v0.31.0

src/runtime/constructors.rs

@@ -176,6 +176,7 @@ impl App {
             auth,
             viewer_slots: Arc::new(Semaphore::new(8)),
             certificate_slots: Arc::new(Semaphore::new(2)),
+            cache_invalidation_slots: Arc::new(Semaphore::new(2)),
             metrics: Arc::new(Metrics::default()),
             transform_metrics: Arc::new(crate::transform::Metrics::default()),
             traffic,

src/runtime/tests.rs

@@ -62,6 +62,7 @@ mod cache_revision_tests {
         wire_only.cache.expose_resident_age = !wire_only.cache.expose_resident_age;
         wire_only.cache.expose_only_hits = !wire_only.cache.expose_only_hits;
         wire_only.cache.via_header = Some("RustProxy edge".into());
+        wire_only.cache.http_invalidation_allowed_cidrs = vec!["192.0.2.42".into()];
         assert_eq!(cache_revision(&wire_only), identity);
         assert!(matches!(
             cache_invalidation(&base, &wire_only),

src/runtime/types.rs

@@ -38,6 +38,7 @@ pub struct App {
     pub auth: Arc<crate::auth::Auth>,
     pub viewer_slots: Arc<Semaphore>,
     pub certificate_slots: Arc<Semaphore>,
+    pub cache_invalidation_slots: Arc<Semaphore>,
     pub metrics: Arc<Metrics>,
     pub transform_metrics: Arc<crate::transform::Metrics>,
     pub traffic: Arc<crate::traffic::Analytics>,
@@ -95,6 +96,8 @@ fn cache_revision(config: &config::Config) -> u64 {
     // edits; the new behavior applies immediately on the next request.
     cache.bypass_query = false;
     cache.bypass_prefixes.clear();
+    // Remote maintenance permissions cannot change stored object representations.
+    cache.http_invalidation_allowed_cidrs.clear();
     cache.expose_status = false;
     cache.expose_hits = false;
     cache.expose_cache_status = false;