Bad test, fix the test

Reviewed-on: #51

.forgejo/workflows/buildAndTest.yml

@@ -48,4 +48,4 @@ jobs:
           --verbosity normal \
           --filter="Category!=Platform-Android" \
           --logger "xunit;LogFileName=test-results.xml" \
-          && echo "✅ Success !" || echo "❌ Fail ($?)!"
+          && echo "✅ Success !" || { echo "❌ Fail ($?)!"; exit 1; }

.forgejo/workflows/release.yml

@@ -175,6 +175,12 @@ jobs:
         run: |
           cd /src/_src
           dotnet restore
+      - name: Test
+        run: |
+          cd /src/_src && dotnet test \
+          --verbosity normal \
+          --filter="Category!=Platform-Android" \
+          --logger "xunit;LogFileName=test-results.xml"
 
       - name: Build de PostIt.Android ARM64
         run: |
@@ -200,6 +206,7 @@ jobs:
           RELEASE_BODY: ${{ env.RELEASE_BODY }}
           IS_PRERELEASE: ${{ env.IS_PRERELEASE }}
         run: |
+          set -e
           if [[ -z "$TAG" ]]; then
             echo "::error::No tag resolved for the API call."
             exit 1

.gitignore

@@ -35,6 +35,7 @@ appsettings-*.*.json
 
 generated/
 *.tmp
+tmp/
 DataDir/
 
 *.tests.trx

CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [1.0.8-rc14] - unstable
+
+### Added
+
+* [PostIt] Ajout d'un `BillingQueryDetailsPageViewModel` et de sa page associee pour afficher le detail d'une commande billing depuis l'historique.
+* [PostIt] Ajout d'un mode detail avec section metier (statut, date, description, motif, infos) et section technique repliable (code, client, provision, lieu, prestations).
+* [PostIt] Ajout d'un badge de statut enrichi (couleur + pictogramme) sur le detail d'une commande pour visualiser l'etat en un coup d'oeil.
+* [PostIt] Ajout d'un bloc d'actions rapide en tete du detail (`Retour`, `Ouvrir en edition`) pour eviter le scroll jusqu'au bas de page.
+* [PostIt] Ajout d'un style monospace sur les metadonnees techniques (code billing, client, provision, lieu, prestations) pour faciliter la lecture des identifiants et valeurs brutes.
+
+### Changed
+
+* [PostIt] Le bouton d'ouverture depuis la liste billing ouvre maintenant une page de detail dediee avant l'eventuelle edition.
+* [PostIt] Amelioration UX des pages billing: badges de statut colores, actions remontees en haut de page, et typographie monospace sur les metadonnees techniques.
+
+### Fixed
+
+* [Yavsc.Api] Correction d'un 500 sur le refresh du catalogue d'activites lorsque `Activity.Description` est `NULL` en base (nullabilite explicite + projection null-safe + gardes sur codes vides).
+* [Yavsc.Api] Correction des erreurs 400/500 sur les routes billing (`Rdv`, `Brush`, `MBrush`) en imposant `ClientId` depuis l'utilisateur authentifie et en ignorant les champs server-owned lors de la validation modele.
+* [Yavsc.Api] Correction du `PUT /api/v1/billing/Rdv/{id}`: mise a jour controlee de l'entite existante (et non remplacement brut du graphe JSON), ce qui supprime les `BadRequest` parasites.
+* [Yavsc.Api] Correction PostgreSQL `timestamptz` sur RDV: normalisation UTC de `EventDate` sur `POST/PUT /api/v1/billing/Rdv` pour eviter l'erreur `Cannot write DateTime with Kind=Local`.
+* [Yavsc.Api] Correction du flux FrontOffice accept/reject de query: sauvegarde avec contexte utilisateur et fallback d'injection pour `IBillingService` afin d'eviter les erreurs serveur en environnement de test.
+* [Yavsc.Blogs] Correction des `BadRequest` sur `POST/PUT /api/v1/blogspot` avec payload JSON (PostIt): les proprietes de navigation/serveur (`Author`, `Tags`, `Comments`, audit) ne bloquent plus la validation.
+* [Yavsc.Org] Correction du flux MVC de creation de commentaire: `SaveChangesAsync(userId)` est utilise pour renseigner les champs d'audit requis (`UserCreated`/`UserModified`).
+* [Yavsc.Api.Test] Stabilisation des fixtures de seed billing: remplissage des metadonnees d'audit (`UserCreated`, `UserModified`, dates) pour eviter les echecs SQLite `NOT NULL`.
 
 ## [1.0.8-rc13] - unstable
 

src/PostIt/PostIt.Tests/BillingQueriesPageViewModelTests.cs

@@ -45,10 +45,8 @@ public class BillingQueriesPageViewModelTests
         Assert.Equal(2, vm.Queries.Count);
         Assert.All(vm.Queries, q => Assert.DoesNotContain("Rejected", q.StatusLabel, StringComparison.OrdinalIgnoreCase));
         Assert.Contains("lecture seule", vm.StatusMessage, StringComparison.OrdinalIgnoreCase);
-        Assert.False(vm.CanOpenDetails);
 
-        vm.SelectedQuery = vm.Queries[0];
-        Assert.False(vm.OpenSelectedQueryCommand.CanExecute(null));
+        Assert.True(vm.Queries.Count > 0);
     }
 
     private sealed class StubBillingApi : IYavscApiClient

src/PostIt/PostIt/Helpers/ServiceCollectionHelpers.cs

@@ -57,6 +57,7 @@ public static class ServiceCollectionHelpers
         services.AddTransient<RdvPage>();
         services.AddTransient<BrushPage>();
         services.AddTransient<BillingQueriesPage>();
+        services.AddTransient<BillingQueryDetailsPage>();
         // ViewModels
         services.AddSingleton(settings);
         services.AddSingleton<YavscApiClient>(api);

src/PostIt/PostIt/ViewLocator.cs

@@ -19,7 +19,7 @@ namespace PostIt;
 public class ViewLocator : IDataTemplate
 {
 
-     public Control Build(object? data)
+    public Control Build(object? data)
     {
         try
         {
@@ -49,10 +49,12 @@ public class ViewLocator : IDataTemplate
             AddCircleMemberDialogViewModel => services.GetRequiredService<AddCircleMemberDialog>(),
             CirclesPageViewModel => services.GetRequiredService<CirclesPage>(),
             PostAclDialogViewModel => services.GetRequiredService<PostAclDialog>(),
+            BillingQueriesPageViewModel => services.GetRequiredService<BillingQueriesPage>(),
+            BillingQueryDetailsPageViewModel => services.GetRequiredService<BillingQueryDetailsPage>(),
             null => new TextBlock { Text = "No view for <null>" },
             _ => new TextBlock { Text = $"No view for {data.GetType().Name}" }
         };
     }
 
-     public bool Match(object? data) => data is ViewModelBase;
+    public bool Match(object? data) => data is ViewModelBase;
 }

src/PostIt/PostIt/ViewModels/Activity/BillingQueriesPageViewModel.cs

@@ -43,7 +43,7 @@ public partial class BillingQueriesPageViewModel : ViewModelBase, IActionStatusV
         ? $"Demandes en cours ({Form.Title})"
         : $"Commandes {Form.Title}";
     public string ContextLabel => $"{Performer.UserName} · {Activity.Name}";
-    public bool CanOpenDetails => !IsReadOnly;
+    public bool CanOpenDetails => true;
 
     public override bool CanNavigateNext
     {
@@ -75,7 +75,7 @@ public partial class BillingQueriesPageViewModel : ViewModelBase, IActionStatusV
 
     public Task InitializeAsync() => RefreshAsync();
 
-    private bool CanOpenSelectedQuery() => !IsReadOnly && SelectedQuery is not null;
+    private bool CanOpenSelectedQuery() => SelectedQuery is not null;
 
     [RelayCommand]
     public async Task RefreshAsync()
@@ -114,12 +114,6 @@ public partial class BillingQueriesPageViewModel : ViewModelBase, IActionStatusV
     [RelayCommand(CanExecute = nameof(CanOpenSelectedQuery))]
     public async Task OpenSelectedQueryAsync()
     {
-        if (IsReadOnly)
-        {
-            this.SetWarningStatus("Mode lecture seule: l'ouverture en modification est désactivée.");
-            return;
-        }
-
         if (SelectedQuery is null)
         {
             this.SetWarningStatus("Sélectionnez une commande.");
@@ -136,8 +130,13 @@ public partial class BillingQueriesPageViewModel : ViewModelBase, IActionStatusV
         try
         {
             var details = await _billingClient.GetQueryAsync(Form.ActionName, SelectedQuery.Id).ConfigureAwait(true);
-            var vm = Form.CreateCommandPageViewModel(Activity, Performer, _billingClient);
-            await vm!.InitializeAsync(details).ConfigureAwait(true);
+            var vm = new BillingQueryDetailsPageViewModel(
+                Activity,
+                Performer,
+                Form,
+                _billingClient,
+                details,
+                IsReadOnly);
             await app.PushPageAsync(vm).ConfigureAwait(true);
         }
         catch (HttpRequestException ex) when (ex.StatusCode is HttpStatusCode.Unauthorized or HttpStatusCode.Forbidden)

