Hanko is a production-grade, self-hostable authentication and identity platform written primarily in Go. The backend exposes public, admin, and management HTTP APIs plus a CLI for migrations, user import/export, JWK/JWT management, and config schema generation. Authentication is implemented as a custom state-machine engine (flowpilot) driving login, registration, password/passkey/MFA/third-party OAuth/SAML flows, backed by JWT sessions, device trust, webhooks, audit logs, and rate limiting. The persistence layer uses gobuffalo/pop with a broad set of per-entity persister interfaces and roughly 65 Fizz migrations covering users, emails, credentials, sessions, tenants, organizations, roles, SAML providers, and webhooks. The frontend is split into a TypeScript SDK (`@teamhanko/hanko-frontend-sdk`) and Preact-based web components (`@teamhanko/hanko-elements`) that render flow states into embeddable `<hanko-auth>` and `<hanko-profile>` elements. The repository also contains a quickstart Go server, framework examples for React, Vue, Angular, Next.js, and Express, Playwright e2e tests, Docker Compose stacks, and Kubernetes manifests. Data flows through Echo routers into flowpilot actions/hooks, which validate inputs, persist state, issue sessions, and trigger webhook events; PostgreSQL, Redis, SMTP, and external OAuth/SAML providers are the primary external dependencies. Overall the codebase is well-structured and heavily tested, with sophisticated security handling around redirect validation, account linking, multi-tenant isolation, and webhook signing. The main friction points are the custom flowpilot framework's learning curve, a very large configuration surface, duplicated example code, and some stale example/e2e toolchains relative to the core Go and Node versions.
This is a production-grade Customer Data Platform (CDP) backend written in Go. It ingests events via HTTP (gateway), transforms and enriches them (processor), and routes them to over 90 destinations including streaming services (e.g., Kafka, Kinesis) and data warehouses (e.g., Snowflake, BigQuery, ClickHouse). The core of the system is a PostgreSQL-backed job queue (JobsDB) that provides partitioned, multi-consumer, durable processing. The architecture is a monolith with multiple internal services that can be deployed in different modes (gateway-only, processor-only, embedded). It includes enterprise features like OAuth token management, user suppression, regulatory deletion (GDPR), and reporting with HyperLogLog aggregation. The codebase is well-structured with clear separation of concerns, extensive unit and integration tests, and many reusable patterns (worker pool, circuit breaker, transaction listeners, config reloading). It is actively maintained with regular commits and security patching.
ember-simple-auth is a lightweight Ember.js addon for implementing authentication and authorization in Ember applications. It provides a session service, pluggable authenticators (OAuth2 password grant, implicit grant, Devise, Torii, and custom), and session stores (localStorage, sessionStorage, cookie, adaptive, ephemeral) that persist the session across page reloads and synchronize across browser tabs. The library supports FastBoot, Engines, and Embroider, and includes built-in test helpers. Architecture follows a service-based pattern where the session service delegates to an internal session module that manages state transitions (unauthenticated, authenticated, loading) and communicates with authenticators and stores via events. The codebase is partially migrated to TypeScript, uses modern tooling (pnpm workspaces, Rollup, eslint flat config), and maintains broad compatibility with Ember versions from 3.28 onward.
Cal.diy is a fully open-source, MIT-licensed fork of Cal.com, providing a self-hostable scheduling platform. It is a large monorepo containing a Next.js web application (apps/web) for booking pages, settings, and admin, a NestJS API (apps/api/v2) for platform REST endpoints, and extensive packages for business logic (packages/features), integrations (packages/app-store with 50+ apps), embeddable booking widgets (packages/embeds), and reusable React atoms (packages/platform/atoms). The architecture uses tRPC for client-server communication, Prisma ORM with PostgreSQL, Redis caching, and a custom dependency injection system (ioctopus) alongside NestJS DI. Key patterns include a tasker abstraction for async/sync background jobs (webhooks, emails, calendar sync), a versioned webhook payload builder factory, repository pattern over Prisma, and a consistent app-store integration structure. The platform exposes a public API with OAuth2, webhooks, and embeddable components for third-party developers. The codebase is actively maintained with frequent schema migrations and CI/CD pipelines, but exhibits some technical drift due to dual API surfaces (tRPC vs REST), stub implementations for enterprise features, and generated files that require regeneration.
