Josep Piguillem
3897113313
Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
90 lines
2.8 KiB
PHP
90 lines
2.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/**
|
|
* HTTP caching for the public API.
|
|
*
|
|
* With an SSR frontend this API sits in the critical path of every page view,
|
|
* so these headers are not a nicety: they are what lets a CDN or the frontend
|
|
* server avoid a round trip per visitor.
|
|
*
|
|
* `stale-while-revalidate` matters most — it means a brief outage or a slow
|
|
* response here degrades into slightly stale content rather than a broken page.
|
|
*/
|
|
class CachePublicResponse
|
|
{
|
|
public function handle(Request $request, Closure $next, int $seconds = 60): Response
|
|
{
|
|
$response = $next($request);
|
|
|
|
// Never cache a preview: the whole point is seeing unpublished work
|
|
// the moment it changes. Nor anything that was not a read — a
|
|
// submission's confirmation belongs to one visitor only.
|
|
if ($request->attributes->get('preview', false)
|
|
|| ! $request->isMethodCacheable()
|
|
|| $response->getStatusCode() >= 400) {
|
|
$response->headers->set('Cache-Control', 'no-store, private');
|
|
|
|
return $response;
|
|
}
|
|
|
|
$response->headers->set(
|
|
'Cache-Control',
|
|
"public, max-age=0, s-maxage={$seconds}, stale-while-revalidate=".($seconds * 10),
|
|
);
|
|
|
|
// Responses vary by language, and the language is negotiated from the
|
|
// header as well as the query string. Without this a shared cache
|
|
// would serve Catalan to a Spanish visitor.
|
|
$response->headers->set('Vary', 'Accept-Language, Accept, Origin');
|
|
|
|
$this->applyEntityTag($request, $response);
|
|
|
|
return $response;
|
|
}
|
|
|
|
/**
|
|
* A content-derived ETag, so an unchanged payload costs the caller a 304
|
|
* with an empty body instead of the full JSON.
|
|
*/
|
|
protected function applyEntityTag(Request $request, Response $response): void
|
|
{
|
|
if (! $response->getContent()) {
|
|
return;
|
|
}
|
|
|
|
$etag = '"'.hash('xxh128', $response->getContent()).'"';
|
|
$response->headers->set('ETag', $etag);
|
|
|
|
$ifNoneMatch = $request->headers->get('If-None-Match');
|
|
|
|
if ($ifNoneMatch !== null && $this->matches($ifNoneMatch, $etag)) {
|
|
$response->setNotModified();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* `If-None-Match` may carry several tags, and a proxy may have weakened
|
|
* ours with a `W/` prefix along the way.
|
|
*/
|
|
protected function matches(string $ifNoneMatch, string $etag): bool
|
|
{
|
|
foreach (explode(',', $ifNoneMatch) as $candidate) {
|
|
$candidate = ltrim(trim($candidate), 'W/');
|
|
|
|
if ($candidate === '*' || hash_equals($etag, $candidate)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
}
|