Skip to content

Refresh the UI, remove OAuth social login, and simplify configuration #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bartes merged 2 commits into from
Jun 5, 2026
Merged

Refresh the UI, remove OAuth social login, and simplify configuration #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d028b43
Refresh the UI, remove OAuth social login, and simplify configuration
bartes Jun 5, 2026
58a6d10
Remove leftover OAuth schema, migration and comment
bartes Jun 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 0 additions & 7 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,3 @@ CASTLE_API_SECRET=

# Publishable key, used by the browser SDK to mint request tokens.
CASTLE_PK=

# Optional: Twitter/X OAuth credentials for the social login demo.
TWITTER_APP_ID=
TWITTER_SECRET=

# Required in production only (generate with `bin/rails secret`).
# SECRET_KEY_BASE=
2 changes: 0 additions & 2 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,6 @@ gem 'castle-rb', '~> 8.1'
gem 'devise', '~> 5.0'
gem 'dotenv-rails'
gem 'hamlit-rails'
gem 'omniauth-rails_csrf_protection'
gem 'omniauth-twitter'
gem 'puma', '~> 6.4'
gem 'rails', '~> 8.1.3'
gem 'responders'
Expand Down
41 changes: 0 additions & 41 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,8 +75,6 @@ GEM
securerandom (>= 0.3)
tzinfo (~> 2.0, >= 2.0.5)
uri (>= 0.13.1)
auth-sanitizer (0.1.4)
version_gem (~> 1.1, >= 1.1.9)
base64 (0.3.0)
bcrypt (3.1.22)
bigdecimal (4.1.2)
Expand All @@ -87,7 +85,6 @@ GEM
byebug (13.0.0)
reline (>= 0.6.0)
castle-rb (8.1.0)
cgi (0.5.1)
concurrent-ruby (1.3.6)
connection_pool (3.0.2)
crass (1.0.6)
Expand Down Expand Up @@ -125,8 +122,6 @@ GEM
activesupport (>= 4.0.1)
hamlit (>= 1.2.0)
railties (>= 4.0.1)
hashie (5.1.0)
logger
i18n (1.14.8)
concurrent-ruby (~> 1.0)
io-console (0.8.2)
Expand Down Expand Up @@ -172,32 +167,6 @@ GEM
racc (~> 1.4)
nokogiri (1.19.3-x86_64-linux-gnu)
racc (~> 1.4)
oauth (1.1.5)
auth-sanitizer (~> 0.1, >= 0.1.3)
base64 (~> 0.1)
cgi
oauth-tty (~> 1.0, >= 1.0.8)
snaky_hash (~> 2.0, >= 2.0.4)
version_gem (~> 1.1, >= 1.1.9)
oauth-tty (1.0.8)
auth-sanitizer (~> 0.1, >= 0.1.3)
cgi
version_gem (~> 1.1, >= 1.1.9)
omniauth (2.1.4)
hashie (>= 3.4.6)
logger
rack (>= 2.2.3)
rack-protection
omniauth-oauth (1.2.1)
oauth
omniauth (>= 1.0, < 3)
rack (>= 1.6.2, < 4)
omniauth-rails_csrf_protection (2.0.1)
actionpack (>= 4.2)
omniauth (~> 2.0)
omniauth-twitter (1.4.0)
omniauth-oauth (~> 1.1)
rack
orm_adapter (0.5.0)
pp (0.6.3)
prettyprint
Expand All @@ -210,10 +179,6 @@ GEM
nio4r (~> 2.0)
racc (1.8.1)
rack (3.2.6)
rack-protection (4.2.1)
base64 (>= 0.1.0)
logger (>= 1.6.0)
rack (>= 3.0.0, < 4)
rack-session (2.1.2)
base64 (>= 0.1.0)
rack (>= 3.0.0)
Expand Down Expand Up @@ -292,9 +257,6 @@ GEM
simplecov_json_formatter (~> 0.1)
simplecov-html (0.13.2)
simplecov_json_formatter (0.1.4)
snaky_hash (2.0.4)
hashie (>= 0.1.0, < 6)
version_gem (>= 1.1.8, < 3)
sprockets (4.2.2)
concurrent-ruby (~> 1.0)
logger
Expand Down Expand Up @@ -325,7 +287,6 @@ GEM
concurrent-ruby (~> 1.0)
uri (1.1.1)
useragent (0.16.11)
version_gem (1.1.10)
warden (1.2.9)
rack (>= 2.0.9)
web-console (4.2.1)
Expand Down Expand Up @@ -354,8 +315,6 @@ DEPENDENCIES
factory_bot_rails
faker
hamlit-rails
omniauth-rails_csrf_protection
omniauth-twitter
puma (~> 6.4)
rails (~> 8.1.3)
rails-controller-testing
Expand Down
57 changes: 10 additions & 47 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@ SDK (8.x).
- **logout, profile updates & custom events** – recorded with the non-blocking
`log` endpoint. The custom event is available from the profile page, once
signed in.
- **Twitter/X OAuth login** – the same risk assessment applied to social sign-in.
- **webhooks** – incoming Castle webhooks are signature-verified with
`Castle::Webhooks::Verify` and listed in the app.
- **browser SDK** – the `@castleio/castle-js` SDK mints a request token in the
Expand All @@ -31,17 +30,19 @@ SDK (8.x).
## Prerequisites

