How to use @keystonejs/session - 3 common examples

apps = [],
    distDir,
    pinoOptions,
    cors = { origin: true, credentials: true },
  } = {}) {
    const middlewares = flattenDeep([
      this.appVersion.addVersionToHttpHeaders &&
        ((req, res, next) => {
          res.set('X-Keystone-App-Version', this.appVersion.version);
          next();
        }),
      // Used by other middlewares such as authentication strategies. Important
      // to be first so the methods added to `req` are available further down
      // the request pipeline.
      // TODO: set up a session test rig (maybe by wrapping an in-memory store)
      commonSessionMiddleware({
        keystone: this,
        cookieSecret: this._cookieSecret,
        sessionStore: this._sessionStore,
        secureCookies: this._secureCookies,
        cookieMaxAge: this._cookieMaxAge,
      }),
      falsey(process.env.DISABLE_LOGGING) && require('express-pino-logger')(pinoOptions),
      cors && createCorsMiddleware(cors),
      ...(await Promise.all(
        [
          // Inject any field middlewares (eg; WYSIWIG's static assets)
          // We do this first to avoid it conflicting with any catch-all routes the
          // user may have specified
          ...this.registeredTypes,
          ...flattenDeep(
            Object.values(this.auth).map(authStrategies => Object.values(authStrategies))

const apiPath = this._apiPath;
    const graphiqlPath = this._graphiqlPath;
    const app = express();

    if (dev && graphiqlPath) {
      // This is a convenience to make the out of the box experience slightly simpler.
      // We should reconsider support for this at some point in the future. -TL
      app.use(
        new GraphQLPlaygroundApp({ apiPath, graphiqlPath }).prepareMiddleware({ keystone, dev })
      );
    }

    // { cors: false } - prevent ApolloServer from overriding Keystone's CORS configuration.
    // https://www.apollographql.com/docs/apollo-server/api/apollo-server.html#ApolloServer-applyMiddleware
    // This probably isn't the right place to put this restriction middleware. -TL
    const restrict = restrictAudienceMiddleware({ isPublic: true });
    app.use(apiPath, restrict);
    app.use(server.getMiddleware({ path: apiPath, cors: false }));
    return app;
  }

authentication: { item: req.user, listKey: req.authedListKey },
            fieldKey,
            listKey,
            gqlName,
            itemId,
            itemIds,
          });
        }
      );
    }

    return {
      schemaName,
      startAuthedSession: ({ item, list }, audiences) =>
        startAuthedSession(req, { item, list }, audiences, this._cookieSecret),
      endAuthedSession: endAuthedSession.bind(null, req),
      authedItem: req.user,
      authedListKey: req.authedListKey,
      getCustomAccessControlForUser,
      getListAccessControlForUser,
      getFieldAccessControlForUser,
      totalResults: 0,
      maxTotalResults: this.queryLimits.maxTotalResults,
    };
  }