v3.0.0

Release Notes: v3.0.0

🎉 Major Release: Authentication-First Architecture

Version 3.0.0 represents a fundamental shift in the module's philosophy: Authentication Only, Authorization Optional. We've removed all built-in authorization features to focus on doing one thing exceptionally well—secure authentication.

🚀 Breaking Changes

1. No More Built-in Authorization

· Removed: @roles() decorator and RolesGuard
· Removed: roles property from all interfaces (JwtPayload, BaseUser, RequestUser)
· Rationale: Authorization is highly application-specific. By removing it, we enable you to implement the exact authorization logic your business needs.

2. Simplified Token Generation

· Changed: TokenService.generateTokens() now accepts only userId instead of full user object
· Changed: All authentication services return simplified AuthResponse with just userId
· Benefit: Cleaner API, no unnecessary data exposure, better separation of concerns

3. Optional Dependencies

· New: argon2 and passport-google-oauth20 are now optional peer dependencies
· Benefit: Install only what you need. Use credentials auth, Google OAuth, or both.

🆕 New Features

1. Truly Modular Installation

# Just credentials auth
npm install @nahnah/nestjs-auth-module argon2

# Just Google OAuth  
npm install @nahnah/nestjs-auth-module passport-google-oauth20

# Both
npm install @nahnah/nestjs-auth-module argon2 passport-google-oauth20

2. Cleaner Public API

· Removed authorization-related exports
· Simplified type interfaces
· More focused module exports

📦 Updated Package Structure

Peer Dependencies (Required):

{
  "@nestjs/common": "^11.0.0",
  "@nestjs/core": "^11.0.0", 
  "@nestjs/jwt": "^11.0.0",
  "@nestjs/passport": "^11.0.0",
  "passport": "^0.7.0",
  "passport-jwt": "^4.0.1",
  "reflect-metadata": "^0.2.0",
  "rxjs": "^7.0.0"
}

Optional (Install as needed):

· argon2 (for password hashing in credentials auth)
· passport-google-oauth20 (for Google OAuth)

🔧 Migration Guide

From v2.x to v3.0:

1. Remove Role-Based Code:

   // BEFORE (v2.x)
   @Roles('admin')
   @UseGuards(JwtAuthGuard, RolesGuard)
   
   // AFTER (v3.0) - implement your own authorization
   @UseGuards(JwtAuthGuard, YourCustomAuthorizationGuard)

2. Update Token Usage:

   // BEFORE (v2.x)
   const tokens = tokenService.generateTokens(fullUser);
   
   // AFTER (v3.0)
   const tokens = tokenService.generateTokens(user.id);

3. Simplify Response Handling:

   // BEFORE (v2.x)
   const { user: { id, email, roles }, tokens } = await authService.login();
   
   // AFTER (v3.0) 
   const { user: { userId }, tokens } = await authService.login();

🎯 Why This Change?

1. Single Responsibility: Authentication ≠ Authorization. They're different concerns.
2. Flexibility: Your authorization logic is unique to your business.
3. Simplicity: Smaller API surface, easier to understand and maintain.
4. Performance: No unnecessary role checks in authentication flow.