bug: fix 500 on Post create/edit (null-deref in DetailPostDto.TagNames)

[devin-ai-integration]

Summary

Fixes an unhandled HTTP 500 when saving a Post via /Posts/Create, /Posts/Edit, /PostsAsync/Create, /PostsAsync/Edit on the migrated .NET 10 app. Found during end-to-end testing of the merged web-migration (PR #25).

Root cause — behavior difference between MVC5 and ASP.NET Core model validation. ASP.NET Core's ValidationVisitor walks the posted model graph and evaluates computed getters. DetailPostDto/DetailPostDtoAsync expose a display-only:

public string TagNames { get { return string.Join(", ", Tags.Select(x => x.Name)); } }

but Tags is [ScaffoldColumn(false)], is never model-bound on POST, and isn't initialized in the ctor → it's null when the visitor invokes the getter → ArgumentNullException: Value cannot be null. (Parameter 'source') thrown before the controller action runs. Classic MVC5's validator never invoked this getter, so the bug was latent.

Fix — make the display-only getter null-safe (sync + async DTOs):

public string TagNames { get { return Tags == null ? string.Empty : string.Join(", ", Tags.Select(x => x.Name)); } }

Minimal by design: no ctor/mapping changes, no controller changes, purely guards the getter.

Scope note

This touches ServiceLayer (2 files), which was migrated in a sibling subsession — but it's a genuine web-blocking runtime bug with no viable fix in the web project (the DTO is the validated model, and [ValidateNever] isn't available without pulling an ASP.NET Core MVC reference into the service layer). No DataLayer/BizLayer/Tests changes.

Verification

dotnet build SampleWebApp/SampleWebApp.csproj succeeds on net10.0. Re-testing Post create/edit end-to-end against SQL Server; results posted as a PR comment.

Link to Devin session: https://app.devin.ai/sessions/395506e0330e4a789b2aec401bd66cf7

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Re-test: Post create/edit 500 is fixed (via Devin session)

Checked out devin/net10-fix-post-create-tagnames, rebuilt, reran against SQL Server 2022, and re-tested the previously-failing flows through the UI. The null-safe TagNames getter resolves the ArgumentNullException — all pass.

Flow	Result
/Posts/Create valid post	✅ Saved ("Successfully created the post.")
/Posts/Edit	✅ Saved ("Successfully updated the post.")
/PostsAsync/Create	✅ Saved
/PostsAsync/Edit	✅ Saved
Empty-form client validation	✅ Still blocks submit
Posts index lists new posts	✅ (ids 35 & 36)

Re-test recording:

Sync Post created (was a 500 before):

Async create + edit evidence