Forge 0.5.0

Forge 0.5.0

Authentication, authorization, and baseline security hardening for generated Python REST API projects across FastAPI, Django, and Flask (all three architectures).

Highlights

• Authentication — email/UUID identity, Argon2id passwords, short-lived access JWTs, and rotating opaque SQL refresh sessions with replay-family revocation
• Auth endpoints — registration, login, refresh, logout, logout-all, /me, and password change
• Account security (optional) — email verification and password reset via digest-only, expiring, single-use action tokens (imply Email; Background Jobs remain optional)
• Authorization — reusable authenticated, verified, permission, any-permission, and owner-or-permission policies; SQLAlchemy RBAC roles/permissions; Django-native Groups/Permissions
• Hardening — process-local abuse throttling (429 + Retry-After), trusted hosts, restrictive CORS, baseline security headers (opt-in HSTS in production), auth-route body limits, sensitive-log redaction, production secret/host checks, and auth-state cleanup commands
• Presets — fastapi-auth and django-auth
• Compatibility — existing no-security and Authentication-only configurations remain valid; Authorization implies Authentication; verification/reset imply Email but not Redis or Background Jobs

Security notes

• Access JWTs remain valid until their short expiry after logout; logout-all and password change invalidate older access tokens via auth_version
• Generated rate limits are process-local (not cluster-wide); multi-instance production deployments should also throttle at the gateway
• Selecting Authorization does not automatically protect existing Products, Categories, or Files endpoints — ownership helpers do not replace query scoping

See CHANGELOG.md for full details.

PyPI publication of forge-scaffolder==0.5.0 will follow separately.

Forge 0.4.0

Forge 0.4.0

Composable project modules with real generated capabilities.

Highlights

• Module system — multi-select modules via interactive flow or YAML, with dependency resolution and module-aware forge plan / forge new --dry-run
• Products & Categories — SQL-backed CRUD APIs with pagination, filtering, sorting, and a product→category relationship when both are selected
• Files — upload/list/metadata/download/delete with SQL metadata; local filesystem or S3-compatible storage; optional MinIO with Docker
• Background Jobs — RQ workers on Redis (reuses selected NoSQL Redis when present), generated worker process, Docker worker service
• Email — SMTP-backed EmailService (no open public send endpoint)
• Webhooks — outgoing asynchronous delivery via Background Jobs to an operator-configured WEBHOOK_URL (no inbound framework / open proxy)
• Presets — fastapi-catalog and fastapi-files
• Compatibility — existing no-module configs and presets remain valid

Not in 0.4

Users, authentication, and authorization remain reserved for a later release.

See CHANGELOG.md for full details.

Install: uv tool install forge-scaffolder==0.4.0 (PyPI publish may follow separately)

Forge 0.3.0

Highlights

• Generate optional GitHub Actions CI for pytest and/or Ruff.
• Preview concrete generated files with forge new --dry-run.
• Improved generated project setup, environment configuration, README, and Docker developer experience.
• Richer forge plan output for CI, environment, Docker services, and health endpoints.

Health and Docker

• FastAPI projects now use /health consistently across all architectures.
• Generated Docker images include a liveness HEALTHCHECK.
• .env.example and Compose environment handling now follow the resolved project configuration.

Compatibility

• Existing YAML configurations without ci remain valid.
• Existing presets remain CI-off.
• FastAPI Clean projects generated by 0.3.0 use /health instead of /api/health.

See CHANGELOG.md for full notes.

Forge 0.2.0

Forge 0.2.0

Independent SQL and NoSQL persistence for generated Python REST API projects.

Added

• Independent persistence selection: SQL (postgresql, sqlite) and NoSQL (mongodb, redis), including SQL + NoSQL combinations
• Interactive flow: optional database → SQL / NoSQL / Both → engine prompts
• YAML persistence configuration (sql / nosql keys)
• MongoDB via the official PyMongo driver (async for FastAPI; sync for Flask/Django)
• Redis via the official redis-py client (async for FastAPI; sync for Flask/Django)
• Docker Compose services for MongoDB and Redis when Docker is selected
• Clearer SQL / NoSQL sections in forge plan
• Preset fastapi-mongo (FastAPI + Modular Monolith + MongoDB + Docker)

Changed

• Persistence is modeled as independent SQL and NoSQL choices in ProjectDefinition / GenerationPlan
• SQLAlchemy, Alembic, and Django ORM remain SQL-only implications

Compatibility

• Legacy YAML database: postgresql / sqlite remains supported as an SQL-only shorthand
• Conflicting database + persistence values are rejected with a clear error

Notes

• Django continues to require SQL in Forge’s current model; MongoDB or Redis can be added alongside SQL
• Install: uv tool install forge-scaffolder (or pip install forge-scaffolder)
• CLI: forge

Forge 0.1.1

[0.1.1] - 2026-09-22

Packaging rename for first PyPI publication.

Changed

• PyPI distribution name is now forge-scaffolder (the previous intended name forge-cli is already occupied on PyPI by an unrelated project)
• Console script remains forge; Python import package remains forge; GitHub repository remains Lacky227/forge-cli
• Prepares / contains the first PyPI publication under the new distribution name

The existing GitHub release v0.1.0 remains the previous release and was not published to PyPI.

Forge 0.1.0

[0.1.0] - 2026-09-22

First public development release of the Forge CLI (forge-cli).

Added

• Interactive forge new flow for Python REST API projects
• Generators for FastAPI, Django, and Flask
• Architecture layouts: Simple, Modular Monolith, and Clean Architecture
• Non-interactive YAML generation via forge new --config
• Curated stack presets via forge new --preset (e.g. fastapi-postgres)
• forge plan — inspect the resolved GenerationPlan from --preset or --config without generating files
• Official generation compatibility matrix (forge.core.compatibility) with structural and executable smoke coverage
• Packaged CLI distribution with Jinja templates included in the wheel
• CI for Python 3.11–3.13 plus packaging smoke validation
• Licensed under GPL-3.0-only

Architecture

• Shared domain model: CLI / config / preset → ProjectDefinition → resolve_plan() → GenerationPlan → generator
• Framework implications (ORM, migrations, DRF) resolved in resolve_plan, not duplicated in presets or YAML