From b25e0e842e8dd9fac4d79d759e2eaebcb3a246bd Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 3 Aug 2026 01:32:59 +0100
Subject: [PATCH 01/24] refacto blogPost

---
 src/PostIt.Tests/BlogApiTestFakes.cs          |  1 +
 src/PostIt/PostIt/App.axaml.cs                | 30 +++++++-------
 src/PostIt/PostIt/Models/BlogPost.cs          | 41 ++++++++++++++-----
 .../PostIt/ViewModels/HomePageViewModel.cs    | 11 ++++-
 src/PostIt/PostIt/Views/MainPage.axaml.cs     |  2 +-
 src/Yavsc.Abstract/Blogspot/IBlog.cs          | 19 ---------
 src/Yavsc.Abstract/Blogspot/IBlogPost.cs      | 15 +++++++
 .../Blogspot/IBlogPostPayLoad.cs              |  9 ++++
 .../Controllers/BlogApiController.cs          |  1 +
 src/Yavsc.Server/Models/Blog/BlogPost.cs      |  7 ++--
 src/Yavsc.Server/Services/BlogSpotService.cs  |  1 +
 11 files changed, 85 insertions(+), 52 deletions(-)
 delete mode 100644 src/Yavsc.Abstract/Blogspot/IBlog.cs
 create mode 100644 src/Yavsc.Abstract/Blogspot/IBlogPost.cs
 create mode 100644 src/Yavsc.Abstract/Blogspot/IBlogPostPayLoad.cs

diff --git a/src/PostIt.Tests/BlogApiTestFakes.cs b/src/PostIt.Tests/BlogApiTestFakes.cs
index 9ec10f89..755ce105 100644
--- a/src/PostIt.Tests/BlogApiTestFakes.cs
+++ b/src/PostIt.Tests/BlogApiTestFakes.cs
@@ -1,6 +1,7 @@
 using PostIt.Models;
 using PostIt.Services;
 using PostIt.ViewModels;
+using Yavsc.Models;
 
 namespace PostIt.Tests;
 
diff --git a/src/PostIt/PostIt/App.axaml.cs b/src/PostIt/PostIt/App.axaml.cs
index 1e0afeaf..b5740f2f 100644
--- a/src/PostIt/PostIt/App.axaml.cs
+++ b/src/PostIt/PostIt/App.axaml.cs
@@ -24,7 +24,7 @@ public partial class App : Application
     /// binding sink with a cross-thread exception inside
     /// <c>DataValidationErrors.SetErrors</c>.
     /// </summary>
-    public IServiceProvider? Services { get; private set; }
+    public IServiceProvider? ServiceProvider { get; private set; }
     private MainWindow window;
     public App()
     {
@@ -91,19 +91,17 @@ public partial class App : Application
         services.AddSingleton(sessionStatus);
         services.AddTransient<SessionStatusBanner>();
 
-        var provider = services.BuildServiceProvider();
+        ServiceProvider  = services.BuildServiceProvider();
 
         // Bind the canonical Settings to the static accessor so any
         // code path that can't easily take a constructor parameter
         // (designer surfaces, Avalonia data templates) still gets
         // the same instance the rest of the app is using. Idempotent:
         // re-binding from a second App boot (tests) is a no-op.
-        Settings.BindToServiceProvider(provider);
-
-        Services = provider;
+        Settings.BindToServiceProvider(ServiceProvider);
 
         DataTemplates.Clear();
-        DataTemplates.Add(new ViewLocator(provider));
+        DataTemplates.Add(new ViewLocator(ServiceProvider));
 
         // Wire the Settings singleton onto the SettingsPage singleton
         // once, at composition time. The page is registered as a
@@ -113,7 +111,7 @@ public partial class App : Application
         // DataContext, and the TwoWay bindings inside the page keep
         // mutating the same in-memory Settings instance that the rest
         // of the app reads (OidcClientOptions construction, etc.).
-        provider.GetRequiredService<SettingsPage>().DataContext = settings;
+        ServiceProvider.GetRequiredService<SettingsPage>().DataContext = settings;
 
         // Settings.DarkMode was previously a dead field: it round-
         // tripped through the settings file and the SettingsPage
@@ -134,8 +132,8 @@ public partial class App : Application
 
         if (ApplicationLifetime is IClassicDesktopStyleApplicationLifetime desktop)
         {
-            var homePage = provider.GetRequiredService<HomePage>();
-            homePage.DataContext = provider.GetRequiredService<HomePageViewModel>();
+            var homePage = ServiceProvider.GetRequiredService<HomePage>();
+            homePage.DataContext = ServiceProvider.GetRequiredService<HomePageViewModel>();
 
             window = new MainWindow();
             window.SessionBanner.DataContext = sessionStatus;
@@ -155,8 +153,8 @@ public partial class App : Application
             {
                 var w = (MainWindow)((IClassicDesktopStyleApplicationLifetime)ApplicationLifetime!).MainWindow!;
                 var nav = w.NavRoot;
-                var hp = provider.GetRequiredService<HomePage>();
-                hp.DataContext = provider.GetRequiredService<HomePageViewModel>();
+                var hp = ServiceProvider.GetRequiredService<HomePage>();
+                hp.DataContext = ServiceProvider.GetRequiredService<HomePageViewModel>();
                 _ = nav.PopToRootAsync();
             };
 
@@ -187,7 +185,7 @@ public partial class App : Application
             sessionStatus.OpenSettingsRequested += () =>
             {
                 var w = (MainWindow)((IClassicDesktopStyleApplicationLifetime)ApplicationLifetime!).MainWindow!;
-                var settingsPage = provider.GetRequiredService<SettingsPage>();
+                var settingsPage = ServiceProvider.GetRequiredService<SettingsPage>();
                 var stack = w.NavRoot.NavigationStack;
                 if (stack.Count > 0 && ReferenceEquals(stack[stack.Count - 1], settingsPage))
                 {
@@ -196,13 +194,13 @@ public partial class App : Application
                 _ = w.NavRoot.PushAsync(settingsPage);
             };
 
-            window.Opened += async (_, _) => await BootAsync(provider, api);
+            window.Opened += async (_, _) => await BootAsync(ServiceProvider, api);
         }
         else if (ApplicationLifetime is ISingleViewApplicationLifetime singleView)
         {
             singleView.MainView = new MainWindow
             {
-                DataContext = provider.GetRequiredService<HomePageViewModel>()
+                DataContext = ServiceProvider.GetRequiredService<HomePageViewModel>()
             };
         }
     }
@@ -243,8 +241,8 @@ public partial class App : Application
     public static async Task PushMainPageAsync()
     {
         var app = (App)Current;
-        var mainVm = app.Services.GetRequiredService<MainPageViewModel>();
-        var mainPage = app.Services.GetRequiredService<MainPage>();
+        var mainVm = app.ServiceProvider.GetRequiredService<MainPageViewModel>();
+        var mainPage = app.ServiceProvider.GetRequiredService<MainPage>();
         mainPage.DataContext = mainVm;
         await app.window.FindControl<NavigationPage>("NavRoot").PushAsync(mainPage).ConfigureAwait(true);
     }
diff --git a/src/PostIt/PostIt/Models/BlogPost.cs b/src/PostIt/PostIt/Models/BlogPost.cs
index 7867eb02..e62fcea2 100644
--- a/src/PostIt/PostIt/Models/BlogPost.cs
+++ b/src/PostIt/PostIt/Models/BlogPost.cs
@@ -1,16 +1,37 @@
 using System;
+using Yavsc.Abstract.Identity;
+using Yavsc.Abstract.Identity.Security;
+using Yavsc.Blogspot;
 
 namespace PostIt.Models;
 
-public class BlogPost
+public class BlogPost : IBlogPost
 {
-    public long Id { get; set; }
-    public string Title { get; set; } = string.Empty;
-    public string? Article { get; set; }
-    public string? Photo { get; set; }
-    public string? AuthorId { get; set; }
-    public DateTime DateCreated { get; set; }
-    public string? UserCreated { get; set; }
-    public DateTime DateModified { get; set; }
-    public string? UserModified { get; set; }
+    public string AuthorId { get; set; }
+
+    public IApplicationUser Author { get; set; }
+
+    public string Article { get; set ; }
+    public string Photo { get; set ; }
+    public long Id { get; set ; }
+    public DateTime DateCreated { get; set ; }
+    public string UserCreated { get; set ; }
+    public DateTime DateModified { get; set ; }
+    public string UserModified { get; set ; }
+    public string Title { get; set ; }
+
+    public bool AuthorizeCircle(long circleId)
+    {
+        throw new NotImplementedException();
+    }
+
+    public ICircleAuthorization[] GetACL()
+    {
+        throw new NotImplementedException();
+    }
+
+    public string[] GetTags()
+    {
+        throw new NotImplementedException();
+    }
 }
diff --git a/src/PostIt/PostIt/ViewModels/HomePageViewModel.cs b/src/PostIt/PostIt/ViewModels/HomePageViewModel.cs
index c11e396a..876f862c 100644
--- a/src/PostIt/PostIt/ViewModels/HomePageViewModel.cs
+++ b/src/PostIt/PostIt/ViewModels/HomePageViewModel.cs
@@ -1,4 +1,5 @@
 using CommunityToolkit.Mvvm.Input;
+using Microsoft.Extensions.DependencyInjection;
 using PostIt;
 using PostIt.Services;
 namespace PostIt.ViewModels;
@@ -7,6 +8,7 @@ public class HomePageViewModel : ViewModelBase
 {
     public YavscApiClient Api { get; }
     public Settings Settings { get; }
+    public SessionStatusViewModel SessionStatus { get; }
 
     private string _welcomeText = "Welcome to PostIt!";
     public string WelcomeText
@@ -18,10 +20,12 @@ public class HomePageViewModel : ViewModelBase
     public override bool CanNavigateNext { get => true; protected set => throw new System.NotImplementedException(); }
     public override bool CanNavigatePrevious { get => false; protected set => throw new System.NotImplementedException(); }
 
-    public HomePageViewModel(YavscApiClient api, Settings settings)
+    public HomePageViewModel(YavscApiClient api, Settings settings, SessionStatusViewModel sessionStatus)
     {
         Api = api;
         Settings = settings;
+        SessionStatus = sessionStatus;
+
     }
     public RelayCommand OpenBlogs { get; set; } = new RelayCommand(() => App.PushMainPageAsync());
     /// <summary>
@@ -33,5 +37,8 @@ public class HomePageViewModel : ViewModelBase
     /// (thread-safe dispatcher marshalling on PropertyChanged) — a
     /// designer-only duplicate instance is therefore harmless.
     /// </summary>
-    public HomePageViewModel() : this(null!, new Settings()) { }
+    public HomePageViewModel() : this(null!, new Settings(), new SessionStatusViewModel())
+    {
+
+    }
 }
diff --git a/src/PostIt/PostIt/Views/MainPage.axaml.cs b/src/PostIt/PostIt/Views/MainPage.axaml.cs
index 1535d2f4..6a907a01 100644
--- a/src/PostIt/PostIt/Views/MainPage.axaml.cs
+++ b/src/PostIt/PostIt/Views/MainPage.axaml.cs
@@ -28,7 +28,7 @@ public partial class MainPage : ContentPage
         // Resolve via the App's DI container so the page gets
         // the canonical services (Api client, settings, ...).
         var app = Application.Current as App;
-        var services = app?.Services;
+        var services = app?.ServiceProvider;
         if (services is null) return;
 
         var page = services.GetRequiredService<SignaturePage>();
diff --git a/src/Yavsc.Abstract/Blogspot/IBlog.cs b/src/Yavsc.Abstract/Blogspot/IBlog.cs
deleted file mode 100644
index 86efc8e3..00000000
--- a/src/Yavsc.Abstract/Blogspot/IBlog.cs
+++ /dev/null
@@ -1,19 +0,0 @@
-
-
-
-using Yavsc.Abstract.Identity;
-
-namespace Yavsc
-{
-    public interface IBlogPostPayLoad
-    {      
-        string Article { get; set; }
-        string Photo { get; set; }
-
-    }
-    public interface IBlogPost : IBlogPostPayLoad, ITrackedEntity, IIdentified<long>, ITitle
-    {
-        string AuthorId { get; set; }
-        IApplicationUser Author { get; }
-    }
-}
diff --git a/src/Yavsc.Abstract/Blogspot/IBlogPost.cs b/src/Yavsc.Abstract/Blogspot/IBlogPost.cs
new file mode 100644
index 00000000..691e03f2
--- /dev/null
+++ b/src/Yavsc.Abstract/Blogspot/IBlogPost.cs
@@ -0,0 +1,15 @@
+
+
+
+using Yavsc.Abstract.Identity;
+using Yavsc.Abstract.Identity.Security;
+using Yavsc.Interfaces;
+
+namespace Yavsc.Blogspot
+{
+    public interface IBlogPost : IBlogPostPayLoad, ICircleAuthorized, ITaggable<long>,  ITrackedEntity, IIdentified<long>, ITitle
+    {
+        string AuthorId { get; set; }
+        IApplicationUser Author { get; }
+    }
+}
diff --git a/src/Yavsc.Abstract/Blogspot/IBlogPostPayLoad.cs b/src/Yavsc.Abstract/Blogspot/IBlogPostPayLoad.cs
new file mode 100644
index 00000000..d8aeb4fe
--- /dev/null
+++ b/src/Yavsc.Abstract/Blogspot/IBlogPostPayLoad.cs
@@ -0,0 +1,9 @@
+namespace Yavsc.Blogspot
+{
+    public interface IBlogPostPayLoad
+    {
+        string Article { get; set; }
+        string Photo { get; set; }
+
+    }
+}
diff --git a/src/Yavsc.Blogs/Controllers/BlogApiController.cs b/src/Yavsc.Blogs/Controllers/BlogApiController.cs
index 69b37e60..23d71742 100644
--- a/src/Yavsc.Blogs/Controllers/BlogApiController.cs
+++ b/src/Yavsc.Blogs/Controllers/BlogApiController.cs
@@ -1,5 +1,6 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Yavsc.Blogspot;
 using Yavsc.Models.Blog;
 using Yavsc.Server.Exceptions;
 using Yavsc.Server.Helpers;
diff --git a/src/Yavsc.Server/Models/Blog/BlogPost.cs b/src/Yavsc.Server/Models/Blog/BlogPost.cs
index eb58cb62..e1b44603 100644
--- a/src/Yavsc.Server/Models/Blog/BlogPost.cs
+++ b/src/Yavsc.Server/Models/Blog/BlogPost.cs
@@ -3,15 +3,14 @@ using System.ComponentModel.DataAnnotations.Schema;
 using Newtonsoft.Json;
 using Yavsc.Abstract.Identity;
 using Yavsc.Abstract.Identity.Security;
-using Yavsc.Interfaces;
 using Yavsc.Models.Access;
 using Yavsc.Models.Relationship;
+using Yavsc.Blogspot;
 
