Safety is a commercial CLI tool for software supply chain security, primarily scanning Python (and limited npm) dependencies for known vulnerabilities. It operates as a multi-command CLI built with Click and Typer, offering commands such as `scan`, `check`, `auth`, `firewall`, `init`, and `codebase`. The architecture is modular: a core scanning engine (`safety/scan/`) discovers dependency files (requirements.txt, pyproject.toml, Pipfile.lock, etc.), resolves packages, and matches them against a proprietary vulnerability database fetched from the Safety platform. Results are formatted via a pluggable formatter system (JSON, HTML, screen, text, SPDX) and can be uploaded to the platform for reporting. The tool also includes a firewall mode that intercepts pip/poetry/uv/npm install commands to block malicious packages in real time, using shell aliases (Unix) or registry/autorun (Windows). Authentication is multi-modal: OAuth2 (browser-based), API keys, and machine tokens, with a complex enrollment flow for enterprise MDM. An internal event bus (`safety/events/event_bus/bus.py`) provides async telemetry and audit trail emission, used throughout auth, init, and scan workflows. The codebase demonstrates strong engineering practices: layered configuration resolution (CLI > env > config file > default), a command wrapper pattern for package managers, and a policy file system (YAML) for ignoring vulnerabilities by severity, CVSS score, or expiration. However, there is notable technical drift: the legacy `check` and `license` commands are deprecated but still present, typing is incomplete in several modules, and the Windows firewall interceptor relies on fragile registry manipulation. The test suite is extensive but heavily mocks external services, making integration tests brittle. External dependencies include `httpx`, `authlib`, `tenacity`, `rich`, `pydantic`, `dparse`, `packaging`, `certifi`, `filelock`, and the proprietary `safety-schemas` package. The tool is distributed as a PyPI package and as a GitHub Action, with CI/CD pipelines building platform-specific binaries via PyInstaller and PyApp. Overall, Safety is a mature, feature-rich security tool with a well-architected core, though some areas show signs of rapid feature growth and legacy debt.
This is an Angular SDK library (`@auth0/auth0-angular`) that integrates Auth0 authentication (OAuth2/OIDC) into Angular single-page applications. It wraps the Promise-based `@auth0/auth0-spa-js` into Angular's reactive ecosystem using RxJS Observables, dependency injection, and Angular Router. The library provides core authentication flows (redirect/popup login, logout, token management), route protection via guards, automatic bearer token injection via HTTP interceptors, and additional features such as MFA, passkeys (WebAuthn), enterprise account linking, custom token exchange, and a MyAccount API client. It supports both traditional NgModule-based and modern standalone (functional) Angular patterns. The playground application included serves as a development and e2e test harness with a local OIDC provider. The architecture is clean, well-tested, and follows Angular best practices, though the core logic is delegated to the underlying Auth0 SPA SDK.
python-o365 is a mature Python library that provides a comprehensive, object-oriented wrapper around the Microsoft Graph API. It enables developers to programmatically access and manage Microsoft 365 services including Outlook email and calendar, OneDrive and SharePoint files, Teams chats and presence, Planner tasks, directory users and groups, and more. The library abstracts OAuth2 authentication (supporting authorization code, public client, and client credentials flows) and handles token refresh, pagination, and API versioning internally. It is designed as a client-side SDK, not a server application, and can be embedded into scripts, web applications (e.g., Flask), or automation workflows.
Ganymede is a media management system focused on archiving and managing Twitch content (VODs, live streams, clips) with a Go backend using Ent ORM, Echo framework, and River job queue, and a Next.js frontend with Mantine UI. It provides video archiving, playlist management, user authentication, API keys, and administrative interfaces. The system processes media through a pipeline involving yt-dlp, FFmpeg, and TwitchDownloaderCLI, storing metadata in PostgreSQL and files on disk. It includes features like chat archiving, chapter detection, muted segment detection, and rule-based playlist automation.
