src/PostIt.Tests/BearerScopeTests.cs

@@ -8,9 +8,6 @@ using System.Text;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
-using Yavsc.Blogspot;
-using Yavsc.Api.Client;
-using PostIt.Services;
 using PostIt.Services;
 using Xunit;
 
@@ -122,7 +119,7 @@ public class BearerScopeTests
             // Resolve a BlogApiClient on top. We don't need real
             // posts; we just need the outbound HTTP request to be
             // the one we capture.
-            var blog = new BlogApiClient(subClient, "http://localhost/");
+            var blog = new BlogApiClient(subClient);
 
             await blog.GetPostsAsync(ct: TestContext.Current.CancellationToken);
 

src/PostIt.Tests/MainPageSaveTests.cs

@@ -3,7 +3,6 @@ using Avalonia.Controls;
 using Avalonia.Headless.XUnit;
 using Avalonia.VisualTree;
 using Yavsc.Blogspot;
-using Yavsc.Api.Client;
 using PostIt.Services;
 using PostIt.ViewModels;
 using PostIt.Views;
@@ -41,7 +40,7 @@ public class MainPageSaveTests
         // not a Control, so it needs a navigation host).
         var recorder = new CallRecorder();
         var api = new RecordingYavscApiClient(recorder);
-        var blog = new BlogApiClient(api, "http://localhost/");
+        var blog = new BlogApiClient(api);
         var viewModel = new MainPageViewModel(blog);
 
         var page = new MainPage { DataContext = viewModel };

src/PostIt.Tests/PostItViewModelTests.cs

@@ -1,5 +1,4 @@
 using Yavsc.Blogspot;
-using Yavsc.Api.Client;
 using PostIt.Services;
 using PostIt.ViewModels;
 
@@ -15,7 +14,7 @@ public class PostItViewModelTests
         // default; tests construct one with a fake YavscApiClient that
         // throws on any call (we never call the API in this test).
         var fakeApi = new ThrowingYavscApiClient();
-        var blog = new BlogApiClient(fakeApi, "http://localhost/");
+        var blog = new BlogApiClient(fakeApi);
         var viewModel = new MainPageViewModel(blog);
 
         viewModel.Posts.Add(new BlogPost { Id = 1, Title = "First post", Article = "Hello world", AuthorId = "alice" });
@@ -47,7 +46,7 @@ public class PostItViewModelTests
             new() { Id = 2, Title = "World" }
         };
         var api = new StubYavscApiClient(expected);
-        var blog = new BlogApiClient(api, "http://localhost/");
+        var blog = new BlogApiClient(api);
 
         var posts = await blog.GetPostsAsync();
 

src/PostIt.Tests/YavscApiClientTests.cs

@@ -8,9 +8,6 @@ using System.Net.Sockets;
 using System.Text;
 using System.Text.Json;
 using System.Threading;
-using Yavsc.Blogspot;
-using Yavsc.Api.Client;
-using PostIt.Services;
 using System.Threading.Tasks;
 using IdentityModel.OidcClient;
 using IdentityModel.OidcClient.Browser;

src/PostIt/PostIt/App.axaml.cs

@@ -7,7 +7,6 @@ using Avalonia.Controls.ApplicationLifetimes;
 using Avalonia.Markup.Xaml;
 using Avalonia.Styling;
 using PostIt.Services;
-using Yavsc.Api.Client;
 using PostIt.ViewModels;
 using PostIt.Views;
 
@@ -56,7 +55,7 @@ public partial class App : Application
             "PostIt", "tokens.json"));
 
         var api = new YavscApiClient(settings, tokenStore);
-        var client = new BlogApiClient(api, settings.BlogsApiUrl);
+        var client = new BlogApiClient(api);
 
         var services = new ServiceCollection();
 

src/PostIt/PostIt/PostIt.csproj

@@ -25,7 +25,6 @@
     <PackageReference Include="IdentityModel.OidcClient" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
     <ProjectReference Include="../../Yavsc.Abstract/Yavsc.Abstract.csproj" />
-    <ProjectReference Include="../../Yavsc.Api.Client/Yavsc.Api.Client.csproj" />
   </ItemGroup>
   <ItemGroup>
     <Content Include="postit-settings.json">

src/PostIt/PostIt/Services/BlogApiClient.cs

@@ -5,16 +5,15 @@ using System.Threading;
 using System.Threading.Tasks;
 using Yavsc.Blogspot;
 
-namespace Yavsc.Api.Client;
+namespace PostIt.Services;
 
