CodeVetter · Repo Unpack · Behavior traces
encode/starlette
The inspected flows follow explicit protocol transitions rather than a standalone executable entrypoint. Startup establishes resources, HTTP routing adapts endpoints, and session persistence occurs when response headers start. Upload and static-file paths cross filesystem boundaries with distinct cleanup and containment rules. WebSocket and exception paths enforce state-dependent behavior that is material to callers.
- Startup: TestClient.__enter__ starts a BlockingPortal and lifespan task → wait_startup sends lifespan.startup → Starlette.__call__ builds its stack → Router.app selects lifespan → Router.lifespan enters the context and sends startup.complete; exit triggers shutdown and context teardown, with failures distinguished by startup state.
- HTTP success: Starlette.__call__ → middleware stack → Router.app → Route.matches → scope update → Route.handle → request_response creates Request → endpoint runs asynchronously or in a worker thread → returned Response sends headers/body and then awaits its background callback.
- Routing fallback: Router.app returns on the first FULL match, remembers the first PARTIAL match for 405, otherwise tries a slash-adjusted scope and RedirectResponse, then calls default; unmatched WebSockets close and unmatched HTTP inside Starlette raises HTTPException(404).
- Upload: endpoint calls Request.form → _get_form selects MultiPartParser → parse streams chunks into callbacks → on_headers_finished creates UploadFile → queued writes and seek(0) complete → FormData returns; parser failures close temporary files, while form context exit closes successful uploads.
- Session persistence: SessionMiddleware loads and verifies an incoming cookie → request.session marks access → Session.__setitem__ marks modification → endpoint returns Response → send_wrapper observes http.response.start and signs JSON into Set-Cookie; read-only access adds Vary without rewriting the cookie.
- Static delivery: Mount updates root_path → StaticFiles.__call__ checks configuration and normalizes the path → get_response runs lookup_path in a thread → file_response selects 304 or FileResponse → FileResponse handles HEAD, pathsend, full content, or byte ranges; malformed and unsatisfiable ranges return 400 and 416.
- WebSocket endpoint: WebSocketRoute adapts a function through websocket_session → endpoint calls WebSocket.accept, which first receives connect if necessary → receive_text/bytes/json validates accepted state → send methods validate application state → close transitions to disconnected; denial responses require the advertised server extension.
- Error handling: ExceptionMiddleware installs handlers in scope → wrap_app_handling_exceptions chooses HTTP status then exception-MRO handlers, rejecting replacement after response start → unhandled HTTP errors reach ServerErrorMiddleware, which emits a debug/custom/default 500 only before start and always re-raises.