CodeVetter · Repo Unpack · Behavior traces
payloadcms/payload
Three concrete paths were followed through implementation: instance startup, REST document creation through MongoDB persistence, and REST login through cookie issuance. Startup shares concurrent initialization work and conditionally activates development and cron behavior. Creation branches for auth collections, uploads, drafts, and versions before shaping the response. Login authenticates before starting its remaining transaction and includes explicit session cleanup on failure.
- Startup begins getPayload → cache lookup by key/default → shared initialization promise → new BasePayload().init; initialization failures clear the promise and mark the error as payloadInitError.
- BasePayload.init awaits config → initializes logger → requires secret → builds the active/previous-secret keyring → registers collections/blocks → initializes DB and KV → optionally connects DB → initializes email.
- Startup then collects custom and API-key auth strategies, appends local JWT when enabled, runs options/config onInit unless disabled, and invokes _initializeCrons only when requested.
- REST creation runs exported POST → Next handlerBuilder → handleEndpoints → createPayloadRequestFromWebRequest → endpoint matching and routeParams injection → wrapped body parsing → createHandler → createOperation.
- createOperation starts a transaction, strips submitted upload identity for non-overridden upload requests, runs beforeOperation, enforces create access unless overridden, generates file data, then runs field/collection validation and change hooks.
- Creation writes local files unless disabled, calls registerLocalStrategy for local-auth collections or payload.db.create otherwise, optionally saves versions, shapes results through hooks, and commits; errors clean temporary files and kill the transaction.
- REST login runs loginHandler → loginWithCookie → loginOperation → normalized identity query excluding trashed users → db.findOne → checkLoginPermission → authenticateLocalStrategy; failed passwords increment attempts when configured, and unverified users are rejected when verification is enabled.
- Successful login starts a transaction → rechecks lock state → adds a session → optionally rehashes the password → resets attempts → runs beforeLogin → signs JWT → applies user read access and afterOperation → commits; loginWithCookie generates the cookie before optional token removal, and the handler returns Set-Cookie.