Changes

# version 1.3-SNAPSHOT

- Add a large-context group allowing users to access larger context by request [AI-assisted, #745]
- Apply new kwic and shrinking properties for kustvakt-dnb
- Fix handling non-existent large context group
- Make large context group optional and disabled by default [AI-assisted]
- Add tests for large context group config [AI-assisted]
- Make rate-limit optional and enabled by default [AI-assisted]
- Improve APIVersionFilter to avoid IndexOutOfBoundsException on empty path segments [AI assisted]
- Add tests for APIVersionFilter [AI assisted]

# version 1.2-SNAPSHOT

- Reactivate Query Serializer Web-service (#903)
- Fix deprecated URL constructor (AI assisted)
- Fix Jackson and serialization deprecated methods (AI assisted)
- Change Userdata to use String username instead of integer userId
- Allow admin to create groups with name length less than 3 characters 
  to support existing groups from C2
- Implemented rate limit for authenticated users (AI assisted)
- Customize rate limit settings in kustvakt.conf (AI assisted)

# version 1.1

- Change VC and query names to lowercase (with AI assistance)
- Implemented pipe response rewriting for match info API (#814)
- Add pipe response for the metadata web-service.

# version 1.0.1

- Add an exception for missing layer.
- Use database for querying statistics in VC List
- Fixed statistics conversion.
- Always update VC statistics at server start
- Use database for statistics service (limited to full version 
  and single VC reference)

# version 1.0

HOT PATCH 1: Reorder tasks for new VC.
New VC should be cached first to avoid calculating leafs to compute statistics 
when storing VC in NamedVCLoader. This allows using existing vc-cache 
containing new vc.

HOT PATCH 2: change int to long for checking total results.

# version 0.80.1-SNAPSHOT

- Calculate and store statistics for named VC.

# version 0.80-SNAPSHOT

- Introduced APIDeprecationFilter (#759)
- Deprecated matchInfo web-service has been removed for API v1.1.
- Remove deprecated Authorization Post web-service for API v1.1 (#767)
- Remove deprecated user-group web-services for API v1.1 (#769)
- Remove deprecated vc web-services for API v1.1 (#771)
- Remove deprecated authorized_only parameter in the client list API for v1.1 (#760)
- Add API version to the QueryService (#806)
- Add API version to the search service (#806)
- Add API version to ResourceParser & ServiceInfo (#806)
- Update Query QuerySerializer with API version in the test suite (#806)
- Add API version to KoralCollectionQueryBuilder (#806)
- Clean up collection node from Krill response (#806)
- Add API version to NamedVCLoader (#806)
- Add corpus support at VirtualCorpusRewrite (#806)
- Add apiVersion to rewrite (#806)
- Fix collection/corpus paths in the test suite (#806)
- Fix authorization with POST tests.
- Add apiVersion for checking VC in caching process (#806)
- Update system-vc and fix get statistics with VC reference test.
- Merge full and lite profiles and create one jar for both. 
- Merge full and lite version in dockerfile and CI tests
- Fix redundant initial-super-client generation.
- Allow system VC to have names with less than 3 characters (support for existing 
  C2 VC, #788)
- Switch Kustvakt Server to run the lite version by default.  
- Add backward compatibility for docker compose legacy-full
  

# version 0.79.1

- Bug fixes & Spring 6.2.11 upgrade (kupietz)
- Migrate to Hibernate 7x (kupietz)
- Make statistics in VC list configurable (default: false)
- Add request log using jetty. (default: disabled)

# version 0.79

- Implement timeout rewrite
- Add a test: changing timeout using a pipe
- Add pipe response rewriting (#794)
- Fix datatype for query statistics (close #802)
- Remove admin test data from database migration (close #808)
- Remove user default settings from the database migration (close #810)
- Fix KoralQuery and remove required access from query reference.
- Remove query reference test data from the database migration (close #811)
- Remove OAuth2 clients and access tokens from the DB migration (close #809)
- Removed db/test folder (close #379)
- Return Timeout Error Code for timeout during LDAP operations. 
  With test and special test conf (bodmo)


# version 0.78.2

- Update LDAP logs using JLog to include timestamp and move it from system.out 
  to ldap.log

# version 0.78.1

- Fix empty security context in statistics requests.

# version 0.78

- Renamed free resource to resource.
- Add required access to resources.
- Determine corpus access dynamically using koralQuery for resources without 
  predefined required_access. 
- Added useful VC (https://korap.ids-mannheim.de/doc/corpus) to resources.json. 
  (#800)
- Omit empty resource description.  
- Added URL-encoding for corpus query at in the resource service. 
- Fixed recaching VC at closing index.
- Removed useful vc from the sample resources.json.

