This is the Supabase JavaScript SDK monorepo, providing isomorphic client libraries for Supabase backend services. It is a well-structured TypeScript monorepo managed with pnpm and Nx, containing six core packages: auth-js (authentication), postgrest-js (database queries via PostgREST), realtime-js (WebSocket-based realtime subscriptions), storage-js (file storage and vector index API), functions-js (edge function invocation), and the umbrella supabase-js package that combines them into a single `createClient()` entry point. The SDK supports multiple runtimes (Node.js, Deno, browsers, Bun, React Native, Cloudflare Workers) and includes optional OpenTelemetry tracing support. The codebase demonstrates high craftsmanship with extensive TypeScript generics for type-safe query building, fluent builder patterns, robust error handling hierarchies, and comprehensive integration tests against local Supabase infrastructure. It is actively maintained with frequent releases, automated CI/CD, and a strong focus on backward compatibility.
steamguard-cli is a robust Rust-based command-line utility designed for managing Steam Two-Factor Authentication (2FA). It serves as a secure alternative to the official Steam Mobile App, allowing users to generate 2FA codes, respond to trade and market confirmations, and manage their authentication secrets locally. The architecture follows a clear separation of concerns: a core library (`steamguard`) handles the complex protocol interactions with Steam's APIs (authentication, confirmations, token management), while the CLI binary (`steamguard-cli`) manages user input, TUI, and file system operations. The tool emphasizes security by encrypting sensitive data (maFiles) using Argon2id-AES256 and leveraging the system keyring for passkey storage. It also features sophisticated migration logic to import accounts from legacy tools like Steam Desktop Authenticator (SDA) and WinAuth, ensuring data portability.
Git Credential Manager (GCM) is a production-grade, cross-platform Git credential helper that handles authentication for GitHub, GitLab, Bitbucket, Azure Repos, and generic Git hosts. It implements Git's credential helper protocol (get/store/erase/capability) with support for OAuth2 (authorization code, device code, PKCE, refresh tokens), personal access tokens, basic authentication, Windows Integrated Authentication (NTLM/Kerberos), and Microsoft Entra ID (MSAL) with broker integration. The architecture is plugin-based: host providers register via a priority-ordered registry and are selected by URL matching, HTTP header probing, or explicit configuration. Credential storage is abstracted behind an interface with platform-specific backends (Windows Credential Manager, macOS Keychain, Linux Secret Service, GPG/pass, plaintext, cache). Interactive prompts are delivered via a terminal UI (Spectre.Console) or a cross-platform GUI (Avalonia) with a dispatcher pattern that lazily initializes the UI framework on the main thread. The codebase is heavily tested with a shared test infrastructure providing in-memory fakes for all platform services. Key entry points include Program.cs (process entry), Application.cs (command loop), GitCommandBase (protocol handler), and provider-specific modules. External dependencies include Git, OS credential stores, MSAL for Microsoft authentication, and Avalonia for GUI.
Apache Shiro is a mature Java security framework and library, not an end-user application. It provides authentication, authorization, session management, and cryptography through a modular Maven multi-module architecture. The central abstractions are SecurityManager, Subject, Realm, Authenticator, Authorizer, and SessionManager, backed by pluggable implementations such as JDBC, LDAP, Active Directory, and text-based realms. The web module adds servlet filters, filter-chain management, JSP/JSF tags, and path-matching URL security, while support modules integrate with Spring, Spring Boot, Guice, CDI, JAX-RS, AspectJ, Quartz, and Jakarta EE. The crypto modules offer modern password hashing (Argon2, BCrypt), legacy SHA hashing, symmetric ciphers, and hash format serialization. The framework is embeddable via programmatic configuration, annotation-driven AOP interceptors, or the legacy INI-based configuration path, which is now deprecated in favor of environment-based setup. The codebase is heavily tested with unit tests and container-based integration tests, and core interfaces remain small and clean; however, it carries noticeable legacy baggage including deprecated factories, duplicated JSP/JSF tag implementations, mixed mocking frameworks, and numerous support modules that require ongoing maintenance to avoid drift. It has no data pipelines or research components; all data-related code is limited to security data sources, caching, and test fixtures.
