Project: edge permit case delivery

Last updated: 5 Oct 20269 min read

project

Build a thin edge layer for a permit portal with public district map tiles and private case 29. The browser may request tiles from several regions, while case writes belong to one authoritative origin. Reviewer 47 has access to organization 6 but not organization 9. Canonicalize request paths, remove viewer-supplied internal headers, and keep object authorization at origin. The edge has a strict upstream-call budget and must return a usable case summary when an optional thumbnail fails. Public tiles use versioned URLs; private case images bypass shared caches. A save reports committed state only after origin evidence and gives the next read a minimum version.

Build contract

Reject ambiguous paths, forged forwarding context, and direct-origin requests that lack protected identity.
Cap upstream fanout, elapsed time, and buffered bytes; fail closed when permission lookup fails while allowing optional image fallback.
Test public tile revision across two edge locations, private cache bypass, idempotent origin writes, and read-after-write version behavior.

Implementation checkpoint

function responseMayUsePublicCache(responseClass, authorized) {
  return responseClass === "versioned-public-tile" && !authorized;
}
console.log(responseMayUsePublicCache("private-case-image", true));
// Output: false

Cost and boundaries

Path normalization costs O(L) for path length L. With F upstream calls and R retries, a careless edge route can generate O(F × R) origin work for each browser request. Cache variants consume storage per revision and language, while a mixed private key risks disclosure. Compare full browser-to-response p95 latency with a regional origin baseline; a nearby edge is not a win when it waits on distant services. Measure subrequests, bytes buffered, public hit rate by location, stale revision age, private cache bypass, duplicate effects, and the longest post-write stale read. Do not put private paths or tokens into broad cache and telemetry keys.

Failure drill

Send encoded separators and a forged tenant header, then call origin directly. Slow the assignment service beyond its deadline and fail an optional thumbnail. Warm two edge locations with style revision 29, purge only one, then release revision 30 under distinct URLs. Change reviewer 47 permission after the edge has made a routing decision; origin must deny case 29. Commit a held-state write, lose its response, and retry with the same key. Return an old version from the nearest replica and show a pending state or route to fresh data. Promote a second origin while the first returns and prove only one can accept further writes.

Acceptance checks

No viewer-supplied proxy field can grant origin access, and private reads use current object policy.
An optional service failure does not hide a successful authorized case summary.
Public cache revisions are location-safe; private representations cannot cross accounts.
One retried mutation yields one committed effect, and a stale read is never presented as the final saved state.

Common Mistakes

Calling a local purge a global invalidation.
Returning save success before origin commit.
Assuming edge proximity compensates for unbounded distant fanout.

web-tech

web-development