Repository:
- Add _lock to InMemoryMunicipalityProfileRepository; make duplicate-JCode
check + insert atomic in CreateAsync (TOCTOU fix) and wrap UpdateAsync
read-modify-write in lock (lost-update fix)
- Normalize JCode before passing to ILegacyLinkValidator so validation and
storage use the same form (was: raw input validated, ToUpperInvariant stored)
- UpdateAsync returns ProfileNotFound (new factory on MunicipalityProfileSaveResult)
so controller can distinguish 404 from 422
Controller:
- Null-guard post-save/update GetByIdAsync result instead of bang-deref
- Return 404 (not 422) when update target profile does not exist
- GET /api/municipalities/jurisdictions accepted as in-scope extension
Data access:
- FromJsonSeedFile: catch(Exception ex) with Console.Error.WriteLine;
DistinctBy(JCode) before projection to suppress duplicates in seed file
- 422 body shape mismatch: problem.error ?? 'Validation failed.' fallback
in createMunicipalityProfile and updateMunicipalityProfile
Frontend:
- Split Promise.all into independent profile + jurisdiction loads so a
jurisdiction failure does not suppress the profile table
- Add jurisdictionsLoadError state; disable "New" button and show warning
alert when jurisdictions are unavailable
Tests:
- Override ILegacyDataAccess in AuthIntegrationTestFactory with hardcoded
defaults, isolating integration tests from the development seed file
- Add wrong-role 403, jurisdiction endpoint 401, update-not-found 404,
and AC#3 audit assertion tests (create + update) to controller suite
- Add fetchAvailableJurisdictions contract tests (success + failure)
- Story 1.10 marked done; sprint-status synced
Daniel Covington