src/PostIt/PostIt/ViewModels/Activity/BillingQueryDetailsPageViewModel.cs

@@ -0,0 +1,208 @@
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Avalonia;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using PostIt.Helpers;
+using Yavsc;
+using Yavsc.Abstract.Workflow;
+using Yavsc.Api.Client;
+
+namespace PostIt.ViewModels;
+
+public partial class BillingQueryDetailsPageViewModel : ViewModelBase, IActionStatusViewModel
+{
+    private readonly BillingApiClient _billingClient;
+    private readonly BillingQueryDetailsDto _details;
+
+    public ActivityInfo Activity { get; }
+    public ActivityUserDisplayItem Performer { get; }
+    public CommandFormSummary Form { get; }
+    public bool IsReadOnly { get; }
+
+    public long Id => _details.Id;
+    public string Title => $"Detail commande #{_details.Id}";
+    public string ContextLabel => $"{Performer.UserName} · {Activity.Name} · {Form.Title}";
+    public string StatusLabel => _details.Status.ToString();
+    public string StatusGlyph => GetStatusGlyph(_details.Status);
+    public string StatusBadgeBackground => GetStatusBadgeBackground(_details.Status);
+    public string StatusBadgeBorder => GetStatusBadgeBorder(_details.Status);
+    public string StatusBadgeForeground => GetStatusBadgeForeground(_details.Status);
+    public string TitleForeground => StatusBadgeForeground;
+    public string BillingCode => _details.BillingCode;
+    public string Description => EmptyAsPlaceholder(_details.Description, "(sans description)");
+    public string Reason => EmptyAsPlaceholder(_details.Reason, "(aucun motif)");
+    public string AdditionalInfo => EmptyAsPlaceholder(_details.AdditionalInfo, "(aucune info complementaire)");
+    public string ClientId => EmptyAsPlaceholder(_details.ClientId, "(non renseigne)");
+    public string EventDateLabel => _details.EventDate?.ToLocalTime().ToString("f") ?? "Date non precisee";
+    public string ConsentLabel => _details.Consent ? "Oui" : "Non";
+    public string ProvisionalLabel => _details.Provisional.HasValue ? _details.Provisional.Value.ToString("0.00") : "(non renseigne)";
+    public string LocationLabel => BuildLocationLabel(_details.Location);
+    public string PrestationsLabel => BuildPrestationsLabel(_details);
+    public bool CanEdit => !IsReadOnly;
+
+    [ObservableProperty]
+    public partial bool IsBusy { get; set; }
+
+    [ObservableProperty]
+    public partial string StatusMessage { get; set; } = "Pret.";
+
+    [ObservableProperty]
+    public partial StatusNotice ActionStatus { get; set; } = StatusNotice.Info("Pret.");
+
+    public override bool CanNavigateNext
+    {
+        get => false;
+        protected set { _ = value; }
+    }
+
+    public override bool CanNavigatePrevious
+    {
+        get => true;
+        protected set { _ = value; }
+    }
+
+    public BillingQueryDetailsPageViewModel(
+        ActivityInfo activity,
+        ActivityUserDisplayItem performer,
+        CommandFormSummary form,
+        BillingApiClient billingClient,
+        BillingQueryDetailsDto details,
+        bool isReadOnly)
+    {
+        Activity = activity ?? throw new ArgumentNullException(nameof(activity));
+        Performer = performer ?? throw new ArgumentNullException(nameof(performer));
+        Form = form ?? throw new ArgumentNullException(nameof(form));
+        _billingClient = billingClient ?? throw new ArgumentNullException(nameof(billingClient));
+        _details = details ?? throw new ArgumentNullException(nameof(details));
+        IsReadOnly = isReadOnly;
+
+        this.SetInfoStatus("Details de commande charges.");
+    }
+
+    [RelayCommand]
+    private async Task OpenEditorAsync()
+    {
+        if (IsReadOnly)
+        {
+            this.SetWarningStatus("Mode lecture seule: edition desactivee.");
+            return;
+        }
+
+        var app = (App?)Application.Current;
+        if (app is null)
+        {
+            throw new InvalidOperationException("Application PostIt indisponible.");
+        }
+
+        IsBusy = true;
+        try
+        {
+            var vm = Form.CreateCommandPageViewModel(Activity, Performer, _billingClient);
+            if (vm is null)
+            {
+                this.SetWarningStatus("Ce formulaire n'est pas encore pris en charge en edition.");
+                return;
+            }
+
+            await vm.InitializeAsync(_details).ConfigureAwait(true);
+            await app.PushPageAsync(vm).ConfigureAwait(true);
+        }
+        catch (Exception ex)
+        {
+            this.SetErrorStatus($"Erreur lors de l'ouverture en edition: {ex.Message}");
+        }
+        finally
+        {
+            IsBusy = false;
+        }
+    }
+
+    [RelayCommand]
+    private async Task BackAsync()
+    {
+        var app = (App?)Application.Current;
+        if (app is null)
+        {
+            throw new InvalidOperationException("Application PostIt indisponible.");
+        }
+
+        await app.GoBackAsync().ConfigureAwait(true);
+    }
+
+    private static string EmptyAsPlaceholder(string? value, string placeholder)
+        => string.IsNullOrWhiteSpace(value) ? placeholder : value;
+
+    private static string BuildLocationLabel(BillingLocationDto? location)
+    {
+        if (location is null)
+        {
+            return "(non renseignee)";
+        }
+
+        var text = EmptyAsPlaceholder(location.Address, "adresse vide");
+        if (location.Latitude.HasValue && location.Longitude.HasValue)
+        {
+            text += $" ({location.Latitude.Value:0.####}, {location.Longitude.Value:0.####})";
+        }
+
+        return text;
+    }
+
+    private static string BuildPrestationsLabel(BillingQueryDetailsDto details)
+    {
+        if (details.PrestationIds.Count > 0)
+        {
+            return string.Join(", ", details.PrestationIds.Select(static id => id.ToString()));
+        }
+
+        return details.PrestationId.HasValue
+            ? details.PrestationId.Value.ToString()
+            : "(aucune)";
+    }
+
+    private static string GetStatusBadgeBackground(QueryStatus status)
+        => status switch
+        {
+            QueryStatus.Accepted => "#E6F7EC",
+            QueryStatus.InProgress => "#FFF4D6",
+            QueryStatus.Rejected => "#FDECEA",
+            QueryStatus.Failed => "#ECEFF1",
+            QueryStatus.Success => "#E8F8EF",
+            _ => "#EAF3FF",
+        };
+
+    private static string GetStatusBadgeBorder(QueryStatus status)
+        => status switch
+        {
+            QueryStatus.Accepted => "#2E7D32",
+            QueryStatus.InProgress => "#B26A00",
+            QueryStatus.Rejected => "#C62828",
+            QueryStatus.Failed => "#607D8B",
+            QueryStatus.Success => "#1E8E3E",
+            _ => "#2A5EA8",
+        };
+
+    private static string GetStatusBadgeForeground(QueryStatus status)
+        => status switch
+        {
+            QueryStatus.Accepted => "#1B5E20",
+            QueryStatus.InProgress => "#7A4A00",
+            QueryStatus.Rejected => "#8E0000",
+            QueryStatus.Failed => "#37474F",
+            QueryStatus.Success => "#145A2A",
+            _ => "#1A4178",
+        };
+
+    private static string GetStatusGlyph(QueryStatus status)
+        => status switch
+        {
+            QueryStatus.Accepted => "OK",
+            QueryStatus.InProgress => "~",
+            QueryStatus.Rejected => "!",
+            QueryStatus.Failed => "X",
+            QueryStatus.Success => "V",
+            _ => "i",
+        };
+}