# version 0.77

- Update statistics in VC info and list web-services to use VC cache (referTo) 
  instead of the original KoralQuery definitions (#791).
- Setup system-vc in Initializator instead of using SQL for testing #793
- Setup creating nemo-vc in VirtualCorpusTestBase instead of using SQL 
  for testing #793
- Setup creating dory-vc in VirtualCorpusTestBase instead of using SQL 
  for testing #793
- Setup creating group-vc in VirtualCorpusTestBase instead of using SQL 
  for testing #793
- Setup creating marlin-vc and published-vc in VirtualCorpusTestBase 
  instead of using SQL for testing #793 
- Fixed request URI at OAuth2 token request API.  
- Improved delete VC tests.
- Add VC rewrite for statistics web-service (#796)
- Updated other config files:
  - Added statisticsRewriteHandler and queryContextRewrite, 
  - changed file locations to the data folder, 
  - removed unused beans (cacheManager, sqliteDataSource)
- Fix landingPage in the free resource web-service (#799) 
- Add pid for resource and use it as resourceId when available #798
- Changed institution to IDS Mannheim.
- Fix loading Spring XML config for DNB & ICC tests.


# version 0.76

- Add institution & landingPage to the resource web-service (#777)
- Make URL mandatory for plugin registration (#573)
- Remove hidden group from test database
- Implemented QueryContextRewrite (#755)
- Replace operation:insertion with operation:injection (#778) 
- Update VirtualCorpusRewrite Remove Owner (#779)
- Add source to QueryReferenceRewrite (#783) and VirtualCorpusRewrite (#780)
- Use operation:override in virtual corpus (reference) rewrite (#780)
- Use operation:override in query reference rewrite (#783)
- Fixed availability regex for all access in the config (important to correctly 
  determine required access of stored VC)
- Rename CollectionRewrite to AvailabilityRewrite  
- Improve AvailabilityRewrite and implement operation:override (#781) 
- Disabled mysql connector Java due to CVE-2023-22102
- Replace origin with editor in rewrites (#782)
- Update scope and add _comment as discussed in #782
- Changed source to original #782
- Change JsonInclude to non default to hide VC statistics when not computed
  

# version 0.75

- Alter role and remove privilege database tables (#763)
- Update user-group and user-group member web-services (#763)
- Remove edit member role web-service (#763)
- Remove query access table (#763)
- Remove query access admin, merged with user-group admin (#763)
- Update share-query and query-access web-services (#763)
- Add new web-service: delete role by query and group (#763)
- Remove soft delete group and group status deleted (#765)
- Remove soft delete group member and member status deleted (#765)
- Removed SearchResourceFilters and UserGroupJson
- Removed deleted_by from user_group and user_group_member tables (#764)
- Removed created_by, status and status_date from user_group_member table (#764)
- Removed GroupMemberStatus (#764)
- Replace invite and subscribe to add member (#764)
- Remove unsubscribe member (#764)
- Added deprecation messages to deprecated services
- Removed mail configuration (#764)
- Deprecate VC access deletion
- Change default port to 8089
- Disallow scope all for non super clients
- Added config for total result cache and fixed inconsistency (#774)
- Changed memberUsername to member in the new member-role-addition web-service
- Removed user-privileges from user-group list response
- Added role names to user-group list
- Added not-timeExceeded to the totalResult constraints
- Replace EDIT_VC occurrences with CREATE_VC, and removed it
- Fixed administrative user group retrieval to return groups with empty members


# version 0.74.1-SNAPSHOT

- Switch Docker image to temurin (diewald)
- - Introduce filter_by and deprecate authorized_only in OAuth2
  client list (close #579)

# version 0.74 hot-fix

- Removed admin & owner restriction on client info access
- Removed registered_by and restrict registration_date to admin/owner-
  only

# version 0.74

- Remove corpusQuery param in the statistics web-service (close #758)
- Moved NamedVCLoader to the init package
- Clean up Spring XML configs
- Fix some logging to write to file instead of stdout
- Change CC RE from CC-BY.* to CC.* (kupietz)
- Unified ResourceFilters and SearchResourceFilters
- Fixed supported versions in the configs & changed delimiter to comma
- Setup log4j2 config (#753)

# version 0.73.2

- Added tests for the DNB scenario with custom max match 
  and context size (#745)
- Cleaned up named-vc
- Updated tests using the old match info web-services (#757)
- Added deprecation warning for the old matchInfo service (#757)
- Fixed empty named VC path in configuration (solves #754)
- Restrict registration info for plugins (solves #572)  
- Removed redirect uri from InstalledPluginDto & updated tests

# version 0.73.1

- Fixed jakarta validation error
- Added openapi doc (#744)
- Moved service.properties to src/main/resources/properties 
- Moved free-resources.json to src/main/resources/json
- Enables inputting free-resources.json from data folder
- Changed loading external kustvakt.conf and jdbc.properties 
  to use /data folder (#598)
- Added KoralQuery check when updating VC (solved #676)
- Setup vc-cache in the data folder (#598)
- Changed generating adminToken in the data folder (#598)
- Moved disk store path cache_store into the data folder (#598)
- Fixed invalid signature of the uber jar
- Updated configurations of the lite version to use the 
  data folder (#598)
- Setup logs files to be generated inside the data folder (#598)

# version 0.73

- Moved the content of the full folder to the root folder
- Removed Piwik
- Removed unused libraries
- Cleaned up spring configs
- Updated Krill and Koral with new groupIds
- Updated Github workflow
- Updated search Krill and removed Lucene
- Updated readme