This is the Symfony Security Core component, a pure PHP library providing a generic, extensible authorization and authentication framework. It is infrastructure code, not an application – it defines interfaces and implementations for token storage, access decision making (with pluggable voters and strategies), role hierarchies, user providers and checkers, signature hashing for secure links, and validation constraints. The architecture relies heavily on design patterns: Strategy (access decision strategies), Chain of Responsibility (user providers/checkers), Decorator (traceable managers, usage tracking token storage), and Template Method (abstract Voter class). It is well-typed with PHP 8.4 features and includes extensive unit tests. The repository also bundles 50+ locale translations for security-related exception messages. It is a mature, actively maintained component that forms the security foundation for Symfony applications.
The Planet Labs Python SDK provides both a programmatic interface and a command-line tool for interacting with Planet's satellite imagery and data APIs. It enables users to authenticate, search for imagery, create and manage orders, handle subscriptions, upload areas of interest, configure cloud storage destinations, and access mosaics. The SDK is designed with a clear separation of concerns, featuring asynchronous API clients with synchronous wrappers, a robust HTTP session with retry and rate-limiting logic, and a flexible authentication system supporting multiple methods (API key, OAuth user, OAuth M2M) and storage strategies. Key architectural elements include a base client class that handles common HTTP operations, service-specific clients for each Planet API, and a Click-based CLI that mirrors the SDK's functionality. The repository also includes reusable utilities for GeoJSON handling, search filter construction, order and subscription request building, and progress reporting for long-running operations. The codebase demonstrates strong engineering practices with extensive test coverage, clear documentation, and active maintenance.
User Switching is a mature WordPress plugin providing instant switching between user accounts. The plugin allows administrators to switch to any user account from the Users screen, switch back to their original account, and 'switch off' (temporarily log out while retaining the ability to switch back). It integrates deeply with WordPress core authentication, using cookies to track originating users and session tokens to manage state. The code is entirely contained in a single main file (`user-switching.php`) that implements a singleton class with hooks and filters. It includes comprehensive integration tests (PHPUnit) and acceptance tests (Playwright) covering switching flows, capabilities, session handling, and command palette features. The plugin also provides explicit integration points for WooCommerce, BuddyPress, bbPress, and the WordPress REST API and command palette. The architecture is typical of a well-crafted WordPress plugin: event-driven via hooks, with clear separation between utility functions and the main class. It is not a library or framework but a self-contained plugin that can be dropped into any WordPress site meeting its requirements.
The openai-python repository is the official Python SDK for interacting with OpenAI's API services. It provides both synchronous and asynchronous clients for accessing OpenAI's REST and WebSocket APIs, including chat completions, embeddings, image generation, audio processing, fine-tuning, vector stores, and admin organization management. The library is generated from OpenAPI specifications using Castiron, ensuring strong type safety via Pydantic models and TypedDict for request/response objects. Key features include streaming support, webhook verification, workload identity authentication, and modular resource organization. The SDK handles authentication, retry logic, pagination, and error handling transparently, making it suitable for production AI-integrated applications.
This is the official Go implementation of JSON Web Tokens (JWT), currently at v5. It provides a comprehensive library for creating, signing, parsing, and validating JWTs. The core package implements all standard JWT claims (RegisteredClaims and MapClaims), multiple signing algorithms (HMAC-SHA, RSA, RSA-PSS, ECDSA, Ed25519), and a flexible parser with functional options for configuration (e.g., allowed algorithms, leeway, audience/issuer/subject validation). The library also includes a `request` subpackage for extracting tokens from HTTP requests via headers or form/query parameters, and a `cmd/jwt` CLI tool for debugging and batch operations. Architecturally, it follows a clean separation of concerns: signing methods implement a common `SigningMethod` interface, claims implement a getter-based `Claims` interface, and validation is handled by a stand-alone `Validator` struct that can be used independently of parsing. The code is well-tested, uses only the Go standard library (no third-party dependencies), and follows modern Go idioms like functional options and error wrapping (Go 1.20+). It is actively maintained with CI, linting, CodeQL, and spell-check workflows.