 namespace Yavsc.Models.Blog
 {
-    
-    public class BlogPost :
-     IBlogPost, ICircleAuthorized, ITaggable<long>
+
+    public class BlogPost : IBlogPost
     {
         [Key(), DatabaseGenerated(DatabaseGeneratedOption.Identity)]
         [Display(Name = "Identifiant du post")]
diff --git a/src/Yavsc.Server/Services/BlogSpotService.cs b/src/Yavsc.Server/Services/BlogSpotService.cs
index a8b52d0d..dc02cde2 100644
--- a/src/Yavsc.Server/Services/BlogSpotService.cs
+++ b/src/Yavsc.Server/Services/BlogSpotService.cs
@@ -10,6 +10,7 @@ using Yavsc.Server.Helpers;
 using Yavsc.Services;
 using Yavsc.ViewModels.Auth;
 using Microsoft.AspNetCore.Http;
+using Yavsc.Blogspot;
 
 public class BlogSpotService
 {

From 3744d9ae9cc9459bea2cfe57eca9e631547a827b Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 3 Aug 2026 01:48:15 +0100
Subject: [PATCH 02/24] Enable blogs on connected status

---
 src/PostIt/PostIt/Views/HomePage.axaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/PostIt/PostIt/Views/HomePage.axaml b/src/PostIt/PostIt/Views/HomePage.axaml
index 7eb6dbb3..16e66cc0 100644
--- a/src/PostIt/PostIt/Views/HomePage.axaml
+++ b/src/PostIt/PostIt/Views/HomePage.axaml
@@ -16,6 +16,7 @@
                            HorizontalAlignment="Center"/>
           <Button Content="Open Blog Interface"
                   Command="{Binding OpenBlogs}"
-                  HorizontalAlignment="Center"/>
+                  HorizontalAlignment="Center"
+                  IsEnabled="{Binding SessionStatus.IsLoggedIn}"/>
         </StackPanel>
 </ContentPage>

From 7d1cca9df0eb204ba587b50bf1d22ff30ea724e9 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 3 Aug 2026 02:16:57 +0100
Subject: [PATCH 03/24] build

---
 .../Communicating/BlogspotController.cs       |  1 +
 src/Yavsc.Org/Services/BlogSpotService.cs     |  1 +
 src/Yavsc.Org/Views/Blogspot/Index.cshtml     | 27 ++++++++++---------
 src/Yavsc.Org/Views/_ViewImports.cshtml       |  1 +
 4 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/src/Yavsc.Org/Controllers/Communicating/BlogspotController.cs b/src/Yavsc.Org/Controllers/Communicating/BlogspotController.cs
index f59b8b82..de0c3c2d 100644
--- a/src/Yavsc.Org/Controllers/Communicating/BlogspotController.cs
+++ b/src/Yavsc.Org/Controllers/Communicating/BlogspotController.cs
@@ -7,6 +7,7 @@ using Yavsc.Models.Blog;
 using Microsoft.Extensions.Options;
 using Yavsc.Server.Exceptions;
 using Yavsc.Server.Helpers;
+using Yavsc.Blogspot;
 
 // For more information on enabling Web API for empty projects, visit http://go.microsoft.com/fwlink/?LinkID=397860
 
diff --git a/src/Yavsc.Org/Services/BlogSpotService.cs b/src/Yavsc.Org/Services/BlogSpotService.cs
index 3700e04f..76858c9c 100644
--- a/src/Yavsc.Org/Services/BlogSpotService.cs
+++ b/src/Yavsc.Org/Services/BlogSpotService.cs
@@ -3,6 +3,7 @@ using System.Security.Claims;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.EntityFrameworkCore;
 using Yavsc;
+using Yavsc.Blogspot;
 using Yavsc.Models;
 using Yavsc.Models.Blog;
 using Yavsc.Server.Exceptions;
diff --git a/src/Yavsc.Org/Views/Blogspot/Index.cshtml b/src/Yavsc.Org/Views/Blogspot/Index.cshtml
index 1e7321aa..d5dc27c9 100644
--- a/src/Yavsc.Org/Views/Blogspot/Index.cshtml
+++ b/src/Yavsc.Org/Views/Blogspot/Index.cshtml
@@ -1,3 +1,4 @@
+
 @model IEnumerable<IBlogPost>
 @{
     ViewBag.Title = "Blogs, l'index";
@@ -43,20 +44,20 @@
     <a asp-action="Create">Create a new article</a>
 </p>
 }
-     
+
 <div class="blog-index">
 @{
     int maxTextLen = 75;
   foreach (var post in Model) {
     <div class="post card">
-    
 
-        <a asp-action="Details" asp-route-id="@post.Id" class="bloglink" >
+
+        <a asp-action="Details" asp-route-id="@((IBlogPost)post).Id" class="bloglink" >
             <div class="float-left"><img class="photo card-photo" src="@post.Photo" ></div>
             <h3 class="index-post-title">@post.Title</h3>
         </a>
         <div>
-          <a asp-action="Details" asp-route-id="@post.Id">
+          <a asp-action="Details" asp-route-id="@((IBlogPost)post).Id">
             <asciidoc summary="@maxTextLen">@post.Article</asciidoc></a>
             <span style="font-size:x-small;">@Html.DisplayFor(m => post.Author)</span>
             <span style="font-size:xx-small;">
@@ -67,20 +68,20 @@
             </span>
         </div>
         <div class="actiongroup">
-            @if ((await AuthorizationService.AuthorizeAsync(User, post, new ReadPermission())).Succeeded) 
+            @if ((await AuthorizationService.AuthorizeAsync(User, post, new ReadPermission())).Succeeded)
             {
-                <a asp-action="Details" asp-route-id="@post.Id"  class="btn btn-light">Details</a>
+                <a asp-action="Details" asp-route-id="@((IBlogPost)post).Id"  class="btn btn-light">Details</a>
             }
-            else 
+            else
             {
-            <a asp-action="Details" asp-route-id="@post.Id" class="btn btn-light">Details</a>
+            <a asp-action="Details" asp-route-id="@((IBlogPost)post).Id" class="btn btn-light">Details</a>
             }
-            @if ((await AuthorizationService.AuthorizeAsync(User, post, new EditPermission())).Succeeded) 
+            @if ((await AuthorizationService.AuthorizeAsync(User, post, new EditPermission())).Succeeded)
             {
-           <a asp-action="Edit" asp-route-id="@post.Id" class="btn btn-primary">Edit</a>
-            
-            <a asp-action="Delete" asp-route-id="@post.Id" class="btn btn-danger">Delete</a>
-            
+           <a asp-action="Edit" asp-route-id="@((IBlogPost)post).Id" class="btn btn-primary">Edit</a>
+
+            <a asp-action="Delete" asp-route-id="@((IBlogPost)post).Id" class="btn btn-danger">Delete</a>
+
             }
         </div>
     </div>
diff --git a/src/Yavsc.Org/Views/_ViewImports.cshtml b/src/Yavsc.Org/Views/_ViewImports.cshtml
index dd88dabc..79811042 100755
--- a/src/Yavsc.Org/Views/_ViewImports.cshtml
+++ b/src/Yavsc.Org/Views/_ViewImports.cshtml
@@ -1,5 +1,6 @@
 @using Microsoft.AspNetCore.Mvc.Localization
 @using Yavsc
+@using Yavsc.Blogspot
 @using Yavsc.Models
 @using Yavsc.Models.Musical;
 @using Yavsc.Models.Drawing;

From c8b05a8950c483ee4844c634304c9b9867255945 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 3 Aug 2026 02:35:50 +0100
Subject: [PATCH 04/24] publish android

---
 .github/workflows/docker-publish-android.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish-android.yml b/.github/workflows/docker-publish-android.yml
index 98237136..317cda80 100644
--- a/.github/workflows/docker-publish-android.yml
+++ b/.github/workflows/docker-publish-android.yml
@@ -44,7 +44,7 @@ jobs:
   publish-release:
     # Uniquement déclenché par un tag v*. Le job apk-deploy tourne en
     # parallèle, on partage l'artefact entre jobs.
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: startsWith(github.ref, 'refs/tags/')
     needs: apk-deploy
     runs-on: ubuntu-latest
     steps:

From 64547840e4a8e4b814a2eda73eda08dd20032d94 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Wed, 5 Aug 2026 21:05:14 +0100
Subject: [PATCH 05/24] refacto BlogPost serialization

---
 src/Yavsc.Abstract/Blogspot/IBlogPost.cs             |  3 +--
 .../Identity/Security/ICircleAuthorized.cs           |  8 ++++++--
 src/Yavsc.Abstract/Interfaces/Models/ITaggable.cs    |  4 ++--
 src/Yavsc.Blogs.Tests/BlogApiTests.cs                |  3 ++-
 src/Yavsc.Blogs/Controllers/BlogApiController.cs     |  4 ++--
 src/Yavsc.Org.Tests/appsettings.json                 |  1 +
 src/Yavsc.Org/Views/Blogspot/Index.cshtml            | 12 ++++++------
 src/Yavsc.Server/Models/Blog/BlogPost.cs             |  4 ++--
 8 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/src/Yavsc.Abstract/Blogspot/IBlogPost.cs b/src/Yavsc.Abstract/Blogspot/IBlogPost.cs
index 691e03f2..5287685d 100644
--- a/src/Yavsc.Abstract/Blogspot/IBlogPost.cs
+++ b/src/Yavsc.Abstract/Blogspot/IBlogPost.cs
@@ -7,9 +7,8 @@ using Yavsc.Interfaces;
 
 namespace Yavsc.Blogspot
 {
-    public interface IBlogPost : IBlogPostPayLoad, ICircleAuthorized, ITaggable<long>,  ITrackedEntity, IIdentified<long>, ITitle
+    public interface IBlogPost : IBlogPostPayLoad, ICircleAuthorized,  ITrackedEntity,  ITitle
     {
-        string AuthorId { get; set; }
         IApplicationUser Author { get; }
     }
 }
diff --git a/src/Yavsc.Abstract/Identity/Security/ICircleAuthorized.cs b/src/Yavsc.Abstract/Identity/Security/ICircleAuthorized.cs
index cc108d2e..25c21961 100644
--- a/src/Yavsc.Abstract/Identity/Security/ICircleAuthorized.cs
+++ b/src/Yavsc.Abstract/Identity/Security/ICircleAuthorized.cs
@@ -1,10 +1,14 @@
+using Yavsc.Interfaces;
+
 namespace Yavsc.Abstract.Identity.Security
 {
-    public interface ICircleAuthorized
+    public interface ICircleAuthorized :  ITaggable<long>
     {
-        long Id { get; set; }
+
         string AuthorId { get; }
+
         bool AuthorizeCircle(long circleId);
+
         ICircleAuthorization [] GetACL();
 
     }
diff --git a/src/Yavsc.Abstract/Interfaces/Models/ITaggable.cs b/src/Yavsc.Abstract/Interfaces/Models/ITaggable.cs
index 89a51d30..eb325b6f 100644
--- a/src/Yavsc.Abstract/Interfaces/Models/ITaggable.cs
+++ b/src/Yavsc.Abstract/Interfaces/Models/ITaggable.cs
@@ -1,9 +1,9 @@
 namespace Yavsc.Interfaces
 {
-    public interface ITaggable<K> 
+    public interface ITaggable<K> : IIdentified<K>
     {
          string [] GetTags();
 
          K Id { get; }
     }
-}
\ No newline at end of file
+}
diff --git a/src/Yavsc.Blogs.Tests/BlogApiTests.cs b/src/Yavsc.Blogs.Tests/BlogApiTests.cs
index fd64555a..35d67fbe 100644
--- a/src/Yavsc.Blogs.Tests/BlogApiTests.cs
+++ b/src/Yavsc.Blogs.Tests/BlogApiTests.cs
@@ -239,7 +239,8 @@ public sealed class BlogApiTests : IClassFixture<BlogsWebServerFixture>
 
