Aeon 6.0 Release Notes

Changed the default URL for the Aeon API from https://servername/aeon/api/ to https://servername/aeonapi/. The Aeon 6.0 API will be installed to this new default path in IIS during the 6.0 server update. This installation path is not customizable.

The Aeon API now uses the Microsoft .NET 8 framework in place of the deprecated Microsoft .NET Core 2.2 framework used in previous API versions for enhanced security.

Users can now authenticate to the Aeon API with their Aeon staff accounts through the generation of staff tokens via several new Token endpoints. This method allows users to use the API directly or through a third-party application without needing an Aeon API key. When this method of authentication is used:

• Actions taken by users via the API will be attributed to their username in the History and Tracking tables, instead of to the "System."
• Certain API endpoints will be restricted only to users with specific permissions (as configured for the user's staff account in the Aeon Staff Manager). 
• Time-based authentication will be enforced via access and refresh tokens (as opposed to API key authentication, which never expires).

In addition to the new Token endpoints noted above, significantly expanded the functionality of the Aeon API through the addition of new endpoints, including:

• An Activities endpoint used to retrieve a list of activities.
• Appointments endpoints used to manage appointments and appointment notes and retrieve appointment history.
• Customization endpoints used to retrieve customization key and CustomDropDown table values configured in the Aeon Customization Manager.
• Emails endpoints used to retrieve and send emails.
• New ReadingRoom endpoints used to retrieve reading room history, retrieve currently signed-in users, sign a user into or out of a reading room, and to update a signed-in user's status to present or away.
• Sites endpoints used to retrieve a list of sites and to manage the site groups configured in the Aeon Web Client.
• Staff endpoints used to retrieve a list of staff accounts and manage site groups and profiles assigned to staff users in the Aeon Web Client.
• Users endpoints used to create users, update user records, retrieve user history and images, manage a user's notes, set a user's clearance status, and change a user's password.
• WebSession endpoints used to manage a web session for a specific user.

Expanded the number of endpoints supporting OData query options. These endpoints are listed in the odata section of the Aeon API Swagger documentation.

Added support for the new ReshelvingLocation field to the Requests/<transactionNumber>/reshelved and Requests/batch/reshelved endpoints.

For more information on this field, see the Database section below.

{
  "newStatus": "<new queue name or ID>",
  "reshelvingLocation": "<reshelving location>"
}

Removed the /api/RequestBarcodes/{barcode}/reshelved and /api/RequestBarcodes/{id}/reshelved endpoints, which were deprecated and replaced with the /api/Requests/Batch/ endpoints in the Aeon 5.0 API.

Changed the data type of the Appointment ID property returned by the GET /api/Users/{username}/appointments endpoint from a string to an integer value. The new data type for this property will also be used in all new endpoints in the Aeon API in which it is included.

The Aeon API will no longer log an unnecessary invalid X-AEON-API-KEY header message when the Swagger interface or other public endpoints that do not require API key authentication are accessed. Bug# 10273

Fixed an issue where new requests created via the /api/Requests/create endpoint could not be associated with an activity. Bug# 27495

Fixed an issue where calling the /api/Users/{username}/requests endpoint to retrieve a user's requests could return an HTTP 500 error when the activeOnly parameter was set to 'true'. Bug# 27501

Fixed an issue where attempting to associate a researcher with a request created via the /api/Requests/create endpoint could fail in that the RequestFor field would be set to the username associated with the request when the request was created instead of to the researcher's username. Bug# 27503

Fixed an issue where attempting to associate a request created via the /api/Requests/create endpoint with a nonexistent researcher username would return inaccurate validation messages that did not clarify why the process failed. The endpoint will now return a single validation message explicitly stating that the username is invalid. Bug# 27504

Removed support for the embedded Chromium browser from the Aeon Desktop Client. Client addons that use a Chromium browser interface will now load using a WebView2 browser. To prevent potential compatibility issues, addons should be updated to versions supporting the WebView2 browser.