This is a production-ready Node.js/Express web application boilerplate designed to jumpstart hackathon projects. The codebase implements a complete user authentication system supporting local email/password, OAuth 2.0/OAuth 1.0a (10+ providers including Google, Facebook, GitHub, Discord, Microsoft), WebAuthn passkeys, and two-factor authentication (TOTP + email). It includes session management with MongoDB, CSRF protection, rate limiting, and custom security measures like timing-safe token comparisons and IP-bound token consumption. Beyond auth, it ships working demos for ~20 third-party API integrations (Stripe, Twilio, GitHub, NYT, Wikipedia, etc.) and AI features powered by LangChain and Groq, including a ReAct agent with SSE streaming, a RAG pipeline with vector search, and LLM-based classification/vision. The repository also provides a sophisticated Playwright-based e2e testing framework using nock-recorded HTTP fixtures, enabling deterministic offline tests without live API keys. All features are organized as deletable modules with a removal checklist to facilitate trimming for production use.
angular-oauth2-oidc is an Angular client library for OAuth 2.0 and OpenID Connect authentication in browser SPAs. Its core is OAuthService, a large stateful injectable that loads OIDC discovery documents, drives login via implicit flow, code flow + PKCE, or password flow, stores tokens through a pluggable OAuthStorage (default sessionStorage, with MemoryStorage fallback), validates tokens through pluggable ValidationHandler implementations, runs silent refresh/session checks via hidden iframes, and emits a typed event stream (OAuthEvent hierarchy) for lifecycle notifications. DefaultOAuthInterceptor attaches bearer tokens to outgoing HTTP calls against configured allowed URLs; UrlHelperService extracts tokens from redirect URLs for both hash and query strategies.
Athenz is an open-source, fine-grained authorization and identity management platform designed for zero-trust environments. It provides centralized (ZMS) and decentralized (ZTS) services for issuing short-lived X.509 certificates, managing role-based access control (RBAC), and enforcing policies across multi-cloud and on-premise infrastructures. The system supports AWS, GCP, Azure, and Kubernetes workloads through pluggable attestation validators and credential providers, enabling service-to-service authentication and authorization without shared secrets. Architecturally, Athenz comprises three core servers: ZMS (management service for domains, roles, policies), ZTS (token service for certificates, OAuth2 tokens, SSH certs), and MSD (micro-segmentation for network policy management). A React/Next.js UI provides administrative management, while client libraries in Java, Go, and Node.js enable integration. The codebase is organized into modular Maven submodules with RDL-generated data models, extensive unit/integration tests, and Docker/Kubernetes deployment artifacts. Key patterns include factory-based dependency injection (e.g., cert signers, private key stores, notification services), dynamic configuration reloading, and composite validators for cloud attestation. This is a production-grade application with clean abstractions, well-defined interfaces, and significant test coverage. While the codebase contains some generated boilerplate and cloud-specific implementations that may drift, the core libraries and utility classes are reusable and demonstrate strong engineering practices.
This is the official Auth0 React SDK (`@auth0/auth0-react`), a client-side library that provides React bindings for Auth0 authentication. It wraps the core `@auth0/auth0-spa-js` library and exposes a React-friendly API via context, hooks, and higher-order components. The architecture follows a standard React context provider pattern: `Auth0Provider` wraps the application tree, and `useAuth0` (or `useAuth0Suspense`) provides authentication state and methods (login, logout, token management, MFA, passkeys). The SDK supports OAuth2 Authorization Code Grant with PKCE, refresh token rotation, DPoP, and custom token exchange. It is designed for single-page applications and is compatible with React 19+, including Next.js App Router (via `'use client'` directive injection). Key entry points include `Auth0Provider` (the root provider), `useAuth0` (primary hook), `useAuth0Suspense` (Suspense-enabled variant), `withAuthenticationRequired` (HOC for route protection), and `withAuth0` (legacy HOC). The SDK manages authentication state through a reducer (`src/reducer.tsx`) and provides a rich error hierarchy (`OAuthError`, `MfaRequiredError`, etc.). External dependencies are minimal: React, ReactDOM, and `@auth0/auth0-spa-js`. The codebase is well-tested with Jest unit tests (using a manual mock for the underlying SDK) and Cypress integration tests against a live Auth0 tenant. The SDK demonstrates strong engineering practices: typed interfaces, memoized context values, structured error handling, and a clear separation of concerns between the provider, hooks, and HOCs. It includes generated TypeDoc documentation and example applications for Vite, Gatsby, and Next.js. While the library is tightly coupled to the Auth0 ecosystem, its patterns (context-based auth, Suspense integration, error hierarchy) are reusable in other authentication contexts.