Ockam is a framework for building secure, interconnected systems that provides identity-based end-to-end encrypted communication, secure channel establishment, and policy-based access control. The architecture features clear separation of concerns with modules for core types, identity management, secure channels, transport abstractions, vault cryptography, API orchestration, and a command-line interface. Implemented primarily in Rust with Elixir components, it uses async/await and OTP patterns for concurrency. Key entry points include the ockam CLI, node builder/context, and orchestrator API. The system enables secure multi-hop routing, message forwarding, and service integration with external systems like Kafka and InfluxDB.
opkssh is a production-grade CLI tool that bridges OpenID Connect (OIDC) authentication with SSH access. It allows users to authenticate via any OIDC provider (Google, Azure, GitLab, Keycloak, etc.) and obtain short-lived SSH certificates embedding OpenPubkey PK tokens. The server-side component, invoked as sshd's AuthorizedKeysCommand, verifies these certificates against policy files and grants access based on email, subject, or group membership. The architecture is a single Go binary with client and server modes, using Cobra for CLI commands. Key entry points include `opkssh login` (interactive OIDC flow, SSH key generation, agent integration), `opkssh verify` (server-side certificate validation and policy enforcement), `opkssh add` (policy management), and `opkssh audit` (configuration validation). External dependencies include the openpubkey library for PK token operations, afero for filesystem abstraction, and testcontainers for integration tests. The tool supports Linux, macOS, and Windows, with platform-specific file permission checks and ACL handling. It also features a policy plugin system for custom access control logic via external scripts.
Authorizer is a self-hosted, production-grade authentication and authorization server written in Go. It implements OAuth 2.0 / OIDC, SAML IdP/SP, SCIM 2.0, WebAuthn/passkeys, TOTP, email/SMS OTP, and fine-grained authorization via an embedded OpenFGA engine. The architecture is transport-agnostic: a shared service layer (internal/service) is called by GraphQL resolvers, gRPC handlers, and HTTP handlers (Gin). It supports multiple storage backends (SQL, MongoDB, Cassandra, DynamoDB, Couchbase, ArangoDB) via a unified storage.Provider interface, plus Redis and in-memory stores for sessions and caching. The system includes a React admin dashboard, an end-user login SPA, and an MCP (Model Context Protocol) server for AI tool exposure. Security is a primary focus, with extensive regression tests for CVEs, SSRF protection, constant-time comparisons, and audit logging.
This is a full-stack AI chat platform (DIAL Chat) built as a monorepo with a NestJS backend-for-frontend (BFF) and a React single-page application. The backend proxies all requests to an external DIAL Core service, handling authentication (OIDC providers, cookie sessions, header tokens, CSRF), configuration aggregation (env, static defaults, feature flags), file management (upload, archive download, sharing, batch operations), conversation lifecycle (CRUD, streaming with SSE, naming, publishing/unpublishing, sharing by invitation), and skills/prompts/toolsets management with manifest import/export. The frontend provides a rich chat UI with conversation panel, attachment input with canvas for previewing PDFs, Office docs, images, and MCP app iframes, a catalog browser for models/agents/toolsets, scheduled tasks with recurrence forms, skill and prompt editors, usage limits dashboards, and overlay embedding for third-party host apps. Both apps share extensive typed libraries (22 private packages) covering the catalog, conversation hooks, shared UI components, and a generated OpenAPI client. The system follows a strict BFF pattern: the frontend never communicates directly with DIAL Core—all API calls go through the NestJS server, which adds session validation, resource ownership checks, and caching. Streaming chat completions use server-sent events (SSE) with a consistent init payload format. The overlay embedding protocol uses postMessage with a documented state machine, feature flags gated by backend configuration. Observable telemetry via OpenTelemetry instruments HTTP lifecycle, generation metrics, and runtime diagnostics with Prometheus endpoints. The codebase is thoroughly tested (Vitest for frontend, Supertest for NestJS integration, browser-level CSP tests) and includes CI/CD pipelines for OpenAPI regeneration, deployment, and e2e testing. Architecture is modular: domain-specific NestJS services are split into focused sub-services (e.g., ConversationsService delegates to ConversationListingService, ConversationPersistenceService, ConversationLifecycleService, ConversationStreamingService). React contexts are used for state management (no Redux), with custom hooks for entity operations. The monorepo leverages Nx for task orchestration, dependency graph enforcement, and bundle budget checks in libraries. External dependencies include DIAL Core (for AI model inference and file storage), various OIDC providers, and optional libraries like MCP UI client for sandboxed app rendering.
