$ show jeremyevans/rodauth
Rodauth is a Ruby authentication framework designed as a Roda plugin, but also usable as middleware or a standalone library. It provides a comprehensive, modular authentication system covering login, logout, account creation, password management, multi-factor authentication (TOTP, WebAuthn, SMS, recovery codes), JWT/JSON API support, session management, and many security features like lockout, password complexity, and audit logging. The architecture is built around a declarative feature DSL where each feature is a self-contained module that can be enabled via `plugin :rodauth` and configured with hundreds of overridable methods. The core library defines a `Rodauth::Auth` class instantiated per request, with metaprogramming for hooks, routes, and value methods. The codebase is exceptionally well-crafted, with a clean separation of concerns, extensive use of inheritance and composition, and a strong emphasis on security (HMAC tokens, timing-safe comparisons, database functions for password hashing). It is actively maintained by the author Jeremy Evans with a long history of releases and security fixes.
The LLM identified 2 files worth highlighting for reuse:
Generates database authentication functions (rodauth_get_salt, rodauth_valid_password_hash) for PostgreSQL, MySQL, and MSSQL. This is a standalone, reusable component that can be extracted to provide secure password hash validation at the database level for any Ruby project using Sequel. It handles bcrypt and argon2 algorithm selection, minimal privilege grants, and supports multiple database types in a single method call.
Implements a pattern for making internal HTTP requests to Rodauth routes without actual HTTP, enabling programmatic access to authentication actions (create account, change password, etc.) from within the same application. The pattern defines a reusable `internal_request_method` that can be used to build admin interfaces or testing utilities. It is extracted from the Rodauth framework but demonstrates a general technique for calling rack endpoints internally.