept?billingCode=Rdv&queryId={queryId}", content: null, TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
 
-        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
 
         using var assertScope = _fixture.Services.CreateScope();
         var assertDb = assertScope.ServiceProvider.GetRequiredService<ApplicationDbContext>();

src/Yavsc.Api.Test/RdvQueryApiControllerTests.cs

@@ -82,4 +82,34 @@ public sealed class RdvQueryApiControllerTests : IClassFixture<ApiWebServerFixtu
         var missingResponse = await http.GetAsync($"/api/v1/billing/Rdv/{fetched.Id}", TestContext.Current.CancellationToken);
         Assert.Equal(HttpStatusCode.NotFound, missingResponse.StatusCode);
     }
+
+    [Fact]
+    public async Task PostQuery_ignores_client_field_and_uses_authenticated_user()
+    {
+        _fixture.ResetAndSeedRdvQueryGraph();
+        using var http = NewClient(subject: "alice");
+
+        var createPayload = new
+        {
+            ActivityCode = "dev",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = DateTime.UtcNow.AddDays(2),
+            Location = new
+            {
+                Address = "2 rue du Test",
+                Latitude = 48.8567,
+                Longitude = 2.3523,
+            },
+            Reason = "Rendez-vous sans champ client",
+            Status = QueryStatus.Inserted,
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/Rdv", createPayload, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.Created, createResponse.StatusCode);
+
+        var created = await createResponse.Content.ReadFromJsonAsync<RdvQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(created);
+        Assert.Equal("alice", created!.ClientId);
+    }
 }