# version 0.72

- Replaced javax.ws to jakarta.ws namespace (#648)
- Upgrading Jersey 2.40 to 3.x (#646)
- Updated Spring 5.x to 6.x and jetty 9.x to 11.x (#645)
- Replaced javax.persistence with jakarta.persistence (#648)
- Migrate Hibernate 5 to 6 (#649)
- Fix missing placeholders 
- Fixed conflicting jackson-jarxrs
- Fixed conflicting commons-logging and spring jcl
- Replaced javax.servlet with jakarta.servlet (#648)
- Updated authorization services using Nimbus (#650)
- Fixed BlockingFilter by replacing javax.annotation.Priority 
  with jakarta.annotation.Priority (#659, #648)
- Replaced javax.annotation with jakarta.annotation
- Enabled legacy support for authorization POST request
- Changed OAuth2 token request using Nimbus (#650) 
- Removed Apache Oltu API from token requests (#650)
- Removed OpenID
- Fixed clearing cache
- Fix JettyServerTest, init package, and some java docs
- Make scope extraction more flexible
- Updated token response using Nimbus (#650)
- Remove Oltu request and validator implementations (#650)
- Updated OAuth2 response handler (#650)
- Fixed ShutdownHandler (fixed #708)
- Fixed issues with multi-release jar (#706, #708)


# version 0.71.1

- Removed auditing (#611)
- Removed old database configurations (#612)
- Removed old tests
- Removed unnecessary caches and methods in the authentication interface
- Added total result cache (#599)
- Fixed missing project.version in info web-service
- Make sure totalResults and other numeric results are numbers (Kupietz)
- Introduce CQP query language in Koral 0.41
- Changed DB connection (fixed #670)
- Resolved duplicate libraries
- Fixed testing expiry access token
- Fix lombok compile warning
- Ensure the order of clean token tests

# version 0.71

- Renamed entity and service packages in core
- Renamed web.controller package in core
- Moved SearchNetworkEndpoint to core.service package
- Merged lite into full
- Merged core into full


# version 0.70.1

- Added data folder containing super_client_info and database 
  for mounting into docker
- Added an error for missing redirect uri in a token request 
  when it has been included in the authorization request.
- Added tests for VC sharing and for OAuth2 client using VC services
- Added and updated VC controller tests
- Moved hibernate.properties
- Added maximum number of user persistent virtual corpora and queries

# version 0.70

- Support token array in matchinfo (fixes #570; diewald)
- Updated VC list API and deprecated owner VC list (addressed #580)
- Added user info web-service (solved #566)
- Implemented configurable resource filters for search and match 
  info APIs (#539)
- Added getting username from LDAP (#568)
- Disabled LDAP auth provider and token API in the auth filter (#587)
- Added LDAP log for users without idsC2Profile
- Fixed log4j2 properties


# version 0.69.3

- Moved the service path of VC admin services to admin/vc (closed #543)
- Added an admin service to load and cache system vc (solved #268)
- Move oauth2 admin service path (closed #544) 
- Excluded admin service to load-cache VC from the test suite
- Fixed refresh token expiry test
- Fixed scope check in OAuth2 token request with refresh token

# version 0.69.2

2022-12-05
- Upgrade version for E2E-simplified Docker images (diewald)
2023-01-27
- Updated client info API (replaced user authorization requirement with super 
  client authentication)
2023-01-30
- Made scope param required in authorization request (solved #508)
2023-01-31
- Allowed OAuth2 clients to use localhost as redirect URIs.
2023-02-03
- Fixed content-type in error responses by changing it to application/json
2023-02-06
- Allow admin access using admin token for the clean token API
2023-02-10
- Use admin filter instead of OAuth2 ADMIN scope  
- Added a plugin test
2023-02-15
- Moved user-group retrieval API to UserGroupAdminController 
  and changed the service path URL of UserGroupAdminController 
2023-02-20
- Deprecate API token (JWT) web-service
- Fixed Slf4J binding
2023-02-28
- Exclude junit5 dependencies to keep test runner in Eclipse using JUnit 4
2023-03-06
- Fixed testing refresh token expiry


# version 0.69.1

- Upgrade version for docker including indexer (diewald)


# version 0.69

 - Migrated to Java 11 and Jersey 2
 - Updated dependencies
 - Use LDAP authentication in Kustvakt-full oauth2 example config (kupietz)


# version 0.68

2022-05-25
 - Added a new API: list plugins (e.g for marketplace)
 - Added redirect URI validation in authorization request (addressed #374)
 - Handled user-defined refresh token expiry (added in client info and 
   list API response)
 - Added installed_plugins table
 - Added a new API: install plugin 
 - Handled redundant plugin installation
 - Handled super client id in plugin installation
 - Deprecated UserClientDto and uses ClientinfoDto instead
 - Updated redirect URI error message for coherence
2022-05-27
 - Added maximum limit to custom refresh token expiry
2022-06-01
 - Added new APIs: list user-installed plugins and uninstall plugin
 - Moved install and list plugin APIs to PluginController and updated their
   service paths under /plugins
2022-06-03 
 - Implemented searching option using a network endpoint
 - Implemented initial super client registration for user authentication
 - Fixed admin clean token API and restrict plugins to confidential only
 
 
 
# version 0.67.1

2022-05-12
 - Implemented mapping of LDAP username to email
 - Handled null parameters in authorization requests
2022-05-25
 - Fixed null client_id
 - Updated ldap.config path in the kustvakt-test.conf
 