 /// <summary>
 /// High-level client for the Blog subsystem of the Yavsc API
 /// (deployed at <c>https://blogs.pschneider.fr</c>). All transport
 /// concerns — base URL, JSON serialisation, Bearer auth, silent
 /// refresh on 401, request body shaping — are delegated to
-/// <see cref="YavscApiClient"/>, which lives in the consuming
-/// application (PostIt). This class is a thin DTO↔path mapper,
-/// nothing more.
+/// <see cref="YavscApiClient"/>. This class is a thin DTO↔path
+/// mapper, nothing more.
 ///
 /// <para><b>URL convention.</b> <see cref="YavscApiClient"/>'s
 /// <c>BaseAddress</c> already terminates with <c>/api/v1/</c>
@@ -35,20 +34,16 @@ public sealed class BlogApiClient
 {
     private const string DefaultPathPrefix = "blog";
 
-    private readonly IYavscApiClient _api;
-    private readonly Uri _baseAddress;
+    private readonly YavscApiClient _api;
     private readonly string _pathPrefix;
 
-    public BlogApiClient(IYavscApiClient api, string blogsBaseAddress, string pathPrefix = DefaultPathPrefix)
+    public BlogApiClient(YavscApiClient api, string pathPrefix = DefaultPathPrefix)
     {
         _api = api ?? throw new ArgumentNullException(nameof(api));
-        if (string.IsNullOrEmpty(blogsBaseAddress))
-            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
 
-        // e.g. "https://blogs.pschneider.fr/api/v1/" — keep the
+        // ApiUrl is e.g. "https://blogs.pschneider.fr/api/v1/" — keep the
         // trailing slash so relative paths ("posts") resolve correctly.
-        _baseAddress = new Uri(blogsBaseAddress);
-        api.Http.BaseAddress = _baseAddress;
+        api.Http.BaseAddress = new Uri(api.Settings.BlogsApiUrl);
 
         _pathPrefix = pathPrefix?.TrimStart('/') ?? DefaultPathPrefix;
     }

src/PostIt/PostIt/Services/YavscApiClient.cs

@@ -9,7 +9,6 @@ using System.Threading;
 using System.Threading.Tasks;
 using IdentityModel.OidcClient;
 using PostIt.ViewModels;
-using Yavsc.Api.Client;
 
 namespace PostIt.Services;
 
@@ -25,7 +24,7 @@ namespace PostIt.Services;
 /// <see cref="BearerTokenHandler"/> only refreshes once even if many
 /// concurrent requests are in flight.
 /// </summary>
-public class YavscApiClient : IYavscApiClient, IAsyncDisposable
+public class YavscApiClient : IAsyncDisposable
 {
     // 60s of slack before the access_token's nominal expiry. Covers
     // network latency + JWT validation on the server side.

src/PostIt/PostIt/ViewModels/MainPageViewModel.cs

@@ -5,7 +5,6 @@ using System.Threading.Tasks;
 using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
 using Yavsc.Blogspot;
-using Yavsc.Api.Client;
 using PostIt.Services;
 
 namespace PostIt.ViewModels;

src/Yavsc.Api.Client/BlogAclApiClient.cs

@@ -1,49 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Net.Http;
-using System.Threading;
-using System.Threading.Tasks;
-using Yavsc.Api.Client.Dtos;
-
-namespace Yavsc.Api.Client;
-
-/// <summary>
-/// HTTP client for <c>/api/blogacl</c> on the Yavsc Blogs server.
-///
-/// <para>Each <see cref="CircleAuthorizationDto"/> grants a single
-/// <c>Circle</c> access to a single <c>BlogPost</c>. The server
-/// scopes every endpoint to the caller's uid: only the author of
-/// the underlying blog post can list, create, modify, or delete
-/// its ACL entries.</para>
-/// </summary>
-public sealed class BlogAclApiClient
-{
-    private const string Path = "blogacl";
-
-    private readonly IYavscApiClient _api;
-
-    public BlogAclApiClient(IYavscApiClient api, string blogsBaseAddress)
-    {
-        _api = api ?? throw new ArgumentNullException(nameof(api));
-        if (string.IsNullOrEmpty(blogsBaseAddress))
-            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
-
-        if (api.Http.BaseAddress is null)
-            api.Http.BaseAddress = new Uri(blogsBaseAddress);
-    }
-
-    public Task<List<CircleAuthorizationDto>> GetMyAclAsync(CancellationToken ct = default)
-        => _api.CallAsync<List<CircleAuthorizationDto>>(HttpMethod.Get, Path, ct: ct);
-
-    public Task<CircleAuthorizationDto?> GetAclAsync(long circleId, CancellationToken ct = default)
-        => _api.CallAsync<CircleAuthorizationDto?>(HttpMethod.Get, $"{Path}/{circleId}", ct: ct);
-
-    public Task<CircleAuthorizationDto?> GrantAsync(CircleAuthorizationDto acl, CancellationToken ct = default)
-        => _api.CallAsync<CircleAuthorizationDto?>(HttpMethod.Post, Path, body: acl, ct: ct);
-
-    public Task UpdateAclAsync(long circleId, CircleAuthorizationDto acl, CancellationToken ct = default)
-        => _api.CallAsync(HttpMethod.Put, $"{Path}/{circleId}", body: acl, ct: ct);
-
-    public Task RevokeAsync(long circleId, CancellationToken ct = default)
-        => _api.CallAsync(HttpMethod.Delete, $"{Path}/{circleId}", ct: ct);
-}