This repository is a Java library for JSON Web Token (JWT) handling per RFC 7519. It provides comprehensive functionality for creating, signing, verifying, and decoding JWTs, supporting multiple cryptographic algorithms including HMAC (HS256/384/512), RSA (RS256/384/512, PS256/384/512), EC (ES256/384/512), and EdDSA (Ed25519/Ed448). The library also includes utilities for JSON Web Key (JWK) management, PEM encoding/decoding of keys and certificates, and ASN.1 DER parsing for low-level cryptographic operations. Architecturally, the library follows a modular structure with clear separation of concerns: core JWT operations in the `jwt` package, JWK handling in `jwks`, PEM utilities in `pem`, and DER parsing in `der`. Cryptographic operations are abstracted through `Signer` and `Verifier` interfaces, enabling the Strategy pattern for pluggable algorithm implementations. Object creation uses the Builder pattern for immutable, fluent APIs (e.g., `JWT.addClaim()`, `KeyPair.build()`). JSON processing is centralized via a configured Jackson `Mapper` with custom serializers/deserializers for Java 8+ date-time types. The design minimizes coupling, allowing components like `JWTUtils` or `HMACSigner` to be reused independently. The library is actively maintained, with recent commits (2026-07-15) and ongoing security updates (e.g., patches for CVE-2022-21449). Dependencies are managed via Maven/Savant, relying primarily on Jackson for JSON processing with optional Bouncy Castle for certain algorithms. The codebase demonstrates strong engineering practices: comprehensive unit tests cover all algorithms and edge cases, clear exception hierarchies provide specific error handling, and Java 9+ module system support is included. It serves as a robust, reusable foundation for any Java application requiring secure token-based authentication or authorization.
This is a TypeScript library implementing an OpenID Connect (OIDC) and OAuth2 client for browser-based applications. It supports Authorization Code Grant with PKCE, refresh tokens, resource owner password credentials, and DPoP, while explicitly excluding the deprecated implicit grant. The library provides both a low-level `OidcClient` for raw protocol operations and a higher-level `UserManager` with session management, event notifications, and automatic silent token renewal via iframes or pop-ups. It is a fork of the archived `oidc-client-js` project, ported to TypeScript with strict typing, comprehensive testing (vitest, jsdom), and modern build tooling (esbuild, ESLint, Husky). The architecture is cleanly layered: a settings store with defaults, navigator abstraction for browser UI (redirect, popup, iframe), storage abstraction for state persistence (in-memory, localStorage, IndexedDB), and an event system for lifecycle callbacks. The codebase demonstrates high craftsmanship with well-isolated, reusable components such as the generic Event emitter, a sleep-aware Timer, and a strategy-pattern for navigation. DPoP support is implemented with secure key storage in IndexedDB and automatic nonce retry. External runtime dependencies are minimal (only `jwt-decode`). Active maintenance is evidenced by regular commits, dependabot configuration, CI workflows, and a versioned release process. This library is suitable for any browser-based SPA requiring standards-compliant OIDC/OAuth2 authentication.
Gophercloud is a comprehensive Go SDK for OpenStack cloud APIs. It provides typed client libraries for over 20 OpenStack services, including compute, networking, block storage, identity, load balancing, container orchestration, bare metal, DNS, key management, and more. The library handles authentication via Keystone (v2/v3), clouds.yaml, environment variables, or direct options, and includes a robust pagination framework (linked, marker, single page) used by all list operations. It follows consistent patterns: each resource has Create/Get/List/Update/Delete functions, builder interfaces for request options, and result types with Extract() methods. The codebase is heavily tested with both unit tests (HTTP mock fixtures) and acceptance tests (against real OpenStack deployments). While primarily a library for infrastructure management, it also exposes utilities like pointer helpers, JSON time parsing, and config file loading. The architecture is modular and extensible, with many reusable patterns.
