Cache only 200 SSR responses, not the 200-209 