Production-grade OAuth2.0/OIDC authorization server with full support for RFC 6749, RFC 7662, RFC 7009, and RFC 8414 — usable as a ready-to-run product (Docker/Helm) or as an embeddable C++ SDK (find_package(authforge-*)). Includes admin console, user-facing frontend, and a comprehensive test suite.
authforge/
├── apps/server/ # Authorization server backend (Drogon C++ framework)
├── libs/ # SDK library packages (authforge::common/oauth2/identity/storage-*/drogon)
├── frontends/admin/ # Admin console frontend (Vue 3 + TailwindCSS)
├── frontends/user/ # User-facing frontend (Vue 3 + Pinia + TailwindCSS)
├── examples/ # SDK consumer examples (find_package smoke hosts)
├── deploy/ # Docker Compose, Helm chart, nginx, observability
├── tests/ # Backend test suite (unit / integration / contract)
├── scripts/ # Build, test, and operations scripts
└── docs/ # Project documentation
The backend is split into 8 CMake packages with an enforced dependency direction (Domain layer never depends on Drogon; verified by tools/arch-guard in CI). Arrows read "depends on":
graph TD
server["authforge-server<br/>(apps/server)"] --> drogon
drogon["authforge::drogon<br/>plugin · controllers · filters · views"] --> oauth2
drogon --> identity
drogon --> memory
drogon --> redis
drogon --> postgres
memory["authforge::storage::memory"] --> oauth2
redis["authforge::storage::redis"] --> oauth2
postgres["authforge::storage::postgres<br/>(ORM models)"] --> identity
oauth2["authforge::oauth2<br/>OAuth2/OIDC engine"] --> common
identity["authforge::identity<br/>auth · MFA · WebAuthn · RBAC"] --> common
common["authforge::common<br/>shared kernel · ports"]
Optional feature areas are gated by Conan/CMake options (with_identity / with_social / with_webauthn) so SDK consumers can shrink the dependency surface.
| Layer | Technology |
|---|---|
| Backend Framework | Drogon (C++17) |
| Database | PostgreSQL 14+ |
| Cache | Redis 7+ |
| Admin Console | Vue 3 + Vite + Pinia + TailwindCSS |
| User Frontend | Vue 3 + Vite |
| Testing | CTest (C++) + Playwright (E2E) + PowerShell (API) |
| Monitoring | Prometheus + Audit Logging |
| Deployment | Docker Compose / Nginx |
| Feature | Standard | Endpoint |
|---|---|---|
| Authorization Code + PKCE | RFC 6749 / RFC 7636 | /oauth2/authorize, /oauth2/login, /oauth2/token |
| Client Credentials | RFC 6749 | /oauth2/token (grant_type=client_credentials) |
| Token Refresh | RFC 6749 | /oauth2/token (grant_type=refresh_token) |
| Token Introspection | RFC 7662 | /oauth2/introspect |
| Token Revocation | RFC 7009 | /oauth2/revoke |
| OIDC Discovery | RFC 8414 | /.well-known/openid-configuration |
| JWKS | RFC 7517 | /.well-known/jwks.json |
| UserInfo | OIDC Core | /oauth2/userinfo |
| User Consent | OAuth2 | /oauth2/consent |
| Device Authorization | RFC 8628 | /oauth2/device_authorization |
| Dynamic Client Registration | RFC 7591 | /oauth2/register |
| Feature | Endpoint |
|---|---|
| User Registration | POST /api/register |
| Password Reset | /api/password-reset/request, /api/password-reset/confirm |
| Email Verification | /api/verify-email, /api/verify-email/resend |
| MFA (TOTP) | /api/me/mfa/setup, /api/me/mfa/verify, /api/me/mfa/disable |
| WebAuthn (FIDO2) | /api/me/webauthn/register/*, /oauth2/webauthn/authenticate/* |
| Google Login | /api/google/login |
| WeChat Login | /api/wechat/login |
| Account Lockout | Progressive lockout (5/10/15/20 failed attempts) |
| Feature | Endpoint |
|---|---|
| Profile | GET /api/me |
| Change Password | PUT /api/me/password |
| Authorized Apps | GET/DELETE /api/me/authorized-apps |
| Account Deletion | DELETE /api/me |
| Module | Features |
|---|---|
| Dashboard | User count, app count, active tokens, failed login stats |
| App Management | Client CRUD, secret rotation, scope assignment, grant type config |
| User Management | User list/details, role assignment, disable/enable, lock status |
| Role Management | Role CRUD (protects built-in roles: admin/user) |
| Scope Management | Scope CRUD (protects built-in scopes: openid/profile/email/admin) |
| Token Management | Token listing, revocation by client/user, individual revocation |
| Organization Management | Multi-tenant organization CRUD |
| Audit Log | Paginated view, filter by event type/result |
| OIDC Keys | Signing key information |
| System Settings | Health monitoring |
- Role-based access control (admin / user / custom roles)
- URL pattern matching for permission checks (
/api/admin/.*requires admin role) - Triple-scope permission control (Client restriction + Role validation + Consent check)
- Prometheus metrics export (
/metrics) - Structured audit logging (login, token issuance/revocation, password changes, etc.)