SaaStart is a B2B SaaS starter kit built with Next.js and Auth0 that provides multi-tenancy organization management, user authentication/authorization, self-service SSO configuration (OIDC and SAML), security policy management (including MFA), user profile and security settings, and SCIM provisioning capabilities. The application follows a modern Next.js App Router architecture with server and client components, uses Auth0 for identity management, and implements role-based access control with admin/member roles. Key features include organization creation and switching, user invitation workflows, domain verification for SSO, and comprehensive dashboard for managing organization settings, members, and connections.
remix-auth-oauth2 is a TypeScript library that provides an OAuth2 strategy for the Remix authentication framework (remix-auth). It implements the OAuth2 Authorization Code flow with PKCE, supporting standard endpoints, refresh tokens, token revocation, and OIDC discovery. The library is designed as a drop-in strategy for Remix apps, handling the redirect to the provider, state validation, token exchange, and invoking a user-supplied verify callback with the obtained tokens and request. It also exports error classes and the CodeChallengeMethod enum for convenience. The architecture is a single Strategy class extending remix-auth's Strategy base, backed by the arctic OAuth2 client library for protocol-level operations. The core logic lives in src/index.ts, with a small helper for redirects and a custom StateStore class that manages multiple concurrent OAuth flows by storing state and code verifiers in cookies. The StateStore is particularly well-crafted: it supports multiple simultaneous authorization attempts (e.g., multiple browser tabs) by merging cookie entries and using unique cookie names per flow, preventing race conditions. The codebase is clean, well-typed, and thoroughly tested with bun:test and MSW, covering redirect generation, state mismatch errors, token exchange, discovery, and concurrency. CI/CD is fully configured with GitHub Actions for build, typecheck, quality, tests, and npm publishing. The library is actively maintained, with recent commits, dependabot updates, and a low technical drift relative to its ecosystem.
This is a monorepo for Auth.js (formerly NextAuth.js), a framework-agnostic authentication library for web applications. The core engine (`@auth/core`) handles OAuth/OIDC, email/passwordless, credentials, and WebAuthn/Passkey authentication flows. It provides a unified API for session management (JWT or database-backed), CSRF protection, and cookie handling. The library is designed to be integrated into multiple frameworks via separate packages: `@auth/nextjs`, `@auth/sveltekit`, `@auth/express`, `@auth/qwik`, and `@auth/solid-start`. Each framework package adapts the core `Auth` function to the framework's request/response model, offering server-side handlers, middleware, and client-side hooks. The repository also includes over 80 built-in OAuth/OIDC provider definitions (e.g., Google, GitHub, Discord, Auth0) and 20+ database adapters (e.g., Prisma, Drizzle, MongoDB, PostgreSQL, DynamoDB) that implement a standard `Adapter` interface for user persistence. The project is now part of Better Auth, and the README recommends new projects use Better Auth unless specific feature gaps exist. The monorepo contains development apps, example applications, and a comprehensive documentation site built with Nextra.
This is the official Google API Client Library for PHP, providing a unified interface to call Google APIs such as Drive, YouTube, Books, and many others. It handles authentication (API keys, OAuth2 web flow, service accounts), HTTP requests via Guzzle, batching, media uploads (simple, multipart, resumable), retries with exponential backoff, caching, and model serialization. The library is in maintenance mode: critical bugs and security issues are addressed, but no new features are added. It is a mature, well-tested library with extensive documentation and examples. The architecture centers around a `Google\Client` object that manages authentication and HTTP, and generated service classes (from `google/apiclient-services`) that map to specific Google APIs. The codebase is well-structured, uses modern PHP (8.0+), and follows PSR standards. Key reusable components include a standalone URI Template parser and a generic retry runner with exponential backoff.