···11-# Changelog
22-33-## v2.1.0 — Native OAuth & Instance Settings
44-55-- **Built-in OAuth** — replaced external AIP OAuth dependency with native `atrium-oauth` integration; HappyView manages the full OAuth flow internally
66-- **Instance settings** — new `instance_settings` key/value table for configurable instance metadata (app name, logo, ToS, privacy policy) with env var fallback
77-- **OAuth branding** — authorization screens now show configurable app name, logo, terms of service, and privacy policy links via the `/oauth-client-metadata.json` endpoint
88-- **Logo upload** — upload a logo image via `PUT /admin/settings/logo` (stored in DB, served at `GET /settings/logo`)
99-- **`settings:manage` permission** — new permission for managing instance settings, included in Manager and Full Access templates
1010-- **Redirect URI support** — `/auth/login` accepts optional `redirect_uri` parameter for post-login navigation
1111-- **CORS improvements** — origin-mirroring CORS with credentials support for cross-origin auth flows
1212-1313-## v2.0.0 — User Permissions & Settings Restructure
1414-1515-- **User permissions system** — replaced the `admins` table with a `users` table supporting 20 granular permissions, permission templates (Viewer, Operator, Manager, Full Access), and a super user concept with escalation and self-modification guards
1616-- **API key permissions** — API keys now have explicit scoped permissions instead of inheriting full admin access; effective permissions are the intersection of the key's permissions and the user's permissions
1717-- **User handles** — user handles are now displayed alongside DIDs throughout the dashboard
1818-- **Settings sub-pages** — Settings page restructured into Users, ENV Variables, and API Keys sub-pages with collapsible sidebar navigation
1919-- **Dashboard route prefix** — all dashboard pages now live under the `/dashboard` route prefix
2020-- **New endpoints** — `GET /admin/users/{id}`, `PATCH /admin/users/{id}/permissions`, `POST /admin/users/transfer-super`, `GET/POST/DELETE /admin/script-variables`
2121-- **New event types** — `user.permissions_updated`, `user.super_transferred`, `auth.permission_denied`, `api_key.created`, `api_key.revoked`, `script_variable.upserted`, `script_variable.deleted`, `hook.executed`, `hook.dead_lettered`
2222-2323-## v1.9.0 — Event Logs
2424-2525-- **Event logging** — system-wide audit trail for lexicon changes, record operations, Lua script executions/errors, admin actions, backfill jobs, and Jetstream connectivity
2626-- **`GET /admin/events`** — query event logs with filtering by event type, category, severity, and subject, with cursor pagination
2727-- **Lua error context** — script errors capture full debugging context: error message, script source, input payload, and caller DID
2828-- **Automatic retention cleanup** — configurable via `EVENT_LOG_RETENTION_DAYS` (default 30 days)
2929-3030-## v1.8.0 — Advanced Queries
3131-3232-- **`db.backlinks()`** — find records that reference a given AT URI
3333-- **`db.raw()`** — run raw read-only SQL with parameterized queries and automatic column type mapping
3434-3535-## v1.7.1 — Patch
3636-3737-- Fixed Docker Compose database URLs for local dev
3838-3939-## v1.7.0 — Lua DB API Improvements
4040-4141-- **`toarray()`** utility — force Lua tables to serialize as JSON arrays (fixes empty `{}` vs `[]`)
4242-- **`db.search()`** — text search on record fields with relevance ranking
4343-- **Array serialization fix** — `db.query()` and `db.search()` now always return proper arrays for `records`
4444-4545-## v1.6.2 — Patch
4646-4747-- Fixed auth: use original auth scheme instead of hardcoded DPoP
4848-4949-## v1.6.1 — Patch
5050-5151-- Fixed broken dynamic page routes
5252-5353-## v1.6.0 — Record Management
5454-5555-- **Delete records** from the dashboard and API (individual and bulk collection deletion)
5656-- **"View Records" buttons** on lexicon pages
5757-- Bug fixes: backfill now loads previously deleted records, empty collections shown in dropdown
5858-5959-## v1.5.1 — Patch
6060-6161-- Removed backfill toggle from query/procedure lexicons (only applies to record lexicons)
6262-6363-## v1.5.0 — Lua Scripting & Dashboard Overhaul
6464-6565-- **Lua scripting** — attach custom Lua scripts to query and procedure lexicons
6666-- **Docusaurus docs site** with GitHub Pages deploy
6767-- **Dark mode** for the dashboard
6868-- **Records table** reworked with dynamic columns, column visibility, and better scrolling
6969-- **Backfill stats tracking**
7070-- **Network and local lexicons merged** into a unified view
7171-- **Shiki code highlighting** in the dashboard
7272-- Bug fixes: rogue record storage, collection dropdown, dynamic page builds