src/PostIt/PostIt/Views/Activity/BillingQueriesPage.axaml

@@ -0,0 +1,90 @@
+<ContentPage xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:PostIt.ViewModels"
+             xmlns:postitControls="using:PostIt.Controls"
+             x:Class="PostIt.Views.BillingQueriesPage"
+             x:DataType="vm:BillingQueriesPageViewModel"
+             Header="Commandes billing">
+    <Grid RowDefinitions="Auto,Auto,Auto,*,Auto" Margin="12">
+        <StackPanel Grid.Row="0" Spacing="3">
+            <TextBlock Text="{Binding Title}" FontSize="20" FontWeight="Bold" />
+            <TextBlock Text="{Binding ContextLabel}" Opacity="0.75" />
+        </StackPanel>
+
+        <Grid Grid.Row="1" Margin="0,10,0,0" ColumnDefinitions="Auto,8,Auto,8,*">
+            <Border Grid.Column="0" Background="#EAF3FF" BorderBrush="#2A5EA8" BorderThickness="1" CornerRadius="6" Padding="8,3">
+                <TextBlock Text="{Binding IsReadOnly, StringFormat='Lecture seule : {0}'}" FontSize="11" />
+            </Border>
+            <Border Grid.Column="2" Background="#F2F7F2" BorderBrush="#2F6D2F" BorderThickness="1" CornerRadius="6" Padding="8,3">
+                <TextBlock Text="{Binding OngoingOnly, StringFormat='En cours uniquement : {0}'}" FontSize="11" />
+            </Border>
+            <TextBlock Grid.Column="4"
+                       HorizontalAlignment="Right"
+                       VerticalAlignment="Center"
+                       Text="{Binding Queries.Count, StringFormat='Résultats : {0}'}"
+                       Opacity="0.7" />
+        </Grid>
+
+        <Grid Grid.Row="2" ColumnDefinitions="Auto,8,Auto,*" Margin="0,12,0,12">
+            <Button Grid.Column="0" Content="Rafraîchir" Command="{Binding RefreshCommand}" />
+            <Button Content="Voir le detail"
+                    Grid.Column="2"
+                    Command="{Binding OpenSelectedQueryCommand}"
+                    IsVisible="{Binding CanOpenDetails}" />
+        </Grid>
+
+        <ListBox Grid.Row="3"
+                 ItemsSource="{Binding Queries}"
+                 SelectedItem="{Binding SelectedQuery, Mode=TwoWay}">
+            <ListBox.ItemTemplate>
+                <DataTemplate x:DataType="vm:BillingQueryDisplayItem">
+                    <Border BorderThickness="1"
+                            BorderBrush="#22000000"
+                            CornerRadius="8"
+                            Padding="10"
+                            Margin="0,0,0,8">
+                        <Grid RowDefinitions="Auto,Auto,Auto" ColumnDefinitions="*,Auto">
+                            <TextBlock Grid.Row="0"
+                                       Grid.Column="0"
+                                       Text="{Binding Description}"
+                                       FontWeight="Bold"
+                                       TextWrapping="Wrap" />
+                            <TextBlock Grid.Row="0"
+                                       Grid.Column="1"
+                                       Text="{Binding StatusLabel}"
+                                       FontSize="11"
+                                       Opacity="0.75"
+                                       HorizontalAlignment="Right" />
+
+                            <TextBlock Grid.Row="1"
+                                       Grid.ColumnSpan="2"
+                                       Margin="0,4,0,0"
+                                       Text="{Binding Summary}"
+                                       TextWrapping="Wrap"
+                                       FontSize="12"
+                                       Opacity="0.85" />
+
+                            <Grid Grid.Row="2" Grid.ColumnSpan="2" ColumnDefinitions="*,Auto" Margin="0,8,0,0">
+                                <TextBlock Grid.Column="0"
+                                           Text="{Binding EventDateLabel, StringFormat='Date : {0}'}"
+                                           FontSize="11"
+                                           Opacity="0.7" />
+                                <TextBlock Grid.Column="1"
+                                           Text="{Binding BillingCode, StringFormat='Code : {0}'}"
+                                           FontSize="11"
+                                           Opacity="0.65"
+                                           HorizontalAlignment="Right" />
+                            </Grid>
+                        </Grid>
+                    </Border>
+                </DataTemplate>
+            </ListBox.ItemTemplate>
+        </ListBox>
+
+        <Grid Grid.Row="4" ColumnDefinitions="*,Auto" Margin="0,12,0,0">
+            <postitControls:StatusBar Grid.Column="0"
+                                      DataContext="{Binding ActionStatus}" />
+            <ProgressBar Grid.Column="1" Width="120" IsIndeterminate="True" IsVisible="{Binding IsBusy}" />
+        </Grid>
+    </Grid>
+</ContentPage>

src/PostIt/PostIt/Views/Activity/BillingQueryDetailsPage.axaml

@@ -0,0 +1,131 @@
+<ContentPage xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:PostIt.ViewModels"
+             xmlns:postitControls="using:PostIt.Controls"
+             x:Class="PostIt.Views.BillingQueryDetailsPage"
+             x:DataType="vm:BillingQueryDetailsPageViewModel"
+             Header="Detail commande">
+    <Grid RowDefinitions="Auto,Auto,*,Auto" Margin="12">
+        <StackPanel Grid.Row="0" Spacing="4">
+            <TextBlock Text="{Binding Title}"
+                       FontSize="20"
+                       FontWeight="Bold"
+                       Foreground="{Binding TitleForeground}" />
+            <TextBlock Text="{Binding ContextLabel}" Opacity="0.75" />
+        </StackPanel>
+
+        <Grid Grid.Row="1" Margin="0,10,0,0" ColumnDefinitions="Auto,8,Auto,*">
+            <Button Grid.Column="0"
+                    Content="Retour"
+                    Command="{Binding BackCommand}" />
+            <Button Grid.Column="2"
+                    Content="Ouvrir en edition"
+                    Command="{Binding OpenEditorCommand}"
+                    IsVisible="{Binding CanEdit}" />
+        </Grid>
+
+        <ScrollViewer Grid.Row="2" Margin="0,12,0,12">
+            <StackPanel Spacing="10">
+                <Border BorderThickness="1"
+                        BorderBrush="#22000000"
+                        CornerRadius="8"
+                        Padding="10">
+                    <Grid ColumnDefinitions="Auto,12,*" RowDefinitions="Auto,Auto" RowSpacing="8">
+                        <TextBlock Grid.Row="0" Grid.Column="0" Text="Statut" FontWeight="SemiBold" />
+                        <Border Grid.Row="0"
+                                Grid.Column="2"
+                                Background="{Binding StatusBadgeBackground}"
+                                BorderBrush="{Binding StatusBadgeBorder}"
+                                BorderThickness="1"
+                                CornerRadius="6"
+                                Padding="8,3"
+                                HorizontalAlignment="Left">
+                            <StackPanel Orientation="Horizontal" Spacing="6">
+                                <TextBlock Text="{Binding StatusGlyph}"
+                                           Foreground="{Binding StatusBadgeForeground}"
+                                           FontWeight="Bold" />
+                                <TextBlock Text="{Binding StatusLabel}"
+                                           Foreground="{Binding StatusBadgeForeground}"
+                                           FontWeight="SemiBold" />
+                            </StackPanel>
+                        </Border>
+
+                        <TextBlock Grid.Row="1" Grid.Column="0" Text="Date" FontWeight="SemiBold" />
+                        <TextBlock Grid.Row="1" Grid.Column="2" Text="{Binding EventDateLabel}" />
+                    </Grid>
+                </Border>
+
+                <Border BorderThickness="1"
+                        BorderBrush="#22000000"
+                        CornerRadius="8"
+                        Padding="10">
+                    <Grid ColumnDefinitions="Auto,12,*" RowDefinitions="Auto,Auto,Auto,Auto" RowSpacing="8">
+                        <TextBlock Grid.Row="0" Grid.Column="0" Text="Description" FontWeight="SemiBold" />
+                        <TextBlock Grid.Row="0" Grid.Column="2" Text="{Binding Description}" TextWrapping="Wrap" />
+
+                        <TextBlock Grid.Row="1" Grid.Column="0" Text="Motif" FontWeight="SemiBold" />
+                        <TextBlock Grid.Row="1" Grid.Column="2" Text="{Binding Reason}" TextWrapping="Wrap" />
+
+                        <TextBlock Grid.Row="2" Grid.Column="0" Text="Infos" FontWeight="SemiBold" />
+                        <TextBlock Grid.Row="2" Grid.Column="2" Text="{Binding AdditionalInfo}" TextWrapping="Wrap" />
+
+                        <TextBlock Grid.Row="3" Grid.Column="0" Text="Consentement" FontWeight="SemiBold" />
+                        <TextBlock Grid.Row="3" Grid.Column="2" Text="{Binding ConsentLabel}" />
+                    </Grid>
+                </Border>
+
+                <Expander Header="Metadonnees techniques"
+                          IsExpanded="False">
+                    <Border BorderThickness="1"
+                            BorderBrush="#22000000"
+                            CornerRadius="8"
+                            Padding="10"
+                            Margin="0,6,0,0">
+                        <Grid ColumnDefinitions="Auto,12,*" RowDefinitions="Auto,Auto,Auto,Auto,Auto" RowSpacing="8">
+                            <TextBlock Grid.Row="0" Grid.Column="0" Text="Code" FontWeight="SemiBold" />
+                            <TextBlock Grid.Row="0"
+                                       Grid.Column="2"
+                                       Text="{Binding BillingCode}"
+                                       FontFamily="Consolas, Courier New, monospace" />
+
+                            <TextBlock Grid.Row="1" Grid.Column="0" Text="Client" FontWeight="SemiBold" />
+                            <TextBlock Grid.Row="1"
+                                       Grid.Column="2"
+                                       Text="{Binding ClientId}"
+                                       FontFamily="Consolas, Courier New, monospace" />
+
+                            <TextBlock Grid.Row="2" Grid.Column="0" Text="Provision" FontWeight="SemiBold" />
+                            <TextBlock Grid.Row="2"
+                                       Grid.Column="2"
+                                       Text="{Binding ProvisionalLabel}"
+                                       FontFamily="Consolas, Courier New, monospace" />
+
+                            <TextBlock Grid.Row="3" Grid.Column="0" Text="Lieu" FontWeight="SemiBold" />
+                            <TextBlock Grid.Row="3"
+                                       Grid.Column="2"
+                                       Text="{Binding LocationLabel}"
+                                       TextWrapping="Wrap"
+                                       FontFamily="Consolas, Courier New, monospace" />
+
+                            <TextBlock Grid.Row="4" Grid.Column="0" Text="Prestations" FontWeight="SemiBold" />
+                            <TextBlock Grid.Row="4"
+                                       Grid.Column="2"
+                                       Text="{Binding PrestationsLabel}"
+                                       TextWrapping="Wrap"
+                                       FontFamily="Consolas, Courier New, monospace" />
+                        </Grid>
+                    </Border>
+                </Expander>
+            </StackPanel>
+        </ScrollViewer>
+
+        <Grid Grid.Row="3" ColumnDefinitions="*,Auto" Margin="0,8,0,0">
+            <postitControls:StatusBar Grid.Column="0"
+                                      DataContext="{Binding ActionStatus}" />
+            <ProgressBar Grid.Column="1"
+                         Width="120"
+                         IsIndeterminate="True"
+                         IsVisible="{Binding IsBusy}" />
+        </Grid>
+    </Grid>
+</ContentPage>

