{"id":19031046,"url":"https://github.com/hackclub/auth","last_synced_at":"2026-06-23T11:32:42.045Z","repository":{"id":312921390,"uuid":"1049245902","full_name":"hackclub/auth","owner":"hackclub","description":"a better basket to put all your eggs in","archived":false,"fork":false,"pushed_at":"2026-06-08T13:45:25.000Z","size":46926,"stargazers_count":76,"open_issues_count":62,"forks_count":50,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-06-08T15:27:34.709Z","etag":null,"topics":["idp","oauth2","oidc","saml","saml2"],"latest_commit_sha":null,"homepage":"https://auth.hackclub.com","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hackclub.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-09-02T17:38:18.000Z","updated_at":"2026-06-08T13:46:00.000Z","dependencies_parsed_at":"2025-09-02T21:21:11.834Z","dependency_job_id":"aa511be2-4b5b-4877-9c30-a0d21341cc99","html_url":"https://github.com/hackclub/auth","commit_stats":null,"previous_names":["hackclub/identity-vault","hackclub/account","hackclub/auth"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/hackclub/auth","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hackclub%2Fauth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hackclub%2Fauth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hackclub%2Fauth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hackclub%2Fauth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hackclub","download_url":"https://codeload.github.com/hackclub/auth/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hackclub%2Fauth/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34686727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-23T02:00:07.161Z","response_time":65,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["idp","oauth2","oidc","saml","saml2"],"created_at":"2024-11-08T21:21:14.453Z","updated_at":"2026-06-23T11:32:42.040Z","avatar_url":"https://github.com/hackclub.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Hack Club Auth\n\nThis is the Rails codebase powering https://auth.hackclub.com!\n\n## contributing\n\nask around in [#idv-dev](https://hackclub.slack.com/archives/C09D1E22CF5) or poke [nora](https://hackclub.slack.com/team/U06QK6AG3RD)!\n\navoid questions that can be answered by reading the source code, but otherwise i'd be happy to help you get up to speed :-D\n\nkindly `bin/lint` your code before you submit it!\n\n## local dev setup\n\n### prerequisites\n\nyou'll need:\n- ruby 3.4.4+ (i use [mise](https://mise.jdx.dev) to manage this)\n- node.js + yarn\n- postgres (see below)\n- imagemagick \u0026 libvips (image processing)\n- libxmlsec1 (SAML signing)\n\non macOS:\n\n```bash\nbrew install imagemagick libvips libxmlsec1 yarn\n```\n\n### database\n\neasiest way is docker. if you don't have it and you're on macOS, [orbstack](https://orbstack.dev) works well enough.\n\n```bash\ndocker compose -f docker-compose-dbonly.yml up -d\n```\n\nthis gives you a postgres instance at `postgresql://postgres@localhost:5432/identity_vault_development`.\n\nif you've got your own postgres running somewhere, that works too – just point at it.\n\n### environment\n\ncreate a `.env.development` file:\n\n```bash\nDATABASE_URL=postgresql://postgres@localhost:5432/identity_vault_development\n```\n\nthat's it for local dev – lockbox will use a deterministic dev key automatically. see [environment variables](#environment-variables) below for the full list.\n\n### install \u0026 setup\n\n```bash\nbundle install\nyarn install\nbin/rails db:prepare\nbin/rails db:seed\n```\n\nthe seeds create a dev account with 2FA already set up. it'll print out the TOTP secret – add that to your authenticator app.\n\n### running the thing\n\n```bash\nbin/dev\n```\n\nif you want hot reload on css \u0026 js, also run `bin/vite dev` in another terminal.\n\n### logging in to the backend\n\n1. go to http://localhost:3000/login\n2. enter `identity@hackclub.com`\n3. grab the verification code from http://localhost:3000/letter_opener\n4. enter your TOTP code (from the authenticator app you set up during seeding)\n5. head to http://localhost:3000/backend\n\nthe backend requires 2FA – that's why the seeds set up a TOTP for you.\n\n## environment variables\n\n### required\n\n| var | description |\n|-----|-------------|\n| `DATABASE_URL` | postgres connection string |\n\n### required in production\n\n| var | description |\n|-----|-------------|\n| `SECRET_KEY_BASE` | rails secret key – generate with `openssl rand -hex 64` |\n| `LOCKBOX_MASTER_KEY` | encryption key for lockbox fields – generate with `openssl rand -hex 32` |\n\n### active record encryption\n\nused for `encrypts` fields (like aadhaar data). generate these with `bin/rails db:encryption:init` or use random strings.\n\n| var | description |\n|-----|-------------|\n| `ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY` | primary encryption key |\n| `ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY` | deterministic encryption key |\n| `ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT` | key derivation salt |\n\n### slack integration\n\n| var | description |\n|-----|-------------|\n| `SLACK_BOT_TOKEN` | bot token (xoxb-*) |\n| `SLACK_TEAM_ID` | workspace ID (T*) |\n| `SLACK_SCIM_TOKEN` | SCIM API token for user provisioning |\n| `SLACK_CLIENT_ID` | OAuth client ID |\n| `SLACK_CLIENT_SECRET` | OAuth client secret |\n| `SLACK_SIGNING_SECRET` | webhook request verification |\n| `SLACK_ADULT_WEBHOOK_URL` | webhook for guardian notifications |\n\n### SAML\n\n| var | description |\n|-----|-------------|\n| `SAML_IDP_CERT_PATH` | path to SAML IdP certificate |\n| `SAML_IDP_KEY_PATH` | path to SAML IdP private key |\n\ngenerate a self-signed cert for local dev:\n\n```bash\nopenssl req -x509 -newkey rsa:2048 -keyout saml_key.pem -out saml_cert.pem -days 365 -nodes -subj \"/CN=localhost\"\n```\n\n### OIDC\n\n| var | description |\n|-----|-------------|\n| `OIDC_SIGNING_KEY` | RSA private key for JWT signing |\n\ngenerate an RSA key:\n\n```bash\nopenssl genrsa -out oidc_key.pem 2048\n```\n\nthen set `OIDC_SIGNING_KEY` to the contents of `oidc_key.pem` (the whole thing including the BEGIN/END lines).\n\n### email (production/staging/uat)\n\n| var | description |\n|-----|-------------|\n| `SES_SMTP_HOST` | SES SMTP endpoint |\n| `SES_SMTP_USERNAME` | SES SMTP username |\n| `SES_SMTP_PASSWORD` | SES SMTP password |\n\n### document storage (production)\n\n| var | description |\n|-----|-------------|\n| `CLOUDFLARE_R2_ENDPOINT` | R2 endpoint URL |\n| `CLOUDFLARE_R2_ACCESS_KEY_ID` | R2 access key |\n| `CLOUDFLARE_R2_SECRET_ACCESS_KEY` | R2 secret key |\n\n### other\n\n| var | description |\n|-----|-------------|\n| `SENTRY_DSN` | error tracking |\n| `GOOGLE_PLACES_API_KEY` | address autocomplete |\n| `ANALYTICS_DATABASE_URL` | separate analytics DB (optional) |\n| `DISABLE_ANALYTICS` | set to \"true\" to disable Ahoy |\n| `SOURCE_COMMIT` | git commit for version display |\n\n## security\n\nthis oughta go without saying, but if you find a security-relevant issue please either contact me directly or go through the security.hackclub.com flow –\nif you just open an issue or a PR there's a chance a bad actor sees it and exploits it before we can patch or merge.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhackclub%2Fauth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhackclub%2Fauth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhackclub%2Fauth/lists"}