MSAL Python is a production-grade OAuth2/OIDC client library for the Microsoft identity platform (Entra ID / Azure AD, ADFS, MSA). It implements the full token acquisition lifecycle: authorization code, client credentials, device code, ROPC, on-behalf-of, and managed identity flows, plus WS-Trust for legacy ADFS federation. The library exposes two primary application classes — PublicClientApplication (desktop/mobile) and ConfidentialClientApplication (web apps/daemons) — built on a shared ClientApplication base with an embedded oauth2cli sub-package for low-level OAuth2 protocol handling. It also supports broker integration via pymsalruntime, proof-of-possession tokens, and regional endpoints.
GoTrue is a self-contained user registration and authentication API written in Go. It provides endpoints for signup, login (via email/password or OAuth2 providers like GitHub, GitLab, Google, Bitbucket, Facebook), token refresh, password recovery, email verification, and user management (CRUD for admin users). The architecture is a monolithic HTTP API using the chi router, backed by a MySQL database (via pop/v5 ORM) and a configurable mailer (SMTP or noop). It supports both single-tenant and multi-tenant deployments, with JWT-based authentication (HS256) and optional SAML SSO. The codebase is well-organized into packages: api for HTTP handlers, models for database entities, conf for configuration, mailer for email sending, and crypto for security utilities. It includes extensive unit tests and integration tests using a MySQL test database.
gologin is a well-tested Go library that turns OAuth1 and OAuth2 authorization flows into chainable net/http handlers. In production it lets a web app register LoginHandler and CallbackHandler for providers (GitHub, Google, Facebook, Bitbucket, Twitter, Tumblr) and then read the authenticated user or access token from the request context in the success handler. It also provides a Twitter TokenHandler for native mobile token login. The architecture is a set of primitive handlers (state, login, callback) that communicate via context, with provider packages composing those primitives and adding a user-fetching step; session management stays orthogonal to authentication. The oauth2 subpackage implements RFC 6749 state-parameter CSRF protection with short-lived secure cookies, while the oauth1 subpackage splits request-token acquisition, auth redirect, temporary-secret persistence, and access-token callback so providers with different secret requirements reuse the same pieces. Provider packages are intentionally thin wrappers around the generic handlers and call provider APIs (go-github, go-twitter, sling, google.golang.org/api) to fetch User objects. The code is thoroughly unit-tested with httptest mocks and includes runnable examples for GitHub, Google, and Twitter. Maintenance is active and the dependency manifests are current, though a few provider endpoints lag behind platform APIs (Facebook still targets Graph API v2.9 and Twitter targets v1.1 verify_credentials), so those specific integrations may need updates. The generic OAuth1/OAuth2 machinery remains solid and portable.
This repository is a Home Assistant custom component that implements a full OpenID Connect (OIDC) Client/Relying Party for authentication. It allows Home Assistant users to log in via an external OIDC Identity Provider (IdP) such as Authentik, Authelia, Keycloak, or any standard OIDC-compliant server. The integration registers a custom auth provider within Home Assistant's auth system, intercepts the default login flow to redirect users to the OIDC provider, and handles the full authorization code flow including PKCE (RFC 7636), ID token validation with configurable signing algorithms, and userinfo retrieval. It supports both public and confidential clients, device code flow for mobile app login, automatic user linking, role-based access mapping from IdP groups, and a multi-step UI configuration wizard for easy setup.
jira.js is a comprehensive TypeScript SDK for Atlassian Jira REST APIs, covering Cloud, Data Center, Agile, Service Management, Assets, Administration, Teams, User Management, and User Provisioning surfaces. It is designed as a modular library with separate client factories (e.g., createCloudClient, createServerClient, createAgileClient) that provide typed access to hundreds of API endpoints. The architecture is built on a core transport layer that handles authentication (basic, bearer, OAuth 2.0), request/response validation using Zod schemas, error classification, retry logic, and multipart form data. Every API response is validated at runtime, with configurable behavior on schema mismatch (warn, throw, silent) and an optional audit mode to detect API drift. The library is primarily generated from Atlassian's OpenAPI specifications, resulting in a large, consistent codebase with models, parameters, and API functions organized by product domain. Key entry points include the client factories and subpath imports like 'jira.js/cloud' or 'jira.js/agile'. Data flows are straightforward: consumers construct typed request options and call client.sendRequest(), which returns validated response objects. External dependencies are minimal: zod for runtime validation, and the platform's fetch API for HTTP. The library also includes webhook signature verification, OAuth 2.0 (3LO) helpers for both Cloud and Data Center, and a browser-compatible bundle. Notable patterns include the use of apiObject and openEnum helpers to create Zod schemas that are permissive by default but strict under audit, enabling graceful handling of API evolution. The error hierarchy uses branded symbols for reliable type guards across package copies. The test suite includes extensive live integration tests against real Atlassian instances, with resource tracking and entitlement-aware gating. Overall, jira.js is a well-engineered, actively maintained SDK that prioritizes type safety and runtime validation, though its large generated surface introduces some duplication and maintenance overhead.