src/Yavsc.Api.Client/CircleApiClient.cs

@@ -1,53 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Net.Http;
-using System.Threading;
-using System.Threading.Tasks;
-using Yavsc.Api.Client.Dtos;
-
-namespace Yavsc.Api.Client;
-
-/// <summary>
-/// HTTP client for <c>/api/circle</c> on the Yavsc Blogs server.
-///
-/// <para>Same conventions as <see cref="BlogApiClient"/>: all
-/// transport is delegated to <see cref="YavscApiClient"/>; this
-/// class only maps paths to DTOs.</para>
-///
-/// <para>The server now (since the BlogAcl fix on this branch)
-/// scopes every read and write to the caller's uid. There is no
-/// way for the client to read or modify another user's circles
-/// — the route will return 404 (not 403) when the circle exists
-/// but belongs to someone else, to avoid leaking its existence.</para>
-/// </summary>
-public sealed class CircleApiClient
-{
-    private const string Path = "circle";
-
-    private readonly IYavscApiClient _api;
-
-    public CircleApiClient(IYavscApiClient api, string blogsBaseAddress)
-    {
-        _api = api ?? throw new ArgumentNullException(nameof(api));
-        if (string.IsNullOrEmpty(blogsBaseAddress))
-            throw new ArgumentException("Base address is required.", nameof(blogsBaseAddress));
-
-        if (api.Http.BaseAddress is null)
-            api.Http.BaseAddress = new Uri(blogsBaseAddress);
-    }
-
-    public Task<List<CircleDto>> GetMyCirclesAsync(CancellationToken ct = default)
-        => _api.CallAsync<List<CircleDto>>(HttpMethod.Get, Path, ct: ct);
-
-    public Task<CircleDto?> GetCircleAsync(long id, CancellationToken ct = default)
-        => _api.CallAsync<CircleDto?>(HttpMethod.Get, $"{Path}/{id}", ct: ct);
-
-    public Task<CircleDto?> CreateCircleAsync(CircleDto circle, CancellationToken ct = default)
-        => _api.CallAsync<CircleDto?>(HttpMethod.Post, Path, body: circle, ct: ct);
-
-    public Task UpdateCircleAsync(long id, CircleDto circle, CancellationToken ct = default)
-        => _api.CallAsync(HttpMethod.Put, $"{Path}/{id}", body: circle, ct: ct);
-
-    public Task DeleteCircleAsync(long id, CancellationToken ct = default)
-        => _api.CallAsync(HttpMethod.Delete, $"{Path}/{id}", ct: ct);
-}

src/Yavsc.Api.Client/Dtos/CircleAuthorizationDto.cs

@@ -1,19 +0,0 @@
-namespace Yavsc.Api.Client.Dtos;
-
-/// <summary>
-/// Wire format for <c>GET /api/blogacl</c> and friends.
-///
-/// <para>The server-side
-/// <c>Yavsc.Models.Access.CircleAuthorizationToBlogPost</c> EF entity
-/// carries virtual navigation properties (<c>Target</c>,
-/// <c>Allowed</c>) that pull in the full BlogPost and Circle graphs.
-/// The client never needs them: when showing the ACL of a post, the
-/// UI already has the post, and the circles are looked up by id
-/// against the list returned by <c>GET /api/circle</c>.</para>
-/// </summary>
-public sealed class CircleAuthorizationDto
-{
-    public long CircleId { get; set; }
-    public long BlogPostId { get; set; }
-    public bool Comment { get; set; }
-}