This repository provides a set of Keycloak identity provider plugins for Russian social networks: Yandex, VK (legacy API), VK ID (new OAuth 2.0 with PKCE), Mail.Ru, and Odnoklassniki. It extends Keycloak's OAuth2 identity provider framework with custom endpoints, token exchange logic, user profile mapping, and admin UI themes. The architecture follows Keycloak's SPI pattern: each provider has a factory, config, identity provider class, and optional custom callback endpoint. Notable engineering includes PKCE support for VK ID, signature-based API authentication for Odnoklassniki, Basic Auth token exchange for Mail.Ru, and Infinispan-based state caching for VK ID's custom OAuth flow. The code is well-structured, uses modern Java 17 and Jakarta EE, and includes CI/CD pipelines for building and publishing to Maven Central. However, the repository lacks unit tests, which is a significant gap for a production-grade library.
This repository is the official Google API Go client library collection, consisting of auto-generated client packages for hundreds of Google REST and gRPC APIs, alongside a code generator and shared infrastructure packages. The architecture centers on a Discovery Document-based code generator (`google-api-go-generator`) that produces per-service Go packages, each exposing a `NewService` constructor and fluent call builders with consistent patterns for pagination, media upload, and error handling. Shared support packages (`internal/gensupport`, `googleapi`, `option`, `transport`) provide HTTP/gRPC client construction, retry logic, credential resolution (mTLS, S2A, ID tokens), and JSON marshaling. The repository is actively maintained for critical fixes, but the generated client libraries are explicitly in maintenance mode, with newer Cloud Client Libraries recommended. Key entry points include `option.ClientOption` for client configuration, `transport/http.NewClient` and `transport/grpc.Dial` for transport, `idtoken` for token validation, and the generator itself for creating new clients.
u8views is a production Go web application that tracks GitHub profile views and generates embeddable SVG badges showing view counts (day, week, month, total). Users authenticate via GitHub OAuth2, and the service counts views of their GitHub profile (likely via a tracking pixel or API). The monolithic backend uses Gin, PostgreSQL, sqlc for type-safe SQL, and quicktemplate for server-side HTML rendering. The frontend uses TypeScript with esbuild and ApexCharts for statistics dashboards. The codebase is well-structured with clean separation of concerns: controllers, services, repository pattern, and custom SVG badge generation with font measurement. It includes CI via GitHub Actions, Docker Compose for local development, and Ansible deployment scripts. Notable reusable components include the badge generation library and the OAuth2 flow implementation. Minor code smells include multiple legacy cmd versions (v1, v2, v3), fire-and-forget goroutines for view counting without error handling, and duplicated inline CSS across templates.
stravalib is a well-crafted Python client library for the Strava V3 REST API. It provides a high-level, Pythonic interface for authenticating (via OAuth2), retrieving, and modifying Strava data such as activities, athletes, clubs, segments, routes, and streams. The architecture is layered: a Client class orchestrates higher-level operations, delegating HTTP communication to a lower-level protocol module (ApiV3) that handles authentication, rate limiting, automatic token refresh, and error mapping. Data is modeled using Pydantic v2, with both auto-generated models from the official Strava Swagger spec and handcrafted domain models that add lazy-loading, unit conversion (via Pint), and custom types like Distance and Duration. The library includes a configurable rate limiter with priority levels, a generic paginated iterator (BatchedResultsIterator), and extensive unit and integration tests including a mock API stub that leverages the Swagger spec for realistic testing. It is not a standalone application but a library intended for integration into scripts, web apps, or data analysis pipelines. While primarily an API client, its unit conversion and stream retrieval features make it useful for fitness data research. The codebase is actively maintained with frequent releases and CI, though it shows signs of technical drift due to deprecation of certain Strava endpoints and reliance on an auto-generated model that may lag behind API changes.
