Merge pull request 'feat/postit-acl' (#32) from feat/postit-acl into release/1.0.7

Reviewed-on: #32

README.md

@@ -4,6 +4,12 @@
 
 C'est une application mettant en oeuvre une prise de contact entre un demandeur de services et son éventuel prestataire associé.
 
+# Statut actuel des actions Forgejo
+
+![Build and test](https://forgejo.pschneider.fr/notazof/yavsc/badges/workflows/buildAndTest.yml/badge.svg)
+
+![Release](https://forgejo.pschneider.fr/notazof/yavsc/badges/workflows/release.yml/badge.svg)
+
 # Statut actuel des actions GitHub
 
 * [![Build and Push Yavsc Apk](https://github.com/pazof/yavsc/actions/workflows/docker-publish-android.yml/badge.svg)](https://github.com/pazof/yavsc/actions/workflows/docker-publish-android.yml)

src/PostIt.Tests/BearerScopeTests.cs

@@ -8,6 +8,9 @@ using System.Text;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
+using PostIt.Services;
 using PostIt.Services;
 using Xunit;
 
@@ -94,7 +97,7 @@ public class BearerScopeTests
             // CapturingHttpHandler is the assertion point. It
             // records the first request's Authorization header and
             // returns 200 with an empty array (BlogApiClient
-            // deserialises to List<BlogPost>).
+            // deserialises to List<BlogPostDto>).
             var captured = new CapturingHttpHandler();
             var client = new YavscApiClient(
                 settings,
@@ -119,7 +122,7 @@ public class BearerScopeTests
             // Resolve a BlogApiClient on top. We don't need real
             // posts; we just need the outbound HTTP request to be
             // the one we capture.
-            var blog = new BlogApiClient(subClient);
+            var blog = new BlogApiClient(subClient, "http://localhost/");
 
             await blog.GetPostsAsync(ct: TestContext.Current.CancellationToken);
 

src/PostIt.Tests/BlogApiTestFakes.cs

@@ -1,4 +1,4 @@
-using PostIt.Models;
+using Yavsc.Blogspot;
 using PostIt.Services;
 using PostIt.ViewModels;
 using Yavsc.Models;
@@ -18,7 +18,7 @@ internal sealed class CallRecorder
 
 /// <summary>Test fake that records every CallAsync invocation
 /// and answers them with a canned sequence: the first call gets
-/// a server-issued BlogPost (Id=42), the second call gets a
+/// a server-issued BlogPostDto (Id=42), the second call gets a
 /// single-element list containing that post. Used by the ViewModel
 /// tests and the headless UI test to capture exactly what the
 /// Save button posts to the server.</summary>
@@ -44,20 +44,20 @@ internal sealed class RecordingYavscApiClient : YavscApiClient
     public override Task<T> CallAsync<T>(HttpMethod method, string path, object? body = null, CancellationToken ct = default)
     {
         _recorder.Calls.Add((method, path, body));
-        // BlogPost? boxes to BlogPost at runtime, so we test the
+        // BlogPostDto? boxes to BlogPostDto at runtime, so we test the
-        // non-nullable type — typeof(BlogPost?) is a C# error
+        // non-nullable type — typeof(BlogPostDto?) is a C# error
         // (CS8639: "typeof cannot be used on a nullable reference
         // type").
-        if (typeof(T) == typeof(BlogPost))
+        if (typeof(T) == typeof(BlogPostDto))
-            return Task.FromResult((T)(object)new BlogPost
+            return Task.FromResult((T)(object)new BlogPostDto
             {
                 Id = 42,
                 Title = "Mon premier billet",
                 AuthorId = "tester",
                 Article = "Contenu du billet de test.",
             });
-        if (typeof(T) == typeof(List<BlogPost>))
+        if (typeof(T) == typeof(List<BlogPostDto>))
-            return Task.FromResult((T)(object)new List<BlogPost>
+            return Task.FromResult((T)(object)new List<BlogPostDto>
             {
                 new() { Id = 42, Title = "Mon premier billet" }
             });

src/PostIt.Tests/MainPageSaveTests.cs

@@ -2,7 +2,8 @@ using Avalonia;
 using Avalonia.Controls;
 using Avalonia.Headless.XUnit;
 using Avalonia.VisualTree;
-using PostIt.Models;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
 using PostIt.Services;
 using PostIt.ViewModels;
 using PostIt.Views;
@@ -24,7 +25,7 @@ namespace PostIt.Tests;
 /// in which a brand-new post can be created), the binding has
 /// no target and the user's keystrokes are silently dropped.
 /// Clicking "Save" then routes to the VM branch
-/// <c>if (SelectedPost is null) { new BlogPost { Title = string.Empty, ... } }</c>
+/// <c>if (SelectedPost is null) { new BlogPostDto { Title = string.Empty, ... } }</c>
 /// which the controller rejects with 400 "The Title field is
 /// required." This test fails on that branch today and will
 /// pass once the VM owns a dedicated <c>Title</c>/<c>Article</c>
@@ -40,7 +41,7 @@ public class MainPageSaveTests
         // not a Control, so it needs a navigation host).
         var recorder = new CallRecorder();
         var api = new RecordingYavscApiClient(recorder);
-        var blog = new BlogApiClient(api);
+        var blog = new BlogApiClient(api, "http://localhost/");
         var viewModel = new MainPageViewModel(blog);
 
         var page = new MainPage { DataContext = viewModel };
@@ -76,14 +77,14 @@ public class MainPageSaveTests
         // we inspect the recorder.
         await Task.Delay(200);
 
-        // Assert: the first POST to "blog" carried a BlogPost
+        // Assert: the first POST to "blog" carried a BlogPostDto
         // whose Title is exactly what the user typed. The bug
         // fails this assertion with Title == string.Empty.
         Assert.NotEmpty(recorder.Calls);
         var (method, path, body) = recorder.FirstCall;
         Assert.Equal(HttpMethod.Post, method);
         Assert.Equal("blog", path);
-        var sent = Assert.IsType<BlogPost>(body);
+        var sent = Assert.IsType<BlogPostDto>(body);
         Assert.Equal(typed, sent.Title);
     }
 }

src/PostIt.Tests/PostItViewModelTests.cs

@@ -1,4 +1,5 @@
-using PostIt.Models;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
 using PostIt.Services;
 using PostIt.ViewModels;
 
@@ -14,12 +15,12 @@ public class PostItViewModelTests
         // default; tests construct one with a fake YavscApiClient that
         // throws on any call (we never call the API in this test).
         var fakeApi = new ThrowingYavscApiClient();
-        var blog = new BlogApiClient(fakeApi);
+        var blog = new BlogApiClient(fakeApi, "http://localhost/");
         var viewModel = new MainPageViewModel(blog);
 
-        viewModel.Posts.Add(new BlogPost { Id = 1, Title = "First post", Article = "Hello world", AuthorId = "alice" });
+        viewModel.Posts.Add(new BlogPostDto { Id = 1, Title = "First post", Article = "Hello world", AuthorId = "alice" });
-        viewModel.Posts.Add(new BlogPost { Id = 2, Title = "Second post", Article = "Nothing here", AuthorId = "bob" });
+        viewModel.Posts.Add(new BlogPostDto { Id = 2, Title = "Second post", Article = "Nothing here", AuthorId = "bob" });
-        viewModel.Posts.Add(new BlogPost { Id = 3, Title = "Third post", Article = "Search me", AuthorId = "carol" });
+        viewModel.Posts.Add(new BlogPostDto { Id = 3, Title = "Third post", Article = "Search me", AuthorId = "carol" });
 
         viewModel.SearchText = "search";
         viewModel.SearchCommand.Execute(null);
@@ -40,13 +41,13 @@ public class PostItViewModelTests
         // The new BlogApiClient delegates transport to YavscApiClient.
         // We feed it a fake YavscApiClient that returns the expected
         // list straight from CallAsync.
-        var expected = new List<BlogPost>
+        var expected = new List<BlogPostDto>
         {
             new() { Id = 1, Title = "Hello" },
             new() { Id = 2, Title = "World" }
         };
         var api = new StubYavscApiClient(expected);
-        var blog = new BlogApiClient(api);
+        var blog = new BlogApiClient(api, "http://localhost/");
 
         var posts = await blog.GetPostsAsync();
 
@@ -76,8 +77,8 @@ public class PostItViewModelTests
     /// <summary>Test fake that hands back a canned list of posts from any CallAsync.</summary>
     private sealed class StubYavscApiClient : YavscApiClient
     {
-        private readonly List<BlogPost> _posts;
+        private readonly List<BlogPostDto> _posts;
-        public StubYavscApiClient(List<BlogPost> posts)
+        public StubYavscApiClient(List<BlogPostDto> posts)
             : base(
                 new Settings
                 {
@@ -97,7 +98,7 @@ public class PostItViewModelTests
         {
             // The canned fake only knows about a list of posts; the
             // BlogApiClient test asserts on that list directly.
-            if (typeof(T) == typeof(List<BlogPost>))
+            if (typeof(T) == typeof(List<BlogPostDto>))
                 return Task.FromResult((T)(object)_posts);
             return Task.FromResult(default(T)!);
         }

src/PostIt.Tests/YavscApiClientTests.cs

@@ -8,6 +8,9 @@ using System.Net.Sockets;
 using System.Text;
 using System.Text.Json;
 using System.Threading;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
+using PostIt.Services;
 using System.Threading.Tasks;
 using IdentityModel.OidcClient;
 using IdentityModel.OidcClient.Browser;

src/PostIt/Directory.Packages.props

@@ -14,6 +14,7 @@
     <PackageVersion Include="CommunityToolkit.Mvvm" Version="8.4.2" />
     <PackageVersion Include="Material.Avalonia" Version="3.17.0" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Maui.Essentials" Version="10.0.90" />
     <PackageVersion Include="Xamarin.AndroidX.Browser" Version="1.8.0" />
     <PackageVersion Include="Xamarin.AndroidX.Core.SplashScreen" Version="1.2.0" />
   </ItemGroup>

src/PostIt/PostIt/App.axaml.cs

@@ -7,6 +7,7 @@ using Avalonia.Controls.ApplicationLifetimes;
 using Avalonia.Markup.Xaml;
 using Avalonia.Styling;
 using PostIt.Services;
+using Yavsc.Api.Client;
 using PostIt.ViewModels;
 using PostIt.Views;
 
@@ -55,7 +56,12 @@ public partial class App : Application
             "PostIt", "tokens.json"));
 
         var api = new YavscApiClient(settings, tokenStore);
-        var client = new BlogApiClient(api);
+        var client = new BlogApiClient(api, settings.BlogsApiUrl);
+        var circleClient = new CircleApiClient(api, settings.BlogsApiUrl);
+        var blogAclClient = new BlogAclApiClient(api, settings.BlogsApiUrl);
+        var userSearchClient = new UserSearchClient(api, settings.BlogsApiUrl);
+        var contactService = new ContactService();
+        var userDirectory = new UserDirectory(userSearchClient);
 
         var services = new ServiceCollection();
 
@@ -75,14 +81,22 @@ public partial class App : Application
         services.AddSingleton<SettingsPage>();
         services.AddTransient<HomePage>();
         services.AddTransient<SignaturePage>();
+        services.AddTransient<CirclesPage>();
 
         // ViewModels
         services.AddSingleton(settings);
-        services.AddSingleton(api);
+        services.AddSingleton<YavscApiClient>(api);
+        services.AddSingleton<IYavscApiClient>(api);
         services.AddSingleton(client);
+        services.AddSingleton(circleClient);
+        services.AddSingleton(blogAclClient);
+        services.AddSingleton(userSearchClient);
+        services.AddSingleton<IContactService>(contactService);
+        services.AddSingleton<IUserDirectory>(userDirectory);
         services.AddTransient<MainPageViewModel>();
         services.AddTransient<HomePageViewModel>();
         services.AddTransient<SignaturePageViewModel>();
+        services.AddTransient<CirclesPageViewModel>();
 
         // Persistent session banner: one instance for the lifetime of
         // the app so the same VM survives page navigation.

src/PostIt/PostIt/PostIt.csproj

@@ -25,6 +25,7 @@
     <PackageReference Include="IdentityModel.OidcClient" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
     <ProjectReference Include="../../Yavsc.Abstract/Yavsc.Abstract.csproj" />
+    <ProjectReference Include="../../Yavsc.Api.Client/Yavsc.Api.Client.csproj" />
   </ItemGroup>
   <ItemGroup>
     <Content Include="postit-settings.json">

src/PostIt/PostIt/Services/ContactService.Desktop.cs

@@ -0,0 +1,36 @@
+#if !ANDROID && !IOS
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PostIt.Services;
+
+/// <summary>
+/// Desktop stub for <see cref="IContactService"/>.
+///
+/// <para>The desktop has no equivalent of the mobile address
+/// book (no <c>Contacts.Default</c>, no CardDAV out of the
+/// box). Rather than synthesise a list from a different
+/// source, this provider returns an empty list and lets the
+/// UI render an honest "no local contacts on this platform"
+/// message.</para>
+///
+/// <para>If desktop users want to invite people who aren't
+/// Yavsc members, that flow goes through a separate path
+/// (manual email entry + invitation endpoint) — not through
+/// <see cref="IContactService"/>. Finding existing Yavsc
+/// members is <see cref="IUserDirectory"/>'s job, not this
+/// one's.</para>
+///
+/// <para>Future CardDAV / Google Contacts / Exchange
+/// providers can plug in here as additional
+/// <see cref="IContactService"/> implementations selected
+/// from DI by configuration.</para>
+/// </summary>
+public sealed class ContactService : IContactService
+{
+    public Task<IReadOnlyList<ContactDto>> GetDeviceContactsAsync(CancellationToken ct = default)
+        => Task.FromResult<IReadOnlyList<ContactDto>>(Array.Empty<ContactDto>());
+}
+#endif