# version 0.67

2022-05-09
 - LDAP authentication and authorization is now configurable and supports SSL (LDAPS) connections
 - An embedded LDAP server can now be started automatically if configured accordingly
2022-05-11
 - Changed the SQL script updating oauth2_client table


# version 0.66

2022-03-31
 - Updated query and user-group name pattern
2022-04-08
 - Added redirect_uri to client info API
2022-04-11
 - Added registration_date, refresh_token_expiry, source and is_permitted
   to the oauth2_client database table, and updated the OAuth2 client 
   registration mechanism
 - Added authorization request with GET and deprecated that with POST
2022-04-13
 - Updated OAuth2Client list API (added redirect_uri, registration_date, 
   permitted, source to OAuth2UserClientDto)
2022-04-20
 - Updated authorization error response (Included error and error 
   description in the client redirect URI except for missing or 
   invalid client id or redirect URI)

 
# version 0.65.2

2022-03-03
 - Removed VCLoader
 - Added foreign keys to the DB tables of access and refresh token scopes
2022-03-07
 - Added more parameter checks and OAuth2Client web-service tests
2022-03-17
 - Updated admin filter by using admin token and role checks
2022-03-18
 - Added an OAuth2 admin API to delete expired/revoked access and refresh tokens
2022-03-28
 - Updated admin filter (admintoken as a form param) and uses 
   it for the closing index reader API 
 - Removed unused admin API: clear access token cache
2022-03-29
 - Updated and moved admin API: updateClientPrivilege to OAuth2AdminController

# version 0.65.1

2022-03-01
 - Restricts the field retrieval web-service to admin only

# version 0.65

!!! includes security updates - please update all Kustvakt libraries
!!! Please also update Krill to version 0.60.2 and Koral to version 0.38 

2021-12-02
 - Updated VC cache
2021-12-03
 - Enabled listing system vc for authorized users
2021-12-08
 - Removed koralQuery and statistics from VC list
 - Added a web-service to retrieve KoralQuery of a VC
2021-12-10
 - [security] Updated log4j libs due to CVE-2021-44228
2021-12-13
 - Fixed broken test suite
2022-01-03
 - [security] More log4j security updates
 - Bumped unboundid-ldapsdk
 - Updated tests
2022-01-25
 - Added show-tokens option to the search API
2022-01-31
 - Added an API retrieving fields of a virtual corpus

# version 0.64.1

2021-10-26
 - Bump Kustvakt and Krill versions


# version 0.64
2021-07-29
 - Updated the change files and made a new version
2021-08-12
 - Fixed errors due to missing query type and added tests
2021-08-13
 - Fixed missing request entity
 - Updated the query service to enable editing query references
2021-08-16
 - Fixed creator param when storing query or VC by admins for 
  the system or other users

# version 0.63.2
2021-06-11
 - Updated OAuth2 token length & secure random algorithm config
 - Added character set filter to random code generator, e.g. for client_id
2021-06-14
 - Updated roleId and super client parameters
2021-06-24
 - Fixed broken test 
2021-07-22
 - Updated cache settings and some loggings
2021-07-26
 - Replaced annotation parsing with restoring the annotation tables to the
database
 - Moved cache config to the full config 

# version 0.63.1
2021-02-22
 - Updated libraries (margaretha)
 - Renamed virtual corpus to query (margaretha)
2021-02-26
 - Added query access roles and fixed vc access roles (margaretha)
 - Added delete query webservice and tests (margaretha) 
2021-03-25
 - Updated Koral version for Info Controller (margaretha)
 - Updated OAuth2 token list with token type and user clientId 
parameters (margaretha) 
2021-03-29
 - Added client type in the client list web-service. Resolved #58 (margaretha)  
2021-04-19
 - Updated OAuth2Client JSON definition and controller tests (margaretha)
2021-04-26
 - Updated OAuth2 Client list (margaretha)
2021-04-30
 - Updated parameters in the error responses of OAuth2 APIs for coherence (margaretha)
 - Updated OAuth2 API responses for coherence (margaretha) 
2021-06-07
 - Updated OAuth2 client dto (margaretha)
  
# version 0.63
26/10/2020
 - Updated dependency of nimbus-jose-jwt and oauth2-oidc-sdk (diewald)
29/10/2020
 - Introduction of a query reference rewrite mechanism (diewald)
30/10/2020
 - Added database methods for storing query references (diewald) 
04/12/2020
 - Fix hibernate dialect for SQLite (margaretha)
04/12/2020
 - Fix pipe warning (margaretha)
14/01/2021
 - Updated Flyway (margaretha)
21/01/2021
 - Fixed running pipe and updated tests with mockserver (margaretha)
01/02/2021
 - Updated methods dependent to Antrl4-maven-plugin libraries (margaretha) 
05/02/2021
 - Add query reference web-service (diewald,margaretha) 
10/02/2021
 - Fixed problem with multiple desktop apps (diewald, margaretha)
12/02/2021
 - Added listing available queries for users (margaretha)
17/02/2021
 - Removed escaping for KoralQuery in VC and query reference responses (margaretha)
 - Added query and query language in virtual corpus table (margaretha)
18/02/2021
 - Set corpus access public for stored query (margaretha)
19/02/2021
 - Enabled API info web-service (margaretha)  
 