django-auth-adfs is a Django authentication backend that enables integration with Microsoft ADFS and Azure AD for single sign-on (SSO). It implements OAuth2 and OpenID Connect flows to authenticate users against enterprise identity providers, automatically creating and updating Django users based on identity claims. The package provides Django authentication backends, middleware for enforcing authentication, URL handlers for the OAuth2 flow, and Django REST Framework integration for token-based API authentication. The architecture follows Django best practices with clear separation of concerns between configuration, backend logic, views, and middleware.
Cloudreve is a production-grade, self-hosted file management system (v4) built with Go, Gin, and the ent ORM. It provides a full-featured cloud storage platform supporting multiple storage backends (local, S3, Aliyun OSS, Tencent COS, Huawei OBS, Qiniu, Upyun, OneDrive), WebDAV, WOPI for online Office editing, OAuth2, WebAuthn passkeys, full-text search via Meilisearch, thumbnail generation (vips, ffmpeg, LibreOffice), media metadata extraction (EXIF, ffprobe), and a background task queue for async operations like archive creation, remote downloads, and indexing. The architecture follows a layered pattern with dependency injection, a database-backed filesystem (DBFS) with navigators, an event hub for real-time file events, and a master-slave cluster for distributed nodes. The codebase is well-organized into reusable packages (e.g., pkg/request, pkg/queue, pkg/cache, pkg/auth) and includes a comprehensive admin panel for managing users, groups, storage policies, tasks, and nodes. While primarily an application, it also incorporates data engineering patterns like media metadata extraction and full-text indexing for user-facing features.
This repository is a production full-stack application for browsing, searching, downloading, and publishing galgame (visual novel) sticker packs. It is a pnpm monorepo containing a Nuxt 4 SSR frontend (`apps/web`) and a Go Fiber v3 API (`apps/api`) backed by PostgreSQL. The API exposes both internal service endpoints and a public read-only OpenAPI "face" for sticker content, while integrating with external ecosystem services: an OAuth 2.0 identity provider (PKCE, httpOnly session cookies, BFF pattern), a centralized content-addressed image service, a catalog service for games/characters, and a community service for comments, notifications, and reactions. Deployment is Docker images to GHCR via Dokploy, with versioned SQL migrations and GitHub Actions CI building all images on push to the `svelte-kit` branch. The backend is well-layered: handlers own HTTP concerns, services contain business logic without importing Fiber, repositories use GORM, and repeated cross-service communication is isolated in reusable `pkg` clients. Noteworthy engineering includes batch hydration for pack covers/tags/authors, trigram GIN search over flattened multilingual text, cursor pagination for notifications, and RFC 9457 problem-detail error responses in the public API. The frontend is organized into feature modules and includes a race-condition-safe catalog picker, OAuth PKCE utilities, and server-side OG image generation. The codebase is maintained and technically current, though some operational risks remain: dual error dialects between internal and public APIs, silent degradation when optional upstream services are down, and a few hardcoded backfill mappings in one-time scripts.
This is the official Tableau MCP server, a TypeScript application that bridges AI assistants with Tableau Cloud, Tableau Server, and Tableau Desktop via the Model Context Protocol (MCP). It exposes a comprehensive set of tools covering content exploration (workbooks, views, datasources), administration (users, flows, extract refresh tasks, jobs, license reclamation), advanced analytics (Pulse metrics, insights, knowledge graph), and human-in-the-loop confirmation workflows. The server is available in three variants: a web variant running over HTTP with OAuth 2.1 support (PKCE, token rotation, client registration), a desktop variant communicating with the local Tableau Desktop Agent over stdio, and a combined variant. Its architecture is modular: a core server layer registers tools and prompts against an MCP SDK instance, tools delegate to a Zodios-based Tableau REST API client or the desktop agent API, and cross-cutting concerns like authentication, feature gates, telemetry, and session stores are provided through pluggable provider interfaces. The codebase demonstrates strong engineering practices with extensive unit/e2e tests, typed schemas via Zod, consistent error handling patterns, and a clear separation between web and desktop concerns.