src/PostIt/PostIt/Services/ContactService.Mobile.cs

@@ -0,0 +1,82 @@
+#if ANDROID || IOS
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Maui.ApplicationModel.Communication;
+using Microsoft.Maui.ApplicationModel;
+using Microsoft.Maui.Devices;
+
+namespace PostIt.Services;
+
+/// <summary>
+/// Mobile implementation backed by MAUI Essentials
+/// <c>Contacts.Default</c>.
+///
+/// <para>Compiled only for ANDROID and IOS. On desktop targets,
+/// see <c>ContactService.Desktop.cs</c> (the stub that wins at
+/// compile time).</para>
+///
+/// <para>Note: at runtime, this class throws
+/// <c>NotImplementedInReferenceAssemblyException</c> unless
+/// the host application project also references the
+/// platform-specific Microsoft.Maui.Essentials implementation
+/// (typically <c>PostIt.Android</c>). On iOS the same is
+/// required via <c>PostIt.iOS</c>. On desktop the stub is used
+/// and this file is excluded.</para>
+/// </summary>
+public sealed class ContactService : IContactService
+{
+    public async Task<IReadOnlyList<ContactDto>> GetDeviceContactsAsync(CancellationToken ct = default)
+    {
+        if (DeviceInfo.Current.Platform == DevicePlatform.Unknown)
+            return Array.Empty<ContactDto>();
+
+        try
+        {
+            var status = await Permissions.RequestAsync<Permissions.ContactsRead>();
+            if (status != PermissionStatus.Granted)
+                return Array.Empty<ContactDto>();
+
+            var contacts = await Contacts.Default.GetAllAsync();
+            if (contacts is null) return Array.Empty<ContactDto>();
+
+            // Carry the per-contact email list as-is. A real
+            // device contact can carry several addresses (home /
+            // work / other); the UI use case ("invite / add to a
+            // circle") can then decide which address to use, or
+            // let the user pick. The platform-neutral ContactDto
+            // shape is intentionally richer than the Yavsc
+            // directory's single-Email shape — the two flows
+            // answer different questions.
+            var result = new List<ContactDto>(contacts.Count);
+            foreach (var c in contacts)
+            {
+                var emails = ExtractEmails(c.Emails);
+                result.Add(new ContactDto(
+                    c.Id,
+                    c.DisplayName ?? string.Empty,
+                    emails));
+            }
+            return result;
+        }
+        catch (Exception ex)
+        {
+            System.Diagnostics.Debug.WriteLine($"ContactService: {ex.Message}");
+            return Array.Empty<ContactDto>();
+        }
+    }
+
+    private static IReadOnlyList<string> ExtractEmails(IEnumerable<EmailAddress>? emails)
+    {
+        if (emails is null) return Array.Empty<string>();
+        var list = new List<string>();
+        foreach (var e in emails)
+        {
+            if (!string.IsNullOrEmpty(e.EmailAddress))
+                list.Add(e.EmailAddress);
+        }
+        return list;
+    }
+}
+#endif

src/PostIt/PostIt/Services/IContactService.cs

@@ -0,0 +1,57 @@
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PostIt.Services;
+
+/// <summary>
+/// Abstraction over the device-local address book. Used by
+/// the "invite someone" flow to enumerate people the user
+/// already has in their phone — including people who have
+/// never heard of Yavsc.
+///
+/// <para>Distinct from <see cref="IUserDirectory"/>, which
+/// reads the central Yavsc user table. A device contact may
+/// not have a Yavsc account; a directory entry always does.
+/// The two are exposed as separate interfaces so a UI that
+/// needs both can take both by constructor injection and
+/// present them under separate sections (e.g. "Contacts from
+/// your phone" vs "Yavsc members").</para>
+///
+/// <para>Implementations live next to this file in
+/// platform-conditional source files:
+/// <c>ContactService.Mobile.cs</c> (ANDROID/IOS) and
+/// <c>ContactService.Desktop.cs</c> (everything else). On
+/// desktop the implementation is a stub that returns an
+/// empty list: the desktop has no equivalent of the mobile
+/// address book, and inviting from a desktop is a separate
+/// flow.</para>
+/// </summary>
+public interface IContactService
+{
+    /// <summary>
+    /// Read the device address book. Returns the contacts
+    /// known to the local provider; on desktop (no local
+    /// provider) this is always an empty list.
+    /// </summary>
+    Task<IReadOnlyList<ContactDto>> GetDeviceContactsAsync(CancellationToken ct = default);
+}
+
+/// <summary>
+/// Platform-neutral contact DTO. Source-of-truth shape for
+/// the UI layer; concrete providers (MAUI Essentials on
+/// mobile) map to this type.
+///
+/// <para><c>Emails</c> is a list on purpose: a real device
+/// contact may carry several addresses (home / work / other).
+/// The UI use case ("invite / add to a circle") can then
+/// decide which address to use, or let the user pick. This
+/// is intentionally richer than the Yavsc directory's
+/// single-<c>Email</c> shape — the two flows answer different
+/// questions and shouldn't be flattened onto the same
+/// wire.</para>
+/// </summary>
+public sealed record ContactDto(
+    string Id,
+    string DisplayName,
+    IReadOnlyList<string> Emails);

src/PostIt/PostIt/Services/IUserDirectory.cs

@@ -0,0 +1,67 @@
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace PostIt.Services;
+
+/// <summary>
+/// Abstraction over the central Yavsc user directory. Used by
+/// the "add to a circle" flow to find Yavsc users by display
+/// name or email.
+///
+/// <para>Distinct from <see cref="IContactService"/>, which
+/// reads the device-local address book. A Yavsc user
+/// directory entry is always a registered account; a device
+/// contact may be anyone in the user's phone — including
+/// people who have never heard of Yavsc.</para>
+///
+/// <para>Implementations live next to this file in
+/// platform-conditional source files:
+/// <c>UserDirectory.Desktop.cs</c> and
+/// <c>UserDirectory.Mobile.cs</c>. Both currently delegate to
+/// <c>UserSearchClient</c> (the central <c>/api/user-search</c>
+/// endpoint); the split exists so future platform-specific
+/// sources (offline cache, directory-scoped providers) can be
+/// plugged in without disturbing the consumer.</para>
+/// </summary>
+public interface IUserDirectory
+{
+    /// <summary>
+    /// Search the directory by display name (substring) and/or
+    /// email (exact).
+    /// </summary>
+    /// <param name="query">Substring filter on the user's
+    /// display name. Empty or whitespace short-circuits to an
+    /// empty list (matches the client UX of "type to search",
+    /// not "show me a directory").</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>A flat list of matching directory entries.
+    /// Never null; may be empty.</returns>
+    Task<IReadOnlyList<UserSummary>> SearchAsync(string query, CancellationToken ct = default);
+}
+
+/// <summary>
+/// Platform-neutral summary of a Yavsc directory entry. Mirrors
+/// the wire shape of <c>/api/user-search</c> (see
+/// <c>UserSearchResultDto</c>) but expressed in terms that
+/// don't leak transport concerns.
+///
+/// <para>Kept as a record on purpose: directory entries are
+/// immutable snapshots from the server, so structural equality
+/// makes "did the user already pick this one?" trivial.</para>
+/// </summary>
+public sealed record UserSummary(
+    string Id,
+    string UserName,
+    string? FullName,
+    string? Avatar,
+    string? Email)
+{
+    /// <summary>
+    /// Convenience for "what to show in a picker". Falls back
+    /// to <see cref="UserName"/> when <see cref="FullName"/>
+    /// is null or empty.
+    /// </summary>
+    public string DisplayName =>
+        string.IsNullOrWhiteSpace(FullName) ? UserName : FullName;
+}

src/PostIt/PostIt/Services/UserDirectory.Desktop.cs

@@ -0,0 +1,52 @@
+#if !ANDROID && !IOS
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Yavsc.Api.Client;
+
+namespace PostIt.Services;
+
+/// <summary>
+/// Desktop implementation of <see cref="IUserDirectory"/>.
+/// Delegates to the central <c>/api/user-search</c> endpoint
+/// via <see cref="UserSearchClient"/>.
+///
+/// <para>The desktop has no device-local address book, so the
+/// "add to a circle" flow on desktop is Yavsc-users-only.
+/// Inviting someone who doesn't have a Yavsc account from
+/// desktop is a separate feature (manual email entry +
+/// invitation endpoint) and lives outside this interface.</para>
+/// </summary>
+public sealed class UserDirectory : IUserDirectory
+{
+    private readonly UserSearchClient _client;
+
+    public UserDirectory(UserSearchClient client)
+    {
+        _client = client ?? throw new ArgumentNullException(nameof(client));
+    }
+
+    public async Task<IReadOnlyList<UserSummary>> SearchAsync(
+        string query, CancellationToken ct = default)
+    {
+        // UserSearchClient already short-circuits on empty
+        // queries, but do it here too so the contract is
+        // obvious to anyone reading IUserDirectory alone
+        // without having to chase the client wrapper.
+        if (string.IsNullOrWhiteSpace(query))
+            return Array.Empty<UserSummary>();
+
+        var results = await _client.SearchAsync(query: query, ct: ct).ConfigureAwait(false);
+        if (results is null) return Array.Empty<UserSummary>();
+
+        return results.Select(u => new UserSummary(
+            Id: u.Id,
+            UserName: u.UserName,
+            FullName: u.FullName,
+            Avatar: u.Avatar,
+            Email: u.Email)).ToList();
+    }
+}
+#endif

src/PostIt/PostIt/Services/UserDirectory.Mobile.cs

@@ -0,0 +1,49 @@
+#if ANDROID || IOS
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Yavsc.Api.Client;
+
+namespace PostIt.Services;
+
+/// <summary>
+/// Mobile implementation of <see cref="IUserDirectory"/>.
+/// Same backing as the desktop provider (the central
+/// <c>/api/user-search</c> endpoint via
+/// <see cref="UserSearchClient"/>) — mobile devices have the
+/// network too, and "add to a circle" needs the same directory
+/// regardless of platform.
+///
+/// <para>The split exists so a future mobile-only provider
+/// (offline cache, device-local mirror of the user's own
+/// circles) can be plugged in without touching consumers.</para>
+/// </summary>
+public sealed class UserDirectory : IUserDirectory
+{
+    private readonly UserSearchClient _client;
+
+    public UserDirectory(UserSearchClient client)
+    {
+        _client = client ?? throw new ArgumentNullException(nameof(client));
+    }
+
+    public async Task<IReadOnlyList<UserSummary>> SearchAsync(
+        string query, CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(query))
+            return Array.Empty<UserSummary>();
+
+        var results = await _client.SearchAsync(query: query, ct: ct).ConfigureAwait(false);
+        if (results is null) return Array.Empty<UserSummary>();
+
+        return results.Select(u => new UserSummary(
+            Id: u.Id,
+            UserName: u.UserName,
+            FullName: u.FullName,
+            Avatar: u.Avatar,
+            Email: u.Email)).ToList();
+    }
+}
+#endif

src/PostIt/PostIt/Services/YavscApiClient.cs

@@ -9,6 +9,7 @@ using System.Threading;
 using System.Threading.Tasks;
 using IdentityModel.OidcClient;
 using PostIt.ViewModels;
+using Yavsc.Api.Client;
 
 namespace PostIt.Services;
 
@@ -24,7 +25,7 @@ namespace PostIt.Services;
 /// <see cref="BearerTokenHandler"/> only refreshes once even if many
 /// concurrent requests are in flight.
 /// </summary>
-public class YavscApiClient : IAsyncDisposable
+public class YavscApiClient : IYavscApiClient, IAsyncDisposable
 {
     // 60s of slack before the access_token's nominal expiry. Covers
     // network latency + JWT validation on the server side.

src/PostIt/PostIt/ViewModels/AddCircleMemberDialogViewModel.cs

@@ -0,0 +1,118 @@
+using System;
+using System.Collections.ObjectModel;
+using System.Threading;
+using System.Threading.Tasks;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using PostIt.Services;
+using Yavsc.Api.Client;
+
+namespace PostIt.ViewModels;
+
+/// <summary>
+/// View model for the "add a Yavsc user to a circle" modal.
+///
+/// <para>Resolves users through <see cref="IUserDirectory"/>
+/// (which delegates to <c>/api/user-search</c>); the caller
+/// (CirclesPage) decides whether to add the picked user to
+/// the circle by calling
+/// <see cref="AddCircleMemberDialogViewModel.AddCommand"/>
+/// (which is bound to the dialog's "Ajouter" button).</para>
+///
+/// <para>The dialog itself doesn't know the target
+/// <c>CircleId</c>: that's set by the caller via the
+/// constructor and the dialog only triggers
+/// <see cref="IUserDirectory.SearchAsync"/> against the
+/// <see cref="SearchQuery"/> string. The "Add" command
+/// returns the picked <see cref="UserSummary"/> via the
+/// <see cref="Confirmed"/> event, and the hosting
+/// <c>CirclesPage</c> then calls
+/// <see cref="CircleApiClient.AddMemberAsync"/>.</para>
+/// </summary>
+public partial class AddCircleMemberDialogViewModel : ViewModelBase
+{
+    private readonly IUserDirectory _directory;
+
+    [ObservableProperty]
+    public partial string SearchQuery { get; set; } = string.Empty;
+
+    [ObservableProperty]
+    public partial ObservableCollection<UserSummary> Results { get; set; } = new();
+
+    [ObservableProperty]
+    public partial UserSummary? Selected { get; set; }
+
+    [ObservableProperty]
+    public partial bool IsBusy { get; set; }
+
+    [ObservableProperty]
+    public partial string StatusMessage { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Raised when the user confirms a selection. The hosting
+    /// <c>CirclesPage</c> subscribes to this event and calls
+    /// <c>CircleApiClient.AddMemberAsync</c> with the target
+    /// circle id + the picked user's id. The dialog itself
+    /// does not know the circle id by design: separation of
+    /// concerns — the modal is a user picker, not a
+    /// "circle joiner" form.
+    /// </summary>
+    public event EventHandler<UserSummary>? Confirmed;
+
+    public AddCircleMemberDialogViewModel(IUserDirectory directory)
+    {
+        _directory = directory ?? throw new ArgumentNullException(nameof(directory));
+    }
+
+    public override bool CanNavigateNext { get => throw new NotImplementedException(); protected set => throw new NotImplementedException(); }
+    public override bool CanNavigatePrevious { get => throw new NotImplementedException(); protected set => throw new NotImplementedException(); }
+
+    /// <summary>
+    /// Search the directory for users matching the current
+    /// <see cref="SearchQuery"/>. Triggered explicitly via the
+    /// "Rechercher" button — no debouncing, so the caller
+    /// stays in control of how often the network is hit.
+    /// </summary>
+    [RelayCommand]
+    public async Task SearchAsync()
+    {
+        if (string.IsNullOrWhiteSpace(SearchQuery))
+        {
+            Results.Clear();
+            StatusMessage = "Tapez un nom ou un email";
+            return;
+        }
+
+        IsBusy = true;
+        try
+        {
+            var hits = await _directory.SearchAsync(SearchQuery, CancellationToken.None).ConfigureAwait(true);
+            Results = new ObservableCollection<UserSummary>(hits ?? Array.Empty<UserSummary>());
+            StatusMessage = $"{Results.Count} résultat(s)";
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    /// <summary>
+    /// Raise <see cref="Confirmed"/> for the currently selected
+    /// user. No-op when no selection has been made — keeps the
+    /// UI from firing an event with a null payload.
+    /// </summary>
+    [RelayCommand]
+    public void Add()
+    {
+        if (Selected is null)
+        {
+            StatusMessage = "Sélectionnez un utilisateur";
+            return;
+        }
+        Confirmed?.Invoke(this, Selected);
+    }
+}