src/PostIt/PostIt/Views/Activity/BillingQueryDetailsPage.axaml.cs

@@ -0,0 +1,17 @@
+using Avalonia.Controls;
+using Avalonia.Markup.Xaml;
+
+namespace PostIt.Views;
+
+public partial class BillingQueryDetailsPage : ContentPage
+{
+    public BillingQueryDetailsPage()
+    {
+        InitializeComponent();
+    }
+
+    private void InitializeComponent()
+    {
+        AvaloniaXamlLoader.Load(this);
+    }
+}

src/PostIt/PostIt/Views/BillingQueriesPage.axaml

@@ -1,45 +0,0 @@
-<ContentPage xmlns="https://github.com/avaloniaui"
-             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-             xmlns:vm="using:PostIt.ViewModels"
-             xmlns:postitControls="using:PostIt.Controls"
-             x:Class="PostIt.Views.BillingQueriesPage"
-             x:DataType="vm:BillingQueriesPageViewModel"
-             Header="Commandes billing">
-    <Grid RowDefinitions="Auto,Auto,*,Auto" Margin="12">
-        <StackPanel Grid.Row="0" Spacing="2">
-            <TextBlock Text="{Binding Title}" FontSize="18" FontWeight="Bold" />
-            <TextBlock Text="{Binding ContextLabel}" Opacity="0.75" />
-        </StackPanel>
-
-        <StackPanel Grid.Row="1" Orientation="Horizontal" Spacing="8" Margin="0,12,0,12">
-            <Button Content="Rafraîchir" Command="{Binding RefreshCommand}" />
-            <Button Content="Ouvrir la commande"
-                    Command="{Binding OpenSelectedQueryCommand}"
-                    IsVisible="{Binding CanOpenDetails}" />
-        </StackPanel>
-
-        <ListBox Grid.Row="2" ItemsSource="{Binding Queries}" SelectedItem="{Binding SelectedQuery, Mode=TwoWay}">
-            <ListBox.ItemTemplate>
-                <DataTemplate x:DataType="vm:BillingQueryDisplayItem">
-                    <Border BorderThickness="0,0,0,1" BorderBrush="#22000000" Padding="0,0,0,10" Margin="0,0,0,10">
-                        <StackPanel Spacing="3">
-                            <TextBlock Text="{Binding Description}" FontWeight="Bold" />
-                            <TextBlock Text="{Binding Summary}" TextWrapping="Wrap" FontSize="12" Opacity="0.8" />
-                            <StackPanel Orientation="Horizontal" Spacing="8">
-                                <TextBlock Text="{Binding EventDateLabel}" FontSize="11" Opacity="0.7" />
-                                <TextBlock Text="{Binding StatusLabel}" FontSize="11" Opacity="0.7" />
-                                <TextBlock Text="{Binding BillingCode}" FontSize="11" Opacity="0.6" />
-                            </StackPanel>
-                        </StackPanel>
-                    </Border>
-                </DataTemplate>
-            </ListBox.ItemTemplate>
-        </ListBox>
-
-        <Grid Grid.Row="3" ColumnDefinitions="*,Auto" Margin="0,12,0,0">
-            <postitControls:StatusBar Grid.Column="0"
-                                      DataContext="{Binding ActionStatus}" />
-            <ProgressBar Grid.Column="1" Width="120" IsIndeterminate="True" IsVisible="{Binding IsBusy}" />
-        </Grid>
-    </Grid>
-</ContentPage>

src/Yavsc.Abstract/Identity/Security/FileAccessControlRulePayload.cs

@@ -0,0 +1,12 @@
+
+namespace Yavsc.Models.Access
+{
+    using Yavsc.Abstract.Identity.Security;
+
+    public class FileAccessControlRulePayload : CircleAuthorization
+    {
+        public virtual string Path { get; set; }
+
+
+    }
+}

src/Yavsc.Api.Test/Fixtures/ApiWebServerFixture.cs

@@ -204,6 +204,10 @@ public sealed class ApiWebServerFixture : WebHostFixture
             ClientId = "alice",
             PerformerId = "alice",
             Consent = true,
+            UserCreated = "alice",
+            UserModified = "alice",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
             EventDate = DateTime.UtcNow.AddDays(1),
             Location = location,
             Reason = "Initial rendez-vous",
@@ -293,6 +297,10 @@ public sealed class ApiWebServerFixture : WebHostFixture
             ClientId = "alice",
             PerformerId = "alice",
             Consent = true,
+            UserCreated = "alice",
+            UserModified = "alice",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
             EventDate = DateTime.UtcNow.AddDays(3),
             Location = location,
             PrestationId = prestation1.Id,
@@ -308,6 +316,10 @@ public sealed class ApiWebServerFixture : WebHostFixture
             ClientId = "alice",
             PerformerId = "alice",
             Consent = true,
+            UserCreated = "alice",
+            UserModified = "alice",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
             EventDate = DateTime.UtcNow.AddDays(4),
             Location = location,
             Prestations = new List<HairPrestationCollectionItem>

src/Yavsc.Api.Test/FrontOfficeApiControllerTests.cs

@@ -49,8 +49,9 @@ public sealed class FrontOfficeApiControllerTests : IClassFixture<ApiWebServerFi
 
         using var http = NewClient();
         var response = await http.PostAsync($"/api/v1/front/query/accept?billingCode=Rdv&queryId={queryId}", content: null, TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
 
-        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
 
         using var assertScope = _fixture.Services.CreateScope();
         var assertDb = assertScope.ServiceProvider.GetRequiredService<ApplicationDbContext>();

src/Yavsc.Api.Test/RdvQueryApiControllerTests.cs

@@ -82,4 +82,65 @@ public sealed class RdvQueryApiControllerTests : IClassFixture<ApiWebServerFixtu
         var missingResponse = await http.GetAsync($"/api/v1/billing/Rdv/{fetched.Id}", TestContext.Current.CancellationToken);
         Assert.Equal(HttpStatusCode.NotFound, missingResponse.StatusCode);
     }
+
+    [Fact]
+    public async Task PostQuery_ignores_client_field_and_uses_authenticated_user()
+    {
+        _fixture.ResetAndSeedRdvQueryGraph();
+        using var http = NewClient(subject: "alice");
+
+        var createPayload = new
+        {
+            ActivityCode = "dev",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = DateTime.UtcNow.AddDays(2),
+            Location = new
+            {
+                Address = "2 rue du Test",
+                Latitude = 48.8567,
+                Longitude = 2.3523,
+            },
+            Reason = "Rendez-vous sans champ client",
+            Status = QueryStatus.Inserted,
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/Rdv", createPayload, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.Created, createResponse.StatusCode);
+
+        var created = await createResponse.Content.ReadFromJsonAsync<RdvQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(created);
+        Assert.Equal("alice", created!.ClientId);
+    }
+
+    [Fact]
+    public async Task PostQuery_accepts_local_datetime_and_persists_as_utc()
+    {
+        _fixture.ResetAndSeedRdvQueryGraph();
+        using var http = NewClient(subject: "alice");
+
+        var localEventDate = DateTime.Now.AddDays(2);
+        var createPayload = new
+        {
+            ActivityCode = "dev",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = localEventDate,
+            Location = new
+            {
+                Address = "3 rue du Test",
+                Latitude = 48.8568,
+                Longitude = 2.3524,
+            },
+            Reason = "Rendez-vous date locale",
+            Status = QueryStatus.Inserted,
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/Rdv", createPayload, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.Created, createResponse.StatusCode);
+
+        var created = await createResponse.Content.ReadFromJsonAsync<RdvQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(created);
+        Assert.Equal(DateTimeKind.Utc, created!.EventDate.Kind);
+    }
 }

src/Yavsc.Api/Controllers/Business/ActivityApiController.cs

@@ -51,6 +51,14 @@ namespace Yavsc.Controllers
                 .Distinct()
                 .ToArray();
 
