Skip to main content

v0.4.0

nauth-toolkit team

Added​

  • Sign in with your app. The new @nauth-toolkit/oidc-provider package turns your application into an OAuth 2.0 authorization server and OpenID Connect provider, so partners and your own mobile clients can sign users in with accounts they already hold with you. Your existing login runs unchanged inside the flow — challenges, MFA and adaptive risk all still apply — and every artifact lives in the storage adapter you already have, so there are no new tables and no migrations.
npm install @nauth-toolkit/oidc-provider oidc-provider
src/auth/auth.module.ts
imports: [AuthModule.forRoot(authConfig), OIDCProviderModule.forRoot(oidcConfig)];

That registers the provider and the interaction routes your consent screen talks to. The frontend SDK drives them, so there is no hand-written HTTP:

src/app/oidc/interaction.component.ts
const state = await this.auth.oidc.getInteraction(uid);

if (state.gate === 'login_required') {
  await this.auth.oidc.setPendingInteraction(uid);   // survives the whole challenge chain
  void this.router.navigate(['/login']);
} else {
  window.location.assign((await this.auth.oidc.approve(uid)).redirectTo);
}

Start with How the OpenID Connect Provider Works, then Set Up the Provider.

Not a replacement for your own login

This is for letting other applications in. Your own app should keep using AuthService and the frontend SDK — the protocol endpoints do not carry nauth-toolkit's per-identifier rate limiting or account lockout. See when to use this, and when not to.

  • Third-party sign-in appears in the audit trail. OIDC_LOGIN_COMPLETED and OIDC_CONSENT_GRANTED record which application a user was signed into and what it was allowed to see — something the ordinary LOGIN_SUCCESS cannot say, because the authorization request is still parked when the user types their password. See Audit Logs.

  • migrations.autoRun — set it to false to apply migrations from a release task instead of on boot.

src/config/auth.config.ts
migrations: { autoRun: false },

Fixed​

  • Parallel instances no longer race on startup migrations. Instances that boot together — ECS tasks, Kubernetes pods — each saw an empty migrations table and ran the same DDL. Migrations are now serialized behind a database-level lock that the database releases automatically if an instance dies. It is always on and needs no configuration. This mattered most on MySQL, which commits implicitly on DDL, so concurrent runs could half-apply a migration with no way to roll back.

  • Geolocation no longer goes missing on instances that lose the MaxMind download race. Every instance but one used to skip the download and come up with no readers loaded, leaving it without geolocation until restart. Instances now wait their turn and load the database, reusing recent .mmdb files.

  • Redis storage: keys() no longer throws with node-redis v5, which rejected the argument style the adapter was using. Every prefix scan failed, including single logout for the OpenID Connect provider.

Compatibility​

Node.js 22 and 24 are both built, linted and tested in CI. The supported floor is unchanged at >=22.0.0.