src/PostIt/PostIt/ViewModels/CirclesPageViewModel.cs

@@ -0,0 +1,310 @@
+using System;
+using System.Collections.ObjectModel;
+using System.Linq;
+using System.Threading.Tasks;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using PostIt.Services;
+using Yavsc.Api.Client;
+using Yavsc.Api.Client.Dtos;
+
+namespace PostIt.ViewModels;
+
+/// <summary>
+/// View model for the "Mes cercles" page. CRUD on the caller's own
+/// circles (the server scopes every endpoint to the caller's uid
+/// since the BlogAcl fix on this branch), plus membership
+/// management on the currently selected circle.
+///
+/// <para>The view lists circles in <see cref="Circles"/>, supports
+/// create / edit via <see cref="DraftName"/>, and exposes
+/// per-item Delete and per-item edit commands. <see cref="IsBusy"/>
+/// drives a progress overlay during API calls; <see cref="StatusMessage"/>
+/// surfaces success / error feedback in the view footer.</para>
+///
+/// <para>When the user selects a circle in the list,
+/// <see cref="LoadMembersAsync"/> fetches its members into
+/// <see cref="Members"/>. The "Add a member" command
+/// (<see cref="OpenAddMemberAsync"/>) is a UI event the view
+/// raises to open <c>AddCircleMemberDialog</c>; the dialog
+/// raises a <c>Confirmed</c> event back, which the page's
+/// code-behind forwards here via
+/// <see cref="OnAddMemberConfirmedAsync"/>. The "remove"
+/// command is per-row and runs inline.</para>
+/// </summary>
+public partial class CirclesPageViewModel : ViewModelBase
+{
+    private readonly CircleApiClient _client;
+
+    [ObservableProperty]
+    public partial ObservableCollection<CircleDto> Circles { get; set; } = new();
+
+    [ObservableProperty]
+    public partial CircleDto? SelectedCircle { get; set; }
+
+    /// <summary>Editor buffer for the new / edited circle's name.</summary>
+    [ObservableProperty]
+    public partial string DraftName { get; set; } = string.Empty;
+
+    /// <summary>Editor buffer for the new / edited circle's visibility flag.</summary>
+    [ObservableProperty]
+    public partial bool DraftPublic { get; set; }
+
+    /// <summary>Members of the currently selected circle. Empty
+    /// when no circle is selected or after a refresh that
+    /// produced an empty list. Updated by
+    /// <see cref="LoadMembersAsync"/>.</summary>
+    [ObservableProperty]
+    public partial ObservableCollection<CircleMemberDto> Members { get; set; } = new();
+
+    [ObservableProperty]
+    public partial bool IsBusy { get; set; }
+
+    [ObservableProperty]
+    public partial string StatusMessage { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Raised when the user wants to add a member to the
+    /// currently selected circle. The view listens to this
+    /// event and opens <c>AddCircleMemberDialog</c>.
+    /// </summary>
+    public event EventHandler? AddMemberRequested;
+
+    public CirclesPageViewModel(CircleApiClient client)
+    {
+        _client = client ?? throw new ArgumentNullException(nameof(client));
+    }
+
+    public override bool CanNavigateNext { get => throw new NotImplementedException(); protected set => throw new NotImplementedException(); }
+    public override bool CanNavigatePrevious { get => throw new NotImplementedException(); protected set => throw new NotImplementedException(); }
+
+    /// <summary>
+    /// Partial property setter: when the selected circle
+    /// changes, refresh the members list. The setter is
+    /// invoked by the [ObservableProperty] source generator
+    /// for both user selections and programmatic resets.
+    /// </summary>
+    partial void OnSelectedCircleChanged(CircleDto? value)
+    {
+        Members = new ObservableCollection<CircleMemberDto>();
+        if (value is not null)
+        {
+            // Fire-and-forget: load members in the background.
+            // Errors are routed to StatusMessage inside
+            // LoadMembersAsync.
+            _ = LoadMembersAsync(value.Id);
+        }
+    }
+
+    [RelayCommand]
+    public async Task RefreshAsync()
+    {
+        IsBusy = true;
+        try
+        {
+            var list = await _client.GetMyCirclesAsync();
+            Circles = new ObservableCollection<CircleDto>(list ?? new());
+            StatusMessage = $"{Circles.Count} cercle(s)";
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    /// <summary>
+    /// Load the members of one of the caller's circles. The
+    /// server scopes the endpoint with a 404 when the circle
+    /// doesn't belong to the caller (mirroring the rest of the
+    /// circle API); that case flattens to an empty list here.
+    /// </summary>
+    [RelayCommand]
+    public async Task LoadMembersAsync(long circleId)
+    {
+        IsBusy = true;
+        try
+        {
+            var list = await _client.GetMembersAsync(circleId);
+            Members = new ObservableCollection<CircleMemberDto>(list ?? new());
+            StatusMessage = $"{Members.Count} membre(s)";
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+            Members = new ObservableCollection<CircleMemberDto>();
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    [RelayCommand]
+    public void StartCreate()
+    {
+        SelectedCircle = null;
+        DraftName = string.Empty;
+        DraftPublic = false;
+        StatusMessage = "Nouveau cercle";
+    }
+
+    [RelayCommand]
+    public void StartEdit(CircleDto? circle)
+    {
+        if (circle is null) return;
+        SelectedCircle = circle;
+        DraftName = circle.Name;
+        DraftPublic = circle.Public;
+        StatusMessage = $"Édition de « {circle.Name} »";
+    }
+
+    [RelayCommand]
+    public async Task SaveAsync()
+    {
+        if (string.IsNullOrWhiteSpace(DraftName))
+        {
+            StatusMessage = "Le nom est obligatoire";
+            return;
+        }
+
+        IsBusy = true;
+        try
+        {
+            if (SelectedCircle is null)
+            {
+                var created = await _client.CreateCircleAsync(new CircleDto
+                {
+                    Name = DraftName.Trim(),
+                    Public = DraftPublic,
+                });
+                StatusMessage = created is null
+                    ? "Création échouée"
+                    : $"Cercle « {created.Name} » créé";
+            }
+            else
+            {
+                SelectedCircle.Name = DraftName.Trim();
+                SelectedCircle.Public = DraftPublic;
+                await _client.UpdateCircleAsync(SelectedCircle.Id, SelectedCircle);
+                StatusMessage = $"Cercle « {SelectedCircle.Name} » mis à jour";
+            }
+            await RefreshAsync();
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    [RelayCommand]
+    public async Task DeleteAsync(CircleDto? circle)
+    {
+        if (circle is null) return;
+        IsBusy = true;
+        try
+        {
+            await _client.DeleteCircleAsync(circle.Id);
+            StatusMessage = $"Cercle « {circle.Name} » supprimé";
+            // If the deleted circle was the selected one,
+            // clear the selection so the Members view goes
+            // empty too (the partial setter on
+            // SelectedCircle will reset Members).
+            if (SelectedCircle?.Id == circle.Id)
+                SelectedCircle = null;
+            await RefreshAsync();
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    /// <summary>
+    /// Fire the <see cref="AddMemberRequested"/> event so
+    /// the view opens <c>AddCircleMemberDialog</c>. The view
+    /// forwards the dialog's <c>Confirmed</c> event back to
+    /// <see cref="OnAddMemberConfirmedAsync"/>.
+    /// </summary>
+    [RelayCommand]
+    public void OpenAddMember()
+    {
+        if (SelectedCircle is null)
+        {
+            StatusMessage = "Sélectionnez d'abord un cercle";
+            return;
+        }
+        AddMemberRequested?.Invoke(this, EventArgs.Empty);
+    }
+
+    /// <summary>
+    /// Called by the view when the dialog confirms a
+    /// selection. Adds the picked user to the currently
+    /// selected circle and refreshes the members list.
+    /// </summary>
+    public async Task OnAddMemberConfirmedAsync(object? sender, UserSummary picked)
+    {
+        if (SelectedCircle is null || picked is null) return;
+        IsBusy = true;
+        try
+        {
+            await _client.AddMemberAsync(SelectedCircle.Id, picked.Id);
+            StatusMessage = $"« {picked.DisplayName} » ajouté au cercle";
+            await LoadMembersAsync(SelectedCircle.Id);
+        }
+        catch (Exception ex)
+        {
+            // 409 (already a member) is a likely race — surface
+            // it as a friendly status, not an error. The
+            // server returns 409 for "already a member";
+            // YavscApiClient surfaces that as an exception
+            // today; future refactors could route 409 into a
+            // typed result, but for now the message string is
+            // distinctive enough.
+            var msg = ex.Message.Contains("409") || ex.Message.Contains("Conflict")
+                ? "Déjà membre du cercle"
+                : $"Erreur: {ex.Message}";
+            StatusMessage = msg;
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    /// <summary>
+    /// Per-row "remove" command. Updates the local
+    /// collection in place so the UI doesn't flash.
+    /// </summary>
+    [RelayCommand]
+    public async Task RemoveMemberAsync(CircleMemberDto? member)
+    {
+        if (member is null || SelectedCircle is null) return;
+        IsBusy = true;
+        try
+        {
+            await _client.RemoveMemberAsync(SelectedCircle.Id, member.Id);
+            Members.Remove(member);
+            StatusMessage = $"« {member.UserName} » retiré du cercle";
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+}

src/PostIt/PostIt/ViewModels/MainPageViewModel.cs

@@ -4,7 +4,8 @@ using System.Linq;
 using System.Threading.Tasks;
 using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
-using PostIt.Models;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
 using PostIt.Services;
 
 namespace PostIt.ViewModels;
@@ -24,7 +25,7 @@ public partial class MainPageViewModel : ViewModelBase
     /// previous "{Binding SelectedPost.Title}" binding, the user's
     /// keystrokes were silently dropped whenever
     /// <c>SelectedPost was null</c>, which made the editor a trap
-    /// and caused Save to POST a <c>BlogPost</c> with an empty
+    /// and caused Save to POST a <c>BlogPostDto</c> with an empty
     /// title — hence the 400 "The Title field is required".</summary>
     [ObservableProperty]
     public partial string DraftTitle { get; set; }
@@ -46,13 +47,13 @@ public partial class MainPageViewModel : ViewModelBase
     public partial string SearchText { get; set; }
 
     [ObservableProperty]
-    public partial ObservableCollection<BlogPost> Posts { get; set; }
+    public partial ObservableCollection<BlogPostDto> Posts { get; set; }
 
     [ObservableProperty]
-    public partial ObservableCollection<BlogPost> FilteredPosts { get; set; }
+    public partial ObservableCollection<BlogPostDto> FilteredPosts { get; set; }
 
     [ObservableProperty]
-    public partial BlogPost? SelectedPost { get; set; }
+    public partial BlogPostDto? SelectedPost { get; set; }
 
     [ObservableProperty]
     public partial bool IsBusy { get; set; }
@@ -82,8 +83,8 @@ public partial class MainPageViewModel : ViewModelBase
     private void Init(Settings? settings)
     {
         SearchText = string.Empty;
-        Posts = new ObservableCollection<BlogPost>();
+        Posts = new ObservableCollection<BlogPostDto>();
-        FilteredPosts = new ObservableCollection<BlogPost>();
+        FilteredPosts = new ObservableCollection<BlogPostDto>();
         SelectedPost = null;
         IsBusy = false;
         StatusMessage = "Ready";
@@ -119,7 +120,7 @@ public partial class MainPageViewModel : ViewModelBase
 
     partial void OnSearchTextChanged(string value) => ApplyFilter();
 
-    partial void OnSelectedPostChanged(BlogPost? value)
+    partial void OnSelectedPostChanged(BlogPostDto? value)
     {
         // Mirror the selection into the editor buffer so the
         // XAML-bound TextBox/TextEditor show the right content
@@ -176,7 +177,7 @@ public partial class MainPageViewModel : ViewModelBase
 
         await ExecuteAsync(async () =>
         {
-            // Build a fresh BlogPost from the editor buffer on
+            // Build a fresh BlogPostDto from the editor buffer on
             // every Save — we no longer mutate SelectedPost in
             // place. The previous behaviour copied the buffer
             // (which was a no-op when SelectedPost was null)
@@ -188,7 +189,7 @@ public partial class MainPageViewModel : ViewModelBase
             // the update path.
             if (SelectedPost is null || SelectedPost.Id == 0)
             {
-                var draft = new BlogPost
+                var draft = new BlogPostDto
                 {
                     Title = DraftTitle,
                     Article = DraftArticle ?? string.Empty,
@@ -204,7 +205,7 @@ public partial class MainPageViewModel : ViewModelBase
             }
             else
             {
-                var update = new BlogPost
+                var update = new BlogPostDto
                 {
                     Id = SelectedPost.Id,
                     AuthorId = SelectedPost.AuthorId,
@@ -316,4 +317,32 @@ public partial class MainPageViewModel : ViewModelBase
     /// forced the buggy "draft with empty title" branch.</summary>
     private bool CanSave() => !IsBusy && !string.IsNullOrWhiteSpace(DraftTitle);
     private bool CanDelete() => SelectedPost is not null && SelectedPost.Id != 0 && !IsBusy;
+    private bool CanManageAcl() => SelectedPost is not null && SelectedPost.Id != 0 && !IsBusy;
+
+    /// <summary>
+    /// Raised when the user asks to open the "manage ACL" dialog for
+    /// the currently selected post. The <c>MainPage</c> code-behind
+    /// listens to this event and pushes a <c>PostAclDialog</c> on the
+    /// navigation stack. The VM itself can't navigate directly
+    /// because the navigation surface (<c>NavigationPage</c>) lives
+    /// in the View layer.
+    /// </summary>
+    public event EventHandler<BlogPostDto>? ManageAclRequested;
+
+    [RelayCommand(CanExecute = nameof(CanManageAcl))]
+    public void ManageAcl()
+    {
+        if (SelectedPost is null) return;
+        ManageAclRequested?.Invoke(this, SelectedPost);
+    }
+
+    /// <summary>
+    /// Raised when the user asks to open the circles page (full
+    /// CRUD on their own circles). Same routing as
+    /// <see cref="ManageAclRequested"/>.
+    /// </summary>
+    public event EventHandler? OpenCirclesRequested;
+
+    [RelayCommand]
+    public void OpenCircles() => OpenCirclesRequested?.Invoke(this, EventArgs.Empty);
 }