+            // Some providers are brittle when translating Contains over an
+            // empty in-memory array. If there is no candidate activity code,
+            // the catalog is empty by definition.
+            if (codes.Length == 0)
+            {
+                return Ok(new List<ActivityInfo>());
+            }
+
             var performerCounts = await (
                 from ua in _context.UserActivities.AsNoTracking()
                 where !string.IsNullOrWhiteSpace(ua.DoesCode) && codes.Contains(ua.DoesCode)
@@ -64,10 +72,10 @@ namespace Yavsc.Controllers
 
             var filteredActivities = activities
                 .Where(a =>
-                    (performerCounts.TryGetValue(a.Code, out var ownCount) && ownCount > 0)
+                    (TryGetPerformerCount(performerCounts, a.Code, out var ownCount) && ownCount > 0)
                     || (a.Children ?? new List<Activity>())
                         .Where(c => !c.Hidden)
-                        .Any(c => performerCounts.TryGetValue(c.Code, out var childCount) && childCount > 0))
+                        .Any(c => TryGetPerformerCount(performerCounts, c.Code, out var childCount) && childCount > 0))
                 .ToList();
 
             return Ok(filteredActivities.Select(a => ToBrowseItem(a, performerCounts)).ToList());
@@ -269,10 +277,10 @@ namespace Yavsc.Controllers
                 Code = activity.Code,
                 Name = activity.Name,
                 ParentCode = activity.ParentCode,
-                Description = activity.Description,
+                Description = activity.Description ?? string.Empty,
                 Photo = activity.Photo,
                 Rate = activity.Rate,
-                PerformerCount = performerCounts.TryGetValue(activity.Code, out var count) ? count : 0,
+                PerformerCount = TryGetPerformerCount(performerCounts, activity.Code, out var count) ? count : 0,
                 Forms = (activity.Forms ?? Enumerable.Empty<CommandForm>())
                     .Select(f => new CommandFormSummary
                     {
@@ -283,17 +291,17 @@ namespace Yavsc.Controllers
                     .ToList(),
                 Children = (activity.Children ?? Enumerable.Empty<Activity>())
                     .Where(c => !c.Hidden)
-                    .Where(c => performerCounts.TryGetValue(c.Code, out var childCount) && childCount > 0)
+                    .Where(c => TryGetPerformerCount(performerCounts, c.Code, out var childCount) && childCount > 0)
                     .OrderByDescending(c => c.Rate)
                     .Select(c => new ActivityInfo
                     {
                         Code = c.Code,
                         Name = c.Name,
                         ParentCode = c.ParentCode,
-                        Description = c.Description,
+                        Description = c.Description ?? string.Empty,
                         Photo = c.Photo,
                         Rate = c.Rate,
-                        PerformerCount = performerCounts.TryGetValue(c.Code, out var childCount) ? childCount : 0,
+                        PerformerCount = TryGetPerformerCount(performerCounts, c.Code, out var childCount) ? childCount : 0,
                         Forms = (c.Forms ?? Enumerable.Empty<CommandForm>())
                             .Select(f => new CommandFormSummary
                             {
@@ -306,5 +314,19 @@ namespace Yavsc.Controllers
                     .ToList(),
             };
         }
+
+        private static bool TryGetPerformerCount(
+            IReadOnlyDictionary<string, int> performerCounts,
+            string code,
+            out int count)
+        {
+            if (string.IsNullOrWhiteSpace(code))
+            {
+                count = 0;
+                return false;
+            }
+
+            return performerCounts.TryGetValue(code, out count);
+        }
     }
 }

src/Yavsc.Api/Controllers/Business/FrontOfficeApiController.cs

@@ -3,6 +3,7 @@ using Microsoft.AspNetCore.Mvc;
 using Yavsc.Helpers;
 using Yavsc.Models;
 using Yavsc.Services;
+using Yavsc.Server.Helpers;
 using Yavsc.ViewModels.FrontOffice;
 
 namespace Yavsc.ApiControllers
@@ -15,10 +16,10 @@ namespace Yavsc.ApiControllers
 
         private IBillingService billing;
 
-        public FrontOfficeApiController(ApplicationDbContext context, IBillingService billing)
+        public FrontOfficeApiController(ApplicationDbContext context, IBillingService billing = null)
         {
             dbContext = context;
-            this.billing = billing;
+            this.billing = billing ?? new BillingService(context);
         }
 
         [HttpGet("profiles/{actCode}")]
@@ -36,7 +37,7 @@ namespace Yavsc.ApiControllers
             if (billing == null) return BadRequest();
 
             billing.Status = QueryStatus.Rejected;
-            dbContext.SaveChanges();
+            dbContext.SaveChanges(User.GetUserId());
             return Ok();
         }
 
@@ -48,7 +49,7 @@ namespace Yavsc.ApiControllers
             var billing = BillingService.GetBillable(dbContext, billingCode, queryId);
             if (billing == null) return BadRequest();
             billing.Status = QueryStatus.Accepted;
-            dbContext.SaveChanges();
+            dbContext.SaveChanges(User.GetUserId());
             return Ok();
         }
     }

src/Yavsc.Api/Controllers/Business/HairCutQueryApiController.cs

@@ -82,19 +82,17 @@ public class HairCutQueryApiController : Controller
     public async Task<IActionResult> PostQuery([FromBody] HairCutQuery query, CancellationToken cancellationToken)
     {
         var uid = User.GetUserId();
-        if (string.IsNullOrWhiteSpace(query.ClientId))
-        {
-            query.ClientId = uid;
-        }
+        query.ClientId = uid;
 
+        ModelState.Remove("Client");
         ModelState.Remove("ClientId");
+        ModelState.Remove("UserCreated");
+        ModelState.Remove("UserModified");
+        ModelState.Remove("SelectedProfile");
         ModelState.Remove("Prestation");
-
-        if (query.ClientId != uid && !User.IsInRole(Constants.AdminGroupName))
-        {
-            ModelState.AddModelError("ClientId", "You can only create your own HairCutQuery");
-            return BadRequest(ModelState);
-        }
+        ModelState.Remove("PerformerProfile");
+        ModelState.Remove("Context");
+        ModelState.Remove("Regularization");
 
         query.Prestation = await _context.HairPrestation
             .SingleOrDefaultAsync(p => p.Id == query.PrestationId, cancellationToken);

src/Yavsc.Api/Controllers/Business/HairMultiCutQueryApiController.cs

@@ -89,18 +89,16 @@ public class HairMultiCutQueryApiController : Controller
     public async Task<IActionResult> PostQuery([FromBody] HairMultiCutQuery query, CancellationToken cancellationToken)
     {
         var uid = User.GetUserId();
-        if (string.IsNullOrWhiteSpace(query.ClientId))
-        {
-            query.ClientId = uid;
-        }
+        query.ClientId = uid;
 
+        ModelState.Remove("Client");
         ModelState.Remove("ClientId");
-
-        if (query.ClientId != uid && !User.IsInRole(Constants.AdminGroupName))
-        {
-            ModelState.AddModelError("ClientId", "You can only create your own HairMultiCutQuery");
-            return BadRequest(ModelState);
-        }
+        ModelState.Remove("UserCreated");
+        ModelState.Remove("UserModified");
+        ModelState.Remove("SelectedProfile");
+        ModelState.Remove("PerformerProfile");
+        ModelState.Remove("Context");
+        ModelState.Remove("Regularization");
 
         if (query.Prestations is null || query.Prestations.Count == 0)
         {

src/Yavsc.Api/Controllers/Business/RdvQueryApiController.cs

@@ -65,18 +65,18 @@ public class RdvQueryApiController : Controller
     public async Task<IActionResult> PostQuery([FromBody] RdvQuery query, CancellationToken cancellationToken)
     {
         var uid = User.GetUserId();
-        if (string.IsNullOrWhiteSpace(query.ClientId))
-        {
-            query.ClientId = uid;
-        }
+        // Security: the caller always posts for themselves.
+        query.ClientId = uid;
+        query.EventDate = EnsureUtc(query.EventDate);
 
+        ModelState.Remove("Client");
         ModelState.Remove("ClientId");
-
-        if (query.ClientId != uid && !User.IsInRole(Constants.AdminGroupName))
-        {
-            ModelState.AddModelError("ClientId", "You can only create your own RdvQuery");
-            return BadRequest(ModelState);
-        }
+        ModelState.Remove("UserCreated");
+        ModelState.Remove("UserModified");
+        ModelState.Remove("SelectedProfile");
+        ModelState.Remove("PerformerProfile");
+        ModelState.Remove("Context");
+        ModelState.Remove("Regularization");
 
         if (!ModelState.IsValid)
         {
@@ -123,23 +123,44 @@ public class RdvQueryApiController : Controller
     [HttpPut("{id}")]
     public async Task<IActionResult> PutQuery([FromRoute] long id, [FromBody] RdvQuery query, CancellationToken cancellationToken)
     {
-        if (!ModelState.IsValid)
-        {
-            return BadRequest(ModelState);
-        }
-
-        if (id != query.Id)
-        {
-            return BadRequest();
-        }
-
         var uid = User.GetUserId();
-        if (query.ClientId != uid && !User.IsInRole(Constants.AdminGroupName))
+        var existing = await _context.RdvQueries
+            .Include(q => q.Location)
+            .SingleOrDefaultAsync(q => q.Id == id, cancellationToken);
+
+        if (existing is null)
+        {
+            return NotFound();
+        }
+
+        if (existing.ClientId != uid && !User.IsInRole(Constants.AdminGroupName))
         {
             return Forbid();
         }
 
-        _context.Entry(query).State = EntityState.Modified;
+        existing.ActivityCode = query.ActivityCode;
+        existing.PerformerId = query.PerformerId;
+        existing.Consent = query.Consent;
+        existing.EventDate = EnsureUtc(query.EventDate);
+        existing.LocationType = query.LocationType;
+        existing.Reason = query.Reason;
+        existing.Status = query.Status;
+        existing.Provisional = query.Provisional;
+
+        if (query.Location is not null)
+        {
+            var resolvedLocation = await _context.Locations.FirstOrDefaultAsync(
+                x => x.Address == query.Location.Address
+                  && x.Longitude == query.Location.Longitude
+                  && x.Latitude == query.Location.Latitude,
+                cancellationToken);
+
+            existing.Location = resolvedLocation ?? query.Location;
+            if (resolvedLocation is null)
+            {
+                _context.Attach(query.Location);
+            }
+        }
 
         try
         {
@@ -186,4 +207,14 @@ public class RdvQueryApiController : Controller
     {
         return _context.RdvQueries.Any(e => e.Id == id);
     }
+
+    private static DateTime EnsureUtc(DateTime value)
+    {
+        return value.Kind switch
+        {
+            DateTimeKind.Utc => value,
+            DateTimeKind.Local => value.ToUniversalTime(),
+            _ => DateTime.SpecifyKind(value, DateTimeKind.Utc)
+        };
+    }
 }

src/Yavsc.Blogs.Tests/Fixtures/BlogsWebServerFixture.cs

@@ -370,8 +370,6 @@ public sealed class BlogsWebServerFixture : WebHostFixture
         }
     }
 
