CDN (Content Delivery Network)

// CDN request flow:
// 1. User in Mumbai requests: https://aicancode.org/logo.png
// 2. DNS query for aicancode.org → CDN GeoDNS returns Mumbai PoP IP (e.g. 104.18.x.x)
// 3. Browser connects to Mumbai PoP
// 4. PoP checks cache: HIT → serve immediately (~5ms)
//                      MISS → fetch from origin (e.g. Vercel/AWS), cache, serve
//
// Cache key: typically scheme + host + path + (optionally) query string
// X-Cache: HIT / MISS / REFRESH_HIT in response headers

// CloudFront distribution (Terraform):
resource "aws_cloudfront_distribution" "cdn" {
  origin {
    domain_name = "api.aicancode.org"
    origin_id   = "api-origin"
  }
  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    viewer_protocol_policy = "redirect-to-https"
    cache_policy_id        = aws_cloudfront_cache_policy.default.id
  }
  price_class = "PriceClass_200"  // all PoPs except South America
  enabled     = true
}

// Cache-Control directives for CDN:

// Immutable static assets (hashed filenames: app.a1b2c3.js)
// Browser AND CDN cache forever — never revalidate
Cache-Control: public, max-age=31536000, immutable

// Dynamic HTML pages — CDN caches for 60s, browser no-cache
Cache-Control: public, s-maxage=60, max-age=0, must-revalidate
// s-maxage applies to CDN (shared cache); max-age to browser

// API responses — no CDN caching, browser can cache briefly
Cache-Control: private, max-age=30

// Never cache (user-specific, sensitive)
Cache-Control: no-store

// Next.js sets these automatically:
// /_next/static/*   → immutable, 1-year
// /api/*            → no-store (by default)
// pages             → s-maxage=1, stale-while-revalidate (ISR)

// Vary header — cache separate versions per header value:
Vary: Accept-Encoding            // separate cache for gzip vs identity
Vary: Accept-Language            // separate cache per language

// Strategy 1: Versioned URLs (preferred for static assets)
// Build tool (webpack/Next.js) generates content-hash filenames:
// app.js → app.a1b2c3d4.js
// When content changes → new hash → new URL → CDN auto-fetches fresh copy
// Old URL simply stops being referenced → naturally expires after max-age

// Strategy 2: Explicit purge (CloudFront invalidation)
aws cloudfront create-invalidation \
  --distribution-id E1ABC123DEF456 \
  --paths "/index.html" "/api/courses*"

// Cloudflare purge by URL:
curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/purge_cache" \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  --data '{"files":["https://aicancode.org/courses","https://aicancode.org/"]}'

// Surrogate Keys / Cache Tags (Fastly, Cloudflare):
// Origin sets: Surrogate-Key: course-123 user-456
// On update: purge by tag "course-123" → all pages tagged with it are evicted
// Much more granular than path-based purge

// Cloudflare Worker — A/B test at the edge
addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  const url = new URL(request.url)

  // Route 10% of traffic to /beta endpoint
  const variant = Math.random() < 0.1 ? 'beta' : 'stable'
  url.pathname = variant === 'beta' ? '/beta' + url.pathname : url.pathname

  const response = await fetch(url.toString(), request)
  return new Response(response.body, {
    ...response,
    headers: { ...response.headers, 'X-AB-Variant': variant }
  })
}

// Lambda@Edge — add security headers to every CloudFront response:
exports.handler = async (event) => {
  const response = event.Records[0].cf.response
  response.headers['strict-transport-security'] = [{
    key: 'Strict-Transport-Security',
    value: 'max-age=31536000; includeSubDomains'
  }]
  return response
}