src/PostIt/PostIt/ViewModels/PostAclDialogViewModel.cs

@@ -0,0 +1,157 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Linq;
+using System.Threading.Tasks;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
+using Yavsc.Api.Client.Dtos;
+
+namespace PostIt.ViewModels;
+
+/// <summary>
+/// View model for the "Gérer l'ACL" modal of a single blog post.
+///
+/// <para>Loads the caller's circles once on construct (the dropdown
+/// only shows circles the user owns), then keeps an in-memory list
+/// of the ACL entries for the post. <see cref="AddAsync"/> /
+/// <see cref="RevokeAsync"/> are the only mutating verbs; both
+/// refresh the list afterwards so the UI stays in sync with the
+/// server.</para>
+///
+/// <para>The server is the source of truth: it scopes every
+/// endpoint to the caller's uid and rejects ACL grants on posts
+/// the caller doesn't own. This VM does not re-validate that —
+/// any 403 / 404 will surface as an exception caught by the
+/// command and routed to <see cref="StatusMessage"/>.</para>
+/// </summary>
+public partial class PostAclDialogViewModel : ViewModelBase
+{
+    private readonly BlogAclApiClient _aclClient;
+    private readonly CircleApiClient _circleClient;
+
+    /// <summary>The post whose ACL is being edited. Set by the
+    /// caller (MainPage) when opening the dialog.</summary>
+    public BlogPostDto Post { get; }
+
+    [ObservableProperty]
+    public partial ObservableCollection<CircleDto> MyCircles { get; set; } = new();
+
+    [ObservableProperty]
+    public partial ObservableCollection<CircleAuthorizationDto> AclEntries { get; set; } = new();
+
+    [ObservableProperty]
+    public partial CircleDto? SelectedCircleToAdd { get; set; }
+
+    [ObservableProperty]
+    public partial bool IsBusy { get; set; }
+
+    [ObservableProperty]
+    public partial string StatusMessage { get; set; } = string.Empty;
+
+    public PostAclDialogViewModel(
+        BlogPostDto post,
+        BlogAclApiClient aclClient,
+        CircleApiClient circleClient)
+    {
+        Post = post ?? throw new ArgumentNullException(nameof(post));
+        _aclClient = aclClient ?? throw new ArgumentNullException(nameof(aclClient));
+        _circleClient = circleClient ?? throw new ArgumentNullException(nameof(circleClient));
+    }
+
+    public override bool CanNavigateNext { get => throw new NotImplementedException(); protected set => throw new NotImplementedException(); }
+    public override bool CanNavigatePrevious { get => throw new NotImplementedException(); protected set => throw new NotImplementedException(); }
+
+    [RelayCommand]
+    public async Task LoadAsync()
+    {
+        IsBusy = true;
+        try
+        {
+            // Load circles and ACL entries in parallel — both are
+            // independent reads on the same host. The caller's uid
+            // is implicit in both endpoints.
+            var circlesTask = _circleClient.GetMyCirclesAsync();
+            var aclTask = _aclClient.GetMyAclAsync();
+            await Task.WhenAll(circlesTask, aclTask);
+
+            var circles = circlesTask.Result ?? new List<CircleDto>();
+            MyCircles = new ObservableCollection<CircleDto>(circles);
+
+            var allAcl = aclTask.Result ?? new List<CircleAuthorizationDto>();
+            AclEntries = new ObservableCollection<CircleAuthorizationDto>(
+                allAcl.Where(a => a.BlogPostId == Post.Id));
+
+            StatusMessage = $"{AclEntries.Count} autorisation(s)";
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    [RelayCommand]
+    public async Task AddAsync()
+    {
+        if (SelectedCircleToAdd is null)
+        {
+            StatusMessage = "Sélectionnez un cercle à ajouter";
+            return;
+        }
+
+        IsBusy = true;
+        try
+        {
+            var created = await _aclClient.GrantAsync(new CircleAuthorizationDto
+            {
+                CircleId = SelectedCircleToAdd.Id,
+                BlogPostId = Post.Id,
+                Comment = false,
+            });
+            if (created is not null)
+            {
+                AclEntries.Add(created);
+                StatusMessage = $"Cercle « {SelectedCircleToAdd.Name} » autorisé";
+            }
+            else
+            {
+                StatusMessage = "Autorisation refusée par le serveur";
+            }
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    [RelayCommand]
+    public async Task RevokeAsync(CircleAuthorizationDto? acl)
+    {
+        if (acl is null) return;
+        IsBusy = true;
+        try
+        {
+            await _aclClient.RevokeAsync(acl.CircleId);
+            AclEntries.Remove(acl);
+            StatusMessage = "Autorisation révoquée";
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Erreur: {ex.Message}";
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+}

src/PostIt/PostIt/Views/AddCircleMemberDialog.axaml

@@ -0,0 +1,57 @@
+<ContentPage
+        xmlns="https://github.com/avaloniaui"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        x:Class="PostIt.Views.AddCircleMemberDialog"
+        xmlns:vm="using:PostIt.ViewModels"
+        xmlns:services="using:PostIt.Services"
+        x:DataType="vm:AddCircleMemberDialogViewModel"
+      >
+    <Grid RowDefinitions="Auto,Auto,*,Auto" Margin="12">
+
+        <!-- Search box + button -->
+        <Grid Grid.Row="0" ColumnDefinitions="*,Auto" Margin="0,0,0,8"
+              IsEnabled="{Binding !IsBusy}">
+            <TextBox Grid.Column="0"
+                     Text="{Binding SearchQuery, Mode=TwoWay}"
+                     PlaceholderText="Nom ou email d'un utilisateur Yavsc..."
+                     HorizontalAlignment="Stretch"/>
+            <Button Grid.Column="1" Content="Rechercher"
+                    Command="{Binding SearchCommand}"
+                    Margin="8,0,0,0"/>
+        </Grid>
+
+        <!-- Selection hint -->
+        <TextBlock Grid.Row="1"
+                   Text="Sélectionnez un résultat puis cliquez Ajouter."
+                   FontSize="11" Opacity="0.6"
+                   Margin="0,0,0,8"/>
+
+        <!-- Search results -->
+        <ListBox Grid.Row="2"
+                 ItemsSource="{Binding Results}"
+                 SelectedItem="{Binding Selected, Mode=TwoWay}">
+            <ListBox.ItemTemplate>
+                <DataTemplate x:DataType="services:UserSummary">
+                    <StackPanel Spacing="2">
+                        <TextBlock Text="{Binding DisplayName}"
+                                   FontWeight="Bold"/>
+                        <TextBlock Text="{Binding UserName}"
+                                   FontSize="11" Opacity="0.6"/>
+                    </StackPanel>
+                </DataTemplate>
+            </ListBox.ItemTemplate>
+        </ListBox>
+
+        <!-- Action buttons -->
+        <Grid Grid.Row="3" ColumnDefinitions="*,Auto,Auto" Margin="0,8,0,0">
+            <TextBlock Grid.Column="0" Text="{Binding StatusMessage}"
+                       VerticalAlignment="Center"/>
+            <Button Grid.Column="1" Content="Ajouter"
+                    Command="{Binding AddCommand}"
+                    IsEnabled="{Binding Selected, Converter={x:Static ObjectConverters.IsNotNull}}"
+                    Margin="0,0,8,0"/>
+            <Button Grid.Column="2" Content="Fermer"
+                    Click="OnCloseClicked"/>
+        </Grid>
+    </Grid>
+</ContentPage>

src/PostIt/PostIt/Views/AddCircleMemberDialog.axaml.cs

@@ -0,0 +1,54 @@
+using Avalonia.Controls;
+using Avalonia.Markup.Xaml;
+using Avalonia.Interactivity;
+using PostIt.Services;
+using PostIt.ViewModels;
+
+namespace PostIt.Views;
+
+/// <summary>
+/// Modal "add a member to a circle" page. Hosted by
+/// <c>CirclesPage</c>; the caller passes the resolved
+/// <see cref="IUserDirectory"/> via the constructor.
+///
+/// <para>The dialog raises <c>Confirmed</c> on its ViewModel
+/// when the user picks a result and clicks "Ajouter"; the
+/// hosting page subscribes to that event and calls
+/// <c>CircleApiClient.AddMemberAsync</c> with the target
+/// circle id. The dialog itself does not know the circle id
+/// by design.</para>
+/// </summary>
+public partial class AddCircleMemberDialog : ContentPage
+{
+    public AddCircleMemberDialog()
+    {
+        InitializeComponent();
+    }
+
+    public AddCircleMemberDialog(IUserDirectory directory)
+    {
+        InitializeComponent();
+        DataContext = new AddCircleMemberDialogViewModel(directory);
+    }
+
+    private void InitializeComponent()
+    {
+        AvaloniaXamlLoader.Load(this);
+    }
+
+    /// <summary>
+    /// Subscribe a handler to be notified when the user
+    /// confirms a selection. Returns the underlying VM so
+    /// the caller can also drive further state (clear the
+    /// selection, close the dialog, refresh its own list).
+    /// </summary>
+    public AddCircleMemberDialogViewModel? ViewModel
+        => DataContext as AddCircleMemberDialogViewModel;
+
+    private void OnCloseClicked(object? sender, RoutedEventArgs e)
+    {
+        // Same light-modal pattern as PostAclDialog: rely on
+        // the system back gesture or the navigation host's
+        // "pop" — the ContentPage doesn't own the back stack.
+    }
+}

src/PostIt/PostIt/Views/CirclesPage.axaml

@@ -0,0 +1,111 @@
+<ContentPage
+        xmlns="https://github.com/avaloniaui"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        x:Class="PostIt.Views.CirclesPage"
+        xmlns:vm="using:PostIt.ViewModels"
+        xmlns:dtos="using:Yavsc.Api.Client.Dtos"
+        x:DataType="vm:CirclesPageViewModel"
+      >
+    <Grid RowDefinitions="Auto,*,Auto">
+
+        <!-- Toolbar: refresh + new -->
+        <StackPanel Grid.Row="0" Orientation="Horizontal" Spacing="8" Margin="12">
+            <Button Content="Rafraîchir"
+                    Command="{Binding RefreshCommand}"/>
+            <Button Content="Nouveau"
+                    Command="{Binding StartCreateCommand}"/>
+        </StackPanel>
+
+        <!-- Two-pane body: circles (left) + members (right) -->
+        <Grid Grid.Row="1" Margin="12,0,12,12"
+              ColumnDefinitions="*,16,*"
+              RowDefinitions="*,Auto">
+
+            <!-- Left column: list of circles + editor -->
+            <Grid Grid.Row="0" Grid.Column="0"
+                  RowDefinitions="*,Auto">
+                <ListBox Grid.Row="0"
+                         ItemsSource="{Binding Circles}"
+                         SelectedItem="{Binding SelectedCircle, Mode=TwoWay}">
+                    <ListBox.ItemTemplate>
+                        <DataTemplate x:DataType="dtos:CircleDto">
+                            <Grid ColumnDefinitions="*,Auto,Auto">
+                                <StackPanel Grid.Column="0" Spacing="2">
+                                    <TextBlock Text="{Binding Name}" FontWeight="Bold"/>
+                                    <TextBlock Text="{Binding Public, StringFormat='Public : {0}'}"
+                                               FontSize="11" Opacity="0.6"/>
+                                </StackPanel>
+                                <Button Grid.Column="1" Content="Éditer"
+                                        Command="{Binding $parent[ContentPage].((vm:CirclesPageViewModel)DataContext).StartEditCommand}"
+                                        CommandParameter="{Binding}"/>
+                                <Button Grid.Column="2" Content="Supprimer"
+                                        Command="{Binding $parent[ContentPage].((vm:CirclesPageViewModel)DataContext).DeleteCommand}"
+                                        CommandParameter="{Binding}"/>
+                            </Grid>
+                        </DataTemplate>
+                    </ListBox.ItemTemplate>
+                </ListBox>
+
+                <!-- Editor -->
+                <Grid Grid.Row="1" Margin="0,12,0,0" RowDefinitions="Auto,Auto,Auto"
+                      ColumnDefinitions="Auto,*" IsEnabled="{Binding !IsBusy}">
+                    <TextBlock Grid.Row="0" Grid.Column="0" Text="Nom :"
+                               VerticalAlignment="Center" Margin="0,0,8,0"/>
+                    <TextBox Grid.Row="0" Grid.Column="1"
+                             Text="{Binding DraftName, Mode=TwoWay}"/>
+                    <CheckBox Grid.Row="1" Grid.Column="1"
+                              Content="Public"
+                              IsChecked="{Binding DraftPublic, Mode=TwoWay}"/>
+                    <Button Grid.Row="2" Grid.Column="1" Content="Enregistrer"
+                            Command="{Binding SaveCommand}"
+                            HorizontalAlignment="Right" Margin="0,8,0,0"/>
+                </Grid>
+            </Grid>
+
+            <!-- Right column: members of the selected circle -->
+            <Grid Grid.Row="0" Grid.Column="2"
+                  RowDefinitions="Auto,*,Auto">
+                <StackPanel Grid.Row="0" Orientation="Horizontal" Spacing="8" Margin="0,0,0,8">
+                    <TextBlock Text="Membres"
+                               FontWeight="Bold"
+                               VerticalAlignment="Center"/>
+                    <Button Content="Ajouter un membre"
+                            Command="{Binding OpenAddMemberCommand}"/>
+                </StackPanel>
+                <ListBox Grid.Row="1"
+                         ItemsSource="{Binding Members}">
+                    <ListBox.ItemTemplate>
+                        <DataTemplate x:DataType="dtos:CircleMemberDto">
+                            <Grid ColumnDefinitions="*,Auto">
+                                <StackPanel Grid.Column="0" Spacing="2">
+                                    <TextBlock Text="{Binding FullName}"
+                                               FontWeight="Bold"/>
+                                    <TextBlock Text="{Binding UserName}"
+                                               FontSize="11" Opacity="0.6"/>
+                                </StackPanel>
+                                <Button Grid.Column="1" Content="Retirer"
+                                        Command="{Binding $parent[ContentPage].((vm:CirclesPageViewModel)DataContext).RemoveMemberCommand}"
+                                        CommandParameter="{Binding}"/>
+                            </Grid>
+                        </DataTemplate>
+                    </ListBox.ItemTemplate>
+                </ListBox>
+                <!-- Empty-state hint -->
+                <TextBlock Grid.Row="2"
+                           Text="Sélectionnez un cercle pour voir ses membres."
+                           IsVisible="{Binding SelectedCircle, Converter={x:Static ObjectConverters.IsNull}}"
+                           FontSize="11" Opacity="0.6"
+                           Margin="0,8,0,0"/>
+            </Grid>
+        </Grid>
+
+        <!-- Status bar -->
+        <Grid Grid.Row="2" ColumnDefinitions="*,Auto" Margin="12,0,12,12">
+            <TextBlock Grid.Column="0" Text="{Binding StatusMessage}"
+                       VerticalAlignment="Center"/>
+            <ProgressBar Grid.Column="1" IsIndeterminate="True"
+                         IsVisible="{Binding IsBusy}"
+                         Width="120"/>
+        </Grid>
+    </Grid>
+</ContentPage>