src/Yavsc.Api.Client/Dtos/CircleDto.cs

@@ -1,23 +0,0 @@
-namespace Yavsc.Api.Client.Dtos;
-
-/// <summary>
-/// Wire format for <c>GET /api/circle</c> and friends.
-///
-/// <para>Field names match the JSON the server emits (camelCase via
-/// the default <see cref="System.Text.Json"/> policy), so no
-/// <c>[JsonPropertyName]</c> attributes are required.</para>
-///
-/// <para>Mirrors the server-side <c>Yavsc.Models.Relationship.Circle</c>
-/// EF entity but stops short of the navigation properties
-/// (<c>Owner</c>, <c>Members</c>) which depend on
-/// <c>ApplicationUser</c> and other server-only types. The client
-/// only ever needs the id, name, and owner of a circle to drive
-/// the UI.</para>
-/// </summary>
-public sealed class CircleDto
-{
-    public long Id { get; set; }
-    public string Name { get; set; } = string.Empty;
-    public string OwnerId { get; set; } = string.Empty;
-    public bool Public { get; set; }
-}

src/Yavsc.Api.Client/IYavscApiClient.cs

@@ -1,62 +0,0 @@
-using System;
-using System.Net.Http;
-using System.Threading;
-using System.Threading.Tasks;
-
-namespace Yavsc.Api.Client;
-
-/// <summary>
-/// Transport surface that the high-level clients
-/// (<see cref="BlogApiClient"/>, <see cref="CircleApiClient"/>,
-/// <see cref="BlogAclApiClient"/>) need to do their work.
-///
-/// <para>This is intentionally a thin, transport-only contract. It
-/// does not include the OIDC login / refresh / logout surface —
-/// that lives on the concrete <c>YavscApiClient</c> in the
-/// consuming application and is wired by the application
-/// composition root. Splitting the two keeps <c>Yavsc.Api.Client</c>
-/// usable from any host (a CLI, a unit test, a future iOS
-/// client) without dragging OIDC, identity, and a <c>Settings</c>
-/// POMVO everywhere.</para>
-///
-/// <para>Implementations are expected to:</para>
-/// <list type="bullet">
-///   <item>Attach a Bearer access token to every outbound request.</item>
-///   <item>Silently refresh the token on a 401 and retry once.</item>
-///   <item>Serialise the request body as JSON and deserialise the
-///   response body with case-insensitive property matching.</item>
-/// </list>
-///
-/// The exception contract on non-2xx responses is
-/// <see cref="HttpRequestException"/> with a message that includes
-/// the response body (capped), so callers can surface the
-/// server-side validation problem to the UI without losing
-/// context.
-/// </summary>
-public interface IYavscApiClient : IAsyncDisposable
-{
-    /// <summary>
-    /// The configured <see cref="HttpClient"/>. Clients set its
-    /// <c>BaseAddress</c> in their constructors to point at the
-    /// API host they target.
-    /// </summary>
-    HttpClient Http { get; }
-
-    /// <summary>Call a JSON endpoint with a typed return value.</summary>
-    /// <param name="method">HTTP verb.</param>
-    /// <param name="path">Path relative to <see cref="HttpClient.BaseAddress"/>.</param>
-    /// <param name="body">Optional request body, serialised as JSON.</param>
-    /// <param name="ct">Cancellation token.</param>
-    Task<T> CallAsync<T>(
-        HttpMethod method,
-        string path,
-        object? body = null,
-        CancellationToken ct = default);
-
-    /// <summary>Call a JSON endpoint that returns no useful body (DELETE, 204, etc.).</summary>
-    Task CallAsync(
-        HttpMethod method,
-        string path,
-        object? body = null,
-        CancellationToken ct = default);
-}

src/Yavsc.Api.Client/Yavsc.Api.Client.csproj

@@ -1,29 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <RootNamespace>Yavsc.Api.Client</RootNamespace>
-    <AssemblyName>Yavsc.Api.Client</AssemblyName>
-    <Nullable>enable</Nullable>
-    <LangVersion>latest</LangVersion>
-    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <Description>
-      Thin HTTP clients for the Yavsc API. Each client is a DTO↔path
-      mapper; all transport concerns (base URL, JSON, Bearer auth,
-      silent refresh on 401) are delegated to YavscApiClient, which
-      lives in the consuming application (PostIt).
-    </Description>
-    <RepositoryUrl>https://github.com/pazof/yavsc</RepositoryUrl>
-    <Library>true</Library>
-    <AssemblyVersion>1.0.1.0</AssemblyVersion>
-    <FileVersion>1.0.1.0</FileVersion>
-    <InformationalVersion>1.0.1-5+Branch.main.Sha.0617fc6bda7151c70559d87177e2dcfb1b60995f</InformationalVersion>
-    <Version>1.0.1-5</Version>
-  </PropertyGroup>
-  <ItemGroup>
-    <PackageReference Include="GitVersion.MsBuild" />
-  </ItemGroup>
-  <ItemGroup>
-    <ProjectReference Include="../Yavsc.Abstract/Yavsc.Abstract.csproj" />
-  </ItemGroup>
-</Project>