Updated the third-party Newtonsoft dependency used by the Aeon Desktop Client, Aeon Customization Manager, Aeon Staff Manager, and Aeon System Manager to patch a security vulnerability found in the previous version of this component.

Fixed an issue where appointments with invalid data would appear on the User Information and Request forms in the Aeon Desktop Client but would throw an error when opened. These appointments can now be opened, but the invalid data must be fixed (e.g., by ensuring the appointment's stop time occurs after its start time) before the Appointment form can be saved. Bug# 17378

Fixed an issue where the System panel on the Aeon Desktop Client dashboard did not include information for pending or failed appointment-type emails. These emails are now included in the System panel and can be managed via the Failed Email and Pending Email tabs. Bug# 26272

See Troubleshooting Email for more information on accessing and managing failed and pending emails.

Fixed an issue where rescheduling an appointment in the Aeon Desktop Client could result in an error if another user edited that appointment at the same time using a different start or end time. Both the start time and end time on the Appointment form will now be saved to the database when the appointment is saved to avoid potential invalid data, even if only one of these values was changed during editing. Bug# 17181

Fixed an issue where the auto-confirm appointments setting for a reading room in the Aeon Customization Manager would not automatically confirm/re-confirm an appointment after it was edited or rescheduled on the web interface. Bug# 24074

Added a new ReshelvingLocation field to the Transactions table. This field can be added to grids and the Request form in the Aeon Desktop Client and to Transactions grids in the Aeon Web Client. It is also available as a merge field for print and email templates. 

Added new tables to the database to support the Aeon Web Client features:

• RestrictedFieldGroups: Holds data for the restricted field groups configured on the Staff Administration page.
• RestrictedFields: Holds data for the fields assigned to the restricted field groups configured on the Staff Administration page.
• SiteGroups: Holds data for the site groups configured on the Staff Administration page.
• SiteGroupSites: Holds data for the sites assigned to the site groups configured on the Staff Administration page.
• StaffProfiles: Holds data for the profiles configured on the Staff Administration page.
• StaffRestrictedFieldGroups: Holds data for the restricted field groups assigned to each profile configured on the Staff Administration page.
• StaffSiteGroups: Holds data for the site group(s) assigned to each staff account on the Staff Administration page.
• StaffWebClientSessions: Holds data for staff user web sessions in the Aeon Web Client.
• WebClientFields: Holds data for the fields assigned to the layouts configured on the Staff Administration page.
• WebClientGroups: Holds data for the field groups assigned to the layouts configured on the Staff Administration page.
• WebClientLayouts: Holds data for the layouts configured on the Staff Administration page.

For details on the columns in each table, see Aeon Database Tables.

Added two new columns to the Staff database table to support Aeon Web Client features:

• WebClientProfile: Holds data for the web client profile assigned to the staff user on the Staff Administration page.
• MultiFactorAuthKey: Holds data for the user's multi-factor authentication (MFA) configuration.

Added triggers to the Aeon database that will automatically adjust the casing for the username value associated with new appointment or transaction records to match the casing used for that value in the Users database table to prevent issues caused when the casing of these username values did not match.

Fixed an issue where an invalid BCC address on an email would be logged in the Aeon System Manager logs as an "Invalid From Address" error. The System Manager will log an "Invalid BCC Address" error message in these cases.

Changed the underlying third-party component libraries used to facilitate printing documents from the Aeon Desktop Client. No existing printing functionality will be affected or changed by this update, however, the files installed with the Aeon Desktop Client to support printing functionality will be modified as follows as a result of this change:

The Aeon Server Installer PowerShell Scripts will now install the Aeon API to a new default file path location on the Aeon Server (C:\Program Files (x86)\Aeon\AeonApi). The API will be moved from the previous installation location to the new default installation path upon update.

