3.1.0

No breaking change. Apps on 3.0.2 work the same and no user is logged out. The new features are opt-in.

New

• Access tokens, like AdonisJS or Laravel Sanctum: AccessTokenAuthDriver, Auth().createAccessToken(...), and the dox auth:tokens-table command.
• AuthMiddleware(guards: ['web', 'api']) tries guards in order.
• AuthMiddleware(optional: true) lets guests through.
• GuestMiddleware for login and register pages.
• Auth().check(), once(), id(), guest().
• JWT revocation: JwtAuthDriver(revocation: true), revokeToken, revokeAllTokens.
• Smaller JWT: JwtAuthDriver(minimalPayload: true).
• Login throttle: Auth.throttle = LoginThrottle(...).
• Auth().userFromToken(token) and userFromSession(session), for code with no request (like Socket.IO).
• Auth.needsRehash(hash).

final token = await Auth().createAccessToken(user, name: 'cli', abilities: ['read']);

Fixes

• Bearer is read in any case.
• Errors in JWT checks now go to the exception handler. Before, they were hidden.
• Two Authorization headers give a normal 401.

Docs: Authentication, Access tokens

Full list: the CHANGELOG.