# version 0.62.4
24/01/2020
 - Removed salt from config and updated config files (margaretha)
03/02/2020
 - Added an admin API for clearing access token cache (margaretha)
05/02/2020
 - Added a config properties for a long-time access token expiry 
  and excluded refresh tokens for public clients in OAuth2 token 
  responses (margaretha)
 - Removed client authentication from the client deregistration and 
  client-secret reset APIs (margaretha) 
04/03/2020
 - Updated the sample index (diewald)

# version 0.62.3
03/12/2019
 - Implemented pipe extension in the search API (margaretha)
11/12/2019
 - Added errors when requesting VC in caching process (margaretha, 
 resolved #47)
12/12/2019
 - Added support for multiple cq parameters (margaretha, resolved #46)
13/12/2019
 - Handled pipe errors and added tests (margaretha)
19/12/2019
 - Updated create update user-group API (margaretha)
20/12/2019
 - Removed transactional annotations from simple select queries (margaretha)
 - Updated free resource controller (margaretha)
15/01-2020
 - Added additional statistic figures to virtual corpus info API 
  response (margaretha) 
  
# version 0.62.2
17/10/2019
 - Handled vulnerability CVE-2019-17195 (margaretha)
8/11/2019
 - Added user-group name pattern (margaretha, issue #33)
11/11/2019
 - Updated user group service paths and replaced groupId with groupName 
  (margaretha, resolved #33)
12/11/2019
 - Removed UserGroupJson & updated listUserGroups and createUserGroup 
  services (margaretha)
 - Added prefixes to username and groupname parameters in service paths 
  (margaretha, resolved #35)
13/11/2019
 - Added tests for issue #43 (margaretha)
14/11/2019
 - Added client description and URL to list-authorized-clients service 
  (margaretha, close #53)
 - Implemented a service to list clients registered by a user (margaretha, 
  close #52)
 - Added a check for OAuth2 client, VC, and group name length (margaretha)
15/11/2019
 - Merged list authorized client and list registered client services
  (margaretha)
21/11/2019
 - Added a service to list active refresh tokens of a user (margaretha)
 - Added username filtering to token revocation service via super client 
  (margaretha)
26/11/2019
 - Added a service to revoke a single refresh token via super client 
  (margaretha) 

# version 0.62.1
08/07/2019
 - Added tests for public metadata response in search api (margaretha, 
  issue #43)
 - Disabled some tests of unused/disabled web-services (margaretha)
07/08/2019
 - Fixed missing scopes after requesting access token with refresh token 
  (margaretha)
 - Fixed post requests with status OK and empty body (margaretha)
07/08/2019
 - Added users to hidden group when searching in a published VC (margaretha, 
  resolved #40)
15/08/2019
 - Updated the response statuses of VC PUT requests (margaretha)

# version 0.62
28/02/2019
 - Removed old VC controllers and updated tests (margaretha, issue #34)
 - Updated VC access controllers (margaretha)
19/03/2019
 - Added close index controller (margaretha)
11/04/2019
 - Fixed unknown authentication scheme, missing VC entity, and parameter 
  checker (margaretha)
 - Fixed sharing unknown VC, updating corpusQuery, and handling non-
  unique group name and unknown VC access (margaretha)
27/06/2019
 - Handled LDAP errors, fixed #45 (margaretha)
03/07/2019
 - Added re-caching VC at closing-index service, resolved #44 (margaretha)
 - Changed the response media-type of authentication controllers (margaretha)
 - Fixed bugs: allow guest to retrieve system VC, 
  remove VC from cache when it is deleted (margaretha)
04/07/2019
 - Updated VC name pattern and tests (margaretha)

# version 0.61.6
04/02/2019
 - Fixed SQL data and merged oauth2_client_url and oauth2_client (margaretha)
 - Updated client deregistration behavior (margaretha)
05/02/2019
 - Added delete-group-by-name controller (margaretha)
 - Added unique index to group name (margaretha)
06/02/2019
 - Updated a user setting test using array for multiple values (margaretha)
 - Added metadata controller tests (margaretha)
18/02/2019
 - Fixed tests (margaretha)
 - Updated handling errors from Koral (margaretha)
19/02/2019
 - Added fields to metadata controller (margaretha, issue #39)

# version 0.61.5
17/12/2018
 - Added a search timeout test (margaretha)
18/12/2018
 - Updated tests using BeanConfigTest to use SpringJerseyTest (margaretha)
08/01/2019
 - Improved predefined vc caching (issue #28, margaretha)
09/01/2019
 - Added comments (margaretha)
 - Updated code structure (margaretha)
11/01/2019
 - Degraded API version to 1.0 (margaretha)
 - Added OAuth2 client info tests (margaretha)
14/01/2019
 - Added retrieveVCByName and deleteVCByName controllers (margaretha)
16/01/2019
 - Added a PUT request for both creating and editing vc (margaretha)
 - Added aliases to some VC controllers (margaretha)
 - Merged VC access list controllers (margaretha)
21/01/2019
 - Removed codes related to user registration & password management (margaretha)
22/01/2019
 - Added create, edit, retrieve user default setting controllers (margaretha)
22/01/2019
 - Updated default setting controllers & added tests (margaretha)
 - Added delete key in setting controllers (margaretha)
23/01/2019
 - Added default setting key validation (margaretha)
 - Fixed UserdataTest (margaretha) 
24/01/2019
 - Added default setting key validation & fixed UserdataTest (margaretha)
25/01/2019 
 - Added VC reference and MapUtil tests (margaretha)
28/01/2019
 - Fixed username verification in DefaultSettingService (margaretha)
 - Added foundry rewrite with user default setting (margaretha)
 - Added default foundry for morphology layer (margaretha)
29/01/2019
 - Fixed share VC type (margaretha)
 - Added delete setting controller (margaretha)
 - Handled "no resource found" cases (margaretha, issue #37)
30/01/2019
 - Added server shutdown description in readme (margaretha) 

