# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Added

- ✨ `GET /api/v1/uptime` endpoint (PR #67) — returns server start_time and uptime_seconds
- 📝 mkcert local HTTPS doc + Makefile `cert` target (PR #68) — prep for ADR-0028 Phase B OIDC callbacks
- ✨ `pkg/auth/` skeleton for OpenID Connect (PR #69) — types + client surface, handlers come later (Phase B.3+)
- 📝 ADR-0028 Phase B roadmap document (PR #71) — outlines remaining B.3 / B.4 / B.5 work
- ✨ `pkg/auth/` OIDC client implementation : Discover, RefreshJWKS, ExchangeCode, ValidateIDToken (PR #74) — completes ADR-0028 Phase B.3
- ✨ OIDC HTTP handlers : `/api/v1/auth/oidc/{provider}/start` and `/callback` with PKCE + sign-up-on-first-use (PR #75) — completes ADR-0028 Phase B.4
- 🧪 OIDC handler unit tests covering start/callback rejection paths and PKCE redirect (PR #76)

## [0.1.0] - 2026-05-05

### Added

- Magic-link passwordless authentication (ADR-0028 Phases A.1 through A.5, PRs #59-#63)
- OIDC provider config skeleton (ADR-0028 Phase B.1 prep, PR #64)
- Magic-link expired-token cleanup loop (PR #65)
- Mailpit local SMTP infrastructure (ADR-0029)
- BDD parallel email assertion strategy (ADR-0030)