MaxKey is an enterprise-grade Identity and Access Management (IAM) / Single Sign-On (SSO) platform written in Java (Spring Boot) with Angular frontends. It supports a comprehensive set of authentication protocols (OAuth 2.0/OpenID Connect, SAML 2.0, CAS, JWT, form-based, token-based) and identity federation standards (SCIM 2.0, LDAP, Active Directory). The codebase is organized as a multi-module Maven project with clear separation between authentication providers, protocol implementations, persistence layer, and web UIs. Architecturally, it follows a service-oriented model with a custom OAuth2 stack (derived from Spring Security OAuth), MyBatis JPA for persistence, and Redis/Caffeine for caching. The frontends are built on NG-ALAIN (Angular 17) and share a common base for user portal and admin console. While the system is functionally rich and actively maintained, it contains some duplicated code across modules and relies on a legacy OAuth2 implementation that has been superseded by Spring Security 5+. The crypto utilities, OTP infrastructure, and adapter patterns are well-structured and demonstrate non-obvious craftsmanship.
WSO2 API Manager is an enterprise-grade API management platform. In production, it provides API publishing, a developer portal, a gateway for request mediation/security enforcement (authentication, rate limiting, threat protection), a key manager (OAuth2, JWT, API keys), and a traffic manager for analytics and throttling. The architecture is modular, with deployable profiles (all-in-one, control-plane, gateway, traffic-manager) built on the WSO2 Carbon kernel with Apache Synapse mediation. The codebase is primarily Java/Maven with Python-based recommendation engine components, extensive integration tests (both legacy TestNG and a modern Cucumber/Testcontainers parallel framework), and sample scenarios. Key entry points include REST APIs (Publisher, Developer Portal, Admin, Gateway), startup scripts (api-manager.sh), and deployment configuration (deployment.toml). External dependencies include WSO2 Identity Server for key management, databases (H2/PostgreSQL), MongoDB for recommendations, and various protocols (REST, GraphQL, WebSocket, SSE, WebSub, SOAP, MCP).
Firefly is a high-performance asynchronous networking framework for the JVM, written in Java and Kotlin. It provides a comprehensive set of I/O primitives including HTTP/1.1, HTTP/2, WebSocket (RFC 6455), TCP, and UDP, with both client and server implementations. The framework is designed around Kotlin coroutines and Java NIO2 (AIO), offering non-blocking, backpressure-aware streams and a router-based HTTP server with support for content negotiation, CORS, static file serving, and HTTP/2 upgrade. It also includes built-in SLF4J logging with XML configuration, a JSON serialization service, a WeChat enterprise bot module, and a JNI helper for native code integration. The codebase is modular (firefly-common, firefly-net, firefly-slf4j, firefly-serialization, firefly-wechat, firefly-example) and demonstrates deep protocol-level craftsmanship with custom HPACK, Huffman coding, and state-machine parsers. While primarily a library for building network services, it also serves as a reference implementation for protocol handling on the JVM.
This repository is a Payload CMS authentication plugin (payload-auth-plugin) that provides OAuth2, OIDC, password, and passkey authentication strategies. It is designed to be used with Payload CMS v3+ and integrates deeply with Payload's admin panel and frontend via custom API endpoints, collection field injection, and a client-side library. The plugin supports multiple providers (Google, GitHub, Apple, etc.) via a clean provider factory pattern and manages its own session cookies, credential hashing (PBKDF2), and account linking. The architecture is a plugin that hooks into Payload's lifecycle, extending the CMS with authentication endpoints and database collections. The example application (examples/with-website/) demonstrates a full Payload CMS + Next.js website with admin and public authentication flows. Despite being pre-1.0, the codebase exhibits solid engineering patterns: strategy pattern for endpoint registration, collection helper functions that merge user-defined configs, and a reusable AuthClient class for browser-side authentication. However, it lacks automated tests, has several FIXME comments in passkey and password protocols, and is tightly coupled to Payload's internal DB and cookie mechanisms, which introduces technical drift risk as Payload evolves. The plugin is actively maintained with frequent releases and a changelog documenting 50+ versions.
