diff --git a/packages/docs/content/blog/happyview-2.5.md b/packages/docs/content/blog/happyview-2.5.md new file mode 100644 --- /dev/null +++ b/packages/docs/content/blog/happyview-2.5.md @@ -0,0 +1,42 @@ +--- +title: "HappyView v2.5: Permissioned Spaces" +description: "Private groups, invite-only communities, and gated content come to atproto." +date: 2026-05-08 +author: + name: "Trezy" + avatar: "/authors/trezy.webp" +tags: + - announcements +--- + +HappyView 2.5 is out, and it ships with one of the most anticipated features in the [atproto](https://atproto.com) ecosystem: + +✨ Permissioned Spaces. ✨ + +## The problem + +ATProto is public by default. That's great for open social graphs, but not so great for private groups, invite-only communities, or gated content. If you wanted access-controlled data, you were mostly out of luck. + +Spaces fix that. They give you private, access-controlled data under your existing DID. + +## What this means for HappyView + +Because HappyView is [lexicon-driven](/guides/getting-started), Spaces integrate naturally with everything you've already built. All of your scripts can query Spaces directly for membership checks, access levels, private record queries, and more. Custom lexicons can build on top of Spaces today without waiting for anything else to land. + +## Here be dragons + +The whole feature is experimental, and it's gated behind a feature flag. You can enable it from the new "Experimental" page in the dashboard. + +![The Experimental page in the HappyView dashboard](/img/blog/happyview-2.5/experimental-page.png) + +Give it a try, tell me what breaks, and tell me what you want to work differently. + +## Standing on shoulders + +All of the work on Permissioned Spaces follows [Daniel Holmgren's](https://bsky.app/profile/dholms.at) Permissioned Data Diaries. Big credit to [Zicklag's](https://bsky.app/profile/zicklag.dev) work on Arbiter and [flo-bit's](https://bsky.app/profile/flo-bit.dev) work on [Contrail](https://flo-bit.dev/contrail). We're actively working to make sure Spaces will be compatible between HappyView and Contrail as things evolve. + +## Go get some + +Check out [the documentation](https://happyview.dev) and give it a shot! + +We've been talking about permissioned data for forever, and now it's here. I'm excited to see what y'all do with it. diff --git a/packages/docs/content/blog/happyview-2.6-and-2.7.md b/packages/docs/content/blog/happyview-2.6-and-2.7.md new file mode 100644 --- /dev/null +++ b/packages/docs/content/blog/happyview-2.6-and-2.7.md @@ -0,0 +1,46 @@ +--- +title: "HappyView v2.6 + v2.7" +description: "Base path support, a Node.js SDK, security hardening, and a pile of quality-of-life fixes." +date: 2026-05-12 +author: + name: "Trezy" + avatar: "/authors/trezy.webp" +tags: + - announcements +--- + +Two releases in two days. v2.6 landed on May 12th and v2.7 followed the next day. Neither one has a single marquee feature like [Permissioned Spaces](/blog/happyview-2.5), but together they make the whole system noticeably more solid. + +## Base path support + +HappyView can now run on a subpath to make it easier to use behind a reverse proxy. If your setup already serves something at the root and you want HappyView at `/appview` or `/api`, that just works now. The dashboard, OAuth flows, and XRPC routes all respect the configured base path. + +## Node.js SDK + +v2 shipped with browser and generic OAuth client packages. v2.6 added the code for a Node.js-specific OAuth client, and v2.7 published it to npm: + +- [**`@happyview/oauth-client-node`**](https://npmx.dev/package/@happyview/oauth-client-node) — For server-side Node.js applications that need to authenticate against a HappyView instance. + +This rounds out the SDK story. You've got [`@happyview/oauth-client-browser`](https://npmx.dev/package/@happyview/oauth-client-browser) for the browser, [`@happyview/oauth-client`](https://npmx.dev/package/@happyview/oauth-client) for custom or low-level work, and now `oauth-client-node` for server-side apps. All three SDKs were also updated in v2.6 to more closely match their [`@atproto`](https://github.com/bluesky-social/atproto) counterparts, so if you're already using the official SDK the APIs should feel familiar. + +## Security hardening + +v2.6 includes a batch of security fixes: + +- **Privilege escalation prevention** — closed a path that could allow unauthorized permission changes. +- **JWT expiry precision** — tokens are now rejected at the exact expiry second, not after. +- **Rate limiting before rejection** — unauthenticated procedure requests are rate-limited before being rejected, preventing abuse of error responses. +- **Client key enforcement** — rate limiting is now enforced on all XRPC routes, not just a subset. +- **Space credential scoping** — Bearer space credentials are now restricted to space XRPC routes only. + +## Everything else + +- **TID functions** in Lua scripting for generating and working with [TIDs](https://atproto.com/specs/record-key#record-key-type-tid). +- **XRPC proxy settings** in the dashboard for controlling proxy behavior. +- **Experiments page** in the dashboard for toggling feature flags (like the one behind Permissioned Spaces). +- **Dead letter fixes** — dead letters now always get an ID, fixing an issue where some could be created without one ([#20](https://github.com/gamesgamesgamesgamesgames/happyview/issues/20)). +- **Space pagination** — cursors now work correctly when paginating through spaces. + +## Go get some + +Full changelogs: [v2.6.0](https://github.com/gamesgamesgamesgamesgames/happyview/releases/tag/v2.6.0), [v2.7.0](https://github.com/gamesgamesgamesgamesgames/happyview/releases/tag/v2.7.0). If you have questions, feature requests, or just need a little help, join the [Cartridge](https://cartridge.dev) [Discord Server](https://discord.gg/BUPnjaBwRZ) and hop into the `#happyview` channel. diff --git a/packages/docs/content/blog/releasing-happyview-2-into-the-wild.md b/packages/docs/content/blog/releasing-happyview-2-into-the-wild.md --- a/packages/docs/content/blog/releasing-happyview-2-into-the-wild.md +++ b/packages/docs/content/blog/releasing-happyview-2-into-the-wild.md @@ -1,7 +1,7 @@ --- title: "Releasing HappyView 2 Into the Wild" description: "One binary, no companion services, and a lot fewer moving parts." -date: 2026-05-13 +date: 2026-04-24 author: name: "Trezy" avatar: "/authors/trezy.webp" diff --git a/packages/docs/public/img/happyview-2.5/experimental-page.png b/packages/docs/public/img/happyview-2.5/experimental-page.png new file mode 100644 --- /dev/null +++ b/packages/docs/public/img/happyview-2.5/experimental-page.png