0.34.6_repo_cleanup

src/proxy/forward/route_cache.rs

@@ -1,7 +1,4 @@
 {
-// Global host, profile, vhost and location access policies were already enforced
-// before this source/cache path. Do not re-evaluate IP ACLs in isolation here:
-// allow-only country entries and explicit IP allows form one policy scope.
 if let Some(exchange) = request.extensions().get::<Arc<Exchange>>() {
     *exchange.route.lock().unwrap_or_else(|e| e.into_inner()) = Some(route.id.clone());
     exchange.set_source(if route.response.is_some() {
@@ -15,8 +12,6 @@ if let Some(exchange) = request.extensions().get::<Arc<Exchange>>() {
         }
     });
 }
-// Local location responses intentionally still pass host/profile/location ACLs
-// and the outer response-header/security pipeline, but never select/open an upstream.
 if let Some(spec) = &route.response {
     return local_location_response(spec, request.method());
 }
@@ -125,9 +120,6 @@ let cache_settings = route
 let transform_settings = route.frontend.as_ref().map(|f| &f.transform);
 let scope = route.frontend.as_ref().map(|f| f.id.as_str()).unwrap_or("");
 if let Some(exchange) = request.extensions().get::<Arc<Exchange>>() {
-    // The resolved route was already recorded before local response, LB and
-    // ACL decisions. Do not acquire the route mutex and copy its ID twice on
-    // every reverse-proxy request.
     exchange.set_cache_enabled(cache_settings.active_for(route.cache));
     exchange.set_transform_enabled(transform_settings.is_some_and(|settings| settings.enabled));
 }
@@ -169,8 +161,6 @@ let body_empty = if cache_enabled
 } else {
     cache_enabled && request.body().is_end_stream()
 };
-// Keep the original URI alive through forwarding: ordinary targets can be
-// borrowed while route rewrites still allocate and are strictly validated.
 let public_suffix: std::borrow::Cow<'_, str> = std::borrow::Cow::Borrowed(
     routing_uri.path_and_query().map(|v| v.as_str()).unwrap_or("/")
 );
@@ -247,9 +237,6 @@ if let Some(frontend) = &route.frontend {
     crate::headers::apply(request.headers_mut(), &frontend.headers.request);
 }
 crate::headers::apply(request.headers_mut(), &route.headers.request);
-// Canonical trusted metadata cannot be overwritten by custom request rules.
-// A vhost may intentionally withhold only the visitor IP from the application;
-// ACL/rate-limit/Tinyauth decisions above still use the authenticated client address.
 context.apply_upstream(
     request.headers_mut(),
     route
@@ -289,9 +276,6 @@ let if_range = if effective_cacheable {
 } else { None };
 let range_requested = !matches!(range_selection, crate::cache::RangeSelection::None);
 
-// Match Varnish-style cache identity: a load-balanced backend member must not
-// fragment the object cache. The vhost scope + canonical host + request target
-// already identify the public resource; Vary handles representation variants.
 let cache_route = route.id.as_str();
 let mut cache_key_headers = None;
 if effective_cacheable && ignore_static_cookie && request.headers().contains_key("cookie") {