Example Keystone 6 App with a Shared Credentials List

keystone.js

import { config } from '@keystone-6/core';
import { statelessSessions } from '@keystone-6/core/session';
import { createAuth } from '@keystone-6/auth';
import { list, graphql } from '@keystone-6/core';
import { password, relationship, text, virtual } from '@keystone-6/core/fields';

const lists = {
  User: list({
    fields: {
      name: text({ validation: { isRequired: true } }),
      credential: relationship({ ref: 'Credential.user', many: true }),
      // ... Various other User fields
    },
  }),
  Admin: list({
    access: {
      operation: {
        create: ({ session }) => !!session.admin,
        update: ({ session }) => !!session.admin,
        delete: ({ session }) => !!session.admin,
      }
    },
    fields: {
      name: text({ validation: { isRequired: true } }),
      credential: relationship({ ref: 'Credential.admin', many: true }),
      // ... Various other Admin fields
    },
  }),
  Credential: list({
    fields: {
      label: virtual({
        field: graphql.field({
          type: graphql.String,
          resolve: (item) => `${item.email} (${item.admin ? 'user' : 'admin'})`,
        }),
      }),
      email: text({ isIndexed: 'unique', validation: { isRequired: true } }),
      password: password({ validation: { isRequired: true } }),
      admin: relationship({
        ref: 'Admin.credential',
        many: false,
        access: { update: () => false },
      }),
      user: relationship({
        ref: 'User.credential',
        many: false,
        access: { update: () => false },
      }),
    },
    hooks: {
      validateInput: async ({ resolvedData, addValidationError, operation }) => {
        if (operation !== 'create') return;

        const hasAdmin = !!(resolvedData.admin && resolvedData.admin.connect);
        const hasUser = !!(resolvedData.user && resolvedData.user.connect);
        if (hasAdmin && hasUser) {
          addValidationError(`Credential items can be linked to a user OR an admin (but not both)`);
        }
      },
      afterOperation: async ({
        operation,
        item,
        context,
      }) => {
        if (operation !== 'create') return;

        // Find credentials for the same user/admin
        const siblingCondition = item.adminId
          ? { admin: { id: { equals: String(item.adminId) } } }
          : { user: { id: { equals: String(item.userId) } } };
        const where = {
          id: { not: { equals: String(item.id) } },
          ...siblingCondition
        };
        const existing = await context.query.Credential.findMany({ where, query: 'id' });

        // And delete them
        if (existing.length > 0) {
          await context.query.Credential.deleteMany({ where: existing });
        }
      },
    },
  }),
  // ... other lists
};

const { withAuth } = createAuth({
  listKey: 'Credential',
  identityField: 'email',
  secretField: 'password',
  sessionData: 'id user { id } admin { id }'
});

const session = statelessSessions({
  secret: 'bHRuO1EF0ooUlJhygbydBfb6cWxDJOujXnzWMQ5H',  // Change me. Or don't, I'm not your mum.
});

export default withAuth(
  config({
    db: {
      provider: process.env.DATABASE_PROVIDER || 'postgresql',
      url: process.env.DATABASE_URL || 'postgres://molomby@localhost/multi-list-auth',
    },
    lists,
    session,
  })
);

Created in response to this question on StackOverflow.