-
-
     /// <summary>Create a circle owned by <paramref name="ownerId"/>
     /// directly in the SQLite store and return its server-assigned
     /// id.</summary>
@@ -415,5 +413,4 @@ public sealed class BlogsWebServerFixture : WebHostFixture
         db.SaveChanges();
         return post.Id;
     }
-
 }

src/Yavsc.Blogs/Controllers/BlogApiController.cs

@@ -55,6 +55,14 @@ namespace Yavsc.Blogs.Controllers
         [HttpPut("{id}")]
         public async Task<IActionResult> PutBlog(long id, [FromBody] Models.Blog.BlogPost blog)
         {
+            // These properties are server-managed or optional graph members and
+            // should not block JSON payloads coming from API clients.
+            ModelState.Remove(nameof(Models.Blog.BlogPost.Author));
+            ModelState.Remove(nameof(Models.Blog.BlogPost.Tags));
+            ModelState.Remove(nameof(Models.Blog.BlogPost.Comments));
+            ModelState.Remove(nameof(Models.Blog.BlogPost.UserCreated));
+            ModelState.Remove(nameof(Models.Blog.BlogPost.UserModified));
+
             if (!ModelState.IsValid)
             {
                 return BadRequest(ModelState);
@@ -87,6 +95,14 @@ namespace Yavsc.Blogs.Controllers
         [HttpPost]
         public IActionResult PostBlog([FromBody] Models.Blog.BlogPost blog)
         {
+            // These properties are server-managed or optional graph members and
+            // should not block JSON payloads coming from API clients.
+            ModelState.Remove(nameof(Models.Blog.BlogPost.Author));
+            ModelState.Remove(nameof(Models.Blog.BlogPost.Tags));
+            ModelState.Remove(nameof(Models.Blog.BlogPost.Comments));
+            ModelState.Remove(nameof(Models.Blog.BlogPost.UserCreated));
+            ModelState.Remove(nameof(Models.Blog.BlogPost.UserModified));
+
             if (!ModelState.IsValid)
             {
                 return BadRequest(ModelState);

src/Yavsc.Org/Controllers/Accounting/AccountController.cs

@@ -25,6 +25,7 @@ using IdentityModel;
 using Yavsc.Server.Helpers;
 using Microsoft.AspNetCore.Mvc.Localization;
 using System.Diagnostics;
+using System.Data.Common;
 
 namespace Yavsc.Controllers
 {
@@ -467,8 +468,25 @@ IHtmlLocalizerFactory htmlLocalizerFactory,
 
             if (ModelState.IsValid)
             {
+                var existingUser = await _userManager.FindByEmailAsync(model.Email);
+                if (existingUser is not null)
+                {
+                    ModelState.AddModelError(nameof(model.Email), _localizer["DuplicateEmail"]);
+                    return View(model);
+                }
+
                 var user = new ApplicationUser { UserName = model.UserName, Email = model.Email };
-                var result = await _userManager.CreateAsync(user, model.Password);
+                IdentityResult result;
+                try
+                {
+                    result = await _userManager.CreateAsync(user, model.Password);
+                }
+                catch (DbUpdateException ex) when (IsDuplicateEmailViolation(ex))
+                {
+                    _logger.LogWarning(ex, "Registration rejected: duplicate email '{Email}'.", model.Email);
+                    ModelState.AddModelError(nameof(model.Email), _localizer["DuplicateEmail"]);
+                    return View(model);
+                }
                 if (result.Succeeded)
                 {
                     _logger.LogInformation(3, "User created a new account with password.");
@@ -517,6 +535,21 @@ IHtmlLocalizerFactory htmlLocalizerFactory,
             return View(model);
         }
 
+        private static bool IsDuplicateEmailViolation(Exception exception)
+        {
+            for (var current = exception; current is not null; current = current.InnerException)
+            {
+                if (current is DbException pg
+                    && pg.ErrorCode == 23505)
+                    // UNIQUE VIOLATION https://www.postgresql.org/docs/8.4/errcodes-appendix.html
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
         [Authorize, HttpPost, ValidateAntiForgeryToken]
         public async Task<IActionResult> SendConfirationEmail()
         {

src/Yavsc.Org/Controllers/Communicating/CommentsController.cs

@@ -121,6 +121,7 @@ namespace Yavsc.Controllers
         public async Task<IActionResult> Create(Comment comment)
         {
             comment.UserCreated = User.GetUserId();
+            comment.UserModified = comment.UserCreated;
             // AuthorId/UserCreated is set server-side after model binding;
             // remove the stale binding error so a valid authenticated POST
             // does not fall into the invalid branch.
@@ -129,7 +130,7 @@ namespace Yavsc.Controllers
             if (ModelState.IsValid)
             {
                 _context.Comment.Add(comment);
-                await _context.SaveChangesAsync();
+                await _context.SaveChangesAsync(comment.UserCreated);
                 return RedirectToAction("Index");
             }
             ViewBag.ReceiverId = new SelectList(_context.BlogSpot, "Id", "Title", comment.ReceiverId);

src/Yavsc.Org/Migrations/20260907091755_AddCircleAuthorizationToFileAcl.cs

@@ -0,0 +1,825 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Yavsc.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddCircleAuthorizationToFileAcl : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_BankIdentity_AspNetUsers_UserId",
+                table: "BankIdentity");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_DeviceDeclaration_AspNetUsers_DeviceOwnerId",
+                table: "DeviceDeclaration");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_Estimates_Performers_OwnerId",
+                table: "Estimates");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_HairMultiCutQueries_Locations_LocationId",
+                table: "HairMultiCutQueries");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_RdvQueries_Locations_LocationId",
+                table: "RdvQueries");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Content",
+                table: "TrustDeclarations",
+                type: "character varying(2000)",
+                maxLength: 2000,
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "character varying(2000)",
+                oldMaxLength: 2000,
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserModified",
+                table: "RdvQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserCreated",
+                table: "RdvQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Reason",
+                table: "RdvQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<long>(
+                name: "LocationId",
+                table: "RdvQueries",
+                type: "bigint",
+                nullable: false,
+                defaultValue: 0L,
+                oldClrType: typeof(long),
+                oldType: "bigint",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Description",
+                table: "RdvQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserModified",
+                table: "Project",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserCreated",
+                table: "Project",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "WebSite",
+                table: "Performers",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "ExerciseCountryCode",
+                table: "Performers",
+                type: "text",
+                nullable: false,
+                oldClrType: typeof(string),
+                oldType: "character varying(2)",
+                oldMaxLength: 2);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserModified",
+                table: "HairMultiCutQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserCreated",
+                table: "HairMultiCutQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<long>(
+                name: "LocationId",
+                table: "HairMultiCutQueries",
+                type: "bigint",
+                nullable: false,
+                defaultValue: 0L,
+                oldClrType: typeof(long),
+                oldType: "bigint",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Description",
+                table: "HairMultiCutQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserModified",
+                table: "HairCutQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserCreated",
+                table: "HairCutQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Description",
+                table: "HairCutQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "AdditionalInfo",
+                table: "HairCutQueries",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Title",
+                table: "Estimates",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "OwnerId",
+                table: "Estimates",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Description",
+                table: "Estimates",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "AttachedGraphicsString",
+                table: "Estimates",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "AttachedFilesString",
+                table: "Estimates",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Version",
+                table: "DeviceDeclaration",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Platform",
+                table: "DeviceDeclaration",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Model",
+                table: "DeviceDeclaration",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "DeviceOwnerId",
+                table: "DeviceDeclaration",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserModified",
+                table: "Comment",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserCreated",
+                table: "Comment",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Article",
+                table: "Comment",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Title",
+                table: "Bug",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Description",
+                table: "Bug",
+                type: "character varying(10240)",
+                maxLength: 10240,
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "character varying(10240)",
+                oldMaxLength: 10240,
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "WicketCode",
+                table: "BankIdentity",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserId",
+                table: "BankIdentity",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "IBAN",
+                table: "BankIdentity",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "BankCode",
+                table: "BankIdentity",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "BIC",
+                table: "BankIdentity",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "AccountNumber",
+                table: "BankIdentity",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_BankIdentity_AspNetUsers_UserId",
+                table: "BankIdentity",
+                column: "UserId",
+                principalTable: "AspNetUsers",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Cascade);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_DeviceDeclaration_AspNetUsers_DeviceOwnerId",
+                table: "DeviceDeclaration",
+                column: "DeviceOwnerId",
+                principalTable: "AspNetUsers",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Cascade);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_Estimates_Performers_OwnerId",
+                table: "Estimates",
+                column: "OwnerId",
+                principalTable: "Performers",
+                principalColumn: "PerformerId",
+                onDelete: ReferentialAction.Cascade);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_HairMultiCutQueries_Locations_LocationId",
+                table: "HairMultiCutQueries",
+                column: "LocationId",
+                principalTable: "Locations",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Cascade);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_RdvQueries_Locations_LocationId",
+                table: "RdvQueries",
+                column: "LocationId",
+                principalTable: "Locations",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Cascade);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_BankIdentity_AspNetUsers_UserId",
+                table: "BankIdentity");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_DeviceDeclaration_AspNetUsers_DeviceOwnerId",
+                table: "DeviceDeclaration");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_Estimates_Performers_OwnerId",
+                table: "Estimates");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_HairMultiCutQueries_Locations_LocationId",
+                table: "HairMultiCutQueries");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_RdvQueries_Locations_LocationId",
+                table: "RdvQueries");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Content",
+                table: "TrustDeclarations",
+                type: "character varying(2000)",
+                maxLength: 2000,
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "character varying(2000)",
+                oldMaxLength: 2000);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserModified",
+                table: "RdvQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserCreated",
+                table: "RdvQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Reason",
+                table: "RdvQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<long>(
+                name: "LocationId",
+                table: "RdvQueries",
+                type: "bigint",
+                nullable: true,
+                oldClrType: typeof(long),
+                oldType: "bigint");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Description",
+                table: "RdvQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserModified",
+                table: "Project",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserCreated",
+                table: "Project",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "WebSite",
+                table: "Performers",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "ExerciseCountryCode",
+                table: "Performers",
+                type: "character varying(2)",
+                maxLength: 2,
+                nullable: false,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserModified",
+                table: "HairMultiCutQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserCreated",
+                table: "HairMultiCutQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<long>(
+                name: "LocationId",
+                table: "HairMultiCutQueries",
+                type: "bigint",
+                nullable: true,
+                oldClrType: typeof(long),
+                oldType: "bigint");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Description",
+                table: "HairMultiCutQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserModified",
+                table: "HairCutQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserCreated",
+                table: "HairCutQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Description",
+                table: "HairCutQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "AdditionalInfo",
+                table: "HairCutQueries",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Title",
+                table: "Estimates",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "OwnerId",
+                table: "Estimates",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Description",
+                table: "Estimates",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "AttachedGraphicsString",
+                table: "Estimates",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "AttachedFilesString",
+                table: "Estimates",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Version",
+                table: "DeviceDeclaration",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Platform",
+                table: "DeviceDeclaration",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Model",
+                table: "DeviceDeclaration",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "DeviceOwnerId",
+                table: "DeviceDeclaration",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserModified",
+                table: "Comment",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserCreated",
+                table: "Comment",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Article",
+                table: "Comment",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Title",
+                table: "Bug",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Description",
+                table: "Bug",
+                type: "character varying(10240)",
+                maxLength: 10240,
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "character varying(10240)",
+                oldMaxLength: 10240);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "WicketCode",
+                table: "BankIdentity",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "UserId",
+                table: "BankIdentity",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "IBAN",
+                table: "BankIdentity",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "BankCode",
+                table: "BankIdentity",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "BIC",
+                table: "BankIdentity",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "AccountNumber",
+                table: "BankIdentity",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_BankIdentity_AspNetUsers_UserId",
+                table: "BankIdentity",
+                column: "UserId",
+                principalTable: "AspNetUsers",
+                principalColumn: "Id");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_DeviceDeclaration_AspNetUsers_DeviceOwnerId",
+                table: "DeviceDeclaration",
+                column: "DeviceOwnerId",
+                principalTable: "AspNetUsers",
+                principalColumn: "Id");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_Estimates_Performers_OwnerId",
+                table: "Estimates",
+                column: "OwnerId",
+                principalTable: "Performers",
+                principalColumn: "PerformerId");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_HairMultiCutQueries_Locations_LocationId",
+                table: "HairMultiCutQueries",
+                column: "LocationId",
+                principalTable: "Locations",
+                principalColumn: "Id");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_RdvQueries_Locations_LocationId",
+                table: "RdvQueries",
+                column: "LocationId",
+                principalTable: "Locations",
+                principalColumn: "Id");
+        }
+    }
+}