         // The list should now be empty.
         var listResponse = await http.GetAsync("/api/v1/blog");
-        using var doc = JsonDocument.Parse(await listResponse.Content.ReadAsStringAsync());
+        String response = await listResponse.Content.ReadAsStringAsync();
+        using var doc = JsonDocument.Parse(response);
         Assert.Equal(0, doc.RootElement.GetArrayLength());
     }
 
diff --git a/src/Yavsc.Blogs/Controllers/BlogApiController.cs b/src/Yavsc.Blogs/Controllers/BlogApiController.cs
index 23d71742..ac7b59df 100644
--- a/src/Yavsc.Blogs/Controllers/BlogApiController.cs
+++ b/src/Yavsc.Blogs/Controllers/BlogApiController.cs
@@ -22,9 +22,9 @@ namespace Yavsc.Blogs.Controllers
 
         // GET: api/BlogApi
         [HttpGet]
-        public async Task<IEnumerable<IBlogPost>> GetBlogspot(int start = 0, int take = 25)
+        public async Task<IEnumerable<BlogPost>> GetBlogspot(int start = 0, int take = 25)
         {
-            return await blogSpotService.Index(User, null, start, take);
+            return (await blogSpotService.Index(User, null, start, take)).Cast<BlogPost>();
         }
 
         // GET: api/BlogApi/5
diff --git a/src/Yavsc.Org.Tests/appsettings.json b/src/Yavsc.Org.Tests/appsettings.json
index 5f353cd8..ef95fef6 100644
--- a/src/Yavsc.Org.Tests/appsettings.json
+++ b/src/Yavsc.Org.Tests/appsettings.json
@@ -1,6 +1,7 @@
 {
     "Site": {
         "Authority": "https://localhost:5101",
+        "Audience": ["blogs"],
         "Title": "Yavsc dev",
         "Slogan": "Yavsc : WIP.",
         "Banner": "/images/yavsc.png",
diff --git a/src/Yavsc.Org/Views/Blogspot/Index.cshtml b/src/Yavsc.Org/Views/Blogspot/Index.cshtml
index d5dc27c9..52cf3b88 100644
--- a/src/Yavsc.Org/Views/Blogspot/Index.cshtml
+++ b/src/Yavsc.Org/Views/Blogspot/Index.cshtml
@@ -52,19 +52,19 @@
     <div class="post card">
 
 
-        <a asp-action="Details" asp-route-id="@((IBlogPost)post).Id" class="bloglink" >
+        <a asp-action="Details" asp-route-id="@post.Id" class="bloglink" >
             <div class="float-left"><img class="photo card-photo" src="@post.Photo" ></div>
             <h3 class="index-post-title">@post.Title</h3>
         </a>
         <div>
-          <a asp-action="Details" asp-route-id="@((IBlogPost)post).Id">
+          <a asp-action="Details" asp-route-id="@post.Id">
             <asciidoc summary="@maxTextLen">@post.Article</asciidoc></a>
             <span style="font-size:x-small;">@Html.DisplayFor(m => post.Author)</span>
             <span style="font-size:xx-small;">
             posté le @post.DateCreated.ToString("dddd d MMM yyyy à H:mm")
             @if ((post.DateModified - post.DateCreated).Minutes > 0){ 
                 @:- Modifié le @post.DateModified.ToString("dddd d MMM yyyy à H:mm")
-            })
+            }
             </span>
         </div>
         <div class="actiongroup">
@@ -74,13 +74,13 @@
             }
             else
             {
-            <a asp-action="Details" asp-route-id="@((IBlogPost)post).Id" class="btn btn-light">Details</a>
+            <a asp-action="Details" asp-route-id="@post.Id" class="btn btn-light">Details</a>
             }
             @if ((await AuthorizationService.AuthorizeAsync(User, post, new EditPermission())).Succeeded)
             {
-           <a asp-action="Edit" asp-route-id="@((IBlogPost)post).Id" class="btn btn-primary">Edit</a>
+           <a asp-action="Edit" asp-route-id="@post.Id" class="btn btn-primary">Edit</a>
 
-            <a asp-action="Delete" asp-route-id="@((IBlogPost)post).Id" class="btn btn-danger">Delete</a>
+            <a asp-action="Delete" asp-route-id="@post.Id" class="btn btn-danger">Delete</a>
 
             }
         </div>
diff --git a/src/Yavsc.Server/Models/Blog/BlogPost.cs b/src/Yavsc.Server/Models/Blog/BlogPost.cs
index e1b44603..442cbb1f 100644
--- a/src/Yavsc.Server/Models/Blog/BlogPost.cs
+++ b/src/Yavsc.Server/Models/Blog/BlogPost.cs
@@ -35,7 +35,7 @@ namespace Yavsc.Models.Blog
         public string? AuthorId { get; set; }
 
         [Display(Name = "Auteur")]
-        public virtual ApplicationUser? Author { set; get; }
+        public virtual ApplicationUser Author { set; get; }
 
 
         [Display(Name = "Date de création")]
@@ -95,6 +95,6 @@ namespace Yavsc.Models.Blog
         [InverseProperty("Post")]
         public virtual List<Comment> Comments { get; set; }
 
-        IApplicationUser IBlogPost.Author { get => this.Author; }
+        IApplicationUser IBlogPost.Author => Author;
     }
 }

From cd03b04755cffda61179cded29ff74759c3a50f8 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Wed, 5 Aug 2026 21:11:22 +0100
Subject: [PATCH 06/24] re-refacto BlogPost serialization

---
 src/Yavsc.Abstract/Interfaces/Models/ITaggable.cs | 2 --
 src/Yavsc.Blogs/Controllers/BlogApiController.cs  | 4 ++--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/Yavsc.Abstract/Interfaces/Models/ITaggable.cs b/src/Yavsc.Abstract/Interfaces/Models/ITaggable.cs
index eb325b6f..bb4020a8 100644
--- a/src/Yavsc.Abstract/Interfaces/Models/ITaggable.cs
+++ b/src/Yavsc.Abstract/Interfaces/Models/ITaggable.cs
@@ -3,7 +3,5 @@ namespace Yavsc.Interfaces
     public interface ITaggable<K> : IIdentified<K>
     {
          string [] GetTags();
-
-         K Id { get; }
     }
 }
diff --git a/src/Yavsc.Blogs/Controllers/BlogApiController.cs b/src/Yavsc.Blogs/Controllers/BlogApiController.cs
index ac7b59df..23d71742 100644
--- a/src/Yavsc.Blogs/Controllers/BlogApiController.cs
+++ b/src/Yavsc.Blogs/Controllers/BlogApiController.cs
@@ -22,9 +22,9 @@ namespace Yavsc.Blogs.Controllers
 
         // GET: api/BlogApi
         [HttpGet]
-        public async Task<IEnumerable<BlogPost>> GetBlogspot(int start = 0, int take = 25)
+        public async Task<IEnumerable<IBlogPost>> GetBlogspot(int start = 0, int take = 25)
         {
-            return (await blogSpotService.Index(User, null, start, take)).Cast<BlogPost>();
+            return await blogSpotService.Index(User, null, start, take);
         }
 
         // GET: api/BlogApi/5

From 44b391d496de0aa7bbb3521bbba13c5c1526791b Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 10 Aug 2026 18:12:59 +0100
Subject: [PATCH 07/24] Activity protection

---
 Directory.Build.props                         |  1 +
 .../Business/ActivityApiController.cs         |  3 +-
 .../NativeConfidentialController.cs           |  8 ++---
 src/Yavsc.Blogs.Tests/BlogApiTests.cs         | 32 +++++++++++++++++++
 src/Yavsc.Org/Extensions/HostingExtensions.cs |  3 ++
 .../Services/GoogleApis/CalendarManager.cs    |  2 +-
 6 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/Directory.Build.props b/Directory.Build.props
index 873845c4..aec8c990 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -11,5 +11,6 @@
       from without conflicting names.
     -->
     <UseProjectNamespaceForGitVersionInformation>true</UseProjectNamespaceForGitVersionInformation>
+    <NoWarn>NU1701, NU1901, NU1902</NoWarn>
   </PropertyGroup>
 </Project>
diff --git a/src/Yavsc.Api/Controllers/Business/ActivityApiController.cs b/src/Yavsc.Api/Controllers/Business/ActivityApiController.cs
index f6b215e7..d2da2ea7 100644
--- a/src/Yavsc.Api/Controllers/Business/ActivityApiController.cs
+++ b/src/Yavsc.Api/Controllers/Business/ActivityApiController.cs
@@ -15,7 +15,6 @@ namespace Yavsc.Controllers
 {
     [Produces("application/json")]
     [Route("api/activity")]
-    [AllowAnonymous]
     public class ActivityApiController : Controller
     {
         private ApplicationDbContext _context;
@@ -88,7 +87,7 @@ namespace Yavsc.Controllers
         }
 
         // POST: api/ActivityApi
-        [HttpPost,Authorize("AdministratorOnly")]
+        [HttpPost, Authorize("AdministratorOnly")]
         public async Task<IActionResult> PostActivity([FromBody] Activity activity)
         {
             if (!ModelState.IsValid)
diff --git a/src/Yavsc.Api/Controllers/NativeConfidentialController.cs b/src/Yavsc.Api/Controllers/NativeConfidentialController.cs
index 01cd8478..4e771830 100644
--- a/src/Yavsc.Api/Controllers/NativeConfidentialController.cs
+++ b/src/Yavsc.Api/Controllers/NativeConfidentialController.cs
@@ -1,15 +1,15 @@
 
-using System;
-using System.Linq;
+
 using System.Security.Claims;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.Logging;
-using Yavsc.Helpers;
+
 using Yavsc.Models;
 using Yavsc.Models.Identity;
 using Yavsc.Server.Helpers;
 
+#nullable enable
+
 [Authorize, Route("~/api/gcm")]
 public class NativeConfidentialController : Controller
 {
diff --git a/src/Yavsc.Blogs.Tests/BlogApiTests.cs b/src/Yavsc.Blogs.Tests/BlogApiTests.cs
index 35d67fbe..bf0758c6 100644
--- a/src/Yavsc.Blogs.Tests/BlogApiTests.cs
+++ b/src/Yavsc.Blogs.Tests/BlogApiTests.cs
@@ -148,6 +148,38 @@ public sealed class BlogApiTests : IClassFixture<BlogsWebServerFixture>
         Assert.Equal(created.Id, doc.RootElement[0].GetProperty("id").GetInt64());
     }
 
+    [Fact]
+    public async Task PostBlog_sets_AuthorId_on_created_post_and_list_entry()
+    {
+        ResetDatabase();
+        using var http = NewClient(subject: "tester");
+
+        var draft = new BlogPost
+        {
+            Id = 0,
+            Title = "Billet avec auteur",
+            AuthorId = "payload-attacker",
+            Article = "Contenu de test.",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow
+        };
+
+        var postResponse = await http.PostAsJsonAsync("/api/v1/blog", draft);
+        Assert.Equal(HttpStatusCode.Created, postResponse.StatusCode);
+
+        var created = await postResponse.Content.ReadFromJsonAsync<BlogPost>();
+        Assert.NotNull(created);
+        Assert.Equal("tester", created!.AuthorId);
+
+        var listResponse = await http.GetAsync("/api/v1/blog");
+        Assert.Equal(HttpStatusCode.OK, listResponse.StatusCode);
+
+        using var doc = JsonDocument.Parse(await listResponse.Content.ReadAsStringAsync());
+        Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+        Assert.Equal(1, doc.RootElement.GetArrayLength());
+        Assert.Equal("tester", doc.RootElement[0].GetProperty("authorId").GetString());
+    }
+
     [Fact]
     public async Task GetBlog_returns_401_when_no_token_is_provided()
     {
diff --git a/src/Yavsc.Org/Extensions/HostingExtensions.cs b/src/Yavsc.Org/Extensions/HostingExtensions.cs
index b3f90639..0cae23a7 100644
--- a/src/Yavsc.Org/Extensions/HostingExtensions.cs
+++ b/src/Yavsc.Org/Extensions/HostingExtensions.cs
@@ -1189,6 +1189,8 @@ ADD COLUMN IF NOT EXISTS ""Moderated"" boolean NOT NULL DEFAULT FALSE;");
         }
     }
 
+#nullable enable
+
     static void LoadGoogleConfig(IConfigurationRoot configuration)
     {
         string? googleClientFile = configuration["Authentication:Google:GoogleWebClientJson"];
@@ -1204,6 +1206,7 @@ ADD COLUMN IF NOT EXISTS ""Moderated"" boolean NOT NULL DEFAULT FALSE;");
             Config.GServiceAccount = JsonConvert.DeserializeObject<GoogleServiceAccount>(safile.OpenText().ReadToEnd());
         }
     }
+#nullable disable
 
     public static IApplicationBuilder ConfigureFileServerApp(this IApplicationBuilder app,
                 bool enableDirectoryBrowsing = false)
diff --git a/src/Yavsc.Server/Services/GoogleApis/CalendarManager.cs b/src/Yavsc.Server/Services/GoogleApis/CalendarManager.cs
index 00f5a9b2..f91b3393 100644
--- a/src/Yavsc.Server/Services/GoogleApis/CalendarManager.cs
+++ b/src/Yavsc.Server/Services/GoogleApis/CalendarManager.cs
@@ -197,7 +197,7 @@ namespace Yavsc.Services
                 if (credential.IsCreateScopedRequired)
                 {
                     credential = credential.CreateScoped(scopesCalendar);
-                }/* 
+                }/*
                 var credential = await GoogleHelpers.GetCredentialForApi(new string [] { scopeCalendar });
                 if (credential.IsCreateScopedRequired)
                 {

