$ show authorizerdev/authorizer
Authorizer is a self-hosted, production-grade authentication and authorization server written in Go. It implements OAuth 2.0 / OIDC, SAML IdP/SP, SCIM 2.0, WebAuthn/passkeys, TOTP, email/SMS OTP, and fine-grained authorization via an embedded OpenFGA engine. The architecture is transport-agnostic: a shared service layer (internal/service) is called by GraphQL resolvers, gRPC handlers, and HTTP handlers (Gin). It supports multiple storage backends (SQL, MongoDB, Cassandra, DynamoDB, Couchbase, ArangoDB) via a unified storage.Provider interface, plus Redis and in-memory stores for sessions and caching. The system includes a React admin dashboard, an end-user login SPA, and an MCP (Model Context Protocol) server for AI tool exposure. Security is a primary focus, with extensive regression tests for CVEs, SSRF protection, constant-time comparisons, and audit logging.
The LLM identified 6 files worth highlighting for reuse:
Provides HMAC-based OTP hashing and verification with constant-time comparison. Used for email/SMS OTP storage and validation. Reusable in any Go project needing secure OTP handling.
Implements an SSRF-hardened HTTP client with IP pinning, DNS rebinding prevention, and private network blocking. Two variants: one for general use (blocks private IPs) and one for trusted callers (allows private IPs). Easily extractable for any Go service that makes outbound HTTP requests.
A template directory containing skeleton implementations for all storage provider methods (CRUD for users, sessions, webhooks, etc.). Each file documents the expected contract and invariants. This pattern enables rapid addition of new database backends with consistent behavior.
Provides a tracked goroutine manager that recovers panics, logs errors, and supports graceful draining on shutdown. Used for background email/webhook delivery. Reusable in any Go server needing safe background task execution.
Encodes and decodes OAuth authorization state as opaque, server-side handles with positional delimiter escaping. Prevents injection attacks that were possible with legacy caller-supplied values. Demonstrates a secure state management pattern for OAuth flows.
Provides generic pointer helper functions (e.g., Ref, Deref) for optional fields in Go structs. Used extensively in the codebase to handle nullable values cleanly. A small, zero-dependency utility package that can be reused in any Go project.