Skip to content
Aurora Catalyst

OAuth provisioning on register

Auto-generated from the source archive. Do not edit by hand — rerun catalyst-changelog-sync instead.

What changed

Section titled “What changed”
  • Registering a HubApp now provisions its OAuth identity — application, authorization-code client, and their link — in a single all-or-nothing transaction; any failure rolls the whole registration back.
  • The register form requires a redirectUri (absolute http(s) URL), and after registration a show-once dialog presents the .env block the satellite needs — issuer URL, application code, generated secret, and redirect URI — with a copy button. The secret is never retrievable again.
  • Each HubApp carries a unique applicationId linking its provisioned OAuth application, with no physical foreign key between the two bounded contexts.

Why it matters

Section titled “Why it matters”

Before this, a registered app was pure metadata: it had no OAuth identity, so it could not participate in the SSO flow. Now registering an app is all it takes to make it SSO-capable — the HUB create flow is the single owner of satellite OAuth provisioning, so the catalog and the real OAuth clients can never drift apart. The client is born with empty scopes; you configure them later in the o-auth module.

View original proposal