From 0d3fbf22c3e8e474b3464a39330522f80162781c Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 10 Aug 2026 18:34:01 +0100
Subject: [PATCH 08/24] GetUserId_reads_NameIdentifier_when_sub_was_mapped

---
 .../BlogApiMappedClaimsTests.cs               | 156 ++++++++++++++++++
 src/Yavsc.Blogs.Tests/BlogApiTests.cs         |  14 ++
 .../JwtClaimMappingCollection.cs              |   8 +
 .../MappedClaimsBlogsWebServerFixture.cs      | 109 ++++++++++++
 src/Yavsc.Server/Helpers/UserHelpers.cs       |   4 +-
 5 files changed, 290 insertions(+), 1 deletion(-)
 create mode 100644 src/Yavsc.Blogs.Tests/BlogApiMappedClaimsTests.cs
 create mode 100644 src/Yavsc.Blogs.Tests/JwtClaimMappingCollection.cs
 create mode 100644 src/Yavsc.Blogs.Tests/MappedClaimsBlogsWebServerFixture.cs

diff --git a/src/Yavsc.Blogs.Tests/BlogApiMappedClaimsTests.cs b/src/Yavsc.Blogs.Tests/BlogApiMappedClaimsTests.cs
new file mode 100644
index 00000000..f02a1b99
--- /dev/null
+++ b/src/Yavsc.Blogs.Tests/BlogApiMappedClaimsTests.cs
@@ -0,0 +1,156 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Security.Claims;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Tokens;
+using Yavsc.Models;
+using Yavsc.Models.Blog;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Blogs.Tests;
+
+[Collection("JwtClaimMapping")]
+public sealed class BlogApiMappedClaimsTests : IClassFixture<MappedClaimsBlogsWebServerFixture>
+{
+    private readonly MappedClaimsBlogsWebServerFixture _fixture;
+
+    public BlogApiMappedClaimsTests(MappedClaimsBlogsWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    private void ResetDatabase()
+    {
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        db.Database.EnsureDeleted();
+        db.Database.EnsureCreated();
+    }
+
+    private HttpClient NewClient(string subject = "tester")
+    {
+        var http = new HttpClient
+        {
+            BaseAddress = new Uri(_fixture.Addresses.First())
+        };
+        http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
+            "Bearer",
+            IssueMappedClaimsToken(subject));
+        return http;
+    }
+
+    private static string IssueMappedClaimsToken(string subject)
+    {
+        var now = DateTime.UtcNow;
+        var claims = new List<Claim>
+        {
+            new("sub", subject),
+            new("scope", "blogs"),
+        };
+
+        var token = new JwtSecurityToken(
+            issuer: TestTokenIssuer.Issuer,
+            audience: TestTokenIssuer.Audience,
+            claims: claims,
+            notBefore: now,
+            expires: now.AddHours(1),
+            signingCredentials: new SigningCredentials(
+                TestTokenIssuer.SigningKey,
+                SecurityAlgorithms.HmacSha256));
+
+        return new JwtSecurityTokenHandler().WriteToken(token);
+    }
+
+    [Fact]
+    public async Task PostBlog_with_mapped_sub_claim_sets_AuthorId_from_authenticated_user()
+    {
+        ResetDatabase();
+        using var http = NewClient(subject: "mapped-user");
+
+        var draft = new BlogPost
+        {
+            Id = 0,
+            Title = "Billet JWT remappe",
+            AuthorId = "payload-attacker",
+            Article = "Contenu de test.",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow
+        };
+
+        var response = await http.PostAsJsonAsync("/api/v1/blog", draft);
+        Assert.Equal(HttpStatusCode.Created, response.StatusCode);
+
+        var created = await response.Content.ReadFromJsonAsync<BlogPost>();
+        Assert.NotNull(created);
+        Assert.Equal("mapped-user", created!.AuthorId);
+    }
+
+    [Fact]
+    public async Task PutBlog_with_mapped_sub_claim_allows_owner_to_update()
+    {
+        ResetDatabase();
+        using var http = NewClient(subject: "mapped-owner");
+
+        var createdResponse = await http.PostAsJsonAsync("/api/v1/blog", new BlogPost
+        {
+            Id = 0,
+            Title = "Billet à modifier",
+            AuthorId = "payload-attacker",
+            Article = "Contenu initial.",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow
+        });
+
+        Assert.Equal(HttpStatusCode.Created, createdResponse.StatusCode);
+        var created = await createdResponse.Content.ReadFromJsonAsync<BlogPost>();
+        Assert.NotNull(created);
+
+        var updateResponse = await http.PutAsJsonAsync($"/api/v1/blog/{created!.Id}", new BlogPost
+        {
+            Id = created.Id,
+            Title = "Billet modifié",
+            AuthorId = created.AuthorId,
+            Article = "Contenu mis à jour.",
+            DateCreated = created.DateCreated,
+            DateModified = DateTime.UtcNow
+        });
+
+        Assert.Equal(HttpStatusCode.NoContent, updateResponse.StatusCode);
+    }
+
+    [Fact]
+    public async Task PutBlog_with_mapped_sub_claim_rejects_non_owner()
+    {
+        ResetDatabase();
+        using var ownerHttp = NewClient(subject: "mapped-owner");
+
+        var createdResponse = await ownerHttp.PostAsJsonAsync("/api/v1/blog", new BlogPost
+        {
+            Id = 0,
+            Title = "Billet protégé",
+            AuthorId = "payload-attacker",
+            Article = "Contenu initial.",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow
+        });
+
+        Assert.Equal(HttpStatusCode.Created, createdResponse.StatusCode);
+        var created = await createdResponse.Content.ReadFromJsonAsync<BlogPost>();
+        Assert.NotNull(created);
+
+        using var otherHttp = NewClient(subject: "mapped-other");
+        var updateResponse = await otherHttp.PutAsJsonAsync($"/api/v1/blog/{created!.Id}", new BlogPost
+        {
+            Id = created.Id,
+            Title = "Tentative de modification",
+            AuthorId = created.AuthorId,
+            Article = "Contenu non autorisé.",
+            DateCreated = created.DateCreated,
+            DateModified = DateTime.UtcNow
+        });
+
+        Assert.Equal(HttpStatusCode.Unauthorized, updateResponse.StatusCode);
+    }
+}
diff --git a/src/Yavsc.Blogs.Tests/BlogApiTests.cs b/src/Yavsc.Blogs.Tests/BlogApiTests.cs
index bf0758c6..7e725e4f 100644
--- a/src/Yavsc.Blogs.Tests/BlogApiTests.cs
+++ b/src/Yavsc.Blogs.Tests/BlogApiTests.cs
@@ -1,10 +1,12 @@
 using System.Net;
 using System.Net.Http;
 using System.Net.Http.Json;
+using System.Security.Claims;
 using System.Text.Json;
 using Microsoft.Extensions.DependencyInjection;
 using Yavsc.Models;
 using Yavsc.Models.Blog;
+using Yavsc.Server.Helpers;
 using Yavsc.Tests.Shared;
 
 namespace Yavsc.Blogs.Tests;
@@ -20,6 +22,7 @@ namespace Yavsc.Blogs.Tests;
 /// header (or sending a token signed with the wrong key) gets a
 /// 401 back from the framework.
 /// </summary>
+[Collection("JwtClaimMapping")]
 public sealed class BlogApiTests : IClassFixture<BlogsWebServerFixture>
 {
     private readonly BlogsWebServerFixture _fixture;
@@ -180,6 +183,17 @@ public sealed class BlogApiTests : IClassFixture<BlogsWebServerFixture>
         Assert.Equal("tester", doc.RootElement[0].GetProperty("authorId").GetString());
     }
 
+    [Fact]
+    public void GetUserId_reads_NameIdentifier_when_sub_was_mapped()
+    {
+        var principal = new ClaimsPrincipal(
+            new ClaimsIdentity(
+                [new Claim(ClaimTypes.NameIdentifier, "tester")],
+                authenticationType: "Bearer"));
+
+        Assert.Equal("tester", principal.GetUserId());
+    }
+
     [Fact]
     public async Task GetBlog_returns_401_when_no_token_is_provided()
     {
diff --git a/src/Yavsc.Blogs.Tests/JwtClaimMappingCollection.cs b/src/Yavsc.Blogs.Tests/JwtClaimMappingCollection.cs
new file mode 100644
index 00000000..e141c0f3
--- /dev/null
+++ b/src/Yavsc.Blogs.Tests/JwtClaimMappingCollection.cs
@@ -0,0 +1,8 @@
+using Xunit;
+
+namespace Yavsc.Blogs.Tests;
+
+[CollectionDefinition("JwtClaimMapping", DisableParallelization = true)]
+public sealed class JwtClaimMappingCollection
+{
+}
diff --git a/src/Yavsc.Blogs.Tests/MappedClaimsBlogsWebServerFixture.cs b/src/Yavsc.Blogs.Tests/MappedClaimsBlogsWebServerFixture.cs
new file mode 100644
index 00000000..c9d95774
--- /dev/null
+++ b/src/Yavsc.Blogs.Tests/MappedClaimsBlogsWebServerFixture.cs
@@ -0,0 +1,109 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Tokens;
+using Yavsc.Blogs.Controllers;
+using Yavsc.Models;
+using Yavsc.Services;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Blogs.Tests;
+
+/// <summary>
+/// Dedicated integration-test host that mirrors the production JWT
+/// remapping behavior: MapInboundClaims remains enabled and the
+/// default inbound map rewrites "sub" to ClaimTypes.NameIdentifier.
+/// This is the closest in-process reproduction of the production
+/// authentication surface for the blog API.
+/// </summary>
+public sealed class MappedClaimsBlogsWebServerFixture : IDisposable
+{
+    private readonly InMemoryDatabaseRoot _inMemoryRoot = new();
+    private readonly Dictionary<string, string> _savedInboundMap;
+    private readonly WebApplication _app;
+
+    public MappedClaimsBlogsWebServerFixture()
+    {
+        _savedInboundMap = new Dictionary<string, string>(JwtSecurityTokenHandler.DefaultInboundClaimTypeMap);
+        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap["sub"] = ClaimTypes.NameIdentifier;
+
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseUrls("http://127.0.0.1:5104");
+
+        builder.Services.AddDbContext<ApplicationDbContext>(opt =>
+            opt.UseInMemoryDatabase("Yavsc.Blogs.Tests.MappedClaims", _inMemoryRoot));
+
+        builder.Services.AddSingleton<IFileSystemAuthManager>(new NoopFileSystemAuthManager());
+        builder.Services.AddScoped<BlogSpotService>();
+        builder.Services.AddScoped<IAuthorizationHandler, PermissionHandler>();
+        builder.Services.AddControllers()
+            .AddApplicationPart(typeof(BlogApiController).Assembly);
+        builder.Services.AddAuthorization(opt =>
+        {
+            opt.AddPolicy("BlogScope", policy =>
+            {
+                policy.RequireAuthenticatedUser()
+                      .RequireClaim("scope", "blogs");
+            });
+        });
+        builder.Services.AddAuthentication("Bearer")
+            .AddJwtBearer("Bearer", options =>
+            {
+                options.IncludeErrorDetails = true;
+                options.MapInboundClaims = true;
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = true,
+                    ValidIssuer = TestTokenIssuer.Issuer,
+                    ValidateAudience = false,
+                    ValidateLifetime = true,
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = TestTokenIssuer.SigningKey,
+                    RoleClaimType = YavscConstants.RoleClaimType,
+                    NameClaimType = YavscConstants.NameClaimType,
+                };
+            });
+
+        _app = builder.Build();
+        _app.UseRouting();
+        _app.UseAuthentication();
+        _app.UseAuthorization();
+        _app.MapControllers();
+        _app.StartAsync().GetAwaiter().GetResult();
+
+        Addresses = ["http://127.0.0.1:5104"];
+        Services = _app.Services;
+    }
+
+    public IReadOnlyList<string> Addresses { get; }
+
+    public IServiceProvider Services { get; }
+
+    public void Dispose()
+    {
+        _app.StopAsync().GetAwaiter().GetResult();
+        _app.DisposeAsync().AsTask().GetAwaiter().GetResult();
+
+        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
+        foreach (var kvp in _savedInboundMap)
+        {
+            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap[kvp.Key] = kvp.Value;
+        }
+    }
+
+    private sealed class NoopFileSystemAuthManager : IFileSystemAuthManager
+    {
+        public FileAccessRight GetFilePathAccess(System.Security.Claims.ClaimsPrincipal user, string fileRelativePath)
+            => FileAccessRight.None;
+
+        public void SetAccess(long circleId, string normalizedFullPath, FileAccessRight access)
+        {
+        }
+    }
+}
diff --git a/src/Yavsc.Server/Helpers/UserHelpers.cs b/src/Yavsc.Server/Helpers/UserHelpers.cs
index 105c1beb..c3ee708d 100644
--- a/src/Yavsc.Server/Helpers/UserHelpers.cs
+++ b/src/Yavsc.Server/Helpers/UserHelpers.cs
@@ -32,7 +32,9 @@ namespace Yavsc.Server.Helpers
 
         public static string GetUserId(this ClaimsPrincipal user)
         {
-            return user.FindFirstValue("sub");
+            return user.FindFirstValue("sub")
+                ?? user.FindFirstValue(ClaimTypes.NameIdentifier)
+                ?? user.FindFirstValue("nameid");
         }
 
         public static string GetUserName(this ClaimsPrincipal user)