You'll need a Castle account. If you don't have one, start a free trial at
https://castle.io. From the dashboard (Settings → API) you'll need:
https://castle.io. For local development, use a **sandbox** environment so demo
traffic from `localhost` stays separate from production data — from the Castle
dashboard (Settings → API) grab the sandbox keys:

- your **publishable key** (`pk`) – used by the browser SDK
- your **API secret** – used by the backend SDK
- your **publishable key** (`CASTLE_PK`) – used by the browser SDK
- your **API secret** (`CASTLE_API_SECRET`) – used by the backend SDK

These are the only two values you need to configure.

## Running locally

This app targets **Ruby 3.4** (see `.ruby-version`).

Clone the repo and install dependencies:

```bash
git clone https://github.com/castle/castle-ruby-example.git
cd castle-ruby-example
Expand All @@ -66,38 +67,6 @@ bin/rails server
`bin/setup` runs the dependency install, file copying and database setup in one
step.

## Styling (Tailwind CSS)

The UI is styled with [Tailwind CSS](https://tailwindcss.com) via the
[`tailwindcss-rails`](https://github.com/rails/tailwindcss-rails) gem (no Node
toolchain required). The source is `app/assets/stylesheets/application.tailwind.css`
with design tokens in `config/tailwind.config.js`; it compiles to
`app/assets/builds/tailwind.css`, which is committed so `bin/rails server` works
without a build step.

If you change the views or the Tailwind source, regenerate the stylesheet:

```bash
bin/rails tailwindcss:build # one-off build
bin/rails tailwindcss:watch # rebuild on change during development
```

`assets:precompile` (used by the Docker build) runs `tailwindcss:build`
automatically.

## Configuration

All configuration is read from environment variables (loaded from `.env` in
development and test via `dotenv-rails`):

| Variable | Purpose |
| -------------------- | ---------------------------------------------------- |
| `CASTLE_API_SECRET` | Server-side API secret used by the `castle-rb` SDK. |
| `CASTLE_PK` | Publishable key used by the browser SDK. |
| `TWITTER_APP_ID` | Optional – enables the Twitter/X OAuth login button. |
| `TWITTER_SECRET` | Optional – Twitter/X OAuth secret. |
| `SECRET_KEY_BASE` | Required in production only. |

## Running the tests

```bash
Expand All @@ -110,24 +79,18 @@ The bundled `Dockerfile` is a multi-stage build that compiles assets and runs
the app with Puma as an unprivileged user on port 3000. The SQLite database is
created on first boot.

Build the image:

```bash
docker build -t castle-demo-ruby .
```

Run a container, passing your Castle credentials:

```bash
docker run -d -p 4006:3000 \
-e CASTLE_API_SECRET=YOUR_API_SECRET \
-e CASTLE_PK=YOUR_PUBLISHABLE_KEY \
castle-demo-ruby
```

The app will be available at http://127.0.0.1:4006. A `SECRET_KEY_BASE` is
generated automatically if you don't supply one (set it explicitly to keep
sessions across restarts).
The app will be available at http://127.0.0.1:4006. Point it at a Castle sandbox
environment when running locally. A `SECRET_KEY_BASE` is generated automatically
if you don't supply one (set it explicitly to keep sessions across restarts).

## Disclaimer

Expand Down
Loading