Thoth

Session Record — 2026-02-14 10:49

Created: 2026-02-14 10:49 Updated: 2026-02-14 10:49 Notebook: Work/Sessions

Session Record — 2026-02-14 10:49

Topic: Cloudflare Caching Restoration (Continued)

What We Did

  1. Resumed caching audit from a previous session that had started reviewing Django cookie/session usage for Cloudflare compatibility.

  2. Found and fixed 3 blockers preventing Cloudflare edge caching on give-htmx:

  3. Blocker 1: session['logoPath'] write in give/base.py GiveContextMixin.get_base_page_context() — removed it (logoPath already passed via context, session write was redundant)
  4. Blocker 2: DRF DEFAULT_AUTHENTICATION_CLASSES set to [SessionAuthentication] in config/settings/base.py — changed to []. Safe because all public views use AllowAny; payroll views explicitly set their own auth.
  5. Blocker 3: BillingCountryView and BillingSubregionView in give/views.py inherited HtmxTemplateView.dispatch() which creates sessions and sets Cache-Control: no-store. Added dispatch() override to skip session creation for these static reference data views.

  6. All 3 fixes committed as single commit 6bd1da9c on cloudflare-caching-prep branch, cherry-picked to main and qa.

  7. Documented 6 Cloudflare Cache Rules in CLOUDFLARE_CACHING_RESTORATION.md:

  8. Rule 1: Bypass cache for checkout/session paths
  9. Rule 2: Bypass for Django admin
  10. Rule 3: Bypass for API endpoints
  11. Rule 4: Bypass for auth/CAS paths
  12. Rule 5: Cache homepage and fund pages (eligible for edge cache, 2h TTL)
  13. Rule 6: Cache static assets (1d TTL)

  14. All rules scoped to give-qa-cf.berkeley.edu for QA testing first

  15. Cross-referenced URL config (config/urls.py) against Cache Rules — found 4 missing bypass paths: /pledgefailed, /modal, /api/hepdata, /hepdata. Added to Rule 1.

  16. Created Playwright caching test suite at tests/caching/cloudflare-cache-rules.spec.ts:

  17. 10 tests for cacheable endpoints (homepage, fund pages)
  18. 5 tests for checkout bypass verification
  19. 3 tests for API bypass verification
  20. 1 test for basket isolation (cached pages don't leak basket state)

  21. 1 test for static asset caching

  22. Branch management:

  23. Created cloudflare-caching-prep branch off main
  24. Cherry-picked fixes to main, qa, and mcp-server
  25. Merged main into mcp-server for full sync

  26. Pushed givecore docs updates (multiple commits)

  27. Discovered qa branch email divergence: qa has example.com test emails while main has the correct oskibare1868@gmail.com. User confirmed canonical email preference — saved to memory.

Current State

  • give-htmx branch: main
  • Caching code fixes: On both main and qa
  • Playwright caching tests: On both main and qa
  • Cloudflare Cache Rules: Documented but NOT yet created in dashboard (manual step)
  • givecore docs: Pushed to origin/main with full Phase 2 instructions

Remaining Work

Phase Status Description
Phase 0/0.5 DONE Django code fixes for cookie/session compatibility
Phase 2 READY Create 6 Cache Rules in Cloudflare dashboard (manual)
Phase 1+3 DEFERRED give-worker settings cleanup (with BigGive work)
Phase 4 NEXT Deploy qa, create rules, run Playwright validation
Phase 5 PENDING Production rollout

qa vs main Differences (Unresolved)

  • 3 test files deleted on qa, present on main: cybersource-amount-triggers.spec.ts, gift-verification-e2e.spec.ts, onetime-gift E2E spec
  • 3 checkout specs on qa have example.com emails instead of oskibare1868@gmail.com
  • Deploy configs intentionally different per branch

Key Files Modified

  • give-htmx/give/base.py — removed session['logoPath'] write
  • give-htmx/config/settings/base.py — cleared DRF auth classes
  • give-htmx/give/views.py — dispatch() override on 2 billing views
  • give-htmx/tests/caching/cloudflare-cache-rules.spec.ts — new Playwright test suite
  • givecore/docs/plans/CLOUDFLARE_CACHING_RESTORATION.md — updated with Phase 2 instructions, Playwright section
Write