Rodauth is a Ruby authentication framework designed as a Roda plugin, but also usable as middleware or a standalone library. It provides a comprehensive, modular authentication system covering login, logout, account creation, password management, multi-factor authentication (TOTP, WebAuthn, SMS, recovery codes), JWT/JSON API support, session management, and many security features like lockout, password complexity, and audit logging. The architecture is built around a declarative feature DSL where each feature is a self-contained module that can be enabled via `plugin :rodauth` and configured with hundreds of overridable methods. The core library defines a `Rodauth::Auth` class instantiated per request, with metaprogramming for hooks, routes, and value methods. The codebase is exceptionally well-crafted, with a clean separation of concerns, extensive use of inheritance and composition, and a strong emphasis on security (HMAC tokens, timing-safe comparisons, database functions for password hashing). It is actively maintained by the author Jeremy Evans with a long history of releases and security fixes.
Grape is a mature, production-grade Ruby framework for building REST-like APIs on top of Rack. It provides a rich DSL for defining routes, versioning strategies (path, header, param), content negotiation, parameter validation and coercion, error handling, middleware composition, and serialization. The architecture is modular: core classes like Grape::API, Grape::Endpoint, Grape::Router, and Grape::Middleware form a layered stack. Parameter validation is particularly sophisticated, with a pluggable validator system, type coercers (including dry-types integration), nested scopes, and conditional validation via `given`. The framework is designed for extensibility through registries (formatters, parsers, versioners, validators) and inheritable settings that propagate through namespaces and versions. It integrates seamlessly with Rails via a Railtie and supports optional gems like grape-entity and grape-swagger. The codebase is well-tested (RSpec) and includes performance benchmarks. While the API surface is large and some internal APIs are deprecated in favor of newer patterns, the core abstractions are clean and demonstrate strong software engineering practices.
Iodine is a high-performance concurrent web server for Ruby applications, built as a wrapper around the C-based facil.io framework. It provides native HTTP/WebSocket/Server-Sent Events support, Rack compliance for serving Ruby web applications, and a built-in Pub/Sub system with optional Redis scaling for horizontal distribution. The architecture follows a master-worker model using multiple processes and threads to handle thousands of concurrent connections, with critical networking components implemented in C for performance and Ruby bindings for developer productivity. Key features include static file serving with gzip and X-Sendfile support, a secure Mustache template engine with automatic HTML escaping, a fast JSON parser claiming 20-90% speed improvements over Ruby's standard library, and TLS support (though marked as having known issues for production use). The server integrates with Rack applications through a custom handler and provides upgrade hooks for WebSocket/SSE protocols via the Rack environment. Pub/Sub functionality uses an engine pattern allowing swap between internal cluster-based and external Redis backends. Entry points include the `exe/iodine` CLI executable and programmatic controls via `Iodine.listen`, `Iodine.start`, and `Iodine.stop`. Data flows involve HTTP requests parsed by the C-based HTTP processor, routed to Rack applications or static file handlers, with WebSocket connections upgraded via Rack's `env['rack.upgrade?']` mechanism. The Pub/Sub system operates independently for real-time messaging across processes or machines. External dependencies include the vendored facil.io C library, OpenSSL development headers for TLS support, and optionally the Redis gem for clustered Pub/Sub.