- Health check endpoints (
/health,/health/live,/health/ready)
docker compose -f deploy/docker/docker-compose.yml up -d --build- User Frontend:
http://localhost:8080 - Admin Console:
http://localhost:8081 - Backend API:
http://localhost:5555
The canonical build is Conan 2 + CMake presets (identical to CI):
# 1. Resolve locked dependencies (writes toolchain into the preset's build dir)
conan install . --output-folder=build/linux-release --build=missing \
-s build_type=Release -s compiler.cppstd=17
# 2. Configure + build
# Presets: linux-release / windows-msvc / macos-arm64 (+ -debug / -asan / -tsan variants)
cmake --preset linux-release
cmake --build --preset linux-release
# 3. Run the backend test suite
ctest --test-dir build/linux-release --output-on-failuremanage.ps1 (Windows) and manage.sh (Linux/macOS) wrap the same flow as convenience commands, e.g. .\manage.ps1 build-backend.
To run the full stack locally (backend requires PostgreSQL + Redis):
# Backend
cd apps\server
..\..\build\windows-msvc\apps\server\Release\authforge-server.exe
# Admin console — http://localhost:5174/admin/
cd frontends\admin && npm install && npm run dev
# User frontend — http://localhost:5173
cd frontends\user && npm install && npm run devEmbed AuthForge into your own C++ host via find_package (SDK tarball from Releases, or cmake --install from source):
# Full stack: one package pulls the whole closure (engine + Drogon plugin/controllers)
find_package(authforge-drogon CONFIG REQUIRED)
target_link_libraries(my-host PRIVATE authforge::drogon)
# Or engine-only (no Drogon dependency):
find_package(authforge-oauth2 CONFIG REQUIRED)
find_package(authforge-storage-memory CONFIG REQUIRED)
target_link_libraries(my-engine PRIVATE authforge::oauth2 authforge::storage::memory)v1.x promises source-level SemVer for the public headers (
include/authforge/**), enforced by an api-diff gate in CI — no binary ABI guarantee. Resolve third-party dependencies with the repository'sconanfile.py+conan.lock. Details: SDK Integration Guide · SDK Runtime Contract; reference consumers:examples/full-stack-host,examples/third-party-host(both CI-verified).
| Username | Password | Role |
|---|---|---|
| admin | admin | admin |
| Target | Entry point | Notes |
|---|---|---|
| Docker Compose (dev) | deploy/docker/docker-compose.yml |
Full stack + PostgreSQL + Redis, single command |
| Docker Compose (prod) | deploy/docker/docker-compose.prod.yml |
TLS/nginx, env-file driven secrets |
| Kubernetes (Helm) | deploy/helm/authforge |
Chart with values-driven config; schema migration runs as a Helm hook Job |
helm install authforge deploy/helm/authforge -f my-values.yamlFull walkthroughs: Production Deployment Guide · Windows / Docker Desktop · Security Checklist
Releases are cut from SemVer tags (vX.Y.Z) by release.yml:
- SDK package —
authforge-sdk-<ver>-linux-x86_64.tar.gz(8 static libs + headers + CMake package configs) with.sha256checksum, attached to the GitHub Release. - Container images — multi-arch (amd64 + arm64) on GHCR:
ghcr.io/lucaswang420/authforge-{backend,frontend,admin}:<ver>. - Signatures — image manifests are signed by digest with cosign (keyless, GitHub OIDC).
- SBOMs — SPDX JSON for each image and the source tree (syft), attached to the Release.
Verify before deploying:
# Image signature
cosign verify ghcr.io/lucaswang420/authforge-backend:<version> \
--certificate-identity-regexp 'github.com/lucaswang420/.+/.github/workflows/release.yml' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# SDK tarball integrity
sha256sum -c authforge-sdk-<version>-linux-x86_64.tar.gz.sha256# Admin API full tests
.\scripts\backend\test-admin-endpoints.ps1
# OAuth2 core flow tests
.\scripts\backend\test-oauth2-endpoints.ps1cd frontends\admin
npx playwright test # Full run
npx playwright test --ui # UI mode for debugging
npx playwright test --headed # Headed browser modecd build\windows-msvc
ctest --output-on-failure| Test Type | Scope |
|---|---|
| C++ Unit/Integration Tests (CTest) | SDK libraries, domain services, storage adapters |
| Admin API (PowerShell) | All Admin endpoints + Organization |
| OAuth2 Core (PowerShell) | Auth flows, token management, user services |
| Frontend E2E (Playwright) | Admin console and user frontend pages/interactions |
- OpenAPI Spec: openapi.yaml
- Swagger UI:
http://localhost:5555/docs/api(requires Swagger UI static files) - E2E Testing Guide: E2E_TESTING_GUIDE.md
Evaluating — Architecture Overview · Security Architecture · RBAC Guide
Integrating (SDK) — SDK Integration Guide · SDK Runtime Contract · API Reference
Operating — Production Deployment · Configuration Guide · Observability · Account Lockout
Contributing — CONTRIBUTING.md · Testing Guide · CI/CD Pipeline
Full index: docs/README.md
| Component | Minimum Version |
|---|---|
| C++ Compiler | C++17 (MSVC 2019+ / GCC 9+ / Clang 10+) |
| CMake | 3.21+ |
| PostgreSQL | 14+ |
| Redis | 7+ |
| Node.js | 18+ |
| Docker | 24+ (optional) |
- Contributions welcome — see CONTRIBUTING.md for build, test, and commit conventions.
- To report a vulnerability, follow SECURITY.md — please do not open a public issue.
MIT License — see LICENSE
Project Status: Production Ready | Version: v1.0.0