Removed support for the embedded Chromium browser. To prevent potential compatibility issues after updating, browser-based client addons should be updated to versions supporting the WebView2 browser.

Fixed an issue where an error would occur when using the Clone to Current User option from the request list for a queue or request search results. Bug# 26834

Fixed an issue where an error would occur when using the Print Callslips option from the Activity or Appointment form if any custom fields defined in the Aeon Customization Manager's CustomFieldDefinitions table were present on the print template. Bug# 26639

Fixed an issue where the panel on the left side of the Aeon Options window did not update its color based on the client display skin selected, which could lead to poor color contrast. Bug# 22246

Fixed an issue where creating requests from an Excel spreadsheet file would fail if any custom fields defined in the Aeon Customization Manager's CustomFieldDefinitions table were included in the spreadsheet. Bug# 23597

Fixed an issue where errors could occur when applying service packages to photoduplication requests. Bug# 23473

A lightweight web-based version of the Aeon Staff Client is now available. The Aeon Web Client is a web-based version of the existing Aeon Desktop Client application and is installed via the Aeon 6.0 server installation/update. Once installed, the web client can be accessed via the URL https://servername/aeonstaff/on any standard web browser application (e.g., Google Chrome or Safari) on the user's computer or mobile device, including macOS and iOS devices:

The initial release of the Aeon Web Client includes many of the user management, reading room sign-in, and appointment scheduling features available in the desktop client application, as well as several brand-new customization options and security features exclusive to the new web application: 

For increased security against potentially untrusted XML files, the expansion of XML document type definitions (DTDs) can now be prohibited during EAD processing via the new EADProhibitDTD customization key in the Aeon Customization Manager (located under Web Interface | EAD).

Changed the underlying third-party component libraries used to facilitate Activity exporting from the Aeon web interface. Activity information will now be exported in the .xlsx file format.

The Aeon 6.0 default and feature-specific web pages include all the latest changes and fixes first released in the Aeon v5.2.11 and Aeon v5.2.13 default and feature-specific web pages. For detailed instructions on implementing each of these changes, please see the Aeon 5.2.11 web page release implementation instructions and the Aeon 5.2.13 web page release implementation instructions:

• Removed the jQuery UI JavaScript Library from the web pages for security purposes.

  The jQuery UI JavaScript Library is no longer necessary for the functionality of the web pages and should be removed to ensure the best possible security on the Aeon web interface.

  However, please note that removing this library may break existing implementations of the date picker calendar dropdown tool used with various date fields on the web pages if you have not updated these date picker components to the new version first released with the Aeon 5.2 web pages. See the 5.2.11 web page implementation documentation for more information on updating these components.

• Changed the default password reset instructions on the FAQ web page (FAQ.html) to first direct patrons to use the Forgot Password web form to reset their password before contacting staff. For security purposes, patrons should be encouraged to reset their own passwords.
• Updated the appointments.js file to fix an issue where the Aeon web interface would only consider the current date and would not consider the current time when determining whether an appointment could be scheduled in a reading room based on the room's Appointment Minimum Lead Days value in the Aeon Customization Manager. Aeon will now also consider the current time when making this calculation after the appointments.js file is updated. Bug# 19633
• Fixed an issue where manually entering a date when making an appointment on the web interface could cause a JavaScript console error in the web browser in some cases. Bug# 19926
• Fixed an issue where form fields using a date picker calendar dropdown tool would not initialize correctly when placed inside a photoduplication toggle.
• Changed underlined text used for emphasis on the search results web page (ViewSearchResults.html) to instead use bolded text to adhere to W3C HTML5 guidelines. Bug# 17985
• Removed non-functional popup text for file size and added missing transaction number and file size information to the requests displayed on the Electronically Delivered Items web page (DataRow_ElectronicDelivery.html). Bug# 18112
• Updated the hardcoded copyright year on Logon.html to 2024.
• Fixed an issue where manually entering invalid data into the Appointment Date field (e.g., letters or a string of numbers) when making an appointment on the web interface would cause a JavaScript console error in the web browser.
• Fixed an issue where disabled action buttons for transactions on the Aeon web interface could still be activated using keyboard controls, allowing users to perform actions such as editing cancelled requests. Bug# 15246
• Removed unused CSS properties from the aeon.css file.
• Encoded ampersands used in the code for HTML attribute values on various default and feature-specific web pages.

