dance-lessons-coach/CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• ✨ GET /api/v1/uptime endpoint (PR #67) — returns server start_time and uptime_seconds
• 📝 mkcert local HTTPS doc + Makefile cert target (PR #68) — prep for ADR-0028 Phase B OIDC callbacks
• ✨ pkg/auth/ skeleton for OpenID Connect (PR #69) — types + client surface, handlers come later (Phase B.3+)
• 📝 ADR-0028 Phase B roadmap document (PR #71) — outlines remaining B.3 / B.4 / B.5 work
• ✨ pkg/auth/ OIDC client implementation : Discover, RefreshJWKS, ExchangeCode, ValidateIDToken (PR #74) — completes ADR-0028 Phase B.3
• ✨ OIDC HTTP handlers : /api/v1/auth/oidc/{provider}/start and /callback with PKCE + sign-up-on-first-use (PR #75) — completes ADR-0028 Phase B.4
• 🧪 OIDC handler unit tests covering start/callback rejection paths and PKCE redirect (PR #76)
• 📝 documentation/AUTH.md synthesis covering Phase A + B current state (PR #73)
• 📝 documentation/MISTRAL-AUTONOMOUS-PATTERN.md contributor guide for the Mistral autonomous pattern that ships PRs (PR #78)
• 📝 PHASE_B_ROADMAP marks B.3 + B.4 done (PR #80)
• 📝 documentation/2026-05-05-AUTONOMOUS-SESSION-RECAP.md captures the day's 24 Mistral autonomous PRs (PR #81)
• 📝 README link to Mistral autonomous pattern doc (PR #83)
• 📝 documentation/STATUS.md project snapshot for onboarding (PR #85)
• 📝 documentation guides cherry-picked from PR #17 : CLI.md, CODE_EXAMPLES.md, HISTORY.md, OBSERVABILITY.md, ROADMAP.md, TROUBLESHOOTING.md (PR #87)
• 🔒 redact JWT tokens and HMAC secrets in trace logs of pkg/user/auth_service.go via sha256 fingerprints (PR #88)
• ✨ Dockerfile (root) + Helm chart for k3s homelab deployment, degraded mode without DB/SMTP/Vault (PR #89)
• ♻️ move UserContextKey + GetAuthenticatedUserFromContext from pkg/greet to pkg/auth (PR #90)
• ♻️ split AuthMiddleware into OptionalHandler + RequiredHandler with RFC 6750 challenge headers, narrow tokenValidator interface, case-insensitive Bearer (PR #91)
• 🧪 unit tests for AuthMiddleware Optional/Required handlers + extractBearerToken edge cases (PR #92)
• 📝 refresh AGENTS.md and README.md to reflect auth endpoints (magic-link, OIDC, JWT admin), pkg/auth, pkg/email, pkg/user/api packages, and 30-ADR index. Endpoints listing decision : curated short list + pointer to swagger as source of truth (PR #93)
• 🤖 auto-build Docker image on push to main (paths-ignore for docs) + fix root Dockerfile swag init step (PR #94)

[0.1.0] - 2026-05-05

Added

• Magic-link passwordless authentication (ADR-0028 Phases A.1 through A.5, PRs #59-#63)
• OIDC provider config skeleton (ADR-0028 Phase B.1 prep, PR #64)
• Magic-link expired-token cleanup loop (PR #65)
• Mailpit local SMTP infrastructure (ADR-0029)
• BDD parallel email assertion strategy (ADR-0030)