parse-community/parse-server

Parse Server for Node.js / Express

Structural Verdict

How Data Flows Through the System

HTTP requests flow through middleware, authentication, routing, controllers, and storage adapters before returning responses with optional trigger execution

1. Request Processing — Express middleware validates headers, parses authentication, and sets up request context
2. Authentication — Auth middleware validates master keys, session tokens, and user permissions
3. Routing — PromiseRouter dispatches to appropriate REST or GraphQL handlers
4. Trigger Execution — Before triggers (beforeSave, beforeFind) execute cloud code logic
5. Database Operation — Controllers use storage adapters to perform MongoDB/PostgreSQL operations
6. Response Processing — After triggers execute, response is formatted and returned to client

System Behavior

How the system actually operates at runtime — where data accumulates, what loops, what waits, and what controls what.

Data Pools

Feedback Loops

• Schema Migration (auto-scale, balancing) — Trigger: New field or class detected in request. Action: Automatically update database schema. Exit: Schema matches request requirements.
• Auth Cache Refresh (cache-invalidation, balancing) — Trigger: Session token validation failure. Action: Re-fetch user roles and permissions. Exit: Valid authentication established.
• Live Query Updates (polling, reinforcing) — Trigger: Database change detected. Action: Push updates to subscribed WebSocket clients. Exit: All subscribers notified.

Delays & Async Processing

• Rate Limiting Window (rate-limit, ~configurable (default 1 minute)) — Requests are rejected with 429 status when limit exceeded
• Database Connection Pool (async-processing, ~varies) — Requests queue when all connections are busy
• Cache TTL (cache-ttl, ~configurable) — Stale data served until cache expires and refreshes
• Session Expiry (scheduled-job, ~configurable (default 1 year)) — Users must re-authenticate when session expires

Control Points

• Master Key (env-var) — Controls: Bypasses all ACLs and security restrictions
• Rate Limit Threshold (threshold) — Controls: Maximum requests per time window per IP
• Database URI (env-var) — Controls: Which database instance to connect to
• Enable GraphQL (feature-flag) — Controls: Whether GraphQL endpoint is available
• Live Query Classes (runtime-toggle) — Controls: Which Parse classes support real-time subscriptions

Technology Stack

Key Components

• ParseServer (class) — Main server class that orchestrates all components and handles Express app setup src/ParseServer.js
• Config (class) — Central configuration management with validation and async key loading src/Config.js
• DatabaseController (class) — Core database operations and schema management controller src/Controllers/DatabaseController.js
• getControllers (function) — Factory function that instantiates and wires together all controller instances src/Controllers/index.js
• handleParseHeaders (middleware) — Main authentication and request parsing middleware for all Parse API requests src/middlewares.js
• PromiseRouter (class) — Promise-based router abstraction that wraps Express routing with async/await support src/PromiseRouter.js
• rest (module) — Core REST API operations including find, save, delete with trigger support src/rest.js
• Auth (class) — Authentication and authorization handling with master key, user sessions, and role management src/Auth.js
• triggers (module) — Cloud Code trigger system for beforeSave, afterSave, beforeFind lifecycle hooks src/triggers.js
• authDataValidator (function) — Validates third-party authentication data for OAuth providers like Facebook, Google, Twitter src/Adapters/Auth/index.js
• MongoStorageAdapter (class) — MongoDB database adapter implementing the storage interface src/Adapters/Storage/Mongo/MongoStorageAdapter.js
• ParseGraphQLController (class) — GraphQL API controller with Apollo Server integration src/Controllers/ParseGraphQLController.js
• +1 more components

Sub-Modules

Configuration

jsconfig.json (json)

• compilerOptions.target (string, unknown) — default: ES6
• compilerOptions.module (string, unknown) — default: commonjs

jsdoc-conf.json (json)

• plugins (array, unknown) — default: node_modules/jsdoc-babel,plugins/markdown
• babel.plugins (array, unknown) — default: @babel/plugin-transform-flow-strip-types
• source.include (array, unknown) — default: README.md,./lib/cloud-code,./lib/Options/docs.js,./lib/ParseServer.js,./lib/Adapters
• source.excludePattern (string, unknown) — default: (^|\/|\\)_
• templates.default.outputSourceFiles (boolean, unknown) — default: false
• templates.default.showInheritedInNav (boolean, unknown) — default: false
• templates.default.useLongnameInNav (boolean, unknown) — default: true
• templates.cleverLinks (boolean, unknown) — default: true
• +10 more parameters

Related Backend Api Repositories

Frequently Asked Questions

Analyzed on March 31, 2026 by CodeSea. Written by Karolina Sarna.