This is a SvelteKit application demonstrating authentication using Auth.js. It provides sign-in with multiple providers (Google, GitHub, etc.) and protects a route requiring authentication. The application consists of standard SvelteKit routes, components for UI (header, footer, sign-in button), and centralized authentication configuration in auth.ts. The session is managed via cookies and made available to all pages through a layout load function. The code follows SvelteKit conventions and uses Auth.js's SvelteKit adapter for authentication handling.
This is a client-side JavaScript library that standardizes OAuth2 and OAuth1 authentication and API access to over 20 social networks and cloud services (Facebook, Google, Twitter, GitHub, Dropbox, etc.). It provides a unified API with methods like hello.init(), hello.login(), hello.logout(), hello.api(), and an event system for session lifecycle events. The library handles popup/redirect OAuth flows, token storage (localStorage with cookie fallback), and normalizes API responses into a consistent format. It supports multiple transport mechanisms (XHR, JSONP, iframe POST) and includes platform shims for Chrome Apps and PhoneGap. The architecture is modular: each provider is defined in a separate module with OAuth config, endpoint mappings, and response wrappers. The codebase includes extensive unit and e2e tests with stubbed API responses, demos for each provider, and a build system using Grunt and semantic-release. While actively maintained, it carries some technical debt from legacy browser support, vendored dependencies (Knockout.js, expect.js), and reliance on a third-party OAuth proxy for OAuth1 flows.
Dromara/forest is a declarative HTTP client framework for Java. It allows developers to define HTTP APIs via annotations on interfaces, similar to Retrofit for Android, but targeting the Java ecosystem with deep integration for Spring Boot and Solon. The core engine uses dynamic proxies to intercept interface invocations, builds HTTP requests from annotation metadata, and dispatches them to pluggable backends (Apache HttpClient, OkHttp3). It supports all HTTP methods, file upload/download, JSON/XML/Protobuf serialization, server-sent events (SSE), OAuth2 authentication, retry/redirect policies, cookie management, and async execution (including Kotlin coroutines and Project Reactor). The architecture is modular: a core library defines the annotation lifecycle, request/response models, converter abstractions, and interceptor chains, while separate modules provide Spring Boot auto-configuration, Solon plugin, JAXB/Jakarta XML converters, and a mock server for testing. The framework is designed for production use with customizable logging, SSL, proxy, and connection pooling. External dependencies include OkHttp3, Apache HttpClient, Jackson/Gson/Fastjson for JSON, and optional Reactor/Kotlin. The project includes extensive examples for integrating with AI APIs (ChatGPT, DeepSeek) and standard REST services.
Xibo CMS is a full-stack digital signage content management system that enables users to create, schedule, and manage content displayed on screens. The backend is built with PHP (Slim framework, Symfony EventDispatcher, Phinx migrations) and exposes RESTful APIs consumed by a modern React/TypeScript SPA frontend (Vite, TanStack Query, Tailwind CSS). It supports player communication via XMR (message relay) and legacy SOAP-based XMDS. Key features include layout and playlist management, media library, scheduling with dayparting and recurrence, reporting (proof of play, bandwidth, session history), OAuth2 authentication, multi-tenancy via folders and permissions, and a widget/module system with connectors. The codebase is large and actively maintained, with extensive frontend tests (Vitest) and Docker-based development/deployment. However, it carries some technical debt from a legacy jQuery/Bootstrap UI that coexists with the modern React frontend, and a high volume of database migrations indicates long evolution.
OSIN is a Go library implementing an OAuth 2.0 authorization server as defined in RFC 6749, with support for PKCE (RFC 7636). It provides a modular server with configurable storage backends, token generators, and client authentication. The library handles all standard grant types: authorization code, implicit, resource owner password credentials, client credentials, refresh token, and assertion. It also includes non-standard info endpoints. The architecture is centered around a `Server` struct with pluggable `Storage` and token generator interfaces. Key entry points are `HandleAuthorizeRequest`, `HandleAccessRequest`, and `HandleInfoRequest`, which users integrate into their HTTP handlers. The code is well-structured and tested, but the project is in maintenance-only mode with outdated dependencies (e.g., jwt-go v3, jose.v1) and no recent commits. It remains a solid reference implementation for OAuth2 server logic in Go.
