Authorizer is a self-hosted, production-grade authentication and authorization server written in Go. It implements OAuth 2.0 / OIDC, SAML IdP/SP, SCIM 2.0, WebAuthn/passkeys, TOTP, email/SMS OTP, and fine-grained authorization via an embedded OpenFGA engine. The architecture is transport-agnostic: a shared service layer (internal/service) is called by GraphQL resolvers, gRPC handlers, and HTTP handlers (Gin). It supports multiple storage backends (SQL, MongoDB, Cassandra, DynamoDB, Couchbase, ArangoDB) via a unified storage.Provider interface, plus Redis and in-memory stores for sessions and caching. The system includes a React admin dashboard, an end-user login SPA, and an MCP (Model Context Protocol) server for AI tool exposure. Security is a primary focus, with extensive regression tests for CVEs, SSRF protection, constant-time comparisons, and audit logging.
Athenz is an open-source, fine-grained authorization and identity management platform designed for zero-trust environments. It provides centralized (ZMS) and decentralized (ZTS) services for issuing short-lived X.509 certificates, managing role-based access control (RBAC), and enforcing policies across multi-cloud and on-premise infrastructures. The system supports AWS, GCP, Azure, and Kubernetes workloads through pluggable attestation validators and credential providers, enabling service-to-service authentication and authorization without shared secrets. Architecturally, Athenz comprises three core servers: ZMS (management service for domains, roles, policies), ZTS (token service for certificates, OAuth2 tokens, SSH certs), and MSD (micro-segmentation for network policy management). A React/Next.js UI provides administrative management, while client libraries in Java, Go, and Node.js enable integration. The codebase is organized into modular Maven submodules with RDL-generated data models, extensive unit/integration tests, and Docker/Kubernetes deployment artifacts. Key patterns include factory-based dependency injection (e.g., cert signers, private key stores, notification services), dynamic configuration reloading, and composite validators for cloud attestation. This is a production-grade application with clean abstractions, well-defined interfaces, and significant test coverage. While the codebase contains some generated boilerplate and cloud-specific implementations that may drift, the core libraries and utility classes are reusable and demonstrate strong engineering practices.
laravel-governor is a Laravel package that provides role-based access control (RBAC) with team and ownership support. It integrates with Laravel's native authorization system via policies and gates, offering granular permission management through an admin interface built with Blade templates and Alpine.js. The package includes Eloquent models for roles, permissions, actions, ownership, entities, groups, teams, and assignments, along with migrations, seeders, Artisan commands for setup and publishing, and traits (Governing and Governable) to add authorization capabilities to User and other models. It features a caching layer with automatic invalidation via observers to optimize permission checks, and uses middleware to dynamically register custom policy methods via reflection. The architecture follows Laravel conventions with service providers for booting, controllers for handling requests, and policies for authorization logic.
This repository implements a self-hostable data integration platform for building, deploying, and managing ETL/ELT pipelines. The system features a polyglot microservices architecture: a React frontend (app-ux) for workflow visualization and configuration, two Spring Boot backend services (mgmt-svc for management APIs and ingestion-svc for event intake), and a Node.js processor for executing pipeline transformations. Core functionality includes defining sources, transformations, and destinations; scheduling pipelines via cron; monitoring execution metrics; role-based access control with SSO support; and a plugin architecture for community-contributed apps. Data flows involve ingestion services writing events to PostgreSQL queues, the processor executing transformation steps in sandboxed VMs, and delivering results to destinations. The platform emphasizes secure handling of sensitive data via encryption utilities and provides extensibility through dynamic script execution.