Built-in OAuth — replaced external AIP OAuth dependency with native atrium-oauth integration; HappyView manages the full OAuth flow internally
Instance settings — new instance_settings key/value table for configurable instance metadata (app name, logo, ToS, privacy policy) with env var fallback
OAuth branding — authorization screens now show configurable app name, logo, terms of service, and privacy policy links via the /oauth-client-metadata.json endpoint
Logo upload — upload a logo image via PUT /admin/settings/logo (stored in DB, served at GET /settings/logo)
settings:manage permission — new permission for managing instance settings, included in Manager and Full Access templates
Redirect URI support — /auth/login accepts optional redirect_uri parameter for post-login navigation
CORS improvements — origin-mirroring CORS with credentials support for cross-origin auth flows
User permissions system — replaced the admins table with a users table supporting 20 granular permissions, permission templates (Viewer, Operator, Manager, Full Access), and a super user concept with escalation and self-modification guards
API key permissions — API keys now have explicit scoped permissions instead of inheriting full admin access; effective permissions are the intersection of the key's permissions and the user's permissions
User handles — user handles are now displayed alongside DIDs throughout the dashboard
Settings sub-pages — Settings page restructured into Users, ENV Variables, and API Keys sub-pages with collapsible sidebar navigation
Dashboard route prefix — all dashboard pages now live under the /dashboard route prefix
New endpoints — GET /admin/users/{id}, PATCH /admin/users/{id}/permissions, POST /admin/users/transfer-super, GET/POST/DELETE /admin/script-variables