$ show teamhanko/hanko
Hanko is a production-grade, self-hostable authentication and identity platform written primarily in Go. The backend exposes public, admin, and management HTTP APIs plus a CLI for migrations, user import/export, JWK/JWT management, and config schema generation. Authentication is implemented as a custom state-machine engine (flowpilot) driving login, registration, password/passkey/MFA/third-party OAuth/SAML flows, backed by JWT sessions, device trust, webhooks, audit logs, and rate limiting. The persistence layer uses gobuffalo/pop with a broad set of per-entity persister interfaces and roughly 65 Fizz migrations covering users, emails, credentials, sessions, tenants, organizations, roles, SAML providers, and webhooks. The frontend is split into a TypeScript SDK (`@teamhanko/hanko-frontend-sdk`) and Preact-based web components (`@teamhanko/hanko-elements`) that render flow states into embeddable `<hanko-auth>` and `<hanko-profile>` elements. The repository also contains a quickstart Go server, framework examples for React, Vue, Angular, Next.js, and Express, Playwright e2e tests, Docker Compose stacks, and Kubernetes manifests. Data flows through Echo routers into flowpilot actions/hooks, which validate inputs, persist state, issue sessions, and trigger webhook events; PostgreSQL, Redis, SMTP, and external OAuth/SAML providers are the primary external dependencies. Overall the codebase is well-structured and heavily tested, with sophisticated security handling around redirect validation, account linking, multi-tenant isolation, and webhook signing. The main friction points are the custom flowpilot framework's learning curve, a very large configuration surface, duplicated example code, and some stale example/e2e toolchains relative to the core Go and Node versions.
The LLM identified 5 files worth highlighting for reuse:
Implements a self-contained state-machine stash with history, revert, and gzip+base64 compression. It enables resumable multi-step HTTP flows by persisting state between requests and could be extracted into any stateful workflow engine.
An adversarial redirect-URL validator that guards against open-redirect and host-collision attacks, with glob semantics, port/scheme enforcement, and custom mobile scheme support. It is isolated enough to reuse in any OAuth/SAML service that must validate callback URLs safely.
A generic, configurable rate limiter with in-memory and Redis backends, used to protect passcode and token endpoints. The backend abstraction is minimal and framework-agnostic, making it a good candidate for extraction as a standalone Go library.
A small AEAD helper for AES-GCM encryption and decryption with additional authenticated data, with no framework coupling. It demonstrates safe nonce handling and can be dropped into any Go service needing symmetric encryption.
Provides the fluent builder API for composing flows from states, actions, hooks, and sub-flows. The pattern cleanly separates flow definition from execution and is reusable in other state-driven backend services beyond authentication.