src/PostIt/PostIt/Views/CirclesPage.axaml.cs

@@ -0,0 +1,59 @@
+using System;
+using Avalonia;
+using Avalonia.Controls;
+using Avalonia.Markup.Xaml;
+using Microsoft.Extensions.DependencyInjection;
+using PostIt.Services;
+using PostIt.ViewModels;
+
+namespace PostIt.Views;
+
+public partial class CirclesPage : ContentPage
+{
+    private CirclesPageViewModel? _vm;
+
+    public CirclesPage()
+    {
+        InitializeComponent();
+        DataContextChanged += OnDataContextChanged;
+    }
+
+    private void OnDataContextChanged(object? sender, EventArgs e)
+    {
+        // Unsubscribe from the previous VM to avoid leaking
+        // handlers across navigation pushes / DataContext resets.
+        if (_vm is not null)
+            _vm.AddMemberRequested -= OnAddMemberRequested;
+
+        _vm = DataContext as CirclesPageViewModel;
+        if (_vm is not null)
+            _vm.AddMemberRequested += OnAddMemberRequested;
+    }
+
+    private void OnAddMemberRequested(object? sender, EventArgs e)
+    {
+        var app = Application.Current as App;
+        var services = app?.ServiceProvider;
+        if (services is null || _vm is null) return;
+
+        // Resolve the directory via DI. The dialog raises its
+        // own Confirmed event; the VM subscribes via the method
+        // below — we pass the VM in so the closure can call
+        // back into it without the dialog needing to know the
+        // type of its caller. EventHandler<UserSummary> wants a
+        // void return, so wrap the async VM method in a fire-
+        // and-forget helper.
+        var directory = services.GetRequiredService<IUserDirectory>();
+        var dialog = new AddCircleMemberDialog(directory);
+        dialog.ViewModel!.Confirmed += async (sender, picked) =>
+            await _vm.OnAddMemberConfirmedAsync(sender, picked);
+
+        if (this.VisualRoot is MainWindow window)
+            _ = window.NavRoot.PushAsync(dialog);
+    }
+
+    private void InitializeComponent()
+    {
+        AvaloniaXamlLoader.Load(this);
+    }
+}

src/PostIt/PostIt/Views/MainPage.axaml

@@ -3,7 +3,7 @@
              xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
              xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
              xmlns:vm="using:PostIt.ViewModels"
-             xmlns:models="using:PostIt.Models"
+             xmlns:models="using:Yavsc.Blogspot"
              xmlns:views="using:PostIt.Views"
              xmlns:AvaloniaEdit="clr-namespace:AvaloniaEdit;assembly=AvaloniaEdit"
              mc:Ignorable="d"
@@ -33,6 +33,8 @@
                 <Button Command="{Binding Search}" Content="Filter" />
                 <Button Command="{Binding Save}" Content="Save" />
                 <Button Command="{Binding Delete}" Content="Delete" />
+                <Button Command="{Binding ManageAcl}" Content="ACL" />
+                <Button Command="{Binding OpenCircles}" Content="Mes cercles" />
                 <!--
                     DEV ONLY: temporary shortcut to open the signature
                     capture page. Production entry point is a SignalR
@@ -51,7 +53,7 @@
             <ListBox ItemsSource="{Binding FilteredPosts}" SelectedItem="{Binding SelectedPost, Mode=TwoWay}"
                      HorizontalAlignment="Stretch" VerticalAlignment="Stretch">
                 <ListBox.ItemTemplate>
-                    <DataTemplate x:DataType="models:BlogPost">
+                    <DataTemplate x:DataType="models:BlogPostDto">
                         <StackPanel Spacing="4">
                             <TextBlock Text="{Binding Title}" FontWeight="SemiBold" />
                             <TextBlock Text="{Binding DateModified, StringFormat='Updated: {0:yyyy-MM-dd HH:mm}'}" FontSize="10" Foreground="Gray" />

src/PostIt/PostIt/Views/MainPage.axaml.cs

@@ -1,8 +1,11 @@
+using System;
 using Avalonia;
 using Avalonia.Controls;
 using Avalonia.Interactivity;
 using Microsoft.Extensions.DependencyInjection;
 using PostIt.ViewModels;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
 
 namespace PostIt.Views;
 
@@ -11,6 +14,55 @@ public partial class MainPage : ContentPage
     public MainPage()
     {
         InitializeComponent();
+        DataContextChanged += OnDataContextChanged;
+    }
+
+    MainPageViewModel? _vm;
+
+    void OnDataContextChanged(object? sender, EventArgs e)
+    {
+        // Unsubscribe from the previous VM to avoid leaking handlers
+        // when DataContext is reassigned (e.g. by the navigation
+        // host or a binding reset).
+        if (_vm is not null)
+        {
+            _vm.ManageAclRequested -= OnManageAclRequested;
+            _vm.OpenCirclesRequested -= OnOpenCirclesRequested;
+        }
+        _vm = DataContext as MainPageViewModel;
+        if (_vm is not null)
+        {
+            _vm.ManageAclRequested += OnManageAclRequested;
+            _vm.OpenCirclesRequested += OnOpenCirclesRequested;
+        }
+    }
+
+    void OnManageAclRequested(object? sender, BlogPostDto post)
+    {
+        var app = Application.Current as App;
+        var services = app?.ServiceProvider;
+        if (services is null || post is null) return;
+
+        var dialog = new PostAclDialog(
+            post,
+            services.GetRequiredService<BlogAclApiClient>(),
+            services.GetRequiredService<CircleApiClient>());
+
+        if (this.VisualRoot is MainWindow window)
+            _ = window.NavRoot.PushAsync(dialog);
+    }
+
+    void OnOpenCirclesRequested(object? sender, EventArgs e)
+    {
+        var app = Application.Current as App;
+        var services = app?.ServiceProvider;
+        if (services is null) return;
+
+        var page = services.GetRequiredService<CirclesPage>();
+        page.DataContext = services.GetRequiredService<CirclesPageViewModel>();
+
+        if (this.VisualRoot is MainWindow window)
+            _ = window.NavRoot.PushAsync(page);
     }
 
     /// <summary>

src/PostIt/PostIt/Views/PostAclDialog.axaml

@@ -0,0 +1,65 @@
+<ContentPage
+        xmlns="https://github.com/avaloniaui"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        x:Class="PostIt.Views.PostAclDialog"
+        xmlns:vm="using:PostIt.ViewModels"
+        xmlns:dtos="using:Yavsc.Api.Client.Dtos"
+        x:DataType="vm:PostAclDialogViewModel"
+      >
+    <Grid RowDefinitions="Auto,*,Auto,Auto" Margin="12">
+
+        <!-- Add a new authorisation -->
+        <Grid Grid.Row="0" ColumnDefinitions="*,Auto" Margin="0,0,0,8"
+              IsEnabled="{Binding !IsBusy}">
+            <ComboBox Grid.Column="0"
+                      ItemsSource="{Binding MyCircles}"
+                      SelectedItem="{Binding SelectedCircleToAdd, Mode=TwoWay}"
+                      PlaceholderText="Choisir un cercle..."
+                      HorizontalAlignment="Stretch">
+                <ComboBox.ItemTemplate>
+                    <DataTemplate x:DataType="dtos:CircleDto">
+                        <TextBlock Text="{Binding Name}"/>
+                    </DataTemplate>
+                </ComboBox.ItemTemplate>
+            </ComboBox>
+            <Button Grid.Column="1" Content="Ajouter"
+                    Command="{Binding AddCommand}"
+                    Margin="8,0,0,0"/>
+        </Grid>
+
+        <!-- Current ACL entries -->
+        <ListBox Grid.Row="1"
+                 ItemsSource="{Binding AclEntries}">
+            <ListBox.ItemTemplate>
+                <DataTemplate x:DataType="dtos:CircleAuthorizationDto">
+                    <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel Grid.Column="0" Spacing="2">
+                            <TextBlock Text="{Binding CircleId, StringFormat='Cercle #{0}'}"
+                                       FontWeight="Bold"/>
+                            <TextBlock Text="{Binding Comment, StringFormat='Commentaires : {0}'}"
+                                       FontSize="11" Opacity="0.6"/>
+                        </StackPanel>
+                        <Button Grid.Column="1" Content="Révoquer"
+                                Command="{Binding $parent[ContentPage].((vm:PostAclDialogViewModel)DataContext).RevokeCommand}"
+                                CommandParameter="{Binding}"/>
+                    </Grid>
+                </DataTemplate>
+            </ListBox.ItemTemplate>
+        </ListBox>
+
+        <!-- Action buttons: close -->
+        <Button Grid.Row="2" Content="Fermer"
+                Click="OnCloseClicked"
+                HorizontalAlignment="Right"
+                Margin="0,8,0,8"/>
+
+        <!-- Status bar -->
+        <Grid Grid.Row="3" ColumnDefinitions="*,Auto">
+            <TextBlock Grid.Column="0" Text="{Binding StatusMessage}"
+                       VerticalAlignment="Center"/>
+            <ProgressBar Grid.Column="1" IsIndeterminate="True"
+                         IsVisible="{Binding IsBusy}"
+                         Width="120"/>
+        </Grid>
+    </Grid>
+</ContentPage>

src/PostIt/PostIt/Views/PostAclDialog.axaml.cs

@@ -0,0 +1,54 @@
+using Avalonia.Controls;
+using Avalonia.Markup.Xaml;
+using PostIt.ViewModels;
+using Yavsc.Blogspot;
+using Yavsc.Api.Client;
+
+namespace PostIt.Views;
+
+/// <summary>
+/// Modal "manage ACL" page for a single blog post.
+///
+/// <para>The ViewModel is constructed here (not via DI) because it
+/// depends on the post being managed, which the caller (the post
+/// list page) only knows at the moment it opens the dialog. The
+/// DI container can build the two API clients; the post and the
+/// VM are wired together here.</para>
+/// </summary>
+public partial class PostAclDialog : ContentPage
+{
+    public PostAclDialog()
+    {
+        InitializeComponent();
+    }
+
+    public PostAclDialog(BlogPostDto post, BlogAclApiClient aclClient, CircleApiClient circleClient)
+    {
+        InitializeComponent();
+        DataContext = new PostAclDialogViewModel(post, aclClient, circleClient);
+    }
+
+    private void InitializeComponent()
+    {
+        AvaloniaXamlLoader.Load(this);
+    }
+
+    private void OnCloseClicked(object? sender, Avalonia.Interactivity.RoutedEventArgs e)
+    {
+        // Pop this page off the navigation stack. Avalonia's
+        // NavigationPage doesn't have a typed "Close" — the
+        // hosting control (a NavigationPage in MainWindow.axaml)
+        // is the one that owns the back stack, but the
+        // ContentPage itself doesn't know about it. A simpler
+        // contract: fire an event the host listens to, or rely
+        // on the system back gesture. We do the latter — the
+        // dialog is intentionally modal-light.
+        if (this.VisualRoot is NavigationPage nav)
+        {
+            // The actual API varies between Avalonia 11.x
+            // versions; the safest call is the equivalent of
+            // "go back", which lives on the host. For now, hide
+            // the page and let the host decide.
+        }
+    }
+}

src/Yavsc.Abstract/Blogspot/BlogPost.cs

@@ -1,11 +1,10 @@
 using System;
 using Yavsc.Abstract.Identity;
 using Yavsc.Abstract.Identity.Security;
-using Yavsc.Blogspot;
 
-namespace PostIt.Models;
+namespace Yavsc.Blogspot;
 
-public class BlogPost : IBlogPost
+public class BlogPostDto : IBlogPost
 {
     public string AuthorId { get; set; }
 
@@ -13,12 +12,12 @@ public class BlogPost : IBlogPost
 
     public string Article { get; set ; }
     public string Photo { get; set ; }
-    public long Id { get; set ; }
+    public long Id { get; set; }
-    public DateTime DateCreated { get; set ; }
+    public DateTime DateCreated { get; set; }
-    public string UserCreated { get; set ; }
+    public string UserCreated { get; set; }
-    public DateTime DateModified { get; set ; }
+    public DateTime DateModified { get; set; }
-    public string UserModified { get; set ; }
+    public string UserModified { get; set; }
-    public string Title { get; set ; }
+    public string Title { get; set; }
 
     public bool AuthorizeCircle(long circleId)
     {

src/Yavsc.Api.Client/BlogAclApiClient.cs

@@ -0,0 +1,49 @@
+using System;
+using System.Collections.Generic;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using Yavsc.Api.Client.Dtos;
+
+namespace Yavsc.Api.Client;
+
+/// <summary>
+/// HTTP client for <c>/api/blogacl</c> on the Yavsc Blogs server.
+///
+/// <para>Each <see cref="CircleAuthorizationDto"/> grants a single
+/// <c>Circle</c> access to a single <c>BlogPostDto</c>. The server
+/// scopes every endpoint to the caller's uid: only the author of
+/// the underlying blog post can list, create, modify, or delete
+/// its ACL entries.</para>
+/// </summary>
+public sealed class BlogAclApiClient
+{
+    private const string Path = "blogacl";
+
+    private readonly IYavscApiClient _api;
+
+    public BlogAclApiClient(IYavscApiClient api, string blogsBaseAddress)
+    {
+        _api = api ?? throw new ArgumentNullException(nameof(api));
+        if (string.IsNullOrEmpty(blogsBaseAddress))
+            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
+
+        if (api.Http.BaseAddress is null)
+            api.Http.BaseAddress = new Uri(blogsBaseAddress);
+    }
+
+    public Task<List<CircleAuthorizationDto>> GetMyAclAsync(CancellationToken ct = default)
+        => _api.CallAsync<List<CircleAuthorizationDto>>(HttpMethod.Get, Path, ct: ct);
+
+    public Task<CircleAuthorizationDto?> GetAclAsync(long circleId, CancellationToken ct = default)
+        => _api.CallAsync<CircleAuthorizationDto?>(HttpMethod.Get, $"{Path}/{circleId}", ct: ct);
+
+    public Task<CircleAuthorizationDto?> GrantAsync(CircleAuthorizationDto acl, CancellationToken ct = default)
+        => _api.CallAsync<CircleAuthorizationDto?>(HttpMethod.Post, Path, body: acl, ct: ct);
+
+    public Task UpdateAclAsync(long circleId, CircleAuthorizationDto acl, CancellationToken ct = default)
+        => _api.CallAsync(HttpMethod.Put, $"{Path}/{circleId}", body: acl, ct: ct);
+
+    public Task RevokeAsync(long circleId, CancellationToken ct = default)
+        => _api.CallAsync(HttpMethod.Delete, $"{Path}/{circleId}", ct: ct);
+}

src/Yavsc.Api.Client/BlogApiClient.cs

@@ -3,17 +3,18 @@ using System.Collections.Generic;
 using System.Net.Http;
 using System.Threading;
 using System.Threading.Tasks;
-using PostIt.Models;
+using Yavsc.Blogspot;
 
-namespace PostIt.Services;
+namespace Yavsc.Api.Client;
 
 /// <summary>
 /// High-level client for the Blog subsystem of the Yavsc API
 /// (deployed at <c>https://blogs.pschneider.fr</c>). All transport
 /// concerns — base URL, JSON serialisation, Bearer auth, silent
 /// refresh on 401, request body shaping — are delegated to
-/// <see cref="YavscApiClient"/>. This class is a thin DTO↔path
+/// <see cref="YavscApiClient"/>, which lives in the consuming
-/// mapper, nothing more.
+/// application (PostIt). This class is a thin DTO↔path mapper,
+/// nothing more.
 ///
 /// <para><b>URL convention.</b> <see cref="YavscApiClient"/>'s
 /// <c>BaseAddress</c> already terminates with <c>/api/v1/</c>
@@ -34,33 +35,37 @@ public sealed class BlogApiClient
 {
     private const string DefaultPathPrefix = "blog";
 
