notazof/yavsc
1
1
Fork 0
Code Issues 1 Pull requests 1 Projects 2 Releases 9 Packages Wiki Activity Actions
9 releases 17 tags
  • 1.0.8-rc11 b46548a08f

    1.0.8-rc11
    All checks were successful
    Forgejo Release / release (push) Successful in 12m48s
    Details
    Dotnet build and test / build (pull_request) Successful in 11m46s
    Details
    Pre-release

    notazof released this 2026-08-31 13:38:05 +01:00 | -13 commits to main since this release

    Signed by notazof
    GPG key ID: 1DD5D838E5343B06

    Added

    nothing

    Changed

    • [Yavsc.Api.Test] Mise a jour de Microsoft.EntityFrameworkCore.Sqlite vers 10.0.11 afin de supprimer l'alerte NU1903 liee a SQLitePCLRaw.lib.e_sqlite3 2.1.11.
    • [Yavsc.Org] Nettoyage de la configuration NuGet pour le restore: suppression du fichier local Directory.Packages.props au profit du fichier racine centralise.
    • [Yavsc.Org] Suppression de references de packages redondantes dans le projet, sans impact fonctionnel attendu.

    Fixed

    • [Yavsc.Api.Test] Le restore n'emet plus le warning de vulnerabilite NU1903 sur SQLitePCLRaw.lib.e_sqlite3.
    • [Yavsc.Org] Suppression d'une vulnerabilite de severite elevee sur AutoMapper apres publication et consommation de la nouvelle version candidate de HigginsSoft.IdentityServer8.
    Downloads
  • 1.0.8-rc10 b642cbf067

    1.0.8-rc10
    All checks were successful
    Forgejo Release / release (push) Successful in 10m6s
    Details
    Pre-release

    notazof released this 2026-08-31 12:19:33 +01:00 | -10 commits to main since this release

    Signed by notazof
    GPG key ID: 1DD5D838E5343B06

    Added

    • [PostIt] Une page d'historique des commandes billing permet maintenant d'ouvrir une commande existante.
    • [PostIt] Une vue "Demandes en cours" en lecture seule est disponible pour le performer, filtrée sur les statuts actifs (Inserted, Accepted, InProgress).
    • [Yavsc.Org] Nouvelles entités Country et PerformerCodeInputValidation pour piloter la validation du code entreprise performer par pays.

    Changed

    • [PostIt] La page détail billing se préremplit depuis une commande existante (Rdv, Brush, MBrush) et passe en mode mise à jour.
    • [Yavsc.Org] Le formulaire Manage/SetActivity inclut désormais le pays d'exercice (fr, en, pt) et applique la regex associée au champ SIREN.
    • [Yavsc.Org] La vérification externe du numéro d'entreprise est conservée uniquement pour le pays fr.

    Fixed

    • [PostIt] Le flux historique n'est plus limité à une simple liste: l'action d'ouverture charge la commande cible puis navigue vers la page détail.
    • [Yavsc.Org] Le champ SIREN n'est plus validé avec une règle unique indépendante du pays d'exercice.
    Downloads
  • 1.0.8-rc9 fae0777d70

    1.0.8-rc9
    All checks were successful
    Dotnet build and test / build (push) Successful in 2m55s
    Details
    Forgejo Release / release (push) Successful in 6m0s
    Details
    Pre-release

    notazof released this 2026-08-30 19:51:57 +01:00 | 0 commits to main since this release

    Signed by notazof
    GPG key ID: 1DD5D838E5343B06

    Added

    nothing

    Changed

    masquage non-owner côté backend de l'ACL du billet

    Fixed

    On a maintenant le comportement attendu bout en bout:

    ACL chargée depuis le BlogPostDto
    noms de cercles affichés dans le dialogue ACL côté PostIt

    Downloads
  • 1.0.8-rc8 bd94a707b6

    1.0.8-rc8
    Some checks failed
    Forgejo Release / release (push) Successful in 5m19s
    Details
    Dotnet build and test / build (pull_request) Has been cancelled
    Details
    Pre-release

    notazof released this 2026-08-29 19:15:28 +01:00 | 8 commits to main since this release

