Skip to main content

v0.5.0

nauth-toolkit team

Added​

  • Mount the routes instead of writing them. Every auth endpoint now ships as a bundle you mount. One manifest serves NestJS, Express and Fastify, and the paths match what the frontend SDK already expects — so a new backend needs no controllers at all.
src/config/auth.config.ts
routes: [{ prefix: 'auth' }],

Mount it twice to serve both surfaces from one backend — same handlers, different transport:

src/config/auth.config.ts
tokenDelivery: { method: 'hybrid' },
routes: [
  { prefix: 'auth', delivery: 'cookies' },
  { prefix: 'mobile/auth', delivery: 'json', groups: ['core', 'social'] },
],

Customising one route means excluding its key and writing only that one. Everything else stays mounted, and an unknown key throws at startup rather than silently leaving the shipped route in place. See Authentication Routes.

  • Authorization for admin operations. The toolkit authenticates but ships no role model, so administrative operations now delegate to an IAuthorizationProvider you supply. It is enforced inside the services rather than at a route guard, so one policy covers the shipped routes, a controller you wrote, and a background script alike. Denials are audited. Without a provider nothing changes, and the admin route group refuses to mount.

  • OpenID Connect mounts itself. OIDCProviderModule.forRoot() attaches the provider during module initialisation, so main.ts needs no OpenID Connect code. Rate limiting moved from middleware to configuration, and the mount now selects its attach mechanism from the running HTTP driver, so the Fastify driver is supported alongside Express.

Security​

  • Do not derive authority from user.metadata. That column is caller-writable through signup and the self-service profile update, so a user could grant themselves any role stored there. Read authority from a store the user cannot write — a column on your own entity, a roles table, or an external policy service. See Authorization.

Changed​

  • Two route bundles requesting different token deliveries now fail at startup, naming the offending bundle, instead of failing on the first request.