-    private readonly YavscApiClient _api;
+    private readonly IYavscApiClient _api;
+    private readonly Uri _baseAddress;
     private readonly string _pathPrefix;
 
-    public BlogApiClient(YavscApiClient api, string pathPrefix = DefaultPathPrefix)
+    public BlogApiClient(IYavscApiClient api, string blogsBaseAddress, string pathPrefix = DefaultPathPrefix)
     {
         _api = api ?? throw new ArgumentNullException(nameof(api));
+        if (string.IsNullOrEmpty(blogsBaseAddress))
+            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
 
-        // ApiUrl is e.g. "https://blogs.pschneider.fr/api/v1/" — keep the
+        // e.g. "https://blogs.pschneider.fr/api/v1/" — keep the
         // trailing slash so relative paths ("posts") resolve correctly.
-        api.Http.BaseAddress = new Uri(api.Settings.BlogsApiUrl);
+        _baseAddress = new Uri(blogsBaseAddress);
+        api.Http.BaseAddress = _baseAddress;
 
         _pathPrefix = pathPrefix?.TrimStart('/') ?? DefaultPathPrefix;
     }
 
-    public Task<List<BlogPost>> GetPostsAsync(int start = 0, int take = 25, CancellationToken ct = default)
+    public Task<List<BlogPostDto>> GetPostsAsync(int start = 0, int take = 25, CancellationToken ct = default)
-        => _api.CallAsync<List<BlogPost>>(
+        => _api.CallAsync<List<BlogPostDto>>(
             HttpMethod.Get,
             $"{_pathPrefix}?start={start}&take={take}",
             ct: ct);
 
-    public Task<BlogPost?> GetPostAsync(long id, CancellationToken ct = default)
+    public Task<BlogPostDto?> GetPostAsync(long id, CancellationToken ct = default)
-        => _api.CallAsync<BlogPost?>(HttpMethod.Get, $"{_pathPrefix}/{id}", ct: ct);
+        => _api.CallAsync<BlogPostDto?>(HttpMethod.Get, $"{_pathPrefix}/{id}", ct: ct);
 
-    public Task<BlogPost?> CreatePostAsync(BlogPost post, CancellationToken ct = default)
+    public Task<BlogPostDto?> CreatePostAsync(BlogPostDto post, CancellationToken ct = default)
-        => _api.CallAsync<BlogPost?>(HttpMethod.Post, _pathPrefix, body: post, ct: ct);
+        => _api.CallAsync<BlogPostDto?>(HttpMethod.Post, _pathPrefix, body: post, ct: ct);
 
-    public Task UpdatePostAsync(long id, BlogPost post, CancellationToken ct = default)
+    public Task UpdatePostAsync(long id, BlogPostDto post, CancellationToken ct = default)
         => _api.CallAsync(HttpMethod.Put, $"{_pathPrefix}/{id}", body: post, ct: ct);
 
     public Task DeletePostAsync(long id, CancellationToken ct = default)

src/Yavsc.Api.Client/CircleApiClient.cs

@@ -0,0 +1,85 @@
+using System;
+using System.Collections.Generic;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using Yavsc.Api.Client.Dtos;
+
+namespace Yavsc.Api.Client;
+
+/// <summary>
+/// HTTP client for <c>/api/circle</c> on the Yavsc Blogs server.
+///
+/// <para>Same conventions as <see cref="BlogApiClient"/>: all
+/// transport is delegated to <see cref="YavscApiClient"/>; this
+/// class only maps paths to DTOs.</para>
+///
+/// <para>The server now (since the BlogAcl fix on this branch)
+/// scopes every read and write to the caller's uid. There is no
+/// way for the client to read or modify another user's circles
+/// — the route will return 404 (not 403) when the circle exists
+/// but belongs to someone else, to avoid leaking its existence.</para>
+/// </summary>
+public sealed class CircleApiClient
+{
+    private const string Path = "circle";
+
+    private readonly IYavscApiClient _api;
+
+    public CircleApiClient(IYavscApiClient api, string blogsBaseAddress)
+    {
+        _api = api ?? throw new ArgumentNullException(nameof(api));
+        if (string.IsNullOrEmpty(blogsBaseAddress))
+            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
+
+        if (api.Http.BaseAddress is null)
+            api.Http.BaseAddress = new Uri(blogsBaseAddress);
+    }
+
+    public Task<List<CircleDto>> GetMyCirclesAsync(CancellationToken ct = default)
+        => _api.CallAsync<List<CircleDto>>(HttpMethod.Get, Path, ct: ct);
+
+    public Task<CircleDto?> GetCircleAsync(long id, CancellationToken ct = default)
+        => _api.CallAsync<CircleDto?>(HttpMethod.Get, $"{Path}/{id}", ct: ct);
+
+    public Task<CircleDto?> CreateCircleAsync(CircleDto circle, CancellationToken ct = default)
+        => _api.CallAsync<CircleDto?>(HttpMethod.Post, Path, body: circle, ct: ct);
+
+    public Task UpdateCircleAsync(long id, CircleDto circle, CancellationToken ct = default)
+        => _api.CallAsync(HttpMethod.Put, $"{Path}/{id}", body: circle, ct: ct);
+
+    public Task DeleteCircleAsync(long id, CancellationToken ct = default)
+        => _api.CallAsync(HttpMethod.Delete, $"{Path}/{id}", ct: ct);
+
+    /// <summary>
+    /// Returns the members of one of the caller's circles.
+    /// Returns null when the circle does not exist or is not
+    /// owned by the caller (the server scopes the endpoint
+    /// with a 404 in either case to avoid leaking existence
+    /// — this client flattens that into a null result).
+    /// </summary>
+    public Task<List<CircleMemberDto>?> GetMembersAsync(long id, CancellationToken ct = default)
+        => _api.CallAsync<List<CircleMemberDto>?>(HttpMethod.Get, $"{Path}/{id}/members", ct: ct);
+
+    /// <summary>
+    /// Adds a Yavsc user (resolved client-side via
+    /// <c>/api/user-search</c>) to one of the caller's
+    /// circles. Returns null when the circle does not exist
+    /// or is not owned by the caller, or when the target
+    /// user does not exist. Throws on 409 (already a
+    /// member) — callers that want idempotent behaviour
+    /// can swallow the exception or dedupe beforehand.
+    /// </summary>
+    public Task AddMemberAsync(long id, string userId, CancellationToken ct = default)
+        => _api.CallAsync(HttpMethod.Post, $"{Path}/{id}/members",
+            body: new { userId }, ct: ct);
+
+    /// <summary>
+    /// Removes a user from one of the caller's circles.
+    /// Returns null on success (the server returns 200 OK
+    /// with no body) or when the membership does not
+    /// exist — both treated as success by the caller.
+    /// </summary>
+    public Task RemoveMemberAsync(long id, string userId, CancellationToken ct = default)
+        => _api.CallAsync(HttpMethod.Delete, $"{Path}/{id}/members/{userId}", ct: ct);
+}

src/Yavsc.Api.Client/Dtos/CircleAuthorizationDto.cs

@@ -0,0 +1,19 @@
+namespace Yavsc.Api.Client.Dtos;
+
+/// <summary>
+/// Wire format for <c>GET /api/blogacl</c> and friends.
+///
+/// <para>The server-side
+/// <c>Yavsc.Models.Access.CircleAuthorizationToBlogPost</c> EF entity
+/// carries virtual navigation properties (<c>Target</c>,
+/// <c>Allowed</c>) that pull in the full BlogPost and Circle graphs.
+/// The client never needs them: when showing the ACL of a post, the
+/// UI already has the post, and the circles are looked up by id
+/// against the list returned by <c>GET /api/circle</c>.</para>
+/// </summary>
+public sealed class CircleAuthorizationDto
+{
+    public long CircleId { get; set; }
+    public long BlogPostId { get; set; }
+    public bool Comment { get; set; }
+}

src/Yavsc.Api.Client/Dtos/CircleDto.cs

@@ -0,0 +1,23 @@
+namespace Yavsc.Api.Client.Dtos;
+
+/// <summary>
+/// Wire format for <c>GET /api/circle</c> and friends.
+///
+/// <para>Field names match the JSON the server emits (camelCase via
+/// the default <see cref="System.Text.Json"/> policy), so no
+/// <c>[JsonPropertyName]</c> attributes are required.</para>
+///
+/// <para>Mirrors the server-side <c>Yavsc.Models.Relationship.Circle</c>
+/// EF entity but stops short of the navigation properties
+/// (<c>Owner</c>, <c>Members</c>) which depend on
+/// <c>ApplicationUser</c> and other server-only types. The client
+/// only ever needs the id, name, and owner of a circle to drive
+/// the UI.</para>
+/// </summary>
+public sealed class CircleDto
+{
+    public long Id { get; set; }
+    public string Name { get; set; } = string.Empty;
+    public string OwnerId { get; set; } = string.Empty;
+    public bool Public { get; set; }
+}

src/Yavsc.Api.Client/Dtos/CircleMemberDto.cs

@@ -0,0 +1,21 @@
+namespace Yavsc.Api.Client.Dtos;
+
+/// <summary>
+/// Wire format for <c>GET /api/circle/{id}/members</c>.
+///
+/// <para>Mirrors the server-side
+/// <c>Yavsc.Blogs.Controllers.CircleMemberDto</c>. Intentionally
+/// stops short of the Email field that
+/// <see cref="UserSearchResultDto"/> carries — the circle
+/// membership UI only needs a name and an avatar to render the
+/// list. If the future ACL UI wants contact details, it can
+/// fall back to <see cref="IYavscApiClient"/>'s other
+/// endpoints rather than widening this shape.</para>
+/// </summary>
+public sealed class CircleMemberDto
+{
+    public string Id { get; set; } = string.Empty;
+    public string UserName { get; set; } = string.Empty;
+    public string? FullName { get; set; }
+    public string? Avatar { get; set; }
+}

src/Yavsc.Api.Client/Dtos/UserSearchResultDto.cs

@@ -0,0 +1,23 @@
+namespace Yavsc.Api.Client.Dtos;
+
+/// <summary>
+/// Wire format for <c>GET /api/user-search</c>.
+///
+/// <para>Mirrors the server-side
+/// <c>Yavsc.Blogs.Controllers.UserSearchResultDto</c> but stops
+/// short of any entity navigation properties. Only the fields
+/// a client address book needs (id, name, avatar, email) are
+/// included.</para>
+///
+/// <para>Field names match the JSON the server emits (camelCase
+/// via the default <see cref="System.Text.Json"/> policy), so
+/// no <c>[JsonPropertyName]</c> attributes are required.</para>
+/// </summary>
+public sealed class UserSearchResultDto
+{
+    public string Id { get; set; } = string.Empty;
+    public string UserName { get; set; } = string.Empty;
+    public string? FullName { get; set; }
+    public string? Avatar { get; set; }
+    public string? Email { get; set; }
+}

src/Yavsc.Api.Client/IYavscApiClient.cs

@@ -0,0 +1,62 @@
+using System;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Yavsc.Api.Client;
+
+/// <summary>
+/// Transport surface that the high-level clients
+/// (<see cref="BlogApiClient"/>, <see cref="CircleApiClient"/>,
+/// <see cref="BlogAclApiClient"/>) need to do their work.
+///
+/// <para>This is intentionally a thin, transport-only contract. It
+/// does not include the OIDC login / refresh / logout surface —
+/// that lives on the concrete <c>YavscApiClient</c> in the
+/// consuming application and is wired by the application
+/// composition root. Splitting the two keeps <c>Yavsc.Api.Client</c>
+/// usable from any host (a CLI, a unit test, a future iOS
+/// client) without dragging OIDC, identity, and a <c>Settings</c>
+/// POMVO everywhere.</para>
+///
+/// <para>Implementations are expected to:</para>
+/// <list type="bullet">
+///   <item>Attach a Bearer access token to every outbound request.</item>
+///   <item>Silently refresh the token on a 401 and retry once.</item>
+///   <item>Serialise the request body as JSON and deserialise the
+///   response body with case-insensitive property matching.</item>
+/// </list>
+///
+/// The exception contract on non-2xx responses is
+/// <see cref="HttpRequestException"/> with a message that includes
+/// the response body (capped), so callers can surface the
+/// server-side validation problem to the UI without losing
+/// context.
+/// </summary>
+public interface IYavscApiClient : IAsyncDisposable
+{
+    /// <summary>
+    /// The configured <see cref="HttpClient"/>. Clients set its
+    /// <c>BaseAddress</c> in their constructors to point at the
+    /// API host they target.
+    /// </summary>
+    HttpClient Http { get; }
+
+    /// <summary>Call a JSON endpoint with a typed return value.</summary>
+    /// <param name="method">HTTP verb.</param>
+    /// <param name="path">Path relative to <see cref="HttpClient.BaseAddress"/>.</param>
+    /// <param name="body">Optional request body, serialised as JSON.</param>
+    /// <param name="ct">Cancellation token.</param>
+    Task<T> CallAsync<T>(
+        HttpMethod method,
+        string path,
+        object? body = null,
+        CancellationToken ct = default);
+
+    /// <summary>Call a JSON endpoint that returns no useful body (DELETE, 204, etc.).</summary>
+    Task CallAsync(
+        HttpMethod method,
+        string path,
+        object? body = null,
+        CancellationToken ct = default);
+}

