BlogApiClient is a thin DTO↔path mapper on top of YavscApiClient:
- No more HttpClient, no more accessToken constructor argument.
- Single responsibility: turn Yavsc.Blogs endpoint paths into typed
BlogPost payloads and back, while YavscApiClient owns auth +
refresh + JSON shape.
- Default path prefix is 'api/blog', overridable for tests.
MainPageViewModel and App.axaml.cs are now free of any direct
OidcClient / IBrowser / BearerToken plumbing. The MainPage receives
a fully-configured BlogApiClient (which holds a YavscApiClient, which
holds a TokenStore) at construction. The duplicate LoginAsync method
on MainPageViewModel is gone; the LoginPage is the single entry point
for the interactive PKCE flow.
PlatformBootstrap.Desktop no longer overrides the redirect URI to
loopback. PostIt runs the postit://callback custom scheme
(SingleInstance hand-off) as the production path on desktop; the
loopback constant stays for tests and for platforms that cannot
register a custom scheme.
Settings.cs: DefaultLoopbackRedirectUri is now documented as a
fallback; DefaultDesktopRedirectUri ('postit://callback') is
introduced as the canonical desktop default.
TokenStore.Load() tolerates an empty file (returns null) so
first-launch races and stubbed test fixtures don't blow up the
constructor.
YavscApiClient:
- HasValidSession is exposed for warm-start UI logic.
- CurrentAccessToken / CurrentIdToken are exposed so the LoginPage
ViewModel can mirror the result onto its observable properties.
- CallAsync<T> is now virtual (and the class is no longer sealed)
to allow stubbing in PostItViewModelTests.
Tests (PostIt.Tests):
- YavscApiClientTests covers the silent refresh path (cache the
token, mark it expired, observe a new Bearer in the API server),
the 401 → refresh → retry path (forceFirstRequest on the stub),
HasValidSession after login, and the throw-when-no-token guard.
- OidcStubAuthority now mints a refresh_token in the token response
so YavscApiClient.RefreshTokenAsync can hit /connect/token in
tests.
- PostItViewModelTests uses a ThrowingYavscApiClient / StubYavscApiClient
pair instead of the old HttpClient injection point, matching the
new constructor shape.
dotnet test: 21/21 green. dotnet build: 0 errors.
PostIt is a desktop/mobile app talking to Yavsc.Org
(https://yavsc.pschneider.fr) as an OIDC identity provider. The
previous grant used the client_credentials flow with a client_secret
embedded in postit-settings.json: this was both insecure (secret
travels with the binary) and inappropriate for an interactive app
(token had no user identity, so the API could not scope or audit).
The new flow is Authorization Code + PKCE:
* PostIt client (Settings/AuthenticationSettings.cs): the
ClientSecret property is removed; GetOidcClientOptions now drops
the secret and accepts an optional IBrowser supplied per-platform.
* Settings.cs: new AndroidRedirectUri constant ('android://postit-signin')
that the Android app uses; RedirectUri is no longer hard-coded in
MainViewModel.
* MainViewModel.cs: the manual discovery + client_credentials POST is
replaced with OidcClient.LoginAsync (Authorization Code + PKCE).
* Settings sample: Authority points at the real Yavsc.Org OP, not at
a non-existent Keycloak-style realm path.
* Yavsc.Org/Extensions/HostingExtensions.cs: the 'postit' client seed
is now idempotent (MigratePostItClientToPublic) and detects
legacy state on existing ConfigurationDb rows - flips
RequireClientSecret=false, RequirePkce=true, drops any ClientSecret
row, and replaces the legacy RedirectUris
(https://yavsc.pschneider.fr/, yavsc://callback) with the current
set (http://127.0.0.1:7890/, android://postit-signin).
PostIt.Android:
* MainActivity: explicit Name attribute so the activity alias can
target a stable component; LaunchMode.SingleTask so the existing
instance receives the deep-link Intent; OnNewIntent forwards the
callback URI through AndroidOidcCallbackSink.
* AndroidManifest.xml: activity-alias PostIt.Android.OidcCallbackActivity
exposing scheme=android host=postit-signin to Android, so the OP
redirect lands back in the running PostIt instance.
The IdentityModel.OidcClient.Browser.SystemBrowser package and a
thin AndroidSystemBrowser implementation are added in a follow-up so
OidcClient.LoginAsync can actually drive Chrome Custom Tabs and
consume AndroidOidcCallbackSink.
