[eliasjpr]

What

Finalizes the release notes for the work merged in #21 (P0 fixes, consent/authorization hardening).

• CHANGELOG.md: [Unreleased] - 2024 becomes [1.3.0] - 2026-10-25; a new empty [Unreleased] stays on top. An "Summary of what to check when moving from 1.2.x" list is added to the existing Upgrading section:
  • Authly.config.authenticate_user must be set (otherwise /oauth/authorize and /device answer 500 and issue nothing)
  • unregistered redirect_uri / unknown client / grant the client lacks is 400 (was 401)
  • consent and device approval are POSTs with a signed, single-use, subject-bound Authly::FormToken; user_id / consent query parameters are ignored
  • custom StateStore / PARStore: consume returns Bool and is the only call the handlers make
• shard.yml: version: 1.3.0.

Docs and metadata only; no src/ or spec/ change, so no spec run (nothing to fail). The README already carries the same migration notes (hook, StateStore#consume).

Versioning: how the repo does it, and why 1.3.0

• Tags go up to v1.2.17 (the commit for Security: authenticate the resource owner at /oauth/authorize and /device, escape the consent and device pages #21 is 6494d65 Set shard version 1.2.17). shard.yml and the tag are produced by .github/workflows/crystal.yml on every push to master: paulhatch/semantic-version computes the version from the last tag, defaulting to a patch bump, with (MINOR) / (MAJOR) in a commit message as the markers, then the bot commits Set shard version X and creates the release/tag.
• So Security: authenticate the resource owner at /oauth/authorize and /device, escape the consent and device pages #21 shipped as a patch (1.2.17) although it is breaking for hosts and custom stores. This PR does not tag; the workflow does that after merge.
• Chosen version: 1.3.0, a minor bump. Reasons: it is a behaviour and API break (the authenticate_user hook is mandatory, consume : Bool), which a patch hides; but the break closes a P0 authorization bypass (anyone could obtain a code or token for any user), so keeping ~> 1.x pins resolving to the fixed version is the intent; no repo in this workspace pins authly to ~> 1.2. Strict SemVer would say 2.0.0 for these breaks; if you prefer that, replace (MINOR) by (MAJOR) in the commit/PR title, and change the heading and shard.yml to 2.0.0.
• Important: the version the workflow computes comes from the (MINOR) marker in the commit message(s) landing on master (the commit subject here carries it). If this PR is squash-merged, keep (MINOR) in the squash title/body, otherwise CI computes 1.2.18 and overwrites shard.yml.
• 1.2.17 (already released) contains the Security: authenticate the resource owner at /oauth/authorize and /device, escape the consent and device pages #21 code, so the changelog heading 1.3.0 re-labels it: the 1.2.17 tag ships the same changes without a changelog entry of its own.

---

Generated by Claude Code