Module responsecache 

Laravel’s spatie/laravel-responsecache - narrowed to its core shape, same “names/assignment split” reasoning larust-permissions’s own doc comment used for its own narrowing (see crates/larust-permissions/src/ lib.rs): this caches GET responses with a 200 status, keyed by URL, backed by larust-cache (which already owns its own table bootstrap and expiry sweep - this module adds no new table, just a value shape to store in the existing one).

Opt-in per router/route via .middleware(...), the same as crate::throttle - never part of larust_core::Application::serve’s own default middleware stack.

Deliberately out of scope for this version

• No Accept/content-negotiation Vary. This cache is purely server-side (backed by larust_cache, never a browser or proxy cache), so there’s no real HTTP Vary semantics to implement - only the cache key needs to account for whatever the response actually depends on. Two requests to the same URL differing only in Accept or another header still collide (same cached entry either way); if a route genuinely content-negotiates, don’t cache it, the same guidance as always. Per-session variance (the “auth state” half of the original limitation here) is now handled - see for_minutes_per_session.
• No auto-invalidation on writes. Laravel’s package can auto-clear on any non-GET request; this crate only offers forget (a single URL) and TTL expiry - an app that needs eager invalidation calls forget itself wherever it mutates the underlying data.
• No bulk “clear everything.” larust_cache has no key-prefix scan API to build one on top of - a real follow-up if ever needed, not a gap worth solving speculatively here.
• Only Content-Type survives a cache hit. Every other response header is dropped on a cached replay. Responses that set a cookie or declare Cache-Control: private, no-cache, or no-store are never stored at all: caching them in this shared cache could otherwise leak personalized content to a later visitor.

Structs

ResponseCacheState

pub only because it has to appear in for_minutes/for_duration’s public return type - every field stays private, matching crate::throttle::ThrottleState’s own reasoning.

Functions

for_duration

The general form behind for_minutes. Returns the fully concrete FromFnLayer<...> type rather than an opaque impl Trait - same reasoning as crate::throttle::per’s own doc comment: an app in a different crate calling .middleware(responsecache::for_minutes(5)) needs every real trait bound on the returned value visible, which an opaque return type would erase.

for_duration_per_session

The general form behind for_minutes_per_session.

for_minutes

Caches for minutes minutes, keyed by URL alone - see this module’s own doc comment for why that means every viewer of a given URL shares one cached response. Use for_minutes_per_session instead for a route whose response depends on who’s asking.

for_minutes_per_session

Caches for minutes minutes, keyed by URL and session - a cache hit for one visitor is never served to another. This is the fix for the “no per-user caching” half of this module’s original limitation: the cache key incorporates the session id (from Session::id(), the same cookie-backed identity require_auth/CSRF already key off), not a raw Cookie header or full HTTP Vary semantics - this cache has no browser/proxy audience to announce a Vary header to, so only the key itself needs to account for the viewer. Requires .with_sessions(...) to already be enabled on this router (same requirement CSRF/Session extraction anywhere else already has) - Session is one of this method’s own extractors, so applying it to a router with no session layer fails to compile the same way any other Session-extracting handler would.

forget

Manually evicts one URL’s cached entry - Laravel’s own ResponseCache::forget($url), narrowed to a single URL (see this module’s own doc comment for why there’s no bulk clear).