    Signed by notazof
    GPG key ID: 1DD5D838E5343B06

    Added

    nothing

    Changed

    nothing

    Fixed

    The PostIt publish toggle button

    Downloads
  • 1.0.8-rc7 52eedefb4a

    1.0.8-rc7
    All checks were successful
    Dotnet build and test / build (pull_request) Successful in 3m24s
    Details
    Forgejo Release / release (push) Successful in 6m23s
    Details
    Pre-release

    notazof released this 2026-08-29 18:14:28 +01:00 | 11 commits to main since this release

    Signed by notazof
    GPG key ID: 1DD5D838E5343B06

    Added

    • [PostIt] The search pattern now persists

    Changed

    • The blog spot path is now /api/v1/blogspot (yet in last release)

    Fixed

    • [Yavsc.Org] (Ticket #45) La forme de l'email de l'utilisateur est maintenant validée avant l'envoi du formulaire d'enregistrement
    Downloads
  • 1.0.8-rc6 5b6d2e82db

    1.0.8-rc6
    Some checks failed
    Forgejo Release / release (push) Successful in 7m29s
    Details
    Dotnet build and test / build (push) Failing after 5m43s
    Details
    Pre-release

    notazof released this 2026-08-29 02:50:27 +01:00 | 24 commits to main since this release

    Signed by notazof
    GPG key ID: 1DD5D838E5343B06

    Added

    • a code cleanup,
    • a first Xamarin.UITest is successful, but disabled, because breaking the actual CI process,
    • Android app starts, the login process succeeds

    Changed

    L'identifiant de l'application client Android a changé, il passe en minuscules :
    fr.pschneider.postit

    Fixed

    a bug posting and retrieving ACL from the backend,
    the ACL now comes along with the article,
    [TODO][PostIt] keep ACL along with the article

    Downloads
  • 1.0.8-rc1 48feb27277

    1.0.8-rc1
    All checks were successful
    Dotnet build and test / build (pull_request) Successful in 5m31s
    Details
    Forgejo Release / release (push) Successful in 7m20s
    Details
    Pre-release

    notazof released this 2026-08-21 23:09:56 +01:00 | 145 commits to main since this release

    Signed by notazof
    GPG key ID: 1DD5D838E5343B06

    Added

    • BlogAclApiTests.PostCircleAuthorization_returns_201_when_payload_mirrors_PostIt_shape_against_existing_circle_named_test
      test de non-régression qui épingle la forme exacte du payload
      que PostIt envoie à POST /api/v1/blogacl (un objet
      PostAccessControlRulePayload avec CircleId et BlogPostId).
      C'est le verrou côté test du fix applicatif PostIt + serveur.
    • BlogAclApiTests.PostCircleAuthorization_never_returns_500 : une
      [Theory] couvrant quatre shapes de payload ({ circleId },
      corps vide, { blogPostId } seul, { circleId, blogPostId: 0 })
      qui doivent tous retourner un statut différent de 500. Toute
      réintroduction d'un chemin 500 dans le futur fera rougir ce test.
    • BlogAclApiTests.PostCircleAuthorization_dosent_return_500 et
      ..._dosent_return_500_on_success : entry points [Fact] qui
      appellent la [Theory] ci-dessus avec un payload spécifique
      chacun, pour pouvoir filtrer en isolation depuis la ligne de
      commande ou le CI.
    • Règle « Pas de object dans le code source applicatif » ajoutée
      à CONTRIBUTING.md : types de retour, paramètres, champs,
      propriétés, variables locales doivent être typés statiquement.
      dynamic est interdit pour les mêmes raisons.

    Changed

    • BlogAclApiController.CheckOwner devient CheckOwnerAsync et
      utilise FirstOrDefaultAsync au lieu de First, supprimant
      l'appel LINQ synchrone sur le fil de la requête et retournant
      false sur cercle manquant (le contrôleur mappe déjà cela vers
      ChallengeResult).
    • BlogsWebServerFixture seed alice, son Circle et son
      BlogPost une seule fois au démarrage du host, sur la
      SqliteConnection partagée (Cache=Shared). Le précédent
      EnsureDeleted au début de chaque test fermait la connexion
      statique et détruisait le store :memory: pour tous les autres
      DbContext ; il est retiré au profit d'un EnsureCreated
      idempotent.