src/Yavsc.Org/Migrations/20260907100133_fileACL.cs

@@ -0,0 +1,52 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Yavsc.Migrations
+{
+    /// <inheritdoc />
+    public partial class fileACL : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "CircleAuthorizationToFile",
+                columns: table => new
+                {
+                    CircleId = table.Column<long>(type: "bigint", nullable: false),
+                    Path = table.Column<string>(type: "text", nullable: false),
+                    OwnerId = table.Column<string>(type: "text", nullable: false),
+                    Access = table.Column<byte>(type: "smallint", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_CircleAuthorizationToFile", x => new { x.CircleId, x.Path, x.OwnerId });
+                    table.ForeignKey(
+                        name: "FK_CircleAuthorizationToFile_AspNetUsers_OwnerId",
+                        column: x => x.OwnerId,
+                        principalTable: "AspNetUsers",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_CircleAuthorizationToFile_Circle_CircleId",
+                        column: x => x.CircleId,
+                        principalTable: "Circle",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CircleAuthorizationToFile_OwnerId",
+                table: "CircleAuthorizationToFile",
+                column: "OwnerId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "CircleAuthorizationToFile");
+        }
+    }
+}

src/Yavsc.Org/Migrations/ApplicationDbContextModelSnapshot.cs

@@ -1088,6 +1088,27 @@ namespace Yavsc.Migrations
                     b.ToTable("CircleAuthorizationToBlogPost");
                 });
 
+            modelBuilder.Entity("Yavsc.Models.Access.CircleAuthorizationToFile", b =>
+                {
+                    b.Property<long>("CircleId")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Path")
+                        .HasColumnType("text");
+
+                    b.Property<string>("OwnerId")
+                        .HasColumnType("text");
+
+                    b.Property<byte>("Access")
+                        .HasColumnType("smallint");
+
+                    b.HasKey("CircleId", "Path", "OwnerId");
+
+                    b.HasIndex("OwnerId");
+
+                    b.ToTable("CircleAuthorizationToFile");
+                });
+
             modelBuilder.Entity("Yavsc.Models.AccountBalance", b =>
                 {
                     b.Property<string>("UserId")
@@ -1242,24 +1263,30 @@ namespace Yavsc.Migrations
                     NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
 
                     b.Property<string>("AccountNumber")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("BIC")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("BankCode")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<int>("BankedKey")
                         .HasColumnType("integer");
 
                     b.Property<string>("IBAN")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("UserId")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("WicketCode")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.HasKey("Id");
@@ -1320,9 +1347,11 @@ namespace Yavsc.Migrations
                     NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
 
                     b.Property<string>("AttachedFilesString")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("AttachedGraphicsString")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("ClientId")
@@ -1340,15 +1369,18 @@ namespace Yavsc.Migrations
                         .HasColumnType("text");
 
                     b.Property<string>("Description")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("OwnerId")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<DateTime>("ProviderValidationDate")
                         .HasColumnType("timestamp with time zone");
 
                     b.Property<string>("Title")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.HasKey("Id");
@@ -1521,6 +1553,7 @@ namespace Yavsc.Migrations
                     NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
 
                     b.Property<string>("Article")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("AuthorId")
@@ -1540,9 +1573,11 @@ namespace Yavsc.Migrations
                         .HasColumnType("bigint");
 
                     b.Property<string>("UserCreated")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("UserModified")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<bool>("Visible")
@@ -1892,6 +1927,7 @@ namespace Yavsc.Migrations
                         .HasColumnType("text");
 
                     b.Property<string>("AdditionalInfo")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("ClientId")
@@ -1908,6 +1944,7 @@ namespace Yavsc.Migrations
                         .HasColumnType("timestamp with time zone");
 
                     b.Property<string>("Description")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<DateTime?>("EventDate")
@@ -1936,9 +1973,11 @@ namespace Yavsc.Migrations
                         .HasColumnType("integer");
 
                     b.Property<string>("UserCreated")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("UserModified")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<DateTime?>("ValidationDate")
@@ -1989,12 +2028,13 @@ namespace Yavsc.Migrations
                         .HasColumnType("timestamp with time zone");
 
                     b.Property<string>("Description")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<DateTime>("EventDate")
                         .HasColumnType("timestamp with time zone");
 
-                    b.Property<long?>("LocationId")
+                    b.Property<long>("LocationId")
                         .HasColumnType("bigint");
 
                     b.Property<string>("PaymentId")
@@ -2011,9 +2051,11 @@ namespace Yavsc.Migrations
                         .HasColumnType("integer");
 
                     b.Property<string>("UserCreated")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("UserModified")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<DateTime?>("ValidationDate")
@@ -2158,6 +2200,7 @@ namespace Yavsc.Migrations
                     NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
 
                     b.Property<string>("Description")
+                        .IsRequired()
                         .HasMaxLength(10240)
                         .HasColumnType("character varying(10240)");
 
@@ -2168,6 +2211,7 @@ namespace Yavsc.Migrations
                         .HasColumnType("integer");
 
                     b.Property<string>("Title")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.HasKey("Id");
@@ -2188,18 +2232,22 @@ namespace Yavsc.Migrations
                         .HasDefaultValueSql("LOCALTIMESTAMP");
 
                     b.Property<string>("DeviceOwnerId")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<DateTime?>("LatestActivityUpdate")
                         .HasColumnType("timestamp with time zone");
 
                     b.Property<string>("Model")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("Platform")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("Version")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.HasKey("DeviceId");
@@ -2312,6 +2360,7 @@ namespace Yavsc.Migrations
                     NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
 
                     b.Property<string>("Content")
+                        .IsRequired()
                         .HasMaxLength(2000)
                         .HasColumnType("character varying(2000)");
 