Kanboard is a self-hosted, open-source project management application implementing the Kanban methodology. It provides a full web interface for managing tasks, projects, columns, swimlanes, subtasks, comments, tags, and time tracking, with drag-and-drop board interaction, automatic actions triggered by events, and extensive filtering/search capabilities. The architecture follows a custom MVC pattern with PHP controllers, models, and templates, using Pimple for dependency injection, PicoDb for database abstraction (supporting SQLite, MySQL, PostgreSQL, and MSSQL), and Symfony EventDispatcher for event-driven workflows. It includes a JSON-RPC API, CLI console commands, a plugin system, multiple authentication backends (LDAP, OAuth2, reverse proxy, TOTP), email notifications via SwiftMailer, and analytics (burndown, cumulative flow, lead/cycle time). The frontend uses jQuery and custom JavaScript components with charting via C3.js/D3.js. The codebase is well-structured with clear separation of concerns, extensive unit and integration tests, and a modular design that allows plugins to extend functionality. However, it is explicitly in maintenance mode (no new features, only bug fixes and community contributions), and several vendored libraries (SwiftMailer, PicoDb, JSON-RPC, etc.) may become outdated. The JavaScript layer relies on older patterns (jQuery, global namespace) and lacks a modern build pipeline. Configuration uses global constants rather than environment variables, and some areas show technical debt (e.g., mixed coding styles, deprecated PHP annotations). Despite these issues, the core architecture is solid, and many components (filter system, plugin installer, OAuth2 client, LDAP client, queue manager) are well-designed and potentially reusable in other PHP projects.
ACI.dev is an open-source platform that provides a unified tool-calling interface for AI agents, enabling them to interact with over 600 third-party services via REST APIs or custom connectors. The backend is built with FastAPI, PostgreSQL (with pgvector for semantic search), SQLAlchemy, and Alembic for migrations, while the frontend is a Next.js 15 application with Shadcn UI, TanStack Query, and Zustand. The platform includes a full OAuth2 flow for service authentication, encrypted credential storage using AWS KMS, Stripe-based subscription billing, and a CLI for administrative tasks. It is designed as a multi-tenant SaaS with per-project quotas, agent management, and a playground for testing function calls. Architecturally, the system is modular: apps are defined as JSON schemas (app.json and functions.json) in a standardized format, and a generic execution engine dispatches calls to REST endpoints or local connector modules. The codebase demonstrates strong separation of concerns with CRUD modules, dependency injection, and middleware for rate limiting and logging. It also includes an evaluation pipeline for measuring search relevance (using synthetic intents and metrics like MRR), and a vector-based search for app and function discovery. While primarily an application, the repository contains research-oriented components such as the evaluation pipeline and embedding-based search, reflecting a hybrid nature focused on improving AI agent tool selection. The code is well-maintained and actively developed, with comprehensive test coverage (though some tests are skipped or TODO). The integration system is extensible, and several components (e.g., OAuth2 manager, encrypted SQL types, generic data table UI) are well-crafted and reusable. However, the codebase shows some technical debt in the form of hardcoded configurations, in-memory rate limiting, and app-specific OAuth2 overrides. Overall, it is a professional-grade platform with a high level of craftsmanship, suitable for production use and further extension.
GCLI2API is a production-grade API proxy that converts Google Gemini CLI and Antigravity credentials into OpenAI, Gemini, and Claude compatible API endpoints. It manages OAuth credentials with automatic rotation, error-based cooldowns, and load balancing, providing a unified interface for multiple backend services. The system includes a web-based control panel for credential management, real-time logs, configuration editing, and batch operations. The architecture is a FastAPI web application with modular routers for each API format (OpenAI, Gemini, Claude) and two backend modes (geminicli, antigravity). Format converters handle bidirectional translation between Anthropic, OpenAI, and Gemini schemas, including tool calls, streaming, and thinking blocks. Storage is abstracted via an adapter pattern supporting SQLite, MongoDB, and PostgreSQL, with optional Redis caching for credential pools. Key features include streaming support with fake streaming fallback, anti-truncation via synthetic tool calls, thought signature preservation across format conversions, and a keepalive service. The system relies on httpx for async HTTP, Pydantic for data models, and external Google Cloud APIs for OAuth and quota management. Deployment is supported via Docker, docker-compose, and platform-specific install scripts for Linux, macOS, Windows, and Termux. This is a pure application with no data research or ML components. It demonstrates strong engineering practices in credential management, format conversion, and async I/O, though it suffers from some code duplication between backend modes and limited test coverage.