From 0fd9e40d67db41055f16c192e930aafa0bad2fe5 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 10 Aug 2026 21:48:03 +0100
Subject: [PATCH 09/24] Fix blog comment endpoint path and add regression test

---
 src/Yavsc.Blogs.Tests/BlogApiTests.cs         | 36 +++++++++++++++++++
 .../Communicating/BlogspotController.cs       |  2 +-
 .../ViewComponents/CommentViewComponent.cs    |  2 +-
 src/Yavsc.Org/Views/Blogspot/Details.cshtml   |  6 ++--
 4 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/src/Yavsc.Blogs.Tests/BlogApiTests.cs b/src/Yavsc.Blogs.Tests/BlogApiTests.cs
index 7e725e4f..cc7aaec8 100644
--- a/src/Yavsc.Blogs.Tests/BlogApiTests.cs
+++ b/src/Yavsc.Blogs.Tests/BlogApiTests.cs
@@ -183,6 +183,42 @@ public sealed class BlogApiTests : IClassFixture<BlogsWebServerFixture>
         Assert.Equal("tester", doc.RootElement[0].GetProperty("authorId").GetString());
     }
 
+    [Fact]
+    public async Task PostBlogComment_returns_201_for_existing_post()
+    {
+        ResetDatabase();
+        using var http = NewClient(subject: "tester");
+
+        var draft = new BlogPost
+        {
+            Id = 0,
+            Title = "Billet commentable",
+            AuthorId = "payload-attacker",
+            Article = "Contenu de test.",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow
+        };
+
+        var postResponse = await http.PostAsJsonAsync("/api/v1/blog", draft);
+        Assert.Equal(HttpStatusCode.Created, postResponse.StatusCode);
+
+        var createdPost = await postResponse.Content.ReadFromJsonAsync<BlogPost>();
+        Assert.NotNull(createdPost);
+
+        var commentResponse = await http.PostAsJsonAsync("/api/v1/blogcomments", new
+        {
+            Article = "Premier commentaire",
+            ReceiverId = createdPost!.Id
+        });
+
+        Assert.Equal(HttpStatusCode.Created, commentResponse.StatusCode);
+
+        using var doc = JsonDocument.Parse(await commentResponse.Content.ReadAsStringAsync());
+        Assert.True(doc.RootElement.TryGetProperty("id", out var id));
+        Assert.True(id.GetInt64() > 0);
+        Assert.True(doc.RootElement.TryGetProperty("dateCreated", out _));
+    }
+
     [Fact]
     public void GetUserId_reads_NameIdentifier_when_sub_was_mapped()
     {
diff --git a/src/Yavsc.Org/Controllers/Communicating/BlogspotController.cs b/src/Yavsc.Org/Controllers/Communicating/BlogspotController.cs
index de0c3c2d..8e2c9e5b 100644
--- a/src/Yavsc.Org/Controllers/Communicating/BlogspotController.cs
+++ b/src/Yavsc.Org/Controllers/Communicating/BlogspotController.cs
@@ -71,7 +71,7 @@ namespace Yavsc.Org.Controllers
             try
             {
                 var blog = await blogSpotService.Details(User, id.Value);
-                ViewBag.apicmtctlr = "/api/blogcomments";
+                ViewBag.apicmtctlr = "/api/v1/blogcomments";
                 ViewBag.moderatoFlag = User.IsInMsRole(YavscConstants.BlogModeratorGroupName);
 
                 return View(blog);
diff --git a/src/Yavsc.Org/ViewComponents/CommentViewComponent.cs b/src/Yavsc.Org/ViewComponents/CommentViewComponent.cs
index 6752de94..62d3bb7a 100644
--- a/src/Yavsc.Org/ViewComponents/CommentViewComponent.cs
+++ b/src/Yavsc.Org/ViewComponents/CommentViewComponent.cs
@@ -23,7 +23,7 @@ namespace Yavsc.ViewComponents
             var comment = await context.Comment.Include(c=>c.Children).FirstOrDefaultAsync(c => c.Id==id);
             if (comment == null) 
                 throw new InvalidOperationException();
-            ViewBag.apictlr = "/api/blogcomments";
+            ViewBag.apictlr = "/api/v1/blogcomments";
             return View("Default", comment);
         }
 
diff --git a/src/Yavsc.Org/Views/Blogspot/Details.cshtml b/src/Yavsc.Org/Views/Blogspot/Details.cshtml
index d7d5a791..dc0bea8a 100644
--- a/src/Yavsc.Org/Views/Blogspot/Details.cshtml
+++ b/src/Yavsc.Org/Views/Blogspot/Details.cshtml
@@ -7,7 +7,7 @@
     <script src="~/js/comment.js" asp-append-version="true"></script>
     <script>
         $.psc.blogcomment.prototype.options.lang = '@System.Globalization.CultureInfo.CurrentUICulture.Name';
-        $.psc.blogcomment.prototype.options.apictrlr = '/api/blogcomments';
+        $.psc.blogcomment.prototype.options.apictrlr = '/api/v1/blogcomments';
         $.psc.blogcomment.prototype.options.authorId = '@User.GetUserId()';
         $.psc.blogcomment.prototype.options.authorName = '@User.GetUserName()';
         $(document).ready(function() {
@@ -23,7 +23,7 @@
                         ReceiverId: @Model.Id
                         }),
                     error: function(xhr,data) {
-                        if (xhr.status=400)
+                        if (xhr.status === 400)
                         {
                             if (xhr.responseJSON)
                             {
@@ -45,7 +45,7 @@ $('#commentValidation').html(
                         var nnode = '<div data-type="blogcomment" data-id="'+data.id+'" data-allow-edit="True" data-allow-moderate="@ViewBag.moderatoFlag" data-date="'+data.dateCreated+'" data-username="@User.GetUserName()">'+comment+'</div>';
                         $('#comments').append($(nnode).blogcomment())
                     },
-                    url:'/api/blogcomments'
+                    url:'/api/v1/blogcomments'
                     });
             });
         })

From eebc83cf7e5a0159afb1f44e828be08894c55311 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 10 Aug 2026 22:27:52 +0100
Subject: [PATCH 10/24] Add comments API support and tests

---
 .../CommentsApiIntegrationTests.cs            | 92 +++++++++++++++++++
 .../Controllers/CommentsControllerTests.cs    | 63 +++++++++++++
 src/Yavsc.Org.Tests/TestUserStartupFilter.cs  | 12 +--
 .../Communicating/CommentsController.cs       | 83 +++++++++++++++--
 .../Controllers/DimissClicksApiController.cs  |  2 +-
 src/Yavsc.Org/wwwroot/js/site.js              |  2 +-
 6 files changed, 236 insertions(+), 18 deletions(-)
 create mode 100644 src/Yavsc.Org.Tests/Controllers/CommentsApiIntegrationTests.cs
 create mode 100644 src/Yavsc.Org.Tests/Controllers/CommentsControllerTests.cs

diff --git a/src/Yavsc.Org.Tests/Controllers/CommentsApiIntegrationTests.cs b/src/Yavsc.Org.Tests/Controllers/CommentsApiIntegrationTests.cs
new file mode 100644
index 00000000..4b145cd7
--- /dev/null
+++ b/src/Yavsc.Org.Tests/Controllers/CommentsApiIntegrationTests.cs
@@ -0,0 +1,92 @@
+using System.Net;
+using System.Net.Http.Json;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Models;
+using Yavsc.Models.Blog;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Org.Tests.Controllers;
+
+public class CommentsApiIntegrationTests : IClassFixture<TestWebApplicationFactory>
+{
+    private readonly TestWebApplicationFactory _factory;
+
+    public CommentsApiIntegrationTests(TestWebApplicationFactory factory)
+    {
+        _factory = factory;
+    }
+
+    [Fact]
+    public async Task Post_blogcomments_json_returns_201_and_persists_comment()
+    {
+        long postId;
+
+        using (var scope = _factory.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+            if (!db.Users.Any(u => u.Id == TestUserMiddleware.UserId))
+            {
+                db.Users.Add(new ApplicationUser
+                {
+                    Id = TestUserMiddleware.UserId,
+                    UserName = "test-user",
+                    NormalizedUserName = "TEST-USER",
+                    Email = "test-user@example.com",
+                    NormalizedEmail = "TEST-USER@EXAMPLE.COM",
+                    EmailConfirmed = true,
+                    SecurityStamp = Guid.NewGuid().ToString("N"),
+                    ConcurrencyStamp = Guid.NewGuid().ToString("N")
+                });
+            }
+
+            var post = new BlogPost
+            {
+                Title = "Post for comment API test",
+                AuthorId = TestUserMiddleware.UserId,
+                DateCreated = DateTime.UtcNow,
+                DateModified = DateTime.UtcNow
+            };
+
+            db.BlogSpot.Add(post);
+            await db.SaveChangesAsync(TestContext.Current.CancellationToken);
+            postId = post.Id;
+        }
+
+        var http = _factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            HandleCookies = true,
+            AllowAutoRedirect = false
+        });
+        http.DefaultRequestHeaders.Add(TestAuthPolicyProvider.HeaderName, TestAuthPolicyProvider.AdminRole);
+
+        var response = await http.PostAsJsonAsync(
+            "/api/v1/blogcomments",
+            new
+            {
+                Article = "Comment API integration test",
+                ReceiverId = postId
+            },
+            TestContext.Current.CancellationToken);
+        var responseBody = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(
+            response.StatusCode != HttpStatusCode.InternalServerError,
+            $"Unexpected 500 on POST /api/v1/blogcomments. Body: {responseBody}");
+        Assert.Equal(HttpStatusCode.Created, response.StatusCode);
+        Assert.Contains("\"id\"", responseBody, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("\"dateCreated\"", responseBody, StringComparison.OrdinalIgnoreCase);
+
+        using var verifyScope = _factory.Services.CreateScope();
+        var verifyDb = verifyScope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        var stored = await verifyDb.Comment
+            .OrderByDescending(c => c.Id)
+            .FirstOrDefaultAsync(c => c.ReceiverId == postId, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(stored);
+        Assert.Equal("Comment API integration test", stored!.Article);
+        Assert.Equal(TestUserMiddleware.UserId, stored.AuthorId);
+    }
+}
diff --git a/src/Yavsc.Org.Tests/Controllers/CommentsControllerTests.cs b/src/Yavsc.Org.Tests/Controllers/CommentsControllerTests.cs
new file mode 100644
index 00000000..28213eff
--- /dev/null
+++ b/src/Yavsc.Org.Tests/Controllers/CommentsControllerTests.cs
@@ -0,0 +1,63 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Yavsc.Controllers;
+using Yavsc.Models;
+using Yavsc.Models.Blog;
+
+namespace Yavsc.Org.Tests.Controllers;
+
+public class CommentsControllerTests
+{
+    [Fact]
+    public async Task Create_sets_author_and_persists_comment()
+    {
+        var dbName = $"comments-controller-{Guid.NewGuid():N}";
+        var options = new DbContextOptionsBuilder<ApplicationDbContext>()
+            .UseInMemoryDatabase(dbName)
+            .Options;
+
+        await using var db = new ApplicationDbContext(options);
+        var post = new BlogPost
+        {
+            Title = "Post de test",
+            AuthorId = "post-author",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow
+        };
+        db.BlogSpot.Add(post);
+        await db.SaveChangesAsync(TestContext.Current.CancellationToken);
+
+        var controller = new CommentsController(db)
+        {
+            ControllerContext = new ControllerContext
+            {
+                HttpContext = new DefaultHttpContext
+                {
+                    User = new ClaimsPrincipal(new ClaimsIdentity(
+                    [
+                        new Claim(ClaimTypes.NameIdentifier, "comment-author")
+                    ], "TestAuth"))
+                }
+            }
+        };
+
+        var comment = new Comment
+        {
+            ReceiverId = post.Id,
+            Article = "Commentaire de test",
+            Visible = true
+        };
+
+        var result = await controller.Create(comment);
+
+        var redirect = Assert.IsType<RedirectToActionResult>(result);
+        Assert.Equal("Index", redirect.ActionName);
+
+        var stored = await db.Comment.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.Equal("comment-author", stored.AuthorId);
+        Assert.Equal(post.Id, stored.ReceiverId);
+        Assert.Equal("Commentaire de test", stored.Article);
+    }
+}
diff --git a/src/Yavsc.Org.Tests/TestUserStartupFilter.cs b/src/Yavsc.Org.Tests/TestUserStartupFilter.cs
index 53439ed9..06c6caa8 100644
--- a/src/Yavsc.Org.Tests/TestUserStartupFilter.cs
+++ b/src/Yavsc.Org.Tests/TestUserStartupFilter.cs
@@ -33,15 +33,11 @@ public class TestUserStartupFilter : IStartupFilter
     {
         return app =>
         {
-            // Replay the production pipeline first (this is what
-            // Program.Main + ConfigurePipeline set up, including
-            // UseAuthentication and UseAuthorization).
-            next(app);
-            // Then add our middleware on top. UseMiddleware<T> wires
-            // it through the same IMiddlewareActivator the framework
-            // uses, so the dependency on TestUserMiddleware is
-            // resolved from the request scope.
             app.UseMiddleware<TestUserMiddleware>();
+            // Replay the production pipeline after the test middleware,
+            // so downstream auth and controllers can see the injected
+            // principal when no real login flow is used.
+            next(app);
         };
     }
 }
diff --git a/src/Yavsc.Org/Controllers/Communicating/CommentsController.cs b/src/Yavsc.Org/Controllers/Communicating/CommentsController.cs
index f14a234f..3690671c 100644
--- a/src/Yavsc.Org/Controllers/Communicating/CommentsController.cs
+++ b/src/Yavsc.Org/Controllers/Communicating/CommentsController.cs
@@ -2,16 +2,17 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Rendering;
 using Microsoft.EntityFrameworkCore;
-using Yavsc.Helpers;
 using Yavsc.Models;
 using Yavsc.Models.Blog;
 using Yavsc.Server.Helpers;
 
 namespace Yavsc.Controllers
 {
+
     /// <summary>
     /// Comment some post.
     /// </summary>
+    [Route("~/api/v1/blogcomments")]
     public class CommentsController : Controller
     {
         private readonly ApplicationDbContext _context;
@@ -21,7 +22,68 @@ namespace Yavsc.Controllers
             _context = context;    
         }
 
