Cerbos is a self-hosted, open-source authorization engine (Policy Decision Point) that evaluates access control policies defined in YAML using Common Expression Language (CEL) conditions. It exposes gRPC and HTTP APIs for operations like CheckResources and PlanResources, and supports multiple storage backends (disk, git, cloud blob, SQL databases, and Cerbos Hub). The server is built as a single Go binary with pluggable audit logging (local BadgerDB, Kafka, Hub), OpenTelemetry observability, and a comprehensive CLI admin tool (cerbosctl). Its architecture is modular: policies are compiled into efficient rule tables with bitmap indexing for low-latency evaluation, and the engine supports partial evaluation for resource planning queries. The codebase demonstrates high craftsmanship with clean abstractions, extensive test coverage, and well-designed reusable components such as a custom CEL extension library, a bitmap index for set operations, and a subscription-based event manager for storage changes. It is actively maintained with frequent releases and a growing ecosystem of integrations.
Authorizer is a self-hosted authentication and authorization server written in Go with a React/TypeScript dashboard. It implements OAuth 2.0, OpenID Connect, SAML 2.0 (IdP and SP), SCIM 2.0 provisioning, WebAuthn/passkeys, TOTP/SMS/email OTP MFA, social login (10+ providers), and fine-grained authorization via an embedded OpenFGA engine. The architecture is multi-transport: GraphQL, gRPC, REST (via grpc-gateway), and MCP (Model Context Protocol). Business logic resides in a transport-agnostic service layer (`internal/service/`) with thin adapters for each protocol. Storage is abstracted behind a common interface with implementations for SQL (Postgres, MySQL, SQLite, etc.), MongoDB, Cassandra/ScyllaDB, DynamoDB, Couchbase, and ArangoDB. The system supports multi-tenancy with organizations, domains, and per-org SSO/SCIM configuration. Security is a primary concern: SSRF-safe HTTP clients, constant-time comparisons, audit logging, rate limiting, admin lockout, and extensive regression testing for CVEs. The codebase demonstrates high craftsmanship with clean separation of concerns, extensive test coverage (unit, integration, e2e with Playwright and SDK tests), and reusable patterns like the storage provider interface, memory store abstraction, and transport-agnostic service layer with side effects. However, support for six database backends introduces code duplication and maintenance overhead, with documented TOCTOU races and partial-update footguns. Some deprecated code remains in the tree. Overall, it is a production-grade auth server suitable for self-hosting with a strong security posture.