# version 0.61.4
14/11/2018
 - Integrated lite and full services and controllers in core (margaretha)
21/11/2018
 - Updated OAuth2 refresh token request to create a new refresh token and 
  revoke the old one per request (margaretha)
28/11/2018
 - Updated NamedVCLoader to delete existing VC in DB (margaretha)
 - Handled storing cached VC with VC reference (margaretha)
29/11/2018
 - Added a controller for listing user clients having active refresh tokens 
  (margaretha)
6/12/2018
 - Added debug flags to mitigate log4j debugging performance (margaretha)
 - Fixed KoralNode at() method (margaretha)
11/12/2018
 - Implemented revoking all tokens of a user client via a super client
 (margaretha) 
 - Removed document controllers and KustvaktResource (margaretha)
 - Fixed rewrite bugs (updated rewriteQuery & KoralNode) (margaretha)

 
# version 0.61.3
17/10/2018
 - Updated NamedVCLoader to be optional (margaretha)
 - Updated annotation tables & implemented key-value structure (margaretha)
 - Added annotation parser for annotation data from kalamar (margaretha)
 - Implemented parsing free resource info from json (margaretha)
22/10/2018
 - Updated jetty, spring and hibernate versions (margaretha)
 - Fixed the order of annotation keys and values, and added tests (margaretha)
 - Fixed resource DAO & added tests (margaretha)
24/10/2018
 - Fixed query serialization service (margaretha)
 - Added "highlights" parameter to matchInfo controller (margaretha)
 - Added "fields" parameter to search controllers (margaretha)
 - Integrated lite controllers, services and tests in full version (margaretha)
29/10/2018
 - Moved javax.servlet-api to core (margaretha)
07/11/2018
 - OpenJDK8u181-workaround (see Debian Bug report #911925; diewald)
13/11/2018
 - Added Shutdown handler to Jetty server (margaretha)
 - Fixed storing VC order in NamedVCLoader (margaretha)

# version 0.61.2
12/09/2018
 - Added various log4j2 configurations (margaretha)
13/09/2018
 - Implemented VirtualCorpusRewrite (margaretha)
14/09/2018
 - Fixed SpringJerseyTest ApplicationContext (margaretha)
 - Handled VCRef with username in VirtualCorpusRewrite (margaretha)
 - Enabled VCReferenceTest in maven test suite (margaretha)
18/09/2018
 - Handled unique constraints / inserting duplicate items to DB (margaretha)
 - Added a controller for editing user group member roles (margaretha)
19/09/2018
 - Fixed cached-VC ref with username (margaretha) 

# version 0.61.1
28/08/2018
 - Added API URL versioning (margaretha)
 - Deactivated IdRewrite (margaretha)
 - Fixed kustvakt controller (margaretha)
30/08/2018
 - Fixed root packages & added api version properties in kustvakt.conf
  (margaretha)
 - Fixed versioning in SearchController (margaretha)
 - Added API versioning tests (margaretha)

# version 0.61.0

02/08/2018
 - Added VC reference tests (margaretha)
 - Implemented loading and caching named VCs (margaretha)
03/08/2018 
 - Implemented OAuth2 revoke token (margaretha)
 - Updated OAuth2 refresh token implementation (margaretha)
14/08/2018 
 - Implemented revoke all OAuth2 access tokens and authorization codes of
 client users when deregistering/deleting a client (margaretha)
 - Fixed update OAuth2 access token (margaretha)
 - Implemented reset client secret (margaretha)
 - Fixed revoking latest access token when refreshing OAuth2 access token
  (margaretha)
15/08/2018
 - Implemented OAuth2 client info controller (margaretha)
 - Implemented update OAuth2 client privilege controller for admins
  (margaretha)
 - Implemented unlimited authorization scope for super clients with OAuth2
  password grant (margaretha)
 - Marked native clients implementation to deprecated in favour of super
  clients (margaretha)
 - Enabled using Bearer tokens as user authentication tokens (Authorization
  header value) for many controllers including OAuth2 controllers (margaretha)
16/08/2018
 - Implemented degrading super clients (margaretha)
 - Improved and added OAuth2 tests (margaretha)
21/08/2018
 - Added VC name pattern check (margaretha)
22/08/2018
 - Implemented loading VC from gz files (margaretha)
 - Updated OAuth2 authorization codes' & access tokens' expiry check
  (margaretha)
23/08/2018 
 - Updated RefreshToken implementations with separate DB tables (margaretha)
 - Allows multiple access tokens per refresh token (margaretha)
27/08/2018
 - Added statistic with VC reference tests (margaretha)
 - Fixed OAuth2 SQL files (margaretha) 
28/08/2018
 - Added c3p0 datasource configuration to Spring default-config-xml
  (margaretha)
 - Added running Kustvakt server with custom spring config in the readme
  (margaretha)
 - Removed old OAuth2 codes (margaretha)
 - Moved non-config test codes to misc (margaretha)
 