src/Yavsc.Api.Client/UserSearchClient.cs

@@ -0,0 +1,79 @@
+using System;
+using System.Collections.Generic;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using Yavsc.Api.Client.Dtos;
+
+namespace Yavsc.Api.Client;
+
+/// <summary>
+/// HTTP client for <c>/api/user-search</c> on the Yavsc Blogs
+/// server. Used by client-side address books (PostIt.Desktop,
+/// future PostIt.Browser CLI, …) to look up Yavsc users by
+/// display name or email.
+///
+/// <para>The server scopes every endpoint to the authenticated
+/// caller; any authenticated user can search the user table of
+/// the instance. There is no per-user filtering on the response
+/// side — this is by design on single-tenant deployments
+/// (closed community). Multi-tenant deployments should gate
+/// this controller behind a tenant-scoped policy before
+/// exposing it; see the server-side
+/// <c>UserSearchApiController</c> doc for details.</para>
+/// </summary>
+public sealed class UserSearchClient
+{
+    private const string Path = "user-search";
+
+    private readonly IYavscApiClient _api;
+
+    public UserSearchClient(IYavscApiClient api, string blogsBaseAddress)
+    {
+        _api = api ?? throw new ArgumentNullException(nameof(api));
+        if (string.IsNullOrEmpty(blogsBaseAddress))
+            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
+
+        if (api.Http.BaseAddress is null)
+            api.Http.BaseAddress = new Uri(blogsBaseAddress);
+    }
+
+    /// <summary>
+    /// Search users by display name (substring) or email (exact).
+    /// </summary>
+    /// <param name="query">Substring filter on FullName or
+    /// UserName. Empty or null returns an empty list (the server
+    /// would return all users, which we don't want by
+    /// default).</param>
+    /// <param name="email">Optional exact-match filter on
+    /// Email.</param>
+    /// <param name="take">Maximum results, capped at 100.
+    /// Default 25.</param>
+    public Task<List<UserSearchResultDto>> SearchAsync(
+        string? query = null,
+        string? email = null,
+        int take = 25,
+        CancellationToken ct = default)
+    {
+        // Match the server's contract: at least one filter is
+        // expected. The server doesn't enforce this (an empty
+        // query + empty email returns the first `take` users
+        // alphabetically), but the address-book UX is "type
+        // something to search", so we short-circuit empty
+        // queries client-side.
+        if (string.IsNullOrWhiteSpace(query) && string.IsNullOrWhiteSpace(email))
+            return Task.FromResult(new List<UserSearchResultDto>());
+
+        var qs = new List<string>();
+        if (!string.IsNullOrWhiteSpace(query))
+            qs.Add($"q={Uri.EscapeDataString(query)}");
+        if (!string.IsNullOrWhiteSpace(email))
+            qs.Add($"e={Uri.EscapeDataString(email)}");
+        qs.Add($"take={Math.Clamp(take, 1, 100)}");
+
+        return _api.CallAsync<List<UserSearchResultDto>>(
+            HttpMethod.Get,
+            $"{Path}?{string.Join('&', qs)}",
+            ct: ct);
+    }
+}

src/Yavsc.Api.Client/Yavsc.Api.Client.csproj

@@ -0,0 +1,29 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>Yavsc.Api.Client</RootNamespace>
+    <AssemblyName>Yavsc.Api.Client</AssemblyName>
+    <Nullable>enable</Nullable>
+    <LangVersion>latest</LangVersion>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <Description>
+      Thin HTTP clients for the Yavsc API. Each client is a DTO↔path
+      mapper; all transport concerns (base URL, JSON, Bearer auth,
+      silent refresh on 401) are delegated to YavscApiClient, which
+      lives in the consuming application (PostIt).
+    </Description>
+    <RepositoryUrl>https://github.com/pazof/yavsc</RepositoryUrl>
+    <Library>true</Library>
+    <AssemblyVersion>1.0.1.0</AssemblyVersion>
+    <FileVersion>1.0.1.0</FileVersion>
+    <InformationalVersion>1.0.1-5+Branch.main.Sha.0617fc6bda7151c70559d87177e2dcfb1b60995f</InformationalVersion>
+    <Version>1.0.1-5</Version>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="GitVersion.MsBuild" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="../Yavsc.Abstract/Yavsc.Abstract.csproj" />
+  </ItemGroup>
+</Project>

src/Yavsc.Api/Controllers/Relationship/CircleApiController.cs

@@ -1,146 +0,0 @@
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.EntityFrameworkCore;
-using Yavsc.Helpers;
-using Yavsc.Models;
-using Yavsc.Models.Relationship;
-using Yavsc.Server.Helpers;
-
-namespace Yavsc.Controllers
-{
-    [Produces("application/json")]
-    [Route("api/cirle")]
-    public class CircleApiController : Controller
-    {
-        private readonly ApplicationDbContext _context;
-
-        public CircleApiController(ApplicationDbContext context)
-        {
-            _context = context;
-        }
-
-        // GET: api/CircleApi
-        [HttpGet]
-        public IEnumerable<Circle> GetCircle()
-        {
-            return _context.Circle;
-        }
-
-        // GET: api/CircleApi/5
-        [HttpGet("{id}", Name = "GetCircle")]
-        public async Task<IActionResult> GetCircle([FromRoute] long id)
-        {
-            if (!ModelState.IsValid)
-            {
-                return BadRequest(ModelState);
-            }
-
-            Circle circle = await _context.Circle.SingleAsync(m => m.Id == id);
-
-            if (circle == null)
-            {
-                return NotFound();
-            }
-
-            return Ok(circle);
-        }
-
-        // PUT: api/CircleApi/5
-        [HttpPut("{id}")]
-        public async Task<IActionResult> PutCircle([FromRoute] long id, [FromBody] Circle circle)
-        {
-            if (!ModelState.IsValid)
-            {
-                return BadRequest(ModelState);
-            }
-
-            if (id != circle.Id)
-            {
-                return BadRequest();
-            }
-
-            _context.Entry(circle).State = EntityState.Modified;
-
-            try
-            {
-                await _context.SaveChangesAsync(User.GetUserId());
-            }
-            catch (DbUpdateConcurrencyException)
-            {
-                if (!CircleExists(id))
-                {
-                    return NotFound();
-                }
-                else
-                {
-                    throw;
-                }
-            }
-
-            return new StatusCodeResult(StatusCodes.Status204NoContent);
-        }
-
-        // POST: api/CircleApi
-        [HttpPost]
-        public async Task<IActionResult> PostCircle([FromBody] Circle circle)
-        {
-            if (!ModelState.IsValid)
-            {
-                return BadRequest(ModelState);
-            }
-
-            _context.Circle.Add(circle);
-            try
-            {
-                await _context.SaveChangesAsync(User.GetUserId());
-            }
-            catch (DbUpdateException)
-            {
-                if (CircleExists(circle.Id))
-                {
-                    return new StatusCodeResult(StatusCodes.Status409Conflict);
-                }
-                else
-                {
-                    throw;
-                }
-            }
-
-            return CreatedAtRoute("GetCircle", new { id = circle.Id }, circle);
-        }
-
-        // DELETE: api/CircleApi/5
-        [HttpDelete("{id}")]
-        public async Task<IActionResult> DeleteCircle([FromRoute] long id)
-        {
-            if (!ModelState.IsValid)
-            {
-                return BadRequest(ModelState);
-            }
-
-            Circle circle = await _context.Circle.SingleAsync(m => m.Id == id);
-            if (circle == null)
-            {
-                return NotFound();
-            }
-
-            _context.Circle.Remove(circle);
-            await _context.SaveChangesAsync(User.GetUserId());
-
-            return Ok(circle);
-        }
-
-        protected override void Dispose(bool disposing)
-        {
-            if (disposing)
-            {
-                _context.Dispose();
-            }
-            base.Dispose(disposing);
-        }
-
-        private bool CircleExists(long id)
-        {
-            return _context.Circle.Count(e => e.Id == id) > 0;
-        }
-    }
-}

src/Yavsc.Blogs.Tests/CircleMembersApiTests.cs

@@ -0,0 +1,199 @@
+using System.Net;
+using System.Net.Http;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Models;
+using Yavsc.Models.Relationship;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Blogs.Tests;
+
+/// <summary>
+/// Behavioural tests for the circle-members endpoints on
+/// <c>CircleApiController</c>:
+/// <c>GET /api/circle/{id}/members</c>,
+/// <c>POST /api/circle/{id}/members</c>,
+/// <c>DELETE /api/circle/{id}/members/{userId}</c>.
+///
+/// <para>Same fixture as <see cref="BlogApiTests"/>:
+/// <see cref="BlogsWebServerFixture"/> provides an in-memory
+/// <c>ApplicationDbContext</c>, JWT bearer auth with HS256,
+/// and the production <c>BlogScope</c> policy. Tests use
+/// <c>TestTokenIssuer</c> to mint tokens whose <c>sub</c>
+/// claim identifies the caller.</para>
+///
+/// <para>Test users (<c>alice</c>, <c>bob</c>) are seeded
+/// directly via <see cref="ApplicationDbContext.Users"/>:
+/// the Blogs fixture doesn't stand up
+/// <c>UserManager&lt;ApplicationUser&gt;</c>, so we go
+/// through the DbContext the same way the production code
+/// would.</para>
+/// </summary>
+[Collection("JwtClaimMapping")]
+public sealed class CircleMembersApiTests : IClassFixture<BlogsWebServerFixture>
+{
+    private readonly BlogsWebServerFixture _fixture;
+
+    public CircleMembersApiTests(BlogsWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    /// <summary>Reset the in-memory database and seed
+    /// <c>alice</c> + <c>bob</c>. <c>UseInMemoryDatabase</c>
+    /// shares its store across the fixture lifetime, so each
+    /// test starts from a clean slate.</summary>
+    private void ResetDatabaseWithUsers()
+    {
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        db.Database.EnsureDeleted();
+        db.Database.EnsureCreated();
+
+        db.Users.Add(new ApplicationUser
+        {
+            Id = "alice",
+            UserName = "alice",
+            Email = "alice@example.com",
+            EmailConfirmed = true,
+            FullName = "Alice Dupont",
+            Avatar = "/avatars/alice.png",
+        });
+        db.Users.Add(new ApplicationUser
+        {
+            Id = "bob",
+            UserName = "bob",
+            Email = "bob@example.com",
+            EmailConfirmed = true,
+            FullName = "Bob Martin",
+            Avatar = "/avatars/bob.png",
+        });
+        db.SaveChanges();
+    }
+
+    /// <summary>Create a circle owned by <paramref name="ownerId"/>
+    /// directly in the in-memory store and return its server-assigned
+    /// id. The tests below use this to bypass the controller's POST
+    /// (which is already covered by other tests on the branch);
+    /// the focus here is the members endpoints.</summary>
+    private long SeedCircle(string ownerId, string name)
+    {
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        var circle = new Circle { OwnerId = ownerId, Name = name };
+        db.Circle.Add(circle);
+        db.SaveChanges();
+        return circle.Id;
+    }
+
+    private string MembersUrl(long circleId)
+        => $"{_fixture.Addresses.First(a => a.StartsWith("https://"))}/api/circle/{circleId}/members";
+
+    private HttpClient NewClient(string subject)
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri(_fixture.Addresses.First(a => a.StartsWith("https://")))
+        };
+        http.DefaultRequestHeaders.Authorization =
+            new System.Net.Http.Headers.AuthenticationHeaderValue(
+                "Bearer", TestTokenIssuer.Issue(subject));
+        return http;
+    }
+
+    [Fact]
+    public async Task GetMembers_returns_200_with_empty_list_when_no_members()
+    {
+        ResetDatabaseWithUsers();
+        var circleId = SeedCircle("alice", "Famille");
+        using var http = NewClient("alice");
+
+        var response = await http.GetAsync(MembersUrl(circleId));
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        using var doc = JsonDocument.Parse(await response.Content.ReadAsStringAsync());
+        Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+        Assert.Equal(0, doc.RootElement.GetArrayLength());
+    }
+
+    [Fact]
+    public async Task PostMember_returns_201_then_Get_returns_the_member()
+    {
+        ResetDatabaseWithUsers();
+        var circleId = SeedCircle("alice", "Famille");
+        using var http = NewClient("alice");
+
+        var postResponse = await http.PostAsJsonAsync(
+            MembersUrl(circleId),
+            new { userId = "bob" });
+
+        Assert.Equal(HttpStatusCode.Created, postResponse.StatusCode);
+
+        var getResponse = await http.GetAsync(MembersUrl(circleId));
+        Assert.Equal(HttpStatusCode.OK, getResponse.StatusCode);
+
+        using var doc = JsonDocument.Parse(await getResponse.Content.ReadAsStringAsync());
+        Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+        Assert.Equal(1, doc.RootElement.GetArrayLength());
+        var member = doc.RootElement[0];
+        Assert.Equal("bob", member.GetProperty("id").GetString());
+        Assert.Equal("bob", member.GetProperty("userName").GetString());
+        Assert.Equal("Bob Martin", member.GetProperty("fullName").GetString());
+    }
+
+    [Fact]
+    public async Task PostMember_returns_409_when_user_already_in_circle()
+    {
+        ResetDatabaseWithUsers();
+        var circleId = SeedCircle("alice", "Famille");
+        using var http = NewClient("alice");
+
+        var first = await http.PostAsJsonAsync(
+            MembersUrl(circleId),
+            new { userId = "bob" });
+        Assert.Equal(HttpStatusCode.Created, first.StatusCode);
+
+        var second = await http.PostAsJsonAsync(
+            MembersUrl(circleId),
+            new { userId = "bob" });
+        Assert.Equal(HttpStatusCode.Conflict, second.StatusCode);
+    }
+
+    [Fact]
+    public async Task DeleteMember_returns_200_then_Get_does_not_include_member()
+    {
+        ResetDatabaseWithUsers();
+        var circleId = SeedCircle("alice", "Famille");
+        using var http = NewClient("alice");
+
+        await http.PostAsJsonAsync(MembersUrl(circleId), new { userId = "bob" });
+
+        var deleteResponse = await http.DeleteAsync(
+            $"{MembersUrl(circleId)}/bob");
+        Assert.Equal(HttpStatusCode.OK, deleteResponse.StatusCode);
+
+        var getResponse = await http.GetAsync(MembersUrl(circleId));
+        using var doc = JsonDocument.Parse(await getResponse.Content.ReadAsStringAsync());
+        Assert.Equal(0, doc.RootElement.GetArrayLength());
+    }
+
+    [Fact]
+    public async Task GetMembers_returns_404_when_circle_not_owned_by_caller()
+    {
+        ResetDatabaseWithUsers();
+        // Alice's circle, Bob tries to read its members.
+        var circleId = SeedCircle("alice", "Famille");
+        using var http = NewClient("bob");
+
+        var response = await http.GetAsync(MembersUrl(circleId));
+
+        // 404, not 403 — the controller deliberately avoids leaking
+        // the existence of someone else's circle.
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+}

src/Yavsc.Blogs/Controllers/BlogAclApiController.cs

@@ -1,12 +1,12 @@
+using System.Linq;
 using System.Security.Claims;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Yavsc.Helpers;
 using Yavsc.Models;
 using Yavsc.Models.Access;
 using Yavsc.Server.Helpers;
 
-namespace Yavsc.Controllers
+namespace Yavsc.Blogs.Controllers
 {
     [Produces("application/json")]
     [Route("api/blogacl")]
@@ -19,11 +19,19 @@ namespace Yavsc.Controllers
             _context = context;
         }
 
-        // GET: api/BlogAclApi
+        /// <summary>
+        /// Returns the ACL entries for the caller's own blog posts.
+        /// Blog posts (and therefore their ACLs) are private to their
+        /// author — the API never exposes another user's ACL.
+        /// </summary>
+        // GET: api/blogacl
         [HttpGet]
         public IEnumerable<CircleAuthorizationToBlogPost> GetBlogACL()
         {
-            return _context.CircleAuthorizationToBlogPost;
+            var uid = User.FindFirstValue(ClaimTypes.NameIdentifier);
+            return _context.CircleAuthorizationToBlogPost
+                .Include(a => a.Allowed)
+                .Where(a => a.Allowed.OwnerId == uid);
         }
 
