feat(iwebapi): migrate OpenAPI generation to Microsoft.AspNetCore.OpenApi

[Herman Jensen (h3rmanj)]

Summary

Migrates the iwebapi template from Swashbuckle's OpenAPI document generation to the built-in Microsoft.AspNetCore.OpenApi generator with an IOpenApiDocumentTransformer. Swashbuckle's Swagger UI is retained as the frontend only — it no longer generates the document, it just renders the one produced by the built-in generator.

What changed

• Packages: add Microsoft.AspNetCore.OpenApi (10.0.8); replace the full Swashbuckle.AspNetCore meta-package with Swashbuckle.AspNetCore.SwaggerUI (UI only). Both Asp.Versioning packages are retained (versioning engine + the GroupName the generator routes documents by).
• New AzureAdSecuritySchemeTransformer: a DI-activated document transformer that adds the Azure AD OAuth2 scheme and a global per-operation security requirement — a direct port of the security setup from SwaggerGenConfigurator.
• Program.cs: registers the document with a literal AddOpenApi("v1") call (literal name required so the .NET 10 XML doc-comment source generator stays active) and sets title/version inline; serves it with MapOpenApi() instead of UseSwagger(). Dropped AddEndpointsApiExplorer() (minimal-APIs only; the template uses controllers).
• SwaggerUIConfigurator: repointed from /swagger/{group}/swagger.json to /openapi/{group}.json; dynamic version loop kept so the UI auto-discovers versions.
• Deleted SwaggerGenConfigurator: its security setup moved to the transformer; XML comments are now picked up automatically by the .NET 10 source generator; title/version moved inline.
• packages.lock.json regenerated (CI runs locked-mode: true).

Test Plan

• dotnet build of the main project succeeds (only the pre-existing WeatherForecast nullability warning).
• Ran the app and inspected /openapi/v1.json: correct info title/version, Azure AD OAuth2 scheme, global security requirement on the operation, XML-sourced summary ("Retrieve weather forecast."), and the versioned path /api/v1/WeatherForecast.
• Swagger UI loads at root (HTTP 200).
• dotnet restore --locked-mode (linux-musl-x64) passes — lockfile consistent for CI.
• No remaining references to SwaggerGen, swagger.json, or AddEndpointsApiExplorer in the template.
• Note: the template's test project can't be built in token form (__PROJECT_PATH__); the existing tests (controller unit test + 401 integration test) are unaffected by this change and pass on an instantiated copy.

The __CLIENT_ID__ placeholder in the generated document is intentional (per the template's CLAUDE.md); a real tenant config substitutes it at runtime.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Migrates the iwebapi .NET template’s OpenAPI document generation from Swashbuckle/SwaggerGen to the built-in Microsoft.AspNetCore.OpenApi generator (via AddOpenApi + MapOpenApi), while keeping Swashbuckle’s Swagger UI purely as a frontend renderer.

Changes:

• Switch OpenAPI document generation to Microsoft.AspNetCore.OpenApi with an IOpenApiDocumentTransformer.
• Replace the Swashbuckle meta-package with Swashbuckle.AspNetCore.SwaggerUI and repoint UI to /openapi/{group}.json.
• Remove SwaggerGenConfigurator and introduce AzureAdSecuritySchemeTransformer for Azure AD OAuth2 + security requirements.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
dotnet/iwebapi/Company.WebApplication1/Swagger/SwaggerUIConfigurator.cs	Updates Swagger UI to load docs from the new /openapi/{group}.json endpoint.
dotnet/iwebapi/Company.WebApplication1/Swagger/SwaggerGenConfigurator.cs	Removes SwaggerGen-based document configuration (no longer used).
dotnet/iwebapi/Company.WebApplication1/Swagger/AzureAdSecuritySchemeTransformer.cs	Adds a document transformer to inject Azure AD OAuth2 security scheme and requirements.
dotnet/iwebapi/Company.WebApplication1/Program.cs	Wires up AddOpenApi/MapOpenApi and removes SwaggerGen registration.
dotnet/iwebapi/Company.WebApplication1/packages.lock.json	Updates lockfile for the new OpenAPI/Swashbuckle package set.
dotnet/iwebapi/Company.WebApplication1/Company.WebApplication1.csproj	Adds Microsoft.AspNetCore.OpenApi and switches to Swashbuckle.AspNetCore.SwaggerUI.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.