# version 0.60.5

09/07/2018
 - Added service layer to the search controller (margaretha)
 - Added OAuth2 scope checking in search and VC controllers (margaretha)
 - Added handling OAuth2 bearer token for VC access and User group
  controllers (margaretha)
 - Added default scope to password grant (margaretha)
10/07/2018
 - Made createBasicAuthorizationHeaderValue static (margaretha)
 - Added store access token in openID token service (margaretha)
 - Fixed empty scope in openID authorization and token service (margaretha)
 - Implemented storing authorization code in cache (margaretha)
11/07/2018
 - Fixed authentication time in authentication controller (margaretha)
 - Added OAuth2 access token tests (margaretha)
12/07/2018
 - Updated maven surefire setting for faster test suite runtime (margaretha)
 - Implemented refreshing OAuth2 access token (margaretha)
26/07/2018
 - Fixed issue #27 (margaretha)
02/08/2018s
 - Fixed clientId encoding in OAuth2ClientControllerTest (margaretha)

 
# version 0.60.4

05/07/2018
 - implemented OAuth2 authorization code request with OpenID Authentication
  (margaretha)
 - enabled OAuth2 authorization without OpenID authentication using Nimbus
  library (margaretha)
 - implemented response handler for OpenID authentication errors in authorization
  requests (margaretha)
 - added tests regarding OpenID authentication in authorization requests
  (margaretha)
 - implemented OAuth2 authorization error response via redirect URI instead of
  JSON (margaretha)
 - added state to OAuth2 authorization error response (margaretha)
 - implemented OpenID token service for authorization code flow (margaretha)
 - implemented signed OpenID token with default algorithm RSA256 (margaretha)
 - implemented JSON Web Key (JWK) set web-controller listing kustvakt public
  keys (margaretha)
 - implemented OpenId configuration (margaretha)
 - added authentication time and support for auth_time in id_token (margaretha)
 - implemented support for nonce and max_age parameters in OpenID authentication
  (margaretha)
 - implemented OAuth2 token request with password grant using Nimbus library
  (margaretha)
 - updated redirect URI validator (margaretha)
 - updated client registration requirement to allow desktop applications
  (margaretha)
 - fixed RSA key configuration (margaretha)
 - merged OAuth2 client deregistration controllers (margaretha)
 - fixed OAuth2 client unique URL-hashcode (margaretha)
 - migrated logging to log4j 2 and adapted java.util.logging to log4j(margaretha)
 - Added support for unrestricted corpus statistics (ndiewald)
 - updated paths of user-group deletion-controllers (margaretha)
 - Do not pass broken queries to Krill (diewald)
 - added OAuth2 token request with client authentication via Authorization
  header (margaretha)
 - added port checking in test suite (margaretha)
 
# version 0.60.3

06/06/2018
 - improved user authentication by using authentication filter for authorization
  code request (margaretha)
 - limited client authentication to client id checking in authorization code
  request (margaretha)
 - added user_id in the oauth2_access_token database table (margaretha)
 - implemented OAuth2Authentication provider for token context management
  (margaretha)
 - added parameter checking for authorization DAO (margaretha)
 - added controller tests using OAuth2 access token (margaretha)
 - added database tables for MySQL (margaretha)
 - updated JWT library and related codes (margaretha)
 
# version 0.60.2

03/05/2018
 - implemented OAuth2 client registration (margaretha)
 - implemented OAuth2 client authentication (margaretha)
 - changed virtual corpus search to retrieval (margaretha)
 - implemented public client deregistration task (margaretha)
 - added client registration and deregistration tests (margaretha)
 - implemented confidential client deregistration task (margaretha)
 - fixed storing client secret (margaretha)
 - implemented OAuth2 response handler (margaretha)
 - implemented OAuth2 request access token with client credentials grant
  (margaretha)
 - implemented OAuth2 request access token with resource owner password grant
  (margaretha)
 - implemented OAuth2 authorization code request (margaretha)
 - added OAuth2 error codes (margaretha)
 - added OAuth2 authorization, scope and access token tables for SQLite
  (margaretha)
 - implemented OAuth2 authorization, scope and access token DAO (margaretha)
 - implemented OAuth2 request access token with authorization code grant
  (margaretha)
 - added setting default scopes in the config file (margaretha)
 - fixed loading spring config multiple times in the test suite (margaretha)
 - added SQLite created_date trigger for access token (margaretha)
 - added a join table for access token scopes (margaretha)
 - added access scopes handling (margaretha)
 - added tests about request token with authorization code (margaretha)
 
