Online-first MAUI data layer + post/note browsing

[fboucher]

Parent PRD

#110

Depends on

#120 (MAUI project + auth), #122 (local SQLite layer)

Summary

Implement the IOfflineDataService / OfflineDataService (online path only at this stage). Wire the SharedUI components into the MAUI shell so the app is fully demoable while online: browse posts, view post detail, create/edit notes, view summaries.

Data layer

interface IOfflineDataService
{
    Task<List<Post>> GetPostsAsync();
    Task<Post?> GetPostAsync(string id);
    Task SaveNoteAsync(Note note);
    Task UpdateNoteAsync(Note note);
    Task MarkPostReadAsync(string id);
    // ... mirrors UI needs
}

OfflineDataService (online path): calls remote API via PostNoteClient, mirrors results to ILocalDataService.

UI wiring

Connect SharedUI components (from #119) to IOfflineDataService:

• Post list page
• Post detail page
• Note dialog (create/edit)
• Summary list
• Settings

Acceptance Criteria

• IOfflineDataService and OfflineDataService created
• Online path: reads and writes go to the API and mirror to local SQLite
• Post list, post detail, note creation, summary list visible and functional in the MAUI app while online
• App uses Bearer token from SecureStorage for all API calls

Stories from PRD

User stories 2, 3, 4, 14, 15

[fboucher]

Triage: Scope update needed — remove Bearer token requirement

This issue's acceptance criterion states:

'App uses Bearer token from SecureStorage for all API calls'

This is no longer needed. We've decided to skip Keycloak auth in the MAUI app (device lock is sufficient). The API (NoteBookmark.Api/Program.cs) has no UseAuthentication/UseAuthorization middleware, so no Bearer token is validated.

Updated approach: The PostNoteClient can be used directly with an HttpClient configured to point at the API base URL — no token injection needed. This significantly simplifies the data layer wiring.

The rest of the issue (IOfflineDataService, wiring SharedUI components, online-first data flow) remains valid and unchanged.

[fboucher]

Validation Report — AC Review

Branch: epic/maui-app (commit 65ec3ec)

Acceptance Criteria

• ✅ OfflineDataService created — src/NoteBookmark.MauiApp/Data/OfflineDataService.cs (261 lines) implements IDataService from SharedUI. Routes reads/writes based on IConnectivity.NetworkAccess. Online path calls API via PostNoteClient and mirrors to local SQLite.
• ✅ Online path: reads/writes go to API and mirror to local SQLite — Verified: GetPost (line 161-173), GetNote (109-121), GetSettings (191-203), GetSummaries (79-91), SavePost (175-188), CreateNote (93-107), UpdateNote (123-137) — all cache to ILocalDataService after successful API call
• ✅ Post list, post detail, note creation, summary list visible and functional — Pages (Posts.razor, Summaries.razor, Settings.razor, Search.razor, PostEditor.razor, SummaryEditor.razor) from NoteBookmark.SharedUI are wired via Routes.razor AdditionalAssemblies. OfflineDataService is registered in DI as IDataService.
• ❌ App uses Bearer token from SecureStorage for all API calls — NOT implemented. PostNoteClient (SharedUI) makes requests without any Authorization header. LocalAuthService.GetAccessTokenAsync() returns null and is never called. No DelegatingHandler is configured on the HttpClient.

Assessment

3 of 4 ACs pass. The Bearer token AC is waivable given:

• The API has no auth middleware (UseAuthentication/UseAuthorization are not called), confirmed in Remove Keycloak auth from MAUI app — replace with no-op LocalAuthService #134
• The LocalAuthService design intentionally replaced Keycloak with a no-op
• If future auth is needed, a DelegatingHandler can be added to AddHttpClient<PostNoteClient>

Recommendation: This AC should be marked as superseded by #134's design decision. Close as complete.