Kinda wishing we'd just used something like Auth0 from the start.

Even using devise and omniauth, we're still writing and maintaining a fair amount of code to do SAML SSO, social sign-on, email confirmations, 2FA, etc.

Would have been nice to just integrate with something like Auth0 once and let them handle those things.

But now we're faced with a classic engineering problem: do we keep pushing down the nearly-done but not-ideal path, or back all the way up for a path that's probably better?