CodeVetter · Repo Unpack · Data flow
keystonejs/keystone
Configuration is transformed into executable schemas, generated artifacts, and browser metadata before requests arrive. Each HTTP GraphQL request receives a context containing its decoded session and shared Prisma access. Persistence flows through input resolvers and hooks, while browser preferences, session stores, asset stores, and telemetry use separate state boundaries.
- config() adds IDs and list defaults; initialise-lists invokes each field factory with provider, list metadata, listKey, and fieldKey, then resolves its access, hooks, GraphQL enablement, and UI metadata.
- buildArtifacts() prints the public GraphQL schema and formatted Prisma schema; generateArtifacts() writes both, while generateTypes() derives TypeScript from the internal schema and initialized lists.
- Express parses GraphQL JSON and multipart uploads, then calls context.withRequest(req,res); withRequest() invokes the session strategy and returns a context bound to the resulting session.
- Admin creation serializes field-controller state into mutation variables; server input resolution applies field hooks before list hooks, validates resolved data, transforms it for Prisma, and returns before/after callbacks.
- findMany() enforces maxTake, operation access, list filters, field filtering/cursor permissions, and ordering permissions before a Prisma query; access filters are combined with caller filters using AND.
- File input streams are counted and passed to storage.put(); Prisma receives filename/filesize metadata, output URLs delegate to storage.url(), and changed or deleted assets are removed through afterOperation.
- Stateless sessions seal data into HTTP-only cookies and return the sealed token; storedSessions instead persists data under a random ID and seals that ID, then resolves or deletes it through the configured store.
- Development telemetry POSTs package versions, database provider, list/field counts, OS, and Node major version; Conf records per-project/device send dates, with CI, production, opt-out, and environment-variable exclusions.