Reference · framework 0.7.3

Parts: tested kernel code, one command each.

Mail, a job queue, sign-in, realtime and the dev tools, built and tested on SQLite and Postgres, each with a threat model whose every row cites a test. Add one when the product needs it; its dependencies come first, and once added the code is yours.

Listed from the framework's own .offrails/template/parts/. See also snippets (smaller recipes) and choosing parts.

  • auth-core

    Accounts and sessions every auth sample shares: users, database sessions with rotation and revocation, an account security page (devices, activity), re-auth for sensitive actions, email change, security emails with a 'this wasn't me' link, an audit trail and progressive throttling

    What it gives you

    • Database sessions
    • An account security page
    • Re-authentication ("sudo mode")
    • Email change
    • Security emails
    • An audit trail
    • and 3 more
    cargo offrails add auth-core

    The README of auth-core

  • auth-password

    Email + password: argon2id (OWASP parameters, rehash on sign-in), sign-up with email verification, sign-in with progressive per-account delays, reset by single-use link, change password, a bundled common-password check and a live strength meter that works without JS

    What it gives you

    • argon2id with OWASP's parameters
    • Sign-up that never reveals existing accounts
    • Pre-hijacking defense
    • Sign-in with no enumeration
    • Progressive delays per account
    • Reset by single-use, hashed, 30-minute links
    • and 4 more
    Requires
    auth-core
    cargo offrails add auth-password

    The README of auth-password

  • auth-totp

    Two-factor authentication (TOTP, RFC 6238): enrol with a server-side QR code or setup key, confirm before enable, a code step after any sign-in method, replay protection, 10 hashed recovery codes, 'trust this device for 30 days', re-auth with a code, secrets encrypted at rest

    What it gives you

    • Enrolment with a QR code generated on the server
    • A pending sign-in step
    • Replay protection
    • 10 recovery codes
    • "Don't ask again on this device for 30 days"
    • Step-up
    • and 2 more
    Requires
    auth-core
    cargo offrails add auth-totp

    The README of auth-totp

  • dev-dashboard

    /dev/dashboard, an in-process LiveDashboard: live charts (memory, CPU, req/s, p50/p95/p99, errors, DB pool, Tokio), requests per route, traces as waterfalls, SQL fingerprints with N+1 and EXPLAIN, a live log tail, insights, a routes explorer, an interactive schema diagram (ERD) with a migrations timeline and drift checks, an optional bring-your-own-key AI assistant, test runs and CI, a load lab, Upstreams (the APIs the app calls through its outbound wrapper, with a dependency map), Security (attack and abuse detectors with an attack simulator) and Frontend (rage and dead clicks, JS errors and Web Vitals from a browser beacon). Development only; a read-only subset for admins in production.

    What it gives you

    • AI command center
    • Overview
    • Charts
    • Requests
    • Traces, an explorer on one screen
    • The waterfall
    • and 22 more
    Requires
    nothing
    cargo offrails add dev-dashboard

    The README of dev-dashboard

  • dev-mailbox

    A live local inbox at /dev/mailbox: HTML/text/raw/headers, width and dark previews, codes and links with copy, attachments, search, checks, previews, JSON and a CLI. Development only.

    What it gives you

    • Live inbox
    • Message view
    • Desktop, 600 px, 320 px and Dark
    • Codes and links
    • Checks
    • Attachments
    • and 6 more
    Requires
    mailer
    Needed by
    auth-core
    cargo offrails add dev-mailbox

    The README of dev-mailbox

  • jobs

    A DB-backed job queue (Oban-style): SKIP LOCKED / single-writer claims, typed args, retries with exponential backoff and jitter, unique jobs, priorities, scheduled and cron jobs, rate-limited queues, batches, timeouts, orphan rescue, graceful shutdown, pruning, an inline worker and an app jobs CLI

    What it gives you

    • Typed jobs
    • Correct claiming on both backends
    • Retries
    • Outcomes
    • Scheduling
    • Queues
    • and 5 more
    Requires
    nothing
    cargo offrails add jobs

    The README of jobs

  • jobs-dashboard

    /admin/jobs: live overview (state counters, throughput and queue-wait charts, now-running lane with progress, queues with pause/resume, worker success rates, nodes), job list with filters, search and bulk actions, job detail with timeline and errors per attempt, error groups, cron with run-now; admin-only, CSRF-protected, light and dark, keyboard and mobile friendly

    What it gives you

    • Overview
    • Jobs
    • Job
    • Errors
    • Cron
    • Pause all
    • and 3 more
    Requires
    jobs
    cargo offrails add jobs-dashboard

    The README of jobs-dashboard

  • mailer

    Mailer: templated HTML + text email, delivery adapters (SMTP, dev mailbox storage, log, memory), previews, a test email task

    Requires
    nothing
    cargo offrails add mailer

    The README of mailer

  • realtime

    Channels over WebSocket (offrails.v1) with SSE and long-poll fallbacks: typed rooms, topic authorization on every join and push, presence across tabs and nodes, resume after reconnect, signed socket tokens, revocation, per-user caps, tuned buffers, a live room demo and /dev/sockets

    What it gives you

    • Protocol
    • Transports
    • Who's connecting
    • Authorization
    • Revocation
    • Limits
    • and 4 more
    Requires
    nothing
    cargo offrails add realtime

    The README of realtime

This page is also plain Markdown. Agents: the MCP server's list_parts and read_part.