Photoduplication status will no longer be set for requests sent to user review to fix an issue where these requests could become uneditable if the photoduplication status was set to Awaiting Order Processing by the SkipOrderEstimates parameter. Bug# 12663

Fixed various issues on the default and feature-specific web pages. The list of changes can be found below. For more information on implementing each fix, see Implementing 6.0 Web Page Changes. 

• Added the license and copyright statement for the third-party date picker code library to the datepicker.js file.
• Reformatted the "Important Copyright Information" and "Aeon FAQ (Frequently Asked Questions)" section headers on NewAuthRegistration.html as buttons to fix an accessibility issue where these sections could not be expanded or collapsed using keyboard controls. 
• Updated atlasUtility.js to fix an accessibility issue with the "Other" dropdown javascript feature where when the "Other" option was chosen from the dropdown, the associated text field was unhidden and focus was moved to it automatically, failing WCAG criterion 3.2.2. Keyboard focus will now stay on the dropdown field until the user manually navigates to the text field after making the dropdown selection.
• Updated buildSiteMap.js to fix an issue where empty hyperlinks would be generated in the site map (SiteMap.html) if a hyperlinked image was added to the footer (include_footer.html).
• Fixed issues where Boolean checkbox fields configured on the web pages would not correctly load their values from the database and would not submit a value to the database when unchecked in some cases.
• Adjusted the styling of the buttons contained within the DataRow_ElectronicDelivery.html file to improve the responsive accessibility of these buttons and to make the styling consistent with other DataRows containing three or more buttons on the Aeon web interface.

Updated the Aeon default and feature-specific web pages to rename some of the account management-related features for clarity and to ensure naming consistency across the web pages:

• The My Profile dropdown in the navigation menu was renamed Account Info
• The option within the My Profile dropdown menu to navigate to the ChangeUserInformation.html page was changed from Change User Information to Update User Information
• The page title and page header on ChangeUserInformation.html were changed to Update User Information to match the new name for the navigation link

For more information on implementing these changes, see Implementing 6.0 Web Page Changes. 

The following changes have been made to the layout and style used to format the Aeon default and feature-specific web pages when they are printed from the web browser to improve the readability of the printed material and to increase focus on essential information:

• The following elements are now hidden when the web page is printed:
  • Action buttons (e.g., Edit, Cancel, etc.) on web pages containing transaction details
  • Most buttons included in the DataRow template files (e.g., Details, Action, etc.)
  • The "Skip to main content" link
  • Web alerts
  • Form controls on the search results web page
• The summary of charges will now appear before the list of orders when the ViewOrderEstimates.html, ViewOrderApprovals.html, and CreditCardPayment.html pages are printed
• Form fields are now formatted with a black border color and black text when printed to enhance color contrast
• Buttons and badges are now formatted with a white background color and black text when printed to enhance color contrast
• Set the font size used for body text on print layouts to 11pt
• Implemented missing print styling on the Logon.html web page so that this page is now properly formatted when printed

For more information on implementing each change, see Implementing 6.0 Web Page Changes. 

Added new minified versions of most default JavaScript and CSS files used in the Aeon web pages and updated all relevant web page files to use the new minified files in order to optimize the performance of the Aeon web interface and reduce page load times for users. The minified files will have the extension .min.js or .min.css and will be present in the js or css folder of the default and feature-specific web page downloads alongside the original un-minified version of each file. 

For more information on implementing these new files, see Implementing 6.0 Web Page Changes.