    Fixed

    • POST /api/v1/blogacl ne retourne plus 500 sur les payloads
      dont BlogPostId est absent ou à zéro. Le contrôleur rejette
      BlogPostId <= 0 avec 400 BadRequest avant que la requête
      n'atteigne SaveChangesAsync. L'incident de prod du 2026-08-21
      sur mercure (PostIt envoyant seulement circleId, le serveur
      voyant BlogPostId = default(long) = 0 et EF Core levant
      InvalidOperationException sur l'INSERT) n'est plus atteignable.
    • PostIt PostAclDialogViewModel.AddAsync envoie désormais le
      payload explicite PostAccessControlRulePayload { CircleId, BlogPostId } au lieu de l'ancien CircleAuthorization { CircleId }. Le DTO serveur PostAccessControlRulePayload est
      introduit dans Yavsc.Abstract pour porter le contrat.
    Downloads
  • 1.0.7 03fc898af5

    1.0.7
    All checks were successful
    Dotnet build and test / log-the-inputs (pull_request) Successful in 14s
    Details
    Dotnet build and test / build (pull_request) Successful in 10m53s
    Details
    Forgejo Release / release (push) Successful in 8m42s
    Details
    Pre-release

    notazof released this 2026-08-18 18:40:43 +01:00 | 193 commits to main since this release

    Signed by notazof
    GPG key ID: 1DD5D838E5343B06

    Added

    • Per-post ACL in PostIt: a new “Manage ACL” page, opened from the ACL
      button on a selected post, lets the post author grant or revoke
      grants for individuals or circles. The server scopes each grant
      operation to caller == post.AuthorId and returns 404 (not 403)
      for posts the caller does not own, so the existence of another
      user's post is not leaked.
    • Circle membership API + UI: three new REST endpoints under
      /api/circle/{id}/members (GET list, POST add, DELETE
      remove) and a new “Members” column on the My Circles page with an
      “Add a member” button that opens a search modal. The search modal
      reuses IUserDirectory (introduced by the IContactService split
      in this same release) — exactly the use case the abstraction was
      carved out for.
    • Publish toggle for blog posts: a new PUT /api/BlogApi/{id}/publish
      endpoint, and a Published checkbox in the post toolbar that
      toggles a BlogSpotPublication row for the post. The publish
      signal flows through the pre-existing PermissionHandler.IsPublic
      path, so no new column was needed and the server-side authorisation
      logic is unchanged.
    • UserSearchApiController in Yavsc.Blogs:
      GET /api/user-search?q=...&e=...&take=.... Any-authenticated-
      caller endpoint that exposes the user's email under a closed-
      community assumption (documented in the controller's XML doc).
      Wired to the PostIt Desktop address book so the user search modal
      picks it up.
    • IYavscApiClient abstraction in Yavsc.Api.Client. The transport
      for the blog/circle/blog-acl/user-search clients is now accessed
      through this interface, so PostIt.Tests can stub the HTTP layer
      without spinning up a real WebAPI host.
    • Forgejo Actions release workflow: a .forgejo/workflows/release.yml
      pipeline that builds and publishes a release with the PostIt APK
      on tag push. Written in pure bash (the runner image has no Node),
      uses jq for JSON body construction and response parsing, uses the
      runner-provided GITHUB_TOKEN (no repo-level secret needed),
      validates the CHANGELOG section heading before allowing the tag
      to ship.
    • make release V=<version> target: creates a release/<V> branch
      from main, bumps the <Version> property in every .csproj via
      dotnet-gitversion /updateprojectfiles, commits the bump on the
      release branch, and pushes to origin. Fails fast if the working
      tree is dirty or if HEAD is not on main.
    • Forgejo status badges in the README.

