fixes a 500 in prod and the associated test

src/PostIt/PostIt/ViewModels/PostAclDialogViewModel.cs

@@ -8,6 +8,7 @@ using Yavsc.Blogspot;
 using Yavsc.Api.Client;
 using Yavsc.Api.Client.Dtos;
 using Yavsc.Abstract.Identity.Security;
+using Yavsc.Abstract.BlogSpot;
 
 namespace PostIt.ViewModels;
 
@@ -37,10 +38,12 @@ public partial class PostAclDialogViewModel : ViewModelBase
     public BlogPostDto Post { get; }
 
     [ObservableProperty]
-    public partial ObservableCollection<CircleDto> MyCircles { get; set; } = new();
+    public partial ObservableCollection<CircleDto>
+    MyCircles { get; set; } = new();
 
     [ObservableProperty]
-    public partial ObservableCollection<CircleAuthorization> AclEntries { get; set; } = new();
+    public partial ObservableCollection<PostAccessControlRulePayload>
+    AclEntries { get; set; } = new();
 
     [ObservableProperty]
     public partial CircleDto? SelectedCircleToAdd { get; set; }
@@ -124,7 +127,7 @@ public partial class PostAclDialogViewModel : ViewModelBase
         IsBusy = true;
         try
         {
-            var created = await _aclClient.GrantAsync(new CircleAuthorization
+            var created = await _aclClient.GrantAsync(new Yavsc.Abstract.BlogSpot.PostAccessControlRulePayload
             {
                 CircleId = SelectedCircleToAdd.Id
             });
@@ -149,7 +152,7 @@ public partial class PostAclDialogViewModel : ViewModelBase
     }
 
     [RelayCommand]
-    public async Task RevokeAsync(CircleAuthorization? acl)
+    public async Task RevokeAsync(PostAccessControlRulePayload? acl)
     {
         if (acl is null) return;
         IsBusy = true;

src/Yavsc.Api.Client/BlogAclApiClient.cs

@@ -3,6 +3,7 @@ using System.Collections.Generic;
 using System.Net.Http;
 using System.Threading;
 using System.Threading.Tasks;
+using Yavsc.Abstract.BlogSpot;
 using Yavsc.Abstract.Identity.Security;
 using Yavsc.Api.Client.Dtos;
 
@@ -33,16 +34,16 @@ public sealed class BlogAclApiClient
             api.Http.BaseAddress = new Uri(blogsBaseAddress);
     }
 
-    public Task<List<CircleAuthorization>> GetMyAclAsync(CancellationToken ct = default)
+    public Task<List<PostAccessControlRulePayload>> GetMyAclAsync(CancellationToken ct = default)
-        => _api.CallAsync<List<CircleAuthorization>>(HttpMethod.Get, Path, ct: ct);
+        => _api.CallAsync<List<PostAccessControlRulePayload>>(HttpMethod.Get, Path, ct: ct);
 
-    public Task<CircleAuthorization?> GetAclAsync(long circleId, CancellationToken ct = default)
+    public Task<PostAccessControlRulePayload?> GetAclAsync(long circleId, CancellationToken ct = default)
-        => _api.CallAsync<CircleAuthorization?>(HttpMethod.Get, $"{Path}/{circleId}", ct: ct);
+        => _api.CallAsync<PostAccessControlRulePayload?>(HttpMethod.Get, $"{Path}/{circleId}", ct: ct);
 
-    public Task<CircleAuthorization?> GrantAsync(CircleAuthorization acl, CancellationToken ct = default)
+    public Task<PostAccessControlRulePayload?> GrantAsync(PostAccessControlRulePayload acl, CancellationToken ct = default)
-        => _api.CallAsync<CircleAuthorization?>(HttpMethod.Post, Path, body: acl, ct: ct);
+        => _api.CallAsync<PostAccessControlRulePayload?>(HttpMethod.Post, Path, body: acl, ct: ct);
 
-    public Task UpdateAclAsync(long circleId, CircleAuthorization acl, CancellationToken ct = default)
+    public Task UpdateAclAsync(long circleId, PostAccessControlRulePayload acl, CancellationToken ct = default)
         => _api.CallAsync(HttpMethod.Put, $"{Path}/{circleId}", body: acl, ct: ct);
 
     public Task RevokeAsync(long circleId, CancellationToken ct = default)

src/Yavsc.Blogs.Tests/BlogAclApiTests.cs

@@ -2,6 +2,7 @@ using System.Net;
 using System.Net.Http;
 using System.Net.Http.Json;
 using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Abstract.BlogSpot;
 using Yavsc.Models;
 using Yavsc.Models.Access;
 using Yavsc.Models.Blog;
@@ -186,11 +187,11 @@ public sealed class BlogAclApiTests : IClassFixture<BlogsWebServerFixture>
         var postId = SeedBlogPost("alice", "Billet ACL test");
         using var http = NewClient("alice");
 
-        // Exact wire shape PostIt sends today:
+
-        // { "circleId": <id> } — no blogPostId, no comment.
+        var payload = new PostAccessControlRulePayload
-        var payload = new Dictionary<string, object>
         {
-            ["circleId"] = circleId,
+            CircleId = circleId,
+            BlogPostId = postId
         };
 
         var response = await http.PostAsJsonAsync(BlogAclUrl(), payload);