- OidcLoginPhase enum + IProgress<OidcLoginPhase> on
YavscApiClient.LoginInteractiveAsync, surfaced in the UI as
PhaseLabel (FR). Lets operators see where the flow actually
stalls, in particular whether the postit://callback ever arrives
on the running instance.
- YavscApiClient.TrySilentLoginAsync: silent refresh at boot.
Returns false (and purges the store) when the refresh token is
rejected by the OP.
- App.OnFrameworkInitializationCompleted auto-routes: HomePage is
the navigation root; on Opened the app calls TrySilentLoginAsync
and pushes MainPage if a session is restored. Logout pops back
to HomePage via the new persistent SessionStatusBanner (Connecté
/ Déconnecté + Logout button).
- PostIt.Desktop.Program.Main now detects the postit://callback
URL BEFORE Avalonia boots, hands it off via SingleInstance, and
exits. Stops the 2nd PostIt instance from flashing its own
MainWindow while the 1st instance is still waiting on the named
pipe. The check in App.OnFrameworkInitializationCompleted is
kept as belt-and-braces defence-in-depth.
- SchemeUrlDetector: pure platform-independent detector extracted
for unit testing.
- Tests: 7 new SchemeUrlDetectorTests + 5 new phase / silent
refresh tests in YavscApiClientTests.
The previous commit set Platform.CreateBrowser to null on the desktop
side, so LoginAsync would still fail with 'No browser is available'.
Close that loop with an explicit desktop bootstrap.
PostIt.Desktop/PlatformBootstrap.cs mirrors the Android side: it
populates Platform.DefaultRedirectUri and Platform.CreateBrowser
once at startup. Program.Main calls EnsureInitialized before
BuildAvaloniaApp so the LoginPageViewModel sees a working browser
before any login attempt.
The Yavsc.Org seed now reads Site:ExternalUrl from configuration so
the RedirectUri list for the PostIt client follows the same setting
as the rest of the application (same value used in
Administration/ClientController, AccountController, etc.). Without
this, an embedded 'launch PostIt from a Yavsc.Org page' scenario
would be rejected by IdentityServer (redirect_uri mismatch).
BuildPostItRedirectUris is a small helper that yields the constant
PostItRedirectUris (loopback + Android custom scheme) followed by
Site:ExternalUrl when set. Both SeedNewPostItClient (fresh db) and
MigratePostItClientToPublic (existing db) consume it. The legacy
cleanup block (which used to remove https://yavsc.pschneider.fr/
and yavsc://callback) is dropped: Site:ExternalUrl is now the
canonical way to authorise that path and may legitimately equal
that value.
