CodeVetter · Repo Unpack · Data flow
strapi/strapi
HTTP data crosses authentication and policy boundaries before controller validation and sanitization. The Document Service translates document parameters into locale/status-specific database operations and owns transaction coordination. Media bytes, metadata, session state, and event payloads have distinct persistence/output boundaries. Browser state and MCP transport responses follow separate paths from ordinary REST response handling.
- Endpoint composition attaches route information, authenticates, authorizes, runs policies and route middleware, then invokes the controller. returnBodyMiddleware copies a returned value into ctx.body only when the controller has not already set a body.
- Collection create requires an object body.data, validates/sanitizes query and input, delegates to the content service, sanitizes the returned entity, and sets 201. Base controller sanitizers receive request auth; REST strict-parameter configuration is passed into validation options.
- Collection services default fetch parameters to status:'published', whereas Document Service findMany applies defaultToDraft before status/locale lookup and query translation. API reads and direct Document Service reads therefore have different defaults.
- transformParamsToQuery allowlists query parameters, merges internal lookup into where, removes publication-only top-level parameters, and expresses publication filtering through query.filters so nested populate queries receive cohort conditions using their own model UID.
- Entry creation validates entity data, creates/assigns components, applies attribute transforms, and writes through db.query(uid).create. Database creation processes defaults, inserts a row, attaches relations, rereads selected/populated output, and runs afterCreate lifecycles.
- Document events register an onCommit callback, then reload/populate applicable entries, sanitize the payload, and emit through eventHub. Webhook listeners enqueue those events and POST JSON with configured headers and a ten-second abort timeout.
- Uploads validate/enhance inputs and write provider bytes before creating FILE_MODEL_UID metadata and emitting MEDIA_CREATE; temporary working directories are removed in finally. Read methods sign file URLs through fileService for private-provider output.
- Refresh-token generation persists active session records with origin, user/device identity, idle expiry, and absolute expiry before signing JWTs. MCP independently authenticates an admin bearer token, installs user/auditSource context, and hands the request to a per-request transport that writes directly to the HTTP response.