Skip to content
Aurora Catalyst

Aurora Catalyst Framework

User-facing changes in aurora-catalyst (the Angular + NestJS framework scaffolded by the CLI). Internal refactors, performance improvements, and bug fixes are intentionally omitted — this log is scoped to what changes how you use the platform. Each entry links back to the original proposal in the source repo.

Entries are grouped by the semver tag that ships them, newest first. Changes archived since the last tag appear under Unreleased until a new version is cut.

Unreleased

  • color-picker widget type Feature · 2026-06-17

    A scalar field can now declare widget type color-picker and the front-module generator emits an au-color-picker bound to the Signal Form.

  • Barrel-import lint guard Feature · 2026-06-12

    A new pnpm hr:lint-barrels command enforces barrel-import discipline across backend and frontend, wired into a PostToolUse hook, pre-commit, and CI.

  • Edit Hub apps from the list Feature · 2026-06-12

    The Hub app list gains an Edit action to change mutable metadata and toggle isActive, with code and applicationId kept immutable end to end.

  • OAuth deprovisioning on delete Feature · 2026-06-11

    Deleting a HUB app now atomically tears down its OAuth identity — application, clients, and refresh tokens — and frees its code for re-registration.

  • Per-app access permissions Feature · 2026-06-11

    Each satellite app now gets its own <code>.access IAM permission; the HUB dashboard shows a user only the apps their roles grant.

  • Client secrets hashed at rest Breaking · 2026-06-11

    BREAKING: OAuthApplication.secret is now stored as a bcrypt hash, masked on every read, and verified with bcrypt.compare; frontend environments must carry the plaintext secret.

  • Permission-gated navigation Feature · 2026-06-11

    Sidebar items and routes can now require a permission: the menu hides what the session cannot use, and a reusable permissionGuard blocks unreachable routes.

  • Permission refresh at token issuance Feature · 2026-06-11

    Every login and token renewal now recomputes the account's dPermissions snapshot from its current roles, so role permission changes actually reach users.

  • HUB app registry and dashboard Feature · 2026-06-10

    New hub bounded context: register satellite applications and launch them from a responsive app-launcher dashboard with per-card icon, color, and link.

  • Per-user dashboard preferences Feature · 2026-06-10

    Star favorites and drag-and-drop ordering on the HUB dashboard, saved per user via new toggle-favorite, reorder-apps, and my-preferences endpoints.

  • OAuth provisioning on register Feature · 2026-06-10

    Registering a HUB app now atomically provisions its OAuth identity and hands you a one-time .env credential bundle with the generated secret.

  • RP-initiated hub logout Feature · 2026-06-09

    Sign-out now terminates the hub session through a navigable logout endpoint and a same-origin redirect, ending silent re-authentication.

  • Authorization Code flow with PKCE Feature · 2026-06-08

    The hub now exposes GET /api/o-auth/authorize and accepts the authorization_code grant with mandatory PKCE S256, single-use codes and a hub session cookie.

  • Satellite BFF realigned to PKCE Breaking · 2026-06-08

    Breaking: the satellite BFF now uses the hub's PKCE /token contract; the legacy /credentials JSON exchange and UUID client_id are removed.

  • Authentication none mode Breaking · 2026-06-02

    OAUTH_STRATEGY gains a none mode for keyless bootstrap, and its default changes from aurora-hub to none — a breaking change for deployments relying on the implicit default.

  • MJML email template adapter Breaking · 2026-06-02

    The mailer moves to the MJML template adapter and drops the abandoned handlebars-helpers dependency — a breaking change for anyone relying on its ~180 helpers.

  • Authenticated account query Feature · 2026-05-27

    A new iamMeAccount query (REST + GraphQL) returns the logged-in account from request context — strategy-agnostic and authenticated-only, no permission gate.

  • Logout and token revocation Feature · 2026-05-27

    A new revoke-token flow (POST /api/o-auth/revoke, RFC 7009, plus a GraphQL twin) ends a local-provider session server-side instead of only clearing local storage.

  • Transparent token refresh Feature · 2026-05-27

    Expired-access-token GraphQL calls now refresh and retry silently instead of bouncing the user to sign-in, keeping sessions alive up to the refresh-token lifetime.

  • GraphQL login for local provider Feature · 2026-05-26

    A new oAuthCreateToken GraphQL mutation (Password + Refresh grants) completes the local-provider login flow in the browser, twin of the REST token endpoint.

  • Local-provider token issuance Feature · 2026-05-26

    Catalyst can now issue its own OAuth2 tokens — RFC 6749 Password and Refresh grants at POST /api/o-auth/token, RS256 signing, and a JWKS endpoint — becoming an identity authority.

  • Iam account orchestration Feature · 2026-05-10

    `iamCreateAccount` and `iamUpdateAccountById` now orchestrate uniqueness checks, server-side derived fields, tenant expansion, no-privilege-escalation, and coordinated IamUser writes.

  • Cross-BC ports pattern Breaking · 2026-05-10

    New architectural convention: every cross-bounded-context dependency uses a port + adapter + bridge entry, wired through a global `BridgesModule` composition root.

  • Sticky responsive data-table Feature · 2026-05-08

    `<au-data-table>` gains horizontal sticky columns, stable layout under pagination, and default truncation with native tooltip.

  • User-driven column pinning Feature · 2026-05-08

    `<au-column-toggle>` lock button now pins/unpins columns at runtime via TanStack pinning, with two drag zones and `localStorage` persistence.

  • Atomic composables + manager rewrite Breaking · 2026-05-05

    Composables go atomic under @aurora/composables/{atoms,presets}/, and grid-select-multiple-elements becomes a many-to-many manager with a new immediate link/unlink contract.

  • Relationship components in @aurora Feature · 2026-04-24

    Four new standalone Angular components — async-select-search, grid-select-element, grid-select-multiple-elements, grid-elements-manager — ship under @aurora/components.

  • Add GraphQL Fetchers Feature · 2026-04-22

    Seven new queryX / mutateX fetchers expose pure one-shot GraphQL calls — resolvers no longer need to stand up a composable to pre-load data.