The latest articles on DEV Community by Pavan babu (@pavan_babu_bb4d4d06c72e6b). https://dev.to/pavan_babu_bb4d4d06c72e6b https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3836093%2Fd6521bae-5cf3-40c3-834e-850b3b95e0a4.png https://dev.to/pavan_babu_bb4d4d06c72e6b en Pavan babu Fri, 20 Mar 2026 20:44:57 +0000 https://dev.to/pavan_babu_bb4d4d06c72e6b/how-i-built-rails-81-auth-hipaa-fintech-lti-13-compliance-into-one-source-kit-2g4b https://dev.to/pavan_babu_bb4d4d06c72e6b/how-i-built-rails-81-auth-hipaa-fintech-lti-13-compliance-into-one-source-kit-2g4b <p>Every Rails project I worked on started the same way — two weeks rebuilding authentication, then another 4-6 weeks on compliance infrastructure (HIPAA audit logs, Fintech ledgers, LTI 1.3 for edtech clients).</p> <p>So I packaged it all into a single source kit: <strong>RailsAuthSaaS</strong>.</p> <h2> What's included </h2> <h3> Core Auth (every pack) </h3> <ul> <li>Email/password, magic links, email verification</li> <li>2FA: TOTP + backup codes + QR code setup</li> <li>OAuth: Google + GitHub (OmniAuth 2, CSRF-safe)</li> <li>SAML 2.0 enterprise SSO with admin UI</li> <li>Multi-tenancy, RBAC, remember me, rate limiting</li> <li>Stripe billing, 14-day trial, seat management</li> </ul> <h3> HIPAA Module </h3> <ul> <li>Full audit log with date-range filtering</li> <li>PHI access logging with mandatory justification field</li> <li>CSV + JSON export for auditor evidence</li> <li>Session timeout Rack middleware</li> <li>BAA, DPA, security disclosure pages + <code>/.well-known/security.txt</code> </li> </ul> <h3> Fintech Module </h3> <ul> <li>Immutable double-entry ledger (DB check constraint: balance &gt;= 0)</li> <li>Transaction approval / rejection / reversal / chargeback workflow</li> <li>KYC/AML hooks, PCI/SOC2 helpers</li> </ul> <h3> LTI 1.3 Module </h3> <ul> <li>Full OIDC login flow with nonce replay protection</li> <li>Deep linking (signed JWT), Grade Services (AGS), Names &amp; Roles (NRPS)</li> <li>Tested with Canvas, Moodle, Blackboard</li> </ul> <h2> Tech stack </h2> <ul> <li>Rails 8.1, Ruby 3.3, PostgreSQL</li> <li>Pundit, Stripe, ruby-saml, ROTP, OmniAuth 2</li> <li>91 tests, 332 assertions, 0 failures ✅</li> </ul> <h2> Why source code instead of a gem? </h2> <p>Gems lock you into an API. With source code you own every line — customize anything, no vendor lock-in, no per-user SaaS fees.</p> <h2> ROI </h2> <p>One US Rails developer hour = $75–$150. This kit saves 80–200 hours of implementation work. At CHF 699 for the full Compliance Suite, payback is day 1.</p> <h2> Available packs </h2> <ul> <li>Core Auth — CHF 149</li> <li>HIPAA Pack — CHF 349</li> <li>Fintech Pack — CHF 349</li> <li>EdTech / LTI 1.3 — CHF 249</li> <li>Compliance Suite (all 3 modules) — CHF 699</li> </ul> <p>👉 <a href="https://9608983683638.gumroad.com" rel="noopener noreferrer">https://9608983683638.gumroad.com</a></p> <p>Happy to answer questions about any implementation details in the comments.</p> rails ruby saas webdev