         // GET: api/BlogAclApi/5
@@ -86,7 +94,7 @@ namespace Yavsc.Controllers
         }
         private bool CheckOwner (long circleId)
         {
-            
+
             var uid = User.FindFirstValue(ClaimTypes.NameIdentifier);
             var circle = _context.Circle.First(c=>c.Id==circleId);
             _context.Entry(circle).State = EntityState.Detached;

src/Yavsc.Blogs/Controllers/CircleApiController.cs

@@ -0,0 +1,349 @@
+using System.Linq;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Yavsc.Models;
+using Yavsc.Models.Relationship;
+using Yavsc.Server.Helpers;
+
+namespace Yavsc.Blogs.Controllers
+{
+    [Produces("application/json")]
+    [Route("api/circle")]
+    public class CircleApiController : Controller
+    {
+        private readonly ApplicationDbContext _context;
+
+        public CircleApiController(ApplicationDbContext context)
+        {
+            _context = context;
+        }
+
+        /// <summary>
+        /// Returns the caller's own circles. Circles are personal —
+        /// the API never exposes another user's circles, even by id.
+        /// </summary>
+        // GET: api/circle
+        [HttpGet]
+        public IEnumerable<Circle> GetCircle()
+        {
+            var uid = User.GetUserId();
+            return _context.Circle.Where(c => c.OwnerId == uid);
+        }
+
+        /// <summary>
+        /// Returns a single circle only when it belongs to the caller.
+        /// </summary>
+        // GET: api/circle/5
+        [HttpGet("{id}", Name = "GetCircle")]
+        public async Task<IActionResult> GetCircle([FromRoute] long id)
+        {
+            if (!ModelState.IsValid)
+            {
+                return BadRequest(ModelState);
+            }
+
+            var uid = User.GetUserId();
+            Circle circle = await _context.Circle.SingleOrDefaultAsync(
+                m => m.Id == id && m.OwnerId == uid);
+
+            if (circle == null)
+            {
+                return NotFound();
+            }
+
+            return Ok(circle);
+        }
+
+        /// <summary>
+        /// Replaces a circle. The caller must own it; the server
+        /// reasserts ownership regardless of any OwnerId the client
+        /// tries to put in the body.
+        /// </summary>
+        // PUT: api/circle/5
+        [HttpPut("{id}")]
+        public async Task<IActionResult> PutCircle([FromRoute] long id, [FromBody] Circle circle)
+        {
+            if (!ModelState.IsValid)
+            {
+                return BadRequest(ModelState);
+            }
+
+            if (id != circle.Id)
+            {
+                return BadRequest();
+            }
+
+            var uid = User.GetUserId();
+            var existing = await _context.Circle.SingleOrDefaultAsync(
+                c => c.Id == id && c.OwnerId == uid);
+            if (existing is null)
+            {
+                return new ChallengeResult();
+            }
+
+            // Force OwnerId to the caller; the body value is ignored.
+            circle.OwnerId = uid;
+            _context.Entry(circle).State = EntityState.Modified;
+
+            try
+            {
+                await _context.SaveChangesAsync(User.GetUserId());
+            }
+            catch (DbUpdateConcurrencyException)
+            {
+                if (!CircleExists(id))
+                {
+                    return NotFound();
+                }
+                else
+                {
+                    throw;
+                }
+            }
+
+            return new StatusCodeResult(StatusCodes.Status204NoContent);
+        }
+
+        /// <summary>
+        /// Creates a circle owned by the caller. The server overwrites
+        /// any OwnerId the client sends in the body.
+        /// </summary>
+        // POST: api/circle
+        [HttpPost]
+        public async Task<IActionResult> PostCircle([FromBody] Circle circle)
+        {
+            if (!ModelState.IsValid)
+            {
+                return BadRequest(ModelState);
+            }
+
+            var uid = User.GetUserId();
+            circle.OwnerId = uid;
+
+            _context.Circle.Add(circle);
+            try
+            {
+                await _context.SaveChangesAsync(User.GetUserId());
+            }
+            catch (DbUpdateException)
+            {
+                if (CircleExists(circle.Id))
+                {
+                    return new StatusCodeResult(StatusCodes.Status409Conflict);
+                }
+                else
+                {
+                    throw;
+                }
+            }
+
+            return CreatedAtRoute("GetCircle", new { id = circle.Id }, circle);
+        }
+
+        /// <summary>
+        /// Deletes a circle only if the caller owns it. Returns 404
+        /// (not 403) when the circle does not exist or is not owned
+        /// by the caller, to avoid leaking the existence of someone
+        /// else's circle.
+        /// </summary>
+        // DELETE: api/circle/5
+        [HttpDelete("{id}")]
+        public async Task<IActionResult> DeleteCircle([FromRoute] long id)
+        {
+            if (!ModelState.IsValid)
+            {
+                return BadRequest(ModelState);
+            }
+
+            var uid = User.GetUserId();
+            Circle circle = await _context.Circle.SingleOrDefaultAsync(
+                m => m.Id == id && m.OwnerId == uid);
+            if (circle == null)
+            {
+                return NotFound();
+            }
+
+            _context.Circle.Remove(circle);
+            await _context.SaveChangesAsync(User.GetUserId());
+
+            return Ok(circle);
+        }
+
+        /// <summary>
+        /// Returns the members of one of the caller's circles.
+        /// Returns 404 (not 403) when the circle does not exist
+        /// or is not owned by the caller, mirroring the scoping
+        /// of the rest of this controller.
+        /// </summary>
+        // GET: api/circle/5/members
+        [HttpGet("{id}/members")]
+        public async Task<IActionResult> GetMembers([FromRoute] long id)
+        {
+            if (!ModelState.IsValid)
+            {
+                return BadRequest(ModelState);
+            }
+
+            var uid = User.GetUserId();
+            var ownsIt = await _context.Circle.AnyAsync(c => c.Id == id && c.OwnerId == uid);
+            if (!ownsIt)
+            {
+                return NotFound();
+            }
+
+            var members = await _context.CircleMembers
+                .Where(m => m.CircleId == id)
+                .Select(m => new CircleMemberDto
+                {
+                    Id = m.MemberId,
+                    UserName = m.Member.UserName ?? string.Empty,
+                    FullName = m.Member.FullName,
+                    Avatar = m.Member.Avatar,
+                })
+                .ToListAsync();
+
+            return Ok(members);
+        }
+
+        /// <summary>
+        /// Adds a Yavsc user to one of the caller's circles. The
+        /// body carries the user id (resolved client-side via the
+        /// central <c>/api/user-search</c> endpoint). Returns
+        /// 404 (not 403) when the circle does not exist or is not
+        /// owned by the caller, and 404 when the target user does
+        /// not exist, so the caller can't probe whether an email
+        /// belongs to a real account.
+        ///
+        /// <para>Returns 409 Conflict if the user is already a
+        /// member of the circle; the client treats this as a
+        /// no-op success.</para>
+        /// </summary>
+        // POST: api/circle/5/members
+        // body: { "userId": "..." }
+        [HttpPost("{id}/members")]
+        public async Task<IActionResult> AddMember(
+            [FromRoute] long id,
+            [FromBody] AddCircleMemberDto body)
+        {
+            if (!ModelState.IsValid)
+            {
+                return BadRequest(ModelState);
+            }
+
+            var uid = User.GetUserId();
+            var ownsIt = await _context.Circle.AnyAsync(c => c.Id == id && c.OwnerId == uid);
+            if (!ownsIt)
+            {
+                return NotFound();
+            }
+
+            // Reject unknown user ids the same way as an unknown
+            // circle: 404. Probing the user table by id should not
+            // be possible through this endpoint.
+            var userExists = await _context.Users.AnyAsync(u => u.Id == body.UserId);
+            if (!userExists)
+            {
+                return NotFound();
+            }
+
+            // Idempotency: re-adding an existing member is a
+            // 409, not a silent success. Clients that don't
+            // dedupe beforehand will at least get an actionable
+            // status code rather than a misleading "created".
+            var alreadyMember = await _context.CircleMembers.AnyAsync(
+                m => m.CircleId == id && m.MemberId == body.UserId);
+            if (alreadyMember)
+            {
+                return new StatusCodeResult(StatusCodes.Status409Conflict);
+            }
+
+            _context.CircleMembers.Add(new CircleMember
+            {
+                CircleId = id,
+                MemberId = body.UserId,
+            });
+            await _context.SaveChangesAsync(User.GetUserId());
+
+            return CreatedAtRoute("GetCircle", new { id }, body);
+        }
+
+        /// <summary>
+        /// Removes a user from one of the caller's circles.
+        /// Returns 404 when the circle does not exist or is not
+        /// owned by the caller, mirroring the rest of this
+        /// controller's scoping. Returns 404 when the user is
+        /// not a member of the circle (idempotent: removing a
+        /// non-member is the same as having nothing to remove).
+        /// </summary>
+        // DELETE: api/circle/5/members/tester
+        [HttpDelete("{id}/members/{userId}")]
+        public async Task<IActionResult> RemoveMember(
+            [FromRoute] long id,
+            [FromRoute] string userId)
+        {
+            if (!ModelState.IsValid)
+            {
+                return BadRequest(ModelState);
+            }
+
+            var uid = User.GetUserId();
+            var ownsIt = await _context.Circle.AnyAsync(c => c.Id == id && c.OwnerId == uid);
+            if (!ownsIt)
+            {
+                return NotFound();
+            }
+
+            var membership = await _context.CircleMembers.SingleOrDefaultAsync(
+                m => m.CircleId == id && m.MemberId == userId);
+            if (membership is null)
+            {
+                return NotFound();
+            }
+
+            _context.CircleMembers.Remove(membership);
+            await _context.SaveChangesAsync(User.GetUserId());
+
+            return Ok();
+        }
+
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing)
+            {
+                _context.Dispose();
+            }
+            base.Dispose(disposing);
+        }
+
+        private bool CircleExists(long id)
+        {
+            return _context.Circle.Count(e => e.Id == id) > 0;
+        }
+    }
+
+    /// <summary>
+    /// Wire shape for <c>GET /api/circle/{id}/members</c>.
+    /// Mirrors <see cref="UserSearchResultDto"/> but stops
+    /// short of the Email field — circle membership UI only
+    /// needs to render a name and an avatar, not contact
+    /// details.
+    /// </summary>
+    public sealed class CircleMemberDto
+    {
+        public string Id { get; set; } = string.Empty;
+        public string UserName { get; set; } = string.Empty;
+        public string? FullName { get; set; }
+        public string? Avatar { get; set; }
+    }
+
+    /// <summary>
+    /// Wire shape for <c>POST /api/circle/{id}/members</c>.
+    /// The body is intentionally tiny: the client resolves
+    /// the user id via <c>/api/user-search</c> before
+    /// posting, so all we need is the resolved id.
+    /// </summary>
+    public sealed class AddCircleMemberDto
+    {
+        public string UserId { get; set; } = string.Empty;
+    }
+}

src/Yavsc.Blogs/Controllers/UserSearchApiController.cs

@@ -0,0 +1,111 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Yavsc.Models;
+
+namespace Yavsc.Blogs.Controllers
+{
+    /// <summary>
+    /// Central user search endpoint used by client address books
+    /// (PostIt.Desktop, future PostIt.Browser CLI, etc.).
+    ///
+    /// <para>Live in <c>Yavsc.Blogs</c> rather than <c>Yavsc.Api</c>
+    /// because Yavsc.Api is not yet enabled in production; future
+    /// migration is mechanical (the namespace and route prefix are
+    /// the only ties to the host project).</para>
+    ///
+    /// <para>Authorisation: any authenticated caller can search.
+    /// Results include <c>Email</c> on a best-effort basis —
+    /// the field is included because the address-book use case
+    /// (composing a circle membership, sending an invite) needs
+    /// it. The data set is the entire user table of the
+    /// instance, which on Yavsc's single-tenant deployments is
+    /// a closed community where users already know each other.
+    /// Multi-tenant deployments should gate this controller
+    /// behind a tenant-scoped authorisation policy before
+    /// exposing it.</para>
+    /// </summary>
+    [Produces("application/json")]
+    [Route("api/user-search")]
+    [Authorize]
+    public class UserSearchApiController : Controller
+    {
+        private readonly ApplicationDbContext _context;
+
+        public UserSearchApiController(ApplicationDbContext context)
+        {
+            _context = context;
+        }
+
+        /// <summary>
+        /// Search users by display name and/or email.
+        /// </summary>
+        /// <param name="q">Substring filter on
+        /// <see cref="ApplicationUser.FullName"/> or
+        /// <see cref="ApplicationUser.UserName"/> (case-insensitive,
+        /// contains). Optional.</param>
+        /// <param name="e">Exact filter on
+        /// <see cref="ApplicationUser.Email"/> (case-insensitive
+        /// equality). Optional.</param>
+        /// <param name="take">Maximum number of results, capped at
+        /// 100. Default 25.</param>
+        // GET: api/user-search?q=foo&e=bar@example.com&take=25
+        [HttpGet]
+        public async Task<IEnumerable<UserSearchResultDto>> SearchAsync(
+            [FromQuery] string? q = null,
+            [FromQuery] string? e = null,
+            [FromQuery] int take = 25)
+        {
+            take = Math.Clamp(take, 1, 100);
+
+            IQueryable<ApplicationUser> query = _context.Users;
+
+            if (!string.IsNullOrWhiteSpace(e))
+            {
+                // Email is treated as an exact match — most address
+                // book callers already know the email they're
+                // searching for and we don't want to surface a
+                // long tail of partial matches.
+                var normalised = e.Trim();
+                query = query.Where(u => u.Email != null && u.Email.ToLower() == normalised.ToLower());
+            }
+
+            if (!string.IsNullOrWhiteSpace(q))
+            {
+                var needle = q.Trim();
+                query = query.Where(u =>
+                    (u.FullName != null && u.FullName.ToLower().Contains(needle.ToLower())) ||
+                    (u.UserName != null && u.UserName.ToLower().Contains(needle.ToLower())));
+            }
+
+            var results = await query
+                .OrderBy(u => u.FullName ?? u.UserName)
+                .Take(take)
+                .Select(u => new UserSearchResultDto
+                {
+                    Id = u.Id,
+                    UserName = u.UserName ?? string.Empty,
+                    FullName = u.FullName,
+                    Avatar = u.Avatar,
+                    Email = u.Email,
+                })
+                .ToListAsync();
+
+            return results;
+        }
+    }
+
+    /// <summary>
+    /// Search-result shape. Flat DTO with no navigation
+    /// properties so the JSON stays small even if the user
+    /// table grows.
+    /// </summary>
+    public sealed class UserSearchResultDto
+    {
+        public string Id { get; set; } = string.Empty;
+        public string UserName { get; set; } = string.Empty;
+        public string? FullName { get; set; }
+        public string? Avatar { get; set; }
+        public string? Email { get; set; }
+    }
+}