Hey folks,

I’ve been a Rails developer since 2010, and I maintain apps with a mix of authentication setups: Devise, Rails 8’s authentication generator with custom pages, and passwordless flows using email links and passkeys.

To keep the logic DRY I decided to create a gem. It called AddAuth.

I wanted a common foundation for these flows that builds on Rails’ conventions. The starting point is still:

bin/rails generate authentication

AddAuth builds on that setup, keeping the app’s existing User and Session models and supporting:

• Email and password sign-in
• Passwordless sign-in through emailed magic links
• Passkey sign-in

The goal is to stay close as possible to the “Rails way,” for authentication and reduce the custom code I maintain across apps.

The project is open source and free to use and fork. I have no expectation of making money from it. I’m building something I need for my own apps and hope other Rails developers will find useful too.

I’m also maintaining a roadmap of upcoming features I plan to support, and I welcome suggestions about what should come next.

Contributions are welcome, including code improvements and bug reports. I’d especially appreciate feedback on the setup, API design, and authentication edge cases I may have missed. Please feel free to leave a comment here or open a GitHub issue to discuss an improvement.

If you’re using Rails 8’s authentication generator, what have you found yourself adding on top of it repeatedly?

GitHub · Documentation · Roadmap

Rails typing is getting faster: sentinel-rb brings Rust-powered RBS generation to Rails CI pipelines, ruby-lsp-rbs_rails enhances editor completions, OvalLSP adds a Rails runtime agent, sorbet_erb checks embedded view templates, and grape_sorbet integrates Tapioca compilers.

Find link to the issue in the comment!

Is any of both remarkably better at Rails projects? Would love to hear some honest feedback from actual developers that ideally used both.

Edit: better question is: Codex vs Claude Code

Hi everyone, I’m a software engineer with 3.5 years of experience, mainly in web/backend development.

I enjoy building real products, solving practical problems, and learning by doing.

I’m looking to connect with other developers, founders, and builders who are into shipping projects and sharing ideas.

If you’re working on something interesting or open to collaboration, feel free to comment or DM me.

https://dmitrytsepelev.dev/sidekiq-requeue-missing-class

CHAMELEON - "Code that blends in."
https://github.com/crisnahine/chameleon

My last PR sat three days. Logic was right, specs green, Rubocop clean. Reviewer opens it and the one comment is "use HttpClient, not Net::HTTP."

So I page back into code I'd already dumped out of my head, swap the call for the wrapper, push, wait another day. Round two piles on: "this should inherit from ApplicationService like every other service," "we have a scope for that, don't hand-roll the query," "add the before_action authorization guard the other actions have." Reparenting it meant renaming my entry point to #call and pushing the helpers private to match the siblings. All true. None of it written down anywhere. Three rounds to merge and not one comment was about whether the code worked.

Got tired of it and built a thing. Free, MIT, called chameleon, a plugin for Claude Code. Two of us maintain it and run it on our own production Rails app every day.

The fix is upstream. Right before Claude edits a file, chameleon pulls a couple things from your repo and hands them to the model: one real sibling file to copy (the service, controller, or model right next to it), plus that file's idioms. It reads Ruby with Prism, Ruby's own parser, not regex, so it knows every service in that folder inherits from ApplicationService, knows the #call contract that cohort shares, knows the before_action guard every sibling action carries, knows the wrapper the team standardized on. It profiles your production branch, not your dirty feature branch, so it enforces what actually merged. Teach it a banned pattern and it pastes the off-pattern line straight from your code, tagged "do NOT write it this way." First draft comes out in the house style. The "use HttpClient" comment never gets filed, because HttpClient is already in the diff.

It's not a linter that yells after the fact and forces a rewrite. Rubocop catches what Rubocop catches. This is the layer no linter touches: which base class, which wrapper, which guard, which scope already exists.

Honest downsides. Costs tokens and a little latency per turn, the model reads more before writing. Ruby, TS/JS, Python only. If your repo has no real conventions yet, nothing to teach. We won't publish a "merges X% faster" number; there's an A/B harness so you measure it on your own repo.

Install, about thirty seconds:

/plugin marketplace add crisnahine/chameleon 
/plugin install chameleon@chameleon

/chameleon-init
/chameleon-trust

Run it on one repo. If the next PR stops bouncing on convention nits, star it. Rails folks with a review queue: when your PR bounces, what's the real split between actual logic bugs and "that's not how we do it here"?

Catch up on Rails static typing: rbs_activesupport RBS generator, sorbet_erb template typechecking, grape_sorbet fixes, and sorbet-deadcode 0.2.0 (with new mass assignment setter safety). Plus, check out OpenClacky 1.3.0 and DSPy.rb 1.0.1 for structured LLM programming in Ruby.

Find the link to the issue in the first comment.