# Data flow — redwoodjs/redwood

> Canonical page: https://codevetter.com/unpack/redwood/data-flow

# Data flow — redwoodjs/redwood

Scanned commit a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd (2025-12-13). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Application configuration determines paths, endpoints, feature flags, and browser-exposed values. Browser queries travel through Cell hooks and Apollo links to Yoga, where SDL fields map to service exports and application-owned Prisma clients. Authentication adds identity to request-scoped context before resolver execution. Jobs use a separate durable path that serializes invocation metadata into database records and later loads compiled code in workers.
- getRawConfig reads and interpolates TOML; getConfig merges the parsed values with defaults such as web port 8910, API port 8911, and /.redwood/functions. — [packages/project-config/src/config.ts#L130-148](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/project-config/src/config.ts#L130-L148) [packages/project-config/src/config.ts#L215-234](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/project-config/src/config.ts#L215-L234)
- getEnvVarDefinitions converts configuration into RWJS_ENV endpoint/title/feature values and exposes both explicitly included environment variables and REDWOOD_ENV_ prefixed values to browser expressions. — [packages/vite/src/lib/envVarDefinitions.ts#L5-17](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/vite/src/lib/envVarDefinitions.ts#L5-L17) [packages/vite/src/lib/envVarDefinitions.ts#L29-53](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/vite/src/lib/envVarDefinitions.ts#L29-L53)
- NamedCell removes children from query-variable derivation, runs beforeQuery, resolves a static or functional QUERY, and calls the GraphQLHooksProvider useQuery hook. — [packages/web/src/components/cell/createCell.tsx#L48-64](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/web/src/components/cell/createCell.tsx#L48-L64)
- Apollo obtains getToken for each operation, adds auth-provider and Bearer authorization headers, and sends operations through upload, SSE, or persisted-operation terminating links. — [packages/web/src/apollo/index.tsx#L191-219](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/web/src/apollo/index.tsx#L191-L219) [packages/web/src/apollo/index.tsx#L224-286](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/web/src/apollo/index.tsx#L224-L286)
- The Fastify GraphQL handler supplies a Lambda-shaped event alongside req/reply to yoga.handleNodeRequest, then copies response headers, status, and body into the Fastify reply. — [packages/api-server/src/plugins/graphql.ts#L83-101](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/api-server/src/plugins/graphql.ts#L83-L101)
- getAuthenticationContext prefers an auth-provider-bearing cookie over provider-header authorization, runs configured decoders until a payload is returned, and passes the result to getCurrentUser through the auth-context plugin. — [packages/api/src/auth/index.ts#L130-174](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/api/src/auth/index.ts#L130-L174) [packages/graphql-server/src/plugins/useRedwoodAuthContext.ts#L22-46](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/graphql-server/src/plugins/useRedwoodAuthContext.ts#L22-L46)
- makeMergedSchema combines SDL, directive, subscription, and root definitions; service exports matching field names receive GraphQL args followed by root/context/info. — [packages/graphql-server/src/makeMergedSchema.ts#L97-124](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/graphql-server/src/makeMergedSchema.ts#L97-L124) [packages/graphql-server/src/makeMergedSchema.ts#L375-405](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/graphql-server/src/makeMergedSchema.ts#L375-L405)
- The todo mutation passes a body string from React state into createTodo, stores it through db.todo.create, and appends the returned Todo to Apollo's cached list. — [__fixtures__/example-todo-main/web/src/components/AddTodoControl/AddTodoControl.js#L5-16](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/__fixtures__/example-todo-main/web/src/components/AddTodoControl/AddTodoControl.js#L5-L16) [__fixtures__/example-todo-main/web/src/components/AddTodo/AddTodo.js#L17-39](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/__fixtures__/example-todo-main/web/src/components/AddTodo/AddTodo.js#L17-L39) [__fixtures__/example-todo-main/api/src/services/todos/todos.js#L1-5](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/__fixtures__/example-todo-main/api/src/services/todos/todos.js#L1-L5)
- Job scheduling converts job name/path/args, queue, priority, and computed runAt into a payload; PrismaAdapter persists invocation metadata as JSON in the handler column. — [packages/jobs/src/core/Scheduler.ts#L51-98](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/jobs/src/core/Scheduler.ts#L51-L98) [packages/jobs/src/adapters/PrismaAdapter/PrismaAdapter.ts#L255-265](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/jobs/src/adapters/PrismaAdapter/PrismaAdapter.ts#L255-L265)
- PrismaAdapter selects jobs by priority/runAt, conditionally updates a candidate's lock and attempt count, reloads the record, and deserializes name/path/args for Executor. — [packages/jobs/src/adapters/PrismaAdapter/PrismaAdapter.ts#L157-189](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/jobs/src/adapters/PrismaAdapter/PrismaAdapter.ts#L157-L189) [packages/jobs/src/core/Executor.ts#L62-72](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/jobs/src/core/Executor.ts#L62-L72)
- FileSystemStorage turns a File arrayBuffer into a Node Buffer at a configured or overridden path; UrlSigner binds a path and optional expiry into an HMAC and returns a decoded path after validation. — [packages/storage/src/adapters/FileSystemStorage/FileSystemStorage.ts#L24-40](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/storage/src/adapters/FileSystemStorage/FileSystemStorage.ts#L24-L40) [packages/storage/src/UrlSigner.ts#L39-52](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/storage/src/UrlSigner.ts#L39-L52) [packages/storage/src/UrlSigner.ts#L73-98](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/storage/src/UrlSigner.ts#L73-L98)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)