+        [HttpGet("{id:long}", Name = "GetComment")]
+        public async Task<IActionResult> GetComment(long id)
+        {
+            var comment = await _context.Comment.SingleOrDefaultAsync(m => m.Id == id);
+            if (comment == null)
+            {
+                return NotFound();
+            }
+
+            return Ok(comment);
+        }
+
+        [HttpPost]
+        [IgnoreAntiforgeryToken]
+        [Consumes("application/json")]
+        public async Task<IActionResult> Post([FromBody] CommentPost post)
+        {
+            if (!ModelState.IsValid)
+            {
+                return BadRequest(ModelState);
+            }
+
+            var uid = User.GetUserId();
+            if (string.IsNullOrEmpty(uid))
+            {
+                return Challenge();
+            }
+
+            var article = await _context.BlogSpot.FirstOrDefaultAsync(p => p.Id == post.ReceiverId);
+            if (article == null)
+            {
+                ModelState.AddModelError(nameof(post.ReceiverId), "not found");
+                return BadRequest(ModelState);
+            }
+
+            if (post.ParentId != null)
+            {
+                var parentExists = await _context.Comment.AnyAsync(c => c.Id == post.ParentId);
+                if (!parentExists)
+                {
+                    ModelState.AddModelError(nameof(post.ParentId), "not found");
+                    return BadRequest(ModelState);
+                }
+            }
+
+            var comment = new Comment
+            {
+                ReceiverId = post.ReceiverId,
+                Article = post.Article,
+                ParentId = post.ParentId,
+                AuthorId = uid,
+                UserModified = uid
+            };
+
+            _context.Comment.Add(comment);
+            await _context.SaveChangesAsync(uid);
+
+            return CreatedAtRoute("GetComment", new { id = comment.Id }, new { id = comment.Id, dateCreated = comment.DateCreated });
+        }
+
         // GET: Comments
+        [HttpGet]
         public async Task<IActionResult> Index()
         {
             var applicationDbContext = _context.Comment.Include(c => c.Post);
@@ -45,19 +107,24 @@ namespace Yavsc.Controllers
             return View(comment);
         }
 
-        // GET: Comments/Create
+        // GET: Comments/Create (MVC form endpoint)
+        [HttpGet("form")]
         public IActionResult Create()
         {
-            ViewBag.ReceiverId = new SelectList(_context.BlogSpot, "Id", "Post");
+            ViewBag.ReceiverId = new SelectList(_context.BlogSpot, "Id", "Title");
             return View();
         }
 
-        // POST: Comments/Create
-        [HttpPost]
+        // POST: Comments/Create (MVC form endpoint)
+        [HttpPost("form")]
         [ValidateAntiForgeryToken]
         public async Task<IActionResult> Create(Comment comment)
         {
             comment.UserCreated = User.GetUserId();
+            // AuthorId/UserCreated is set server-side after model binding;
+            // remove the stale binding error so a valid authenticated POST
+            // does not fall into the invalid branch.
+            ModelState.Remove(nameof(Comment.AuthorId));
             
             if (ModelState.IsValid)
             {
@@ -65,7 +132,7 @@ namespace Yavsc.Controllers
                 await _context.SaveChangesAsync();
                 return RedirectToAction("Index");
             }
-            ViewBag.ReceiverId = new SelectList(_context.BlogSpot, "Id", "Post", comment.ReceiverId);
+            ViewBag.ReceiverId = new SelectList(_context.BlogSpot, "Id", "Title", comment.ReceiverId);
             return View(comment);
         }
 
@@ -82,7 +149,7 @@ namespace Yavsc.Controllers
             {
                 return NotFound();
             }
-            ViewBag.ReceiverId = new SelectList(_context.BlogSpot, "Id", "Post", comment.ReceiverId);
+            ViewBag.ReceiverId = new SelectList(_context.BlogSpot, "Id", "Title", comment.ReceiverId);
             return View(comment);
         }
 
@@ -97,7 +164,7 @@ namespace Yavsc.Controllers
                 await _context.SaveChangesAsync();
                 return RedirectToAction("Index");
             }
-            ViewBag.ReceiverId = new SelectList(_context.BlogSpot, "Id", "Post", comment.ReceiverId);
+            ViewBag.ReceiverId = new SelectList(_context.BlogSpot, "Id", "Title", comment.ReceiverId);
             return View(comment);
         }
 
diff --git a/src/Yavsc.Org/Controllers/DimissClicksApiController.cs b/src/Yavsc.Org/Controllers/DimissClicksApiController.cs
index bc1c10b6..19f90787 100644
--- a/src/Yavsc.Org/Controllers/DimissClicksApiController.cs
+++ b/src/Yavsc.Org/Controllers/DimissClicksApiController.cs
@@ -10,7 +10,7 @@ using Yavsc.Server.Helpers;
 namespace Yavsc.Controllers
 {
     [Produces("application/json")]
-    [Route("api/dimiss")]
+    [Route("api/v1/dimiss")]
     public class DimissClicksApiController : Controller
     {
         private readonly ApplicationDbContext _context;
diff --git a/src/Yavsc.Org/wwwroot/js/site.js b/src/Yavsc.Org/wwwroot/js/site.js
index 562e497b..e1bfb3cf 100644
--- a/src/Yavsc.Org/wwwroot/js/site.js
+++ b/src/Yavsc.Org/wwwroot/js/site.js
@@ -3,7 +3,7 @@ var notifClick =
     function(nid) {
         if (nid > 0) {
             $.get({
-                url: '/api/dimiss/click/' + nid,
+                url: '/api/v1/dimiss/click/' + nid,
                 success: $('div[data-nid='+nid+']').remove()
             });
         }

From e3987d789046bbff7c6073a0474f6f364213fd8d Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sat, 15 Aug 2026 15:44:47 +0100
Subject: [PATCH 11/24] postit: add CHANGELOG.md with Keep a Changelog format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Initialise le changelog du projet au format Keep a Changelog 1.1.0,
en français, avec une section [Unreleased] vide prête à être curée
au moment de la première release.

Le préambule documente la convention de parité du patch :
- pair → stable
- impair → preview
- suffixe → instable

Cette convention est partagée avec le dépôt postit-debian pour la
production des paquets .deb (alignement à traiter dans une PR séparée).
---
 CHANGELOG.md | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 00000000..eb596070
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,29 @@
+# Changelog
+
+Toutes les modifications notables de PostIt et de la plateforme Yavsc
+sont documentées dans ce fichier.
+
+Le format suit [Keep a Changelog](https://keepachangelog.com/fr/1.1.0/),
+et ce projet adhère au [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+À noter : la **parité du numéro de patch** porte une signification de canal :
+
+- **patch pair** (ex. `1.0.0`, `1.0.2`) → **stable**
+- **patch impair** (ex. `1.0.1`, `1.0.3`) → **preview**
+- **suffixe** (ex. `1.0.0-rc1`, `1.0.0-alpha`) → **instable**
+
+Cette convention est partagée avec le dépôt
+[`postit-debian`](https://forgejo.pschneider.fr/notazof/postit-debian)
+pour la production des paquets `.deb`.
+
+## [Unreleased]
+
+### Added
+
+### Changed
+
+### Fixed
+
+### Removed
+
+[Unreleased]: https://github.com/pazof/yavsc/compare/HEAD

From 825d54439c200c21ce4463a8b1fc3c52bdc470ca Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sat, 15 Aug 2026 15:51:42 +0100
Subject: [PATCH 12/24] postit: validate CHANGELOG section on tag, classify
 stable/preview/unstable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rend le job publish-release dépendant d'un nouveau job validate-release
qui :
- parse le tag (format MAJOR.MINOR.PATCH[-SUFFIX])
- classifie le canal : pair=stable, impair=preview, suffixe=instable
- fail-fast sur instable sauf opt-in explicite via workflow_dispatch
- vérifie que CHANGELOG.md contient une section ## [<tag>] - <canal>
- expose le body de la section via $GITHUB_ENV pour le job de publication

Le tag trigger passe de 'v*' à '*' (pas de préfixe sur les tags), et
le corps de release GitHub est désormais curé via CHANGELOG.md plutôt
que généré automatiquement.

Cette convention de parité est partagée avec le dépôt postit-debian
pour la production des paquets .deb (alignement à traiter dans une PR
séparée).
---
 .github/workflows/docker-publish-android.yml | 128 +++++++++++++++++--
 1 file changed, 119 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/docker-publish-android.yml b/.github/workflows/docker-publish-android.yml
index 317cda80..ebf52a6d 100644
--- a/.github/workflows/docker-publish-android.yml
+++ b/.github/workflows/docker-publish-android.yml
@@ -5,8 +5,14 @@ on:
     branches:
       - main
     tags:
-      - 'v*'
+      - '*'
   workflow_dispatch:
+    inputs:
+      force_unstable:
+        description: 'Publier une release avec suffixe (ex. 1.0.0-rc1) malgré le fail-fast par défaut.'
+        required: false
+        type: boolean
+        default: false
 
 # softprops/action-gh-release a besoin de contents: write
 # pour publier une release + uploader un asset.
@@ -41,11 +47,113 @@ jobs:
           path: ./PostIt.Android.apk
           retention-days: 7
 