@@ -3086,8 +3135,7 @@ namespace Yavsc.Migrations
 
                     b.Property<string>("ExerciseCountryCode")
                         .IsRequired()
-                        .HasMaxLength(2)
-                        .HasColumnType("character varying(2)");
+                        .HasColumnType("text");
 
                     b.Property<int?>("MaxDailyCost")
                         .HasColumnType("integer");
@@ -3109,6 +3157,7 @@ namespace Yavsc.Migrations
                         .HasColumnType("boolean");
 
                     b.Property<string>("WebSite")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.HasKey("PerformerId");
@@ -3157,12 +3206,13 @@ namespace Yavsc.Migrations
                         .HasColumnType("timestamp with time zone");
 
                     b.Property<string>("Description")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<DateTime>("EventDate")
                         .HasColumnType("timestamp with time zone");
 
-                    b.Property<long?>("LocationId")
+                    b.Property<long>("LocationId")
                         .HasColumnType("bigint");
 
                     b.Property<int>("LocationType")
@@ -3179,15 +3229,18 @@ namespace Yavsc.Migrations
                         .HasColumnType("numeric");
 
                     b.Property<string>("Reason")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<int>("Status")
                         .HasColumnType("integer");
 
                     b.Property<string>("UserCreated")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("UserModified")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<DateTime?>("ValidationDate")
@@ -3326,9 +3379,11 @@ namespace Yavsc.Migrations
                         .HasColumnType("integer");
 
                     b.Property<string>("UserCreated")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<string>("UserModified")
+                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<DateTime?>("ValidationDate")
@@ -3733,6 +3788,25 @@ namespace Yavsc.Migrations
                     b.Navigation("Target");
                 });
 
+            modelBuilder.Entity("Yavsc.Models.Access.CircleAuthorizationToFile", b =>
+                {
+                    b.HasOne("Yavsc.Models.Relationship.Circle", "Allowed")
+                        .WithMany()
+                        .HasForeignKey("CircleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Yavsc.Models.ApplicationUser", "Owner")
+                        .WithMany()
+                        .HasForeignKey("OwnerId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Allowed");
+
+                    b.Navigation("Owner");
+                });
+
             modelBuilder.Entity("Yavsc.Models.AccountBalance", b =>
                 {
                     b.HasOne("Yavsc.Models.ApplicationUser", "Owner")
@@ -3768,7 +3842,9 @@ namespace Yavsc.Migrations
                 {
                     b.HasOne("Yavsc.Models.ApplicationUser", "User")
                         .WithMany("BankInfo")
-                        .HasForeignKey("UserId");
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
 
                     b.Navigation("User");
                 });
@@ -3800,7 +3876,9 @@ namespace Yavsc.Migrations
 
                     b.HasOne("Yavsc.Models.Workflow.PerformerProfile", "Owner")
                         .WithMany()
-                        .HasForeignKey("OwnerId");
+                        .HasForeignKey("OwnerId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
 
                     b.Navigation("Client");
 
@@ -4061,7 +4139,9 @@ namespace Yavsc.Migrations
 
                     b.HasOne("Yavsc.Models.Relationship.Location", "Location")
                         .WithMany()
-                        .HasForeignKey("LocationId");
+                        .HasForeignKey("LocationId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
 
                     b.HasOne("Yavsc.Models.Payment.PayPalPayment", "Regularization")
                         .WithMany()
@@ -4146,7 +4226,9 @@ namespace Yavsc.Migrations
                 {
                     b.HasOne("Yavsc.Models.ApplicationUser", "DeviceOwner")
                         .WithMany("DeviceDeclaration")
-                        .HasForeignKey("DeviceOwnerId");
+                        .HasForeignKey("DeviceOwnerId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
 
                     b.Navigation("DeviceOwner");
                 });
@@ -4445,7 +4527,9 @@ namespace Yavsc.Migrations
 
                     b.HasOne("Yavsc.Models.Relationship.Location", "Location")
                         .WithMany()
-                        .HasForeignKey("LocationId");
+                        .HasForeignKey("LocationId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
 
                     b.HasOne("Yavsc.Models.Payment.PayPalPayment", "Regularization")
                         .WithMany()

src/Yavsc.Server/Models/Access/Circles/CircleAuthorizationToFile.cs

@@ -0,0 +1,24 @@
+
+namespace Yavsc.Models.Access
+{
+    using System.ComponentModel.DataAnnotations.Schema;
+    using System.Text.Json.Serialization;
+    using Models.Relationship;
+    using Yavsc.Services;
+
+    public class CircleAuthorizationToFile : FileAccessControlRulePayload
+    {
+        public FileAccessRight Access { get; set; }
+
+        [JsonIgnore]
+        [ForeignKey("CircleId")]
+        public virtual Circle Allowed { get; set; }
+
+        public string OwnerId { get; set; }
+
+        [JsonIgnore]
+        [ForeignKey("OwnerId")]
+        public virtual ApplicationUser Owner { get; set; }
+
+    }
+}

src/Yavsc.Server/Models/ApplicationDbContext.cs

@@ -1,4 +1,4 @@
-using IdentityServer8.EntityFramework.Entities;
+using IdentityServer8.EntityFramework.Entities;
 using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.ChangeTracking;
@@ -96,6 +96,22 @@ namespace Yavsc.Models
             builder.Entity<UserActivity>().HasKey(u => new { u.DoesCode, u.UserId });
             builder.Entity<Instrumentation>().HasKey(u => new { u.InstrumentId, u.UserId });
             builder.Entity<CircleAuthorizationToBlogPost>().HasKey(a => new { a.CircleId, a.BlogPostId });
+            builder.Entity<CircleAuthorizationToFile>().HasKey(a => new { a.CircleId, a.Path, a.OwnerId });
+            builder.Entity<CircleAuthorizationToFile>()
+                .HasOne(a => a.Allowed)
+                .WithMany()
+                .HasForeignKey(a => a.CircleId)
+                .OnDelete(DeleteBehavior.Cascade)
+                ;
+            builder.Entity<CircleAuthorizationToFile>()
+                .HasOne(a => a.Owner)
+                .WithMany()
+                .HasForeignKey(a => a.OwnerId)
+                .OnDelete(DeleteBehavior.Cascade)
+                ;
+            builder.Entity<CircleAuthorizationToFile>()
+                .Property(a => a.Access)
+                .HasConversion<byte>();
             builder.Entity<CircleMember>().HasKey(c => new { c.MemberId, c.CircleId });
             builder.Entity<DismissClicked>().HasKey(c => new { uid = c.UserId, notid = c.NotificationId });
             builder.Entity<HairTaintInstance>().HasKey(ti => new { ti.TaintId, ti.PrestationId });
@@ -108,6 +124,7 @@ namespace Yavsc.Models
             ;
 
             builder.Entity<Activity>().Property(a => a.ParentCode).IsRequired(false);
+            builder.Entity<Activity>().Property(a => a.Description).IsRequired(false);
 
             builder.Entity<Country>().HasKey(c => c.Code);
             builder.Entity<PerformerCodeInputValidation>()
@@ -366,6 +383,8 @@ namespace Yavsc.Models
 
         public DbSet<CircleAuthorizationToBlogPost> CircleAuthorizationToBlogPost { get; set; }
 
+        public DbSet<CircleAuthorizationToFile> CircleAuthorizationToFile { get; set; }
+
         public DbSet<CommandForm> CommandForm { get; set; }
 
         public DbSet<Ban> Ban { get; set; }

src/Yavsc.Server/Models/Workflow/Activity.cs

@@ -37,7 +37,7 @@ namespace Yavsc.Models.Workflow
         public virtual List<Activity> Children { get; set; }
 
         [Display(Name = "Description")]
-        public string Description { get; set; }
+        public string? Description { get; set; }
 
         [Display(Name = "Photo")]
         public string? Photo { get; set; }

src/Yavsc.Server/Services/FileSystemAuthManager.cs

@@ -3,6 +3,7 @@ using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Options;
 using rules;
 using Yavsc.Models;
+using Yavsc.Models.Access;
 using Yavsc.Server.Helpers;
 
 namespace Yavsc.Services
@@ -98,7 +99,44 @@ namespace Yavsc.Services
 
         public void SetAccess(long circleId, string normalizedFullPath, FileAccessRight access)
         {
-            throw new NotImplementedException();
+            var providerUserName = normalizedFullPath.Split('/')[0];
+            var providerUserId = _dbContext.Users.SingleOrDefault(u => u.UserName == providerUserName)?.Id;
+
+            if (string.IsNullOrEmpty(providerUserId))
+            {
+                return;
+            }
+
+            var acl = _dbContext.CircleAuthorizationToFile.SingleOrDefault(a =>
+                a.CircleId == circleId && a.Path == normalizedFullPath && a.OwnerId == providerUserId);
+
+            if (access == FileAccessRight.None)
+            {
+                if (acl != null)
+                {
+                    _dbContext.CircleAuthorizationToFile.Remove(acl);
+                }
+
+                _dbContext.SaveChanges();
+                return;
+            }
+
+            if (acl == null)
+            {
+                _dbContext.CircleAuthorizationToFile.Add(new CircleAuthorizationToFile
+                {
+                    CircleId = circleId,
+                    Path = normalizedFullPath,
+                    OwnerId = providerUserId,
+                    Access = access
+                });
+            }
+            else
+            {
+                acl.Access = access;
+            }
+
+            _dbContext.SaveChanges();
         }
     }
 }