v3.0.2

Release Notes - v3.0.2

🔧 Bug Fixes

JWT Strategy & Token Validation

Fixed JWT verification key handling and configuration (656e788, cae46ff)

• Resolved critical issue where JWT verification was not properly using the configured secret/key
• Fixed mismatch between token generation and validation configurations
• Improved key selection logic for asymmetric key pairs (RS256, ES256, etc.)

Enhanced JWT strategy validation (427c9db, fd6b9d4)

• Simplified JWT strategy configuration by using secretOrKey instead of secretOrKeyProvider
• Added validation for missing secret/public key in JWT strategy constructor
• Added algorithm, issuer, and audience validation to JWT strategy configuration
• Enhanced refresh token generation with proper conditional key selection (secret vs private key)
• Ensured JWT strategy validates against the same algorithm used for signing

🔄 Refactoring

Configuration Structure

Improved JWT configuration interface (427c9db)

• Renamed JwtConfig interface to JwtAuthConfig for better clarity
• Restructured configuration from flat accessTokenSignOptions/refreshTokenSignOptions to nested structure:

  // Before (v3.0.1)
  jwt: {
    accessTokenSignOptions: { secret, expiresIn },
    refreshTokenSignOptions: { secret, expiresIn }
  }
  
  // After (v3.0.2)
  jwt: {
    accessToken: {
      secret,
      signOptions: { expiresIn }
    },
    refreshToken: {
      secret,
      signOptions: { expiresIn }
    }
  }

• Better type safety and clarity for token configuration

Enhanced token type validation (427c9db)

• Added token type validation ('access' | 'refresh') in JWT payload
• Removed unused token verification methods from TokenService
• Refactored token generation to explicitly use config properties

📖 Documentation

Updated configuration examples (b408ef8)

• Updated README to reflect new JWT configuration structure
• Removed deprecated passReqToCallback from Google OAuth configuration examples
• Improved code formatting and indentation in examples

Added complete auth controller example (e3838ea)

• Comprehensive controller example showing login, register, and OAuth flows
• Demonstrates proper usage of guards, decorators, and services

🔨 Internal Improvements

• Updated type definitions for better IDE support
• Improved error messages when JWT configuration is missing
• Enhanced type safety across token generation and validation

📦 Dependencies

• Updated @types/express to latest version
• Updated @types/passport-google-oauth20 to latest version

⚠️ Breaking Changes

Configuration Structure Change

The JWT configuration structure has been updated. If you're upgrading from v3.0.1, you'll need to update your configuration:

Before (v3.0.1):

AuthModule.forRootAsync({
  useFactory: (config: ConfigService) => ({
    jwt: {
      accessTokenSignOptions: {
        secret: config.get('JWT_SECRET'),
        expiresIn: '15m',
      },
      refreshTokenSignOptions: {
        secret: config.get('JWT_REFRESH_SECRET'),
        expiresIn: '7d',
      },
    },
  }),
})

After (v3.0.2):

AuthModule.forRootAsync({
  useFactory: (config: ConfigService) => ({
    jwt: {
      accessToken: {
        secret: config.get('JWT_SECRET'),
        signOptions: {
          expiresIn: '15m',
          algorithm: 'HS256', // Optional: specify algorithm
          issuer: 'your-app',  // Optional: add issuer
          audience: 'your-audience', // Optional: add audience
        },
      },
      refreshToken: {
        secret: config.get('JWT_REFRESH_SECRET'),
        signOptions: {
          expiresIn: '7d',
        },
      },
    },
  }),
})

Migration Steps

1. Update your JWT configuration to use the new nested structure
2. Move expiresIn and other signing options under signOptions
3. Consider adding algorithm, issuer, and audience for enhanced security (optional but recommended)

Asymmetric Key Support

For RS256/ES256 (asymmetric keys), the configuration now properly distinguishes between signing and verification:

jwt: {
  accessToken: {
    privateKey: fs.readFileSync('private.key'), // For signing
    publicKey: fs.readFileSync('public.key'),   // For verification
    signOptions: {
      algorithm: 'RS256',
      expiresIn: '15m',
    },
  },
}

🙏 Notes

This release focuses on improving JWT configuration structure and fixing critical token validation issues. The configuration changes provide better type safety, clearer structure, and support for advanced JWT features like algorithm-specific validation and asymmetric keys.

All users are encouraged to upgrade and update their configuration to the new structure.

---

Full Changelog: v3.0.1...v3.0.2