v0.34.7

src/cache/policy/response.rs

@@ -92,15 +92,19 @@ pub fn plan(
     {
         return None;
     }
-    // Varnish builtin.vcl treats these as uncacheable origin responses
-    // (hit-for-miss is not implemented by RustProxy). Never weaken private
-    // or no-store handling even if Surrogate-Control is also present.
-    if settings.varnish_compatible
-        && (control.contains_key("no-cache") || surrogate_no_store(headers))
-    {
+    // Surrogate-Control: no-store is a shared-cache veto in compatibility
+    // mode, regardless of public/fallback TTL or any other directive.
+    if settings.varnish_compatible && surrogate_no_store(headers) {
         return None;
     }
-    let requires_revalidation = control.contains_key("no-cache");
+    // Explicitly configured fallback TTL is an opt-in origin no-cache
+    // override *only* for public responses. With fallback disabled, keep
+    // the pre-0.34.7 validator-based revalidation and never grant a HIT.
+    let override_public_no_cache = settings.varnish_compatible
+        && control.contains_key("no-cache")
+        && control.contains_key("public")
+        && settings.default_ttl_seconds > 0;
+    let requires_revalidation = control.contains_key("no-cache") && !override_public_no_cache;
     let must_revalidate = control.contains_key("must-revalidate");
     let proxy_revalidate = control.contains_key("proxy-revalidate");
     let parse_window = |name: &str| -> Option<u64> {
@@ -124,7 +128,9 @@ pub fn plan(
         None => now,
     };
     let declared_ttl =
-        if let Some(value) = control.get("s-maxage").or_else(|| control.get("max-age")) {
+        if override_public_no_cache {
+            Some(settings.default_ttl_seconds)
+        } else if let Some(value) = control.get("s-maxage").or_else(|| control.get("max-age")) {
             Some(value.as_ref()?.parse::<u64>().ok()?)
         } else if let Some(expires) = headers.get("expires") {
             Some(
@@ -156,17 +162,17 @@ pub fn plan(
         None if requires_revalidation => 0,
         None => return None,
     };
-    // Like Varnish's built-in VCL, a backend response with no remaining
-    // freshness is not a reusable shared object (Varnish stores a hit-for-miss
-    // marker instead; RustProxy does not implement those markers).
-    if settings.varnish_compatible && initial_age.as_secs() >= ttl {
-        return None;
-    }
-    // Varnish defaults to ten seconds of grace after a *positive* TTL.
-    // Keep RustProxy's existing must-revalidate/proxy-revalidate safety checks;
-    // never turn a no-cache or zero-TTL response into a grace HIT.
-    if settings.varnish_compatible && stale_while_revalidate == 0 {
-        stale_while_revalidate = 10;
+    // Retain zero-TTL and already-expired representations for conditional
+    // revalidation, client max-stale or stale-if-error. They must not be
+    // served as fresh HITs. Varnish-style grace is only implicit when the
+    // origin did not explicitly set stale-while-revalidate (including =0),
+    // the object arrived fresh and no origin no-cache rule is in effect.
+    if settings.varnish_compatible
+        && !control.contains_key("stale-while-revalidate")
+        && !control.contains_key("no-cache")
+        && initial_age.as_secs() < ttl
+    {
+        stale_while_revalidate = settings.varnish_grace_seconds;
     }
     if !requires_revalidation
         && initial_age.as_secs()