3.1.0

No breaking change. Apps on 3.0.2 work the same and no user is logged out. The new features are opt-in.

New

• Access tokens, like AdonisJS or Laravel Sanctum: AccessTokenAuthDriver, Auth().createAccessToken(...), and the dox auth:tokens-table command.
• AuthMiddleware(guards: ['web', 'api']) tries guards in order.
• AuthMiddleware(optional: true) lets guests through.
• GuestMiddleware for login and register pages.
• Auth().check(), once(), id(), guest().
• JWT revocation: JwtAuthDriver(revocation: true), revokeToken, revokeAllTokens.
• Smaller JWT: JwtAuthDriver(minimalPayload: true).
• Login throttle: Auth.throttle = LoginThrottle(...).
• Auth().userFromToken(token) and userFromSession(session), for code with no request (like Socket.IO).
• Auth.needsRehash(hash).

final token = await Auth().createAccessToken(user, name: 'cli', abilities: ['read']);

Fixes

• Bearer is read in any case.
• Errors in JWT checks now go to the exception handler. Before, they were hidden.
• Two Authorization headers give a normal 401.

Docs: Authentication, Access tokens

Full list: the CHANGELOG.

3.0.2

New: gates and policies

Say what a user may do, like "a user may edit only their own post".

Gate.define('update-post', (User user, Post post) => post.userId == user.id);
Gate.policy<Post>(PostPolicy());

await req.authorize('update', post);   // guest: 401, not allowed: 403
Route.put('/posts/{post}', [AuthMiddleware(), Can('update', param: 'post'), update]);

• Gate.allows, denies, authorize, any, all, and before / after hooks.
• GateResponse.deny('reason') sets the message of the 403.

Docs: Security → Authorization.

3.0.1

New

• JWT tokens keep working after an APP_KEY change. Put the old key in AppConfig(previousKeys: [...]). New tokens use the new key only.
• A JWT secret that is not APP_KEY can list its old secrets with JwtAuthDriver(previousSecrets: [...]).

Needs dox_core 3.0.1 or newer.