-  publish-release:
-    # Uniquement déclenché par un tag v*. Le job apk-deploy tourne en
-    # parallèle, on partage l'artefact entre jobs.
+  # Job de validation : parse le tag, vérifie le format, applique la règle
+  # de parité du patch (pair=stable / impair=preview / suffixe=instable),
+  # et s'assure que CHANGELOG.md contient une section cohérente.
+  # Sans ce job, le job publish-release peut être bypassé (un attaquant
+  # qui contrôle un tag ne peut pas publier de release sans une section
+  # changelog cohérente).
+  validate-release:
     if: startsWith(github.ref, 'refs/tags/')
-    needs: apk-deploy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout du code
+        uses: actions/checkout@v7
+
+      - name: Valider le tag et la section CHANGELOG
+        env:
+          FORCE_UNSTABLE: ${{ inputs.force_unstable || github.event.inputs.force_unstable || 'false' }}
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+
+          # Parse semver : MAJOR.MINOR.PATCH[-SUFFIX]
+          if [[ ! "$TAG" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-.*)?$ ]]; then
+            echo "::error::Tag '$TAG' does not match MAJOR.MINOR.PATCH[-SUFFIX] format."
+            exit 1
+          fi
+
+          MAJOR="${BASH_REMATCH[1]}"
+          MINOR="${BASH_REMATCH[2]}"
+          PATCH="${BASH_REMATCH[3]}"
+          SUFFIX="${BASH_REMATCH[4]}"
+
+          # Classification du canal par parité du patch.
+          # Patch pair + pas de suffixe -> stable.
+          # Patch impair + pas de suffixe -> preview.
+          # Suffixe présent -> instable.
+          if [[ -n "$SUFFIX" ]]; then
+            CHANNEL="unstable"
+          elif (( PATCH % 2 == 0 )); then
+            CHANNEL="stable"
+          else
+            CHANNEL="preview"
+          fi
+
+          echo "Tag $TAG classifié comme channel=$CHANNEL"
+
+          # Fail-fast sur instable sauf opt-in explicite via workflow_dispatch.
+          if [[ "$CHANNEL" == "unstable" && "$FORCE_UNSTABLE" != "true" ]]; then
+            echo "::error::Tag '$TAG' is unstable (suffix '$SUFFIX'). Refusing to publish."
+            echo "Set force_unstable=true via workflow_dispatch to override."
+            exit 1
+          fi
+
+          # Lecture du CHANGELOG.md (doit exister à la racine du repo).
+          if [[ ! -f CHANGELOG.md ]]; then
+            echo "::error::CHANGELOG.md not found at repo root."
+            exit 1
+          fi
+
+          # Extraction de la section [TAG]. On cherche la première ligne
+          # commençant par '## [' qui contient '[TAG]' (entre '## [' et
+          # la prochaine ligne '## [' ou fin de fichier). awk en mode
+          # paragraphe suffit et reste POSIX.
+          BODY=$(awk -v tag="[$TAG]" '
+            /^## \[/ {
+              if (in_section) exit
+              if (index($0, tag) > 0) in_section=1
+              next
+            }
+            in_section { print }
+          ' CHANGELOG.md)
+
+          if [[ -z "$BODY" ]]; then
+            echo "::error::No section matching '## [$TAG]' found in CHANGELOG.md."
+            echo "Add a '## [$TAG] - $CHANNEL' section before tagging."
+            exit 1
+          fi
+
+          # Vérification cohérence du canal déclaré dans le suffixe.
+          # Format attendu : "## [TAG] - stable" / "- preview" / "- unstable".
+          if [[ "$BODY" != *" - $CHANNEL"* ]]; then
+            echo "::error::Section '## [$TAG]' must declare suffix '- $CHANNEL' to match tag parity."
+            echo "Current section body (first 5 lines):"
+            echo "$BODY" | head -5
+            exit 1
+          fi
+
+          echo "Section CHANGELOG validée pour [$TAG] - $CHANNEL"
+
+          # Exposition aux étapes suivantes via $GITHUB_ENV.
+          # heredoc <<EOF pour le body multi-lignes (pattern GitHub Actions).
+          {
+            echo "RELEASE_BODY<<EOF"
+            echo "$BODY"
+            echo "EOF"
+            echo "RELEASE_CHANNEL=$CHANNEL"
+            if [[ "$CHANNEL" == "stable" ]]; then
+              echo "IS_PRERELEASE=false"
+            else
+              echo "IS_PRERELEASE=true"
+            fi
+          } >> "$GITHUB_ENV"
+
+  publish-release:
+    # Déclenché uniquement par un push de tag. Le job apk-deploy produit
+    # l'artefact ; validate-release garantit la cohérence du tag et du
+    # changelog avant publication.
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [apk-deploy, validate-release]
     runs-on: ubuntu-latest
     steps:
       - name: Récupérer l'APK depuis l'artefact
@@ -61,7 +169,9 @@ jobs:
           # apparaîtra dans l'asset et donc dans le permalink :
           #   https://github.com/<owner>/<repo>/releases/latest/download/PostIt.Android.apk
           files: ./PostIt.Android.apk
-          # generate_release_notes: true -> évite d'avoir à maintenir
-          # le corps de release à la main. Décommente si tu veux.
-          # generate_release_notes: true
-
+          # Le body est extrait de la section CHANGELOG.md correspondant
+          # au tag, exposée par validate-release via $GITHUB_ENV.
+          body: ${{ env.RELEASE_BODY }}
+          # stable -> false (marque comme Latest).
+          # preview / unstable -> true (visible mais pas Latest).
+          prerelease: ${{ env.IS_PRERELEASE }}

From 99a62ebf81582288510e16fe24cf52b5d7243734 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sat, 15 Aug 2026 15:51:42 +0100
Subject: [PATCH 13/24] postit: validate CHANGELOG section on tag, classify
 stable/preview/unstable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rend le job publish-release dépendant d'un nouveau job validate-release
qui :
- parse le tag (format MAJOR.MINOR.PATCH[-SUFFIX])
- classifie le canal : pair=stable, impair=preview, suffixe=instable
- fail-fast sur instable sauf opt-in explicite via workflow_dispatch
- vérifie que CHANGELOG.md contient une section ## [<tag>] - <canal>
- expose le body de la section via $GITHUB_ENV pour le job de publication

Le tag trigger passe de 'v*' à '*' (pas de préfixe sur les tags), et
le corps de release GitHub est désormais curé via CHANGELOG.md plutôt
que généré automatiquement.

Cette convention de parité est partagée avec le dépôt postit-debian
pour la production des paquets .deb (alignement à traiter dans une PR
séparée).
---
 .github/workflows/docker-publish-android.yml | 128 +++++++++++++++++--
 1 file changed, 119 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/docker-publish-android.yml b/.github/workflows/docker-publish-android.yml
index 317cda80..ebf52a6d 100644
--- a/.github/workflows/docker-publish-android.yml
+++ b/.github/workflows/docker-publish-android.yml
@@ -5,8 +5,14 @@ on:
     branches:
       - main
     tags:
-      - 'v*'
+      - '*'
   workflow_dispatch:
+    inputs:
+      force_unstable:
+        description: 'Publier une release avec suffixe (ex. 1.0.0-rc1) malgré le fail-fast par défaut.'
+        required: false
+        type: boolean
+        default: false
 
 # softprops/action-gh-release a besoin de contents: write
 # pour publier une release + uploader un asset.
@@ -41,11 +47,113 @@ jobs:
           path: ./PostIt.Android.apk
           retention-days: 7
 
-  publish-release:
-    # Uniquement déclenché par un tag v*. Le job apk-deploy tourne en
-    # parallèle, on partage l'artefact entre jobs.
+  # Job de validation : parse le tag, vérifie le format, applique la règle
+  # de parité du patch (pair=stable / impair=preview / suffixe=instable),
+  # et s'assure que CHANGELOG.md contient une section cohérente.
+  # Sans ce job, le job publish-release peut être bypassé (un attaquant
+  # qui contrôle un tag ne peut pas publier de release sans une section
+  # changelog cohérente).
+  validate-release:
     if: startsWith(github.ref, 'refs/tags/')
-    needs: apk-deploy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout du code
+        uses: actions/checkout@v7
+
+      - name: Valider le tag et la section CHANGELOG
+        env:
+          FORCE_UNSTABLE: ${{ inputs.force_unstable || github.event.inputs.force_unstable || 'false' }}
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+
+          # Parse semver : MAJOR.MINOR.PATCH[-SUFFIX]
+          if [[ ! "$TAG" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-.*)?$ ]]; then
+            echo "::error::Tag '$TAG' does not match MAJOR.MINOR.PATCH[-SUFFIX] format."
+            exit 1
+          fi
+
+          MAJOR="${BASH_REMATCH[1]}"
+          MINOR="${BASH_REMATCH[2]}"
+          PATCH="${BASH_REMATCH[3]}"
+          SUFFIX="${BASH_REMATCH[4]}"
+
+          # Classification du canal par parité du patch.
+          # Patch pair + pas de suffixe -> stable.
+          # Patch impair + pas de suffixe -> preview.
+          # Suffixe présent -> instable.
+          if [[ -n "$SUFFIX" ]]; then
+            CHANNEL="unstable"
+          elif (( PATCH % 2 == 0 )); then
+            CHANNEL="stable"
+          else
+            CHANNEL="preview"
+          fi
+
+          echo "Tag $TAG classifié comme channel=$CHANNEL"
+
+          # Fail-fast sur instable sauf opt-in explicite via workflow_dispatch.
+          if [[ "$CHANNEL" == "unstable" && "$FORCE_UNSTABLE" != "true" ]]; then
+            echo "::error::Tag '$TAG' is unstable (suffix '$SUFFIX'). Refusing to publish."
+            echo "Set force_unstable=true via workflow_dispatch to override."
+            exit 1
+          fi
+
+          # Lecture du CHANGELOG.md (doit exister à la racine du repo).
+          if [[ ! -f CHANGELOG.md ]]; then
+            echo "::error::CHANGELOG.md not found at repo root."
+            exit 1
+          fi
+
+          # Extraction de la section [TAG]. On cherche la première ligne
+          # commençant par '## [' qui contient '[TAG]' (entre '## [' et
+          # la prochaine ligne '## [' ou fin de fichier). awk en mode
+          # paragraphe suffit et reste POSIX.
+          BODY=$(awk -v tag="[$TAG]" '
+            /^## \[/ {
+              if (in_section) exit
+              if (index($0, tag) > 0) in_section=1
+              next
+            }
+            in_section { print }
+          ' CHANGELOG.md)
+
+          if [[ -z "$BODY" ]]; then
+            echo "::error::No section matching '## [$TAG]' found in CHANGELOG.md."
+            echo "Add a '## [$TAG] - $CHANNEL' section before tagging."
+            exit 1
+          fi
+
+          # Vérification cohérence du canal déclaré dans le suffixe.
+          # Format attendu : "## [TAG] - stable" / "- preview" / "- unstable".
+          if [[ "$BODY" != *" - $CHANNEL"* ]]; then
+            echo "::error::Section '## [$TAG]' must declare suffix '- $CHANNEL' to match tag parity."
+            echo "Current section body (first 5 lines):"
+            echo "$BODY" | head -5
+            exit 1
+          fi
+
+          echo "Section CHANGELOG validée pour [$TAG] - $CHANNEL"
+
+          # Exposition aux étapes suivantes via $GITHUB_ENV.
+          # heredoc <<EOF pour le body multi-lignes (pattern GitHub Actions).
+          {
+            echo "RELEASE_BODY<<EOF"
+            echo "$BODY"
+            echo "EOF"
+            echo "RELEASE_CHANNEL=$CHANNEL"
+            if [[ "$CHANNEL" == "stable" ]]; then
+              echo "IS_PRERELEASE=false"
+            else
+              echo "IS_PRERELEASE=true"
+            fi
+          } >> "$GITHUB_ENV"
+
+  publish-release:
+    # Déclenché uniquement par un push de tag. Le job apk-deploy produit
+    # l'artefact ; validate-release garantit la cohérence du tag et du
+    # changelog avant publication.
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [apk-deploy, validate-release]
     runs-on: ubuntu-latest
     steps:
       - name: Récupérer l'APK depuis l'artefact
@@ -61,7 +169,9 @@ jobs:
           # apparaîtra dans l'asset et donc dans le permalink :
           #   https://github.com/<owner>/<repo>/releases/latest/download/PostIt.Android.apk
           files: ./PostIt.Android.apk
-          # generate_release_notes: true -> évite d'avoir à maintenir
-          # le corps de release à la main. Décommente si tu veux.
-          # generate_release_notes: true
-
+          # Le body est extrait de la section CHANGELOG.md correspondant
+          # au tag, exposée par validate-release via $GITHUB_ENV.
+          body: ${{ env.RELEASE_BODY }}
+          # stable -> false (marque comme Latest).
+          # preview / unstable -> true (visible mais pas Latest).
+          prerelease: ${{ env.IS_PRERELEASE }}

From 93f39ca8722bb0da3baebdce412342e496dfcdaa Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sat, 15 Aug 2026 21:56:38 +0100
Subject: [PATCH 14/24] forgejo/ci: pin dotnet sdk 10.0.x for buildAndTest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Le repo cible net10.0 partout (csproj, TFM), mais le workflow CI
Forgejo buildAndTest installait une SDK 9.0.x. Aligne sur 10.0.x
pour que la CI build avec une SDK qui connaît le TFM net10.0.

Pas de global.json ajouté : la SDK est résolue à l'installation
de l'image runner, le repo reste agnostique de la version exacte.
---
 .forgejo/workflows/buildAndTest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/buildAndTest.yml b/.forgejo/workflows/buildAndTest.yml
index cda246cc..c10b4439 100644
--- a/.forgejo/workflows/buildAndTest.yml
+++ b/.forgejo/workflows/buildAndTest.yml
@@ -44,7 +44,7 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v5
       with:
-        dotnet-version: 9.0.x
+        dotnet-version: 10.0.x
     - name: Restore dependencies
       run: dotnet restore
     - name: Build

From 0fe293bcd2a1dfea669fe0c038612770e49484bd Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sat, 15 Aug 2026 22:18:03 +0100
Subject: [PATCH 15/24] forgejo/ci: run build in pazof/yavsc-build-env
 container
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Le workflow buildAndTest tournait sur un runner nu debian-latest avec
setup-dotnet@v5 pour la SDK 10.0.x. Restore échouait car cet
environnement n'a ni la source NuGet interne (isn.pschneider.fr) ni
les workloads Android configurés, contrairement à l'image
pazof/yavsc-build-env utilisée par le Dockerfile.

Bascule le job sur un runner labelisé docker avec l'image
debian12-dotnet10-android36-v1 directement. Le step setup-dotnet
devient inutile (l'image a déjà la SDK 10.0), le restore partage
la même config que le Dockerfile.