This repository implements a Model Context Protocol (MCP) server that exposes the QuickBooks Online API as tools for AI agents such as Claude Code. It provides 143 tools covering full CRUD and search operations across 29 entity types (Customer, Invoice, Bill, Vendor, Employee, Account, Item, JournalEntry, Deposit, Transfer, TimeActivity, etc.) and 11 financial reports (Balance Sheet, Profit & Loss, Cash Flow, Trial Balance, General Ledger, etc.). The architecture follows a clean separation between handler modules (wrapping the node-quickbooks library with OAuth authentication) and tool definitions (Zod schemas registered with the MCP server). A singleton QuickbooksClient manages OAuth 2.0 token refresh and persistence, while environment feature flags (QUICKBOOKS_DISABLE_WRITE/UPDATE/DELETE) suppress tool categories. The codebase is heavily tested with Jest (100% coverage enforced in CI) and uses modern TypeScript (ESM). It handles QBO-specific quirks such as automated sales tax (AST), sparse vs full updates, and fallback patterns (e.g., delete via void/inactive). Despite its broad coverage, the implementation is highly repetitive (87 handlers, 90 tools) with liberal use of `any` types and hand-rolled ambient declarations for missing upstream typings. The project is actively maintained with recent commits and detailed design documentation, though version numbers and test counts show minor drift between README and CHANGELOG. Overall, this is a comprehensive, production-grade integration that prioritizes completeness and correctness over elegance.
This is a fully-featured OAuth2 and OpenID Connect authentication and authorization server built with Node.js/TypeScript and the Curveball framework. It provides user management, role-based access control, multi-factor authentication (TOTP, WebAuthn), and an administrative web UI. The project is self-contained with its own database migrations, CLI binary, and Docker support. It supports multiple database backends (PostgreSQL, MySQL, SQLite) via Knex. The codebase is well-structured following a modular architecture with clear separation between controllers, services, and format handlers. It implements the OAuth2 authorization framework including authorization code, client credentials, implicit, and refresh token grants with PKCE support. The OpenID Connect layer provides discovery, JWKS, and userinfo endpoints. Authentication is modular with pluggable challenge strategies for passwords, TOTP, email OTP, and WebAuthn. The project is retired, as explicitly stated in the README, and the authors recommend migrating to Keycloak. Despite being deprecated, the code remains a solid reference implementation for OAuth2/OIDC in Node.js and contains several reusable components including an abstract key-value store, an SMS adapter pattern, and cryptographic utilities.
The C++ REST SDK (cpprestsdk) is a cross-platform, asynchronous C++ library for building cloud-based client-server applications. It provides a comprehensive set of APIs for HTTP client and server communication, JSON parsing and serialization, URI manipulation, WebSocket client support, OAuth 1.0 and 2.0 authentication, and asynchronous stream I/O. The library is built on a custom task-based concurrency model (PPLX) that abstracts platform-specific threading and synchronization, enabling portable async operations across Windows, Linux, macOS, iOS, and Android. The architecture is modular: HTTP client and server implementations use a pipeline stage pattern for middleware (e.g., compression, authentication), and the stream buffer abstraction decouples data sources from I/O operations. The codebase includes extensive functional tests using a bundled UnitTest++ framework, along with sample applications demonstrating real-world usage (BlackJack game, OAuth flows, file search). However, the repository is officially archived and no longer maintained; it exhibits significant technical drift, including deprecated APIs, platform-specific conditional compilation, and dependencies on older library versions (Boost, OpenSSL). Despite this, many components—such as the PPLX task system, URI builder, JSON value, and stream buffers—are well-crafted and could be extracted for reuse in new projects with minimal adaptation.