My PHP API Returned no-store and Cloudflare Passed Everything Through: Overriding Only the Edge TTL

# Apply settings to the Cache Rules entrypoint (phase: http_request_cache_settings)
# Caution: PUT replaces ALL rules in this phase. Save the current ones first.
ZONE=$CF_ZONE_ID
URL="https://api.cloudflare.com/client/v4/zones/$ZONE/rulesets/phases/http_request_cache_settings/entrypoint"
 
# 1) Always save the "before" state (decide how to roll back first)
curl -sS "$URL" -H "Authorization: Bearer $CF_API_TOKEN" > before-cache-rules.json
 
# 2) Add a rule scoped to the heavy list only
curl -sS -X PUT "$URL" -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" --data '{
  "rules": [{
    "description": "list API: edge ttl only",
    "expression": "(http.host eq \"api.example.com\" and starts_with(http.request.uri.path, \"/v1/list\"))",
    "action": "set_cache_settings",
    "action_parameters": {
      "cache": true,
      "edge_ttl": { "mode": "override_origin", "default": 300 },
      "browser_ttl": { "mode": "respect_origin" }
    }
  }]
}'

// edge-ttl-check.mjs  usage: node edge-ttl-check.mjs <URL> [count] [interval ms]
const [url, nArg = '4', waitArg = '1500'] = process.argv.slice(2);
if (!url) { console.error('Please pass a URL'); process.exit(2); }
const n = Number(nArg), wait = Number(waitArg);
const sleep = ms => new Promise(r => setTimeout(r, ms));
 
const rows = [];
for (let i = 1; i <= n; i++) {
  const t0 = performance.now();
  const res = await fetch(url, { cache: 'no-store', headers: { 'accept-encoding': 'identity' } });
  const body = await res.arrayBuffer();           // read the body so timing is meaningful
  rows.push({
    '#': i,
    status: res.status,
    'cf-cache-status': res.headers.get('cf-cache-status') ?? '(none)',
    age: res.headers.get('age') ?? '-',
    'cache-control': res.headers.get('cache-control') ?? '(none)',
    bytes: body.byteLength,
    ms: Math.round(performance.now() - t0),
  });
  if (i < n) await sleep(wait);
}
console.table(rows);
 
const hits = rows.filter(r => r['cf-cache-status'] === 'HIT').length;
if (rows.every(r => r['cf-cache-status'] === '(none)')) {
  console.log('Verdict: no cf-cache-status header. Not going through Cloudflare, or another layer answers.');
} else if (hits === 0) {
  console.log(`Verdict: no HIT in ${n} requests. The response may be passing through (no-store etc.).`);
} else {
  console.log(`Verdict: ${hits} of ${n} were HIT. The edge is holding the response.`);
}

#!/usr/bin/env bash
# publish-and-purge.sh  usage: ./publish-and-purge.sh [--dry-run] <API path> ...
# If the upload fails, do not reach the purge (set -e)
set -euo pipefail
 
DRY=0
if [ "${1:-}" = "--dry-run" ]; then DRY=1; shift; fi
[ "$#" -ge 1 ] || { echo "Pass at least one path to purge" >&2; exit 2; }
 
: "${API_ORIGIN:?e.g. https://api.example.com}"
: "${CF_ZONE_ID:?}"; : "${CF_API_TOKEN:?}"
 
# 1) Upload (replace with your own deploy command)
if [ "$DRY" -eq 1 ]; then echo "[dry-run] upload skipped"; else ./upload.sh; fi
 
# 2) Turn paths into URLs. Different query strings are different cache entries,
#    so pass exactly what the app requests.
files=$(printf '"%s%s",' $(for p in "$@"; do echo "$API_ORIGIN" "$p"; done))
body="{\"files\":[${files%,}]}"
 
if [ "$DRY" -eq 1 ]; then echo "[dry-run] POST purge_cache $body"; exit 0; fi
 
# 3) Treat anything but success:true as failure
out=$(curl -sS -X POST "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/purge_cache" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" -H "Content-Type: application/json" --data "$body")
echo "$out" | grep -q '"success":true' || { echo "Purge failed: $out" >&2; exit 1; }
echo "Purged: $*"

Add exactly one Cloudflare Cache Rule.
- Target: only paths starting with /v1/list on api.example.com
- Edge TTL: override_origin (300 seconds); Browser TTL: respect_origin
- First save the current entrypoint ruleset to before-cache-rules.json
- PUT replaces existing rules, so include the saved rules in what you send
- Afterwards run edge-ttl-check.mjs 4 times and report that the cache-control column did not change
- Do not touch other paths or other zones