# Changelog

## Unreleased

### Added

- Added PostgreSQL- and MongoDB-backed production auth scaffolding for accounts, identities, refresh sessions, API keys, database lifecycle, DI, seed credentials, and management endpoints.
- Added MongoDB unique/partial/TTL indexes and Mongo repositories with the same auth, refresh-replay, logout, and API-key revocation contract as PostgreSQL.
- Added token-delivery, auth-storage/backend, API-key storage/header/scopes, role, frontend URL, and custom OAuth claim options.
- Added mode-aware Bruno auth flows for JSON tokens and HTTP-only cookies.

### Changed

- Local and OAuth selections now include JWT explicitly; API-key-only scaffolds remain JWT-free.
- OAuth provisioning is configured per provider, and custom providers declare user-id and verified-email claims.
- Raised generated dependency floors to `@soapjs/soap ^0.14.5` and `@soapjs/soap-auth ^1.0.4`.

### Fixed

- Replaced dead Bruno `function onResponse` blocks with executable `test(...)` blocks and aligned generated credentials with the admin seed.
- Persisted auth scaffold settings so `soap add` and `soap update` preserve database auth wiring and controllers.
- Route-auth prompts are now shown only when auth is enabled and list only configured route strategies, including API key when available.
- Feature route paths now preserve the user-provided feature name instead of applying automatic pluralization.

## 1.6.0 - 2026-07-04

### Added

- Added first-class OAuth support to project creation and config updates.
  - `soap create` now supports `--auth oauth` with `--oauth-provider`.
  - Supported OAuth provider presets are `google`, `github`, `facebook`, `discord`, `linkedin`, `twitter`, and `apple`.
  - Custom OAuth providers can be generated with `custom:<name>` plus authorization, token, and userinfo URLs.
- Added interactive OAuth provider selection, including custom provider prompts and OAuth callback/provisioning options.
- Added provider-specific OAuth environment generation for `.env.example` and Docker Compose.
- Added generated OAuth profile mapping for common provider claim shapes.
- Added route generation support for creating a missing use case target automatically when `soap add route --use-case <name>` references a use case that does not exist yet.
- Added automatic feature `setup.ts` wiring for generated use cases, including use cases created through route generation.
- Added smoke coverage for generated OAuth/docs projects and route-created use cases.

### Changed

- Normalized `local`, `oauth`, and legacy `google` route auth selections to JWT-protected routes.
- Updated generated auth documentation to describe OAuth providers, callback modes, provisioning modes, and custom provider setup.
- Updated generated project summaries and `soap info` output to include OAuth providers separately from auth strategies.
- Updated CLI docs for `soap create`, auth setup, and route use-case generation.

### Fixed

- Fixed generated OpenAPI docs projects so `/docs` works with Helmet enabled.
  - Generated projects now disable the default `createApp` Helmet middleware and configure Helmet through `app.security`.
  - Projects with OpenAPI docs now generate CSP directives compatible with Swagger UI assets loaded from `https://unpkg.com`.
- Removed the legacy `refreshToken` cookie fallback from newly generated auth projects; generated JWT refresh extraction now uses only `refresh_token`.
- Fixed route generation so a missing selected use case is not only created, but also imported and bound in the owning feature `setup.ts`.
- Fixed `soap add use-case` wiring so generated use cases are registered in the selected feature setup.

## 1.5.0 - 2026-06-26

### Breaking Changes

- Changed `soap add route` to use the route name as the positional argument and the owning feature as `--feature`.
  - Use `soap add route approve --feature invoice` instead of `soap add route invoice approve`.
- Changed `soap remove route` to use the route name as the positional argument and the owning feature as `--feature`.
  - Use `soap remove route approve --feature invoice` instead of `soap remove route invoice approve`.
- Changed generated component removal commands to use `--feature` consistently.
  - Use `soap remove controller invoice-admin --feature invoice`.
  - Use `soap remove entity invoice --feature invoice`.
  - Use `soap remove use-case approve-invoice --feature invoice`.
  - Use `soap remove repository invoice --feature invoice`.

### Added

- Added `--controller <controller>` to `soap add route` to place a new route method into an existing generated controller in the same feature.
- Added interactive controller placement when adding routes to features that already have generated controllers.
- Added route registry tracking for controller placement so grouped controllers can be regenerated consistently.

### Fixed

- Repository adapters generated by `soap add repository` now implement their generated repository port.
- Repository mappers generated for existing entities now rehydrate domain entities through `Entity.rehydrate(...)` and persist from `entity.props`.
- Route removal now regenerates grouped controllers after removing a route from an existing controller.
- Route removal now deletes generated route contract specs together with the route contract.

### Changed

- Updated route command help, README examples, and CLI docs to use `feature` terminology consistently.
- Updated route path validation messages to refer to the feature path.