From de139ba8c488674f75fcf3a18cada12a7843b6b3 Mon Sep 17 00:00:00 2001
From: Jacob Coffee <jacob@z7x.org>
Date: Mon, 15 Dec 2025 14:33:15 -0600
Subject: [PATCH] skip cache for auth'd users  on downloads

---
 infra/cdn/main.tf | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/infra/cdn/main.tf b/infra/cdn/main.tf
index 91cac411e..a65d5487b 100644
--- a/infra/cdn/main.tf
+++ b/infra/cdn/main.tf
@@ -124,6 +124,12 @@ resource "fastly_service_vcl" "python_org" {
     statement = "req.url ~ \"^/(api|admin)/\""
     type      = "REQUEST"
   }
+  condition {
+    name      = "Authenticated Downloads"
+    priority  = 10
+    statement = "req.url ~ \"^/downloads/\" && req.http.Cookie ~ \"sessionid=\""
+    type      = "REQUEST"
+  }
   condition {
     name      = "apex redirect"
     priority  = 10
@@ -350,6 +356,15 @@ resource "fastly_service_vcl" "python_org" {
     request_condition = "Uncacheable URLs"
     xff               = "append"
   }
+  request_setting {
+    action            = "pass"
+    bypass_busy_wait  = false
+    force_ssl         = false
+    max_stale_age     = 60
+    name              = "Pass Authenticated Downloads"
+    request_condition = "Authenticated Downloads"
+    xff               = "append"
+  }
 
   response_object {
     name              = "www redirect"