# version 0.60.1

28/03/2018
 - added admin-related SQL codes (margaretha)
 - updated AdminDao (margaretha)
 - added optional username query parameter to group list controller (margaretha)
 - fixed non hierarchical URI of kustvakt conf files (margaretha)
 - added delete group member triggers (margaretha)
 - added list user-group by username and status for system admin (margaretha)
 - added user-group status in user-group DTO (margaretha)
 - added check for hidden groups in user-group tests (margaretha)
 - added database trigger test on deleting members when deleting group
  (margaretha)
 - renamed VC type PREDEFINED to SYSTEM (margaretha)
 - added VC list controller for system admin (margaretha)
 - added VC controller tests with for system admin (margaretha)
 - added hidden access removal when deleting published VC (margaretha)
 - added check for hidden groups in VC controller tests (margaretha)
 - added search user-group controller (margaretha)
 - removed createdBy from VirtualCorpusJson (margaretha)
 - moved member role setting from the invitation phase to the after-subscription
  phase (margaretha)
 - added member role removal after deleting members (margaretha)
 - added add and delete member role controllers (margaretha)
 
# version 0.60

14/03/2018
 - set up mail settings using localhost port 25 (margaretha)
 - added mail template in kustvakt configuration (margaretha)
 - added mail settings to readme (margaretha)
 - disabled email notification for auto group (margaretha)
 - added metadata retrieval (diewald)
 - enabled custom implementation for email address retrieval (margaretha)
 - removed old policy and deprecated code (margaretha)
 - moved authentication related code to /full (margaretha)
 - added userRoles attribute to UserGroupDto (margaretha)
 - fixed sqlite trigger (margaretha)
 - fixed member exist error message (margaretha)
 - fixed member invitation to join deleted group (margaretha)
 - added checking deleted group (margaretha)

# version 0.59.10
 
20/02/2018 
 - added sort VC by id (margaretha)
 - added test cases regarding VC sharing (margaretha)
 - implemented withdraw VC from publication (margaretha)
 - added Changes file (margaretha)
 - implemented add/invite users to group (margaretha)
 - implemented delete user-group and member tasks (margaretha)
 - added userMemberStatus in group lists (margaretha)
 - updated and added SQL test data (margaretha)
 - added user group related tests (margaretha)
 - implemented custom configuration for deleting user groups and members (margaretha)
 - updated library versions and java environment (margaretha)
 - added expiration time check for member invitation (margaretha)
 - moved .properties files (margaretha)
 - merged changelog file to Changes (margaretha)
 - updated status codes and error messages to be more detailed (margaretha)
 - testing mail implementation using embedded jetty jndi (margaretha)
 - fixed collection rewrite regarding OR operation with other fields
  (margaretha)
 - implemented sending mail using spring injection and removed jetty jndi
  (margaretha)
 - fixed unrecognized application/json (margaretha)
 - fixed and updated velocity template (margaretha)
 
# version 0.59.9 

19/01/2018
 - restructured basic authentication (margaretha)
 - fixed AuthenticationException to include authentication scheme (margaretha)
 - fixed rewrite redundancy in collection rewrite (margaretha)
 - fixed foundry rewrite for constituents (margaretha)
 - introduced authentication methods, schemes and tokens (margaretha)
 - implemented collection rewrite with multiple licenses (margaretha)
 - fixed foundry rewrite for korap span without wrap node (margaretha)
 - implemented list user group (margaretha)
 - implemented delete VC task (margaretha)
 - implemented create user-group, subscribe to user-groups, unsubscribe to
  user-groups tasks(margaretha)
 - fixed handling JSON mapping exception for missing enums (margaretha)
 - implemented list VC task (margaretha)
 - added KoralQuery in VC lists (margaretha)
 - implemented edit VC task (margaretha)
 - implemented publish VC task (margaretha)
 - implemented share VC task (margaretha)
 - implemented list only owned VC task (margaretha)
 - implemented list VC access task (margaretha)
 - implemented search VC by id task (margaretha)
 - implemented delete VC access (margaretha)
 - implemented search for project VC (margaretha)
 - added search VC related tests (margaretha)
 - removed PredefinedUserGroup.ALL and related codes (margaretha)
 - implemented search for published VC (margaretha)
 
# version 0.59.8
 
21/09/2017
 - restructured statistics service (margaretha)
 - removed deprecated loader codes and tests (margaretha)
 - removed old Spring java configurations (margaretha)
 - implemented entity classes for the new database (margaretha)
 - added MySQL codes regarding VC and for testing (margaretha)
 - added dao methods regarding VC (margaretha)
 - added similar SQL codes (to MySQL) for sqlite (margaretha)
 - added dao methods regarding user groups (margaretha)
 - restructured web-service codes into controller and logic/business-service
  (margaretha)
 - implemented user role and privilege, and added tests (margaretha)
 - prepared test suite using new database (margaretha)
 - implemented UserGroupDao and tests (margaretha)
 - fixed missing exceptions in JsonUtils (margaretha)
 - restructured web filters and authentication codes (margaretha)
 - implemented create/store VC (margaretha)
 - fixed collection rewrite bug regarding availability with operation or
  (margaretha)

# version 0.59.7

13/10/2016
 - MOD: updated search to use new siglen (diewald)
 - MOD: fixed matchinfo retrieval in light service (diewald)

05/05/2015
 - ADD: rest test suite for user service (hanl)
 - MOD: setup parameter modification (hanl)
 - ADD: oauth2 client unique constraint (hanl)