Refs l'image cible par ARG BUILD_ENV_TAG=debian12-dotnet10-android36-v1.
---
 .forgejo/workflows/buildAndTest.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.forgejo/workflows/buildAndTest.yml b/.forgejo/workflows/buildAndTest.yml
index c10b4439..12c47ac2 100644
--- a/.forgejo/workflows/buildAndTest.yml
+++ b/.forgejo/workflows/buildAndTest.yml
@@ -37,14 +37,10 @@ jobs:
 
   build:
 
-    runs-on: debian-latest
+    runs-on: docker://pazof/yavsc-build-env:debian12-dotnet10-android36-v1
 
     steps:
     - uses: actions/checkout@v6
-    - name: Setup .NET
-      uses: actions/setup-dotnet@v5
-      with:
-        dotnet-version: 10.0.x
     - name: Restore dependencies
       run: dotnet restore
     - name: Build

From e165e7bb61d02c2afd85ae6334262c945be07112 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 16 Aug 2026 12:49:50 +0100
Subject: [PATCH 16/24] dotnet-android-build-image: pin to <sha-ou-tag>

---
 .gitmodules                         | 3 +++
 external/dotnet-android-build-image | 1 +
 2 files changed, 4 insertions(+)
 create mode 100644 .gitmodules
 create mode 160000 external/dotnet-android-build-image

diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 00000000..6595fa7d
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "external/dotnet-android-build-image"]
+	path = external/dotnet-android-build-image
+	url = git@forgejo.pschneider.fr:notazof/dotnet-android-build-image.git
diff --git a/external/dotnet-android-build-image b/external/dotnet-android-build-image
new file mode 160000
index 00000000..0695a6c1
--- /dev/null
+++ b/external/dotnet-android-build-image
@@ -0,0 +1 @@
+Subproject commit 0695a6c1fea6508f1a88f7ad0ad9cb93733aa52d

From 4ac8e14ba928954e3eaaa6df1a179e1f3a86801b Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 16 Aug 2026 13:03:17 +0100
Subject: [PATCH 17/24] run on docker

---
 .forgejo/workflows/buildAndTest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/buildAndTest.yml b/.forgejo/workflows/buildAndTest.yml
index 12c47ac2..28fee837 100644
--- a/.forgejo/workflows/buildAndTest.yml
+++ b/.forgejo/workflows/buildAndTest.yml
@@ -37,7 +37,7 @@ jobs:
 
   build:
 
-    runs-on: docker://pazof/yavsc-build-env:debian12-dotnet10-android36-v1
+    runs-on: docker
 
     steps:
     - uses: actions/checkout@v6

From 380b5d12c86dfa3dfc1aaaf7eee5569fae47566f Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 16 Aug 2026 13:15:10 +0100
Subject: [PATCH 18/24] ci: replace actions/checkout with manual git clone
 (image has no node)

The pazof/yavsc-build-env:debian12-dotnet10-android36-v1 image only
ships .NET 10 SDK + Android SDK + JDK 17, no Node. actions/checkout@v6
requires Node, so the job failed with 'exec: node not found'.

Replace actions/checkout with a direct git clone over HTTPS (Forgejo
anonymous is enabled), and init submodules recursively.

Also drop the bogus docker://image:tag runs-on: matcher, use just 'docker'
to match the runner's declared label name.
---
 .forgejo/workflows/buildAndTest.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/buildAndTest.yml b/.forgejo/workflows/buildAndTest.yml
index 28fee837..e0b63433 100644
--- a/.forgejo/workflows/buildAndTest.yml
+++ b/.forgejo/workflows/buildAndTest.yml
@@ -40,10 +40,19 @@ jobs:
     runs-on: docker
 
     steps:
-    - uses: actions/checkout@v6
+    - name: Clone yavsc
+      run: |
+        cd "$RUNNER_WORKSPACE"
+        git clone --depth 1 --branch "${GITHUB_REF_NAME:-main}" \
+          https://forgejo.pschneider.fr/notazof/yavsc.git _src
+        cd _src
+        git submodule update --init --recursive --depth 1
     - name: Restore dependencies
+      working-directory: ${{ runner.workspace }}/_src
       run: dotnet restore
     - name: Build
+      working-directory: ${{ runner.workspace }}/_src
       run: dotnet build --no-restore
     - name: Test
+      working-directory: ${{ runner.workspace }}/_src
       run: dotnet test --no-build --verbosity normal

From 7370f48aac750def991eb0ded4b8259dc1a38928 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 16 Aug 2026 13:22:56 +0100
Subject: [PATCH 19/24] ci: clone via GITHUB_REF instead of GITHUB_REF_NAME

In pull_request context, GITHUB_REF_NAME is the PR number ('17'),
not the source branch. Cloning --branch 17 fails with
'Could not find remote branch 17 to clone'.

Use GITHUB_REF (refs/pull/N/head in PR context, refs/heads/<branch>
in push context) and fetch + checkout FETCH_HEAD. workflow_dispatch
falls back to the default branch.
---
 .forgejo/workflows/buildAndTest.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/buildAndTest.yml b/.forgejo/workflows/buildAndTest.yml
index e0b63433..7a19e803 100644
--- a/.forgejo/workflows/buildAndTest.yml
+++ b/.forgejo/workflows/buildAndTest.yml
@@ -43,9 +43,12 @@ jobs:
     - name: Clone yavsc
       run: |
         cd "$RUNNER_WORKSPACE"
-        git clone --depth 1 --branch "${GITHUB_REF_NAME:-main}" \
-          https://forgejo.pschneider.fr/notazof/yavsc.git _src
+        git clone https://forgejo.pschneider.fr/notazof/yavsc.git _src
         cd _src
+        if [ -n "${GITHUB_REF:-}" ]; then
+          git fetch --depth 1 origin "$GITHUB_REF"
+          git checkout FETCH_HEAD
+        fi
         git submodule update --init --recursive --depth 1
     - name: Restore dependencies
       working-directory: ${{ runner.workspace }}/_src

From 86e59ad1c10ed26d6da95ee227632b52f8c5c434 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 16 Aug 2026 13:26:12 +0100
Subject: [PATCH 20/24] submodule: switch URL from SSH to HTTPS for forgejo
 anonymous access

The runner container does not have an SSH client, and even if it
did, no key is configured for it. Forgejo Actions must reach the
submodule over HTTPS with anonymous read access (which is now
enabled on the Forgejo instance).

Use 'git submodule sync --recursive' on the developer side after
checkout to propagate the URL change to .git/modules/.
---
 .gitmodules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitmodules b/.gitmodules
index 6595fa7d..eadf3c7f 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,3 @@
 [submodule "external/dotnet-android-build-image"]
 	path = external/dotnet-android-build-image
-	url = git@forgejo.pschneider.fr:notazof/dotnet-android-build-image.git
+	url = https://forgejo.pschneider.fr/notazof/dotnet-android-build-image.git

From 5f50135c7ff5d9d9081c6e34273d8f956f31d283 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 16 Aug 2026 13:27:36 +0100
Subject: [PATCH 21/24] ci: drop working-directory, cd into /src/_src
 explicitly

forgejo-runner v13 does not interpolate ${{ runner.workspace }}
in working-directory: (or ignores the field entirely for docker
containers), so the container tried to chdir to '/_src' (literally)
which does not exist.

The image WORKDIR is /src, so clone directly into /src/_src and cd
into it at the start of each step. Adds an echo of the checkout
SHA + branch state for visibility in the log.
---
 .forgejo/workflows/buildAndTest.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.forgejo/workflows/buildAndTest.yml b/.forgejo/workflows/buildAndTest.yml
index 7a19e803..2c0137bd 100644
--- a/.forgejo/workflows/buildAndTest.yml
+++ b/.forgejo/workflows/buildAndTest.yml
@@ -42,7 +42,7 @@ jobs:
     steps:
     - name: Clone yavsc
       run: |
-        cd "$RUNNER_WORKSPACE"
+        cd /src
         git clone https://forgejo.pschneider.fr/notazof/yavsc.git _src
         cd _src
         if [ -n "${GITHUB_REF:-}" ]; then
@@ -50,12 +50,10 @@ jobs:
           git checkout FETCH_HEAD
         fi
         git submodule update --init --recursive --depth 1
+        echo "Checked out at $(git rev-parse HEAD) on $(git branch --show-current 2>/dev/null || echo detached HEAD)"
     - name: Restore dependencies
-      working-directory: ${{ runner.workspace }}/_src
-      run: dotnet restore
+      run: cd /src/_src && dotnet restore
     - name: Build
-      working-directory: ${{ runner.workspace }}/_src
-      run: dotnet build --no-restore
+      run: cd /src/_src && dotnet build --no-restore
     - name: Test
-      working-directory: ${{ runner.workspace }}/_src
-      run: dotnet test --no-build --verbosity normal
+      run: cd /src/_src && dotnet test --no-build --verbosity normal

From 94012c51ab49ef0026e3e331ab48751c6ed7c880 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 16 Aug 2026 13:35:44 +0100
Subject: [PATCH 22/24] nuget: add NuGet.config pointing at isn.pschneider.fr

The yavsc solution depends on HigginsSoft.IdentityServer8.* 8.1.0-alpha.*,
which is only published on the internal feed https://isn.pschneider.fr.
Public nuget.org has 8.0.4 as the nearest version, so every project that
uses IdentityServer8 (Yavsc.Org, Yavsc.Api, Yavsc.Blogs, Yavsc.Server,
cli, Yavsc.Org.Tests, Yavsc.Blogs.Tests) fails with NU1102 on restore.

Both feeds are reachable anonymously, so listing isn first and
nuget.org second in a project-level config restores everything without
credentials. The CI runner on forgejo now sees the same sources as a
local clone.
---
 NuGet.config | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 NuGet.config

diff --git a/NuGet.config b/NuGet.config
new file mode 100644
index 00000000..c601d09b
--- /dev/null
+++ b/NuGet.config
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Project-level NuGet configuration.
+
+  The yavsc solution depends on HigginsSoft.IdentityServer8.* 8.1.0-alpha.*,
+  published only on the internal feed https://isn.pschneider.fr. The public
+  nuget.org feed has 8.0.4 as the nearest version, which causes NU1102 on
+  restore for every project that depends on it (Yavsc.Org, Yavsc.Api,
+  Yavsc.Blogs, Yavsc.Server, cli, tests).
+
+  Listing 'isn' before 'nuget.org' here ensures that restore finds the
+  alpha packages first, then falls back to nuget.org for everything else.
+  Both feeds are reachable anonymously; no credentials are stored here.
+
+  See AGENTS.md for the rationale.
+-->
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="isn" value="https://isn.pschneider.fr/api/v3/index.json" />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+</configuration>

From cc50a8bbc8133ddb543b26bdc857604c7ef74c3e Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 16 Aug 2026 13:39:53 +0100
Subject: [PATCH 23/24] ci: unshallow clone for GitVersion

GitVersion.MsBuild fails on shallow clones ('Repository is a shallow
clone. Git repositories must contain the full history.') because it
walks the git log to compute the SemVer version.

Drop --depth 1 from both the PR ref fetch and the submodule update
so the runner's working tree has full history. The repo is small
enough that the cost is negligible.
---
 .forgejo/workflows/buildAndTest.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/buildAndTest.yml b/.forgejo/workflows/buildAndTest.yml
index 2c0137bd..9b3403db 100644
--- a/.forgejo/workflows/buildAndTest.yml
+++ b/.forgejo/workflows/buildAndTest.yml
@@ -46,10 +46,10 @@ jobs:
         git clone https://forgejo.pschneider.fr/notazof/yavsc.git _src
         cd _src
         if [ -n "${GITHUB_REF:-}" ]; then
-          git fetch --depth 1 origin "$GITHUB_REF"
+          git fetch origin "$GITHUB_REF"
           git checkout FETCH_HEAD
         fi
-        git submodule update --init --recursive --depth 1
+        git submodule update --init --recursive
         echo "Checked out at $(git rev-parse HEAD) on $(git branch --show-current 2>/dev/null || echo detached HEAD)"
     - name: Restore dependencies
       run: cd /src/_src && dotnet restore

From eaa4c16936a627b7b2350f5bdc185b1fa15dae31 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 16 Aug 2026 14:09:11 +0100
Subject: [PATCH 24/24] dockerfile: drop inline 'dotnet nuget add source
 isn.pschneider.fr'

The project-level NuGet.config (added in 94012c51) lists the isn feed
so 'dotnet restore' picks it up without an inline 'dotnet nuget add
source' step.

The inline add source was duplicating NuGet.config and causing build
failures in GitHub Actions:
  - The --allow-insecure-connections flag did not match the actual
    HTTPS deployment of isn.pschneider.fr (Letsencrypt-issued cert,
    not self-signed), making the step fail with 'exit code 1'.
  - docker build --target build-env (used by
    .github/workflows/docker-publish-android.yml) hit this on every
    run.

Both Dockerfile and Dockerfile.backend had the same redundant step;
both removed. 'dotnet restore' still finds the feed via NuGet.config
at /src/NuGet.config (copied in by 'COPY . .').
---
 Dockerfile         | 4 ----
 Dockerfile.backend | 3 ---
 2 files changed, 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 88b11683..795b70ab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,10 +46,6 @@ COPY src/PostIt/PostIt.Desktop/*.csproj ./src/PostIt/PostIt.Desktop/
 # (2) Tout le code source
 COPY . .
 
-# (3) Source NuGet interne (Letsencrypt, certificat auto-signé côté
-# serveur, justifié par build privé).
-RUN dotnet nuget add source https://isn.pschneider.fr/api/v3/index.json --allow-insecure-connections
-
 # (4) Restore
 RUN dotnet restore
 
diff --git a/Dockerfile.backend b/Dockerfile.backend
index 76ad9ea0..a4e9a54a 100644
--- a/Dockerfile.backend
+++ b/Dockerfile.backend
@@ -25,9 +25,6 @@ COPY src/PostIt/PostIt.Desktop/*.csproj ./src/PostIt/PostIt.Desktop/
 # 4. Copie de l'intégralité du code source
 COPY . .
 
-# 3. Restauration des dépendances avec vos workloads actifs
-RUN dotnet nuget add source https://isn.pschneider.fr/api/v3/index.json
-
 # 4. Restauration des dépendances pour tous les projets
 RUN dotnet restore