    Changed

    • The new Publish toggle replaces the “Visibility enum” approach
      originally drafted in this branch: the existing BlogSpotPublication
      table already carried enough information to expose a publish
      switch, so no schema change was needed. The original feat(blog): add Visibility { Private, Public } commit and its EF migration
      were reverted in favour of the endpoint-only toggle.
    • BlogPost DTO and IBlogPost moved from PostIt.Models to
      Yavsc.Abstract.Blogspot, the shared assembly where the server-side
      entity and the wire DTO both live. Renamed Yavsc.Blogspot.BlogPost
      to BlogPostDto to make the wire/entity distinction explicit.
    • BlogAclApiController and CircleApiController moved from
      Yavsc.Api (not yet enabled in production) to Yavsc.Blogs, where
      they belong next to the BlogSpotService they depend on.
    • IContactService split from IUserDirectory: the two interfaces
      previously conflated the local address-book access (mobile-only,
      via Contacts.Default) and the Yavsc user-search access
      (Desktop-only, via /api/user-search) behind a single facade. The
      split restores the ContactDto.Emails multi-value shape that was
      being silently flattened to a single string before.
    • CI: the Forgejo Actions build now compiles .csproj projects
      directly inside the runner container (which ships the .NET SDK +
      Android workload), instead of relying on a separate Docker build
      step. Node-based third-party actions were replaced with bash + curl
      • jq. The validate-release job parses the CHANGELOG section
        heading to derive the channel (stable / preview / unstable)
        rather than the patch-version parity alone.

    Fixed

    • CircleApiController used to read the caller's user id via
      FindFirstValue(ClaimTypes.NameIdentifier), which does not match
      when JWT Bearer middleware has MapInboundClaims = false. Switched
      to User.GetUserId() (tries sub first, then
      ClaimTypes.NameIdentifier, then nameid). This was a latent
      bug visible in tests but easy to ship to production if a host
      ever disabled the remap.
    • CircleApiController and BlogAclApiController reads and writes
      were not always scoped to the caller's own data. Tightened the
      authorisation checks: cross-user reads now return 404, not the
      raw record.
    • validate-release CHANGELOG channel check used to parse the
      patch-version parity only, which disagreed with the channel
      suffix in the section heading (e.g. ## [1.0.7] - preview
      would be flagged as stable from the parity alone). The job now
      inspects the heading line and trusts the suffix when present.
    • .forgejo/workflows/release.yml: the asset-upload URL now carries
      the asset name as a query-string parameter instead of a curl
      positional argument. The previous shape triggered Forgejo's
      “Missing name parameter” 400 in some cases.

    Removed

    • The ## [Unreleased] block has been moved into this section.
    • The abandoned Visibility { Private, Public } enum and its EF
      migration, reverted in this release. The publish toggle covers
      the same user-visible switch without a schema change.
    Downloads
  • 1.0.6 a4792a7a83

    1.0.6
    All checks were successful
    Dotnet build and test / log-the-inputs (pull_request) Successful in 46s
    Details
    Dotnet build and test / build (pull_request) Successful in 12m18s
    Details
    Forgejo Release / release (push) Successful in 6m34s
    Details
    Stable

    notazof released this 2026-08-17 05:44:12 +01:00 | 235 commits to main since this release

    Added

    • Self-hosted Forgejo Actions runner now drives the CI build for the
      yavsc repository, using the
      pazof/yavsc-build-env:debian12-dotnet10-android36-v2 image pulled
      from Docker Hub. Workflow runs end-to-end: clone, restore, build,
      test, with NuGet.config picking up the isn.pschneider.fr feed.
    • The build-env image now ships jq (Debian package, ≥ 1.7), so the
      release workflow can build JSON bodies and parse API responses
      without a hand-rolled sed-based extractor that was matching the
      wrong id field on minified responses.

    Changed

    • CI workflow .forgejo/workflows/buildAndTest.yml no longer relies on
      actions/checkout (the runner image has no Node); clones yavsc via
      git, fetches the ref under test, and initializes submodules over
      HTTPS.

    Fixed

    • Dockerfile and Dockerfile.backend no longer carry a redundant
      dotnet nuget add source step that conflicted with the GitHub
      Actions APK build (--allow-insecure-connections on an HTTPS
      endpoint, exit 1). NuGet.config at the repo root supplies the
      isn.pschneider.fr feed for every restore, including inside Docker.
    • .forgejo/workflows/release.yml: PATCH on /releases/{id} no longer
      404s on existing releases. The previous sed-based json_field
      matched the last id on the line (the author's), so it tried to
      PATCH /releases/1 (the first user of the instance) instead of the
      actual release id. Switched to jq for both body construction and
      field extraction.
    Downloads