$ show netlify/gotrue
GoTrue is a self-contained user registration and authentication API written in Go. It provides endpoints for signup, login (via email/password or OAuth2 providers like GitHub, GitLab, Google, Bitbucket, Facebook), token refresh, password recovery, email verification, and user management (CRUD for admin users). The architecture is a monolithic HTTP API using the chi router, backed by a MySQL database (via pop/v5 ORM) and a configurable mailer (SMTP or noop). It supports both single-tenant and multi-tenant deployments, with JWT-based authentication (HS256) and optional SAML SSO. The codebase is well-organized into packages: api for HTTP handlers, models for database entities, conf for configuration, mailer for email sending, and crypto for security utilities. It includes extensive unit tests and integration tests using a MySQL test database.
The LLM identified 4 files worth highlighting for reuse:
Provides SecureToken() for generating cryptographically random tokens and SecureCompare() for comparing strings in constant time (with SHA-256 hashing to mask length). This is a self-contained utility that can be extracted and reused in any Go project requiring secure token generation or timing-safe comparisons.
Defines Provider and OAuthProvider interfaces for external identity providers, along with a UserProvidedData struct and helper functions like makeRequest and chooseHost. The concrete implementations (github, gitlab, google, etc.) all adhere to this interface, making it easy to add new providers. The abstraction is clean and could be reused in other Go projects needing OAuth2 integration.
Defines a Mailer interface with methods for sending invite, confirmation, recovery, and email change emails, plus a general Send method. The TemplateMailer implementation uses the mailme library and HTML templates with default content. The interface is minimal and could be extracted to support different mail backends (e.g., SendGrid, SES) in other projects.
Defines specific error types (UserNotFoundError, RefreshTokenNotFoundError, InstanceNotFoundError) and an IsNotFoundError helper function. These are simple, self-contained domain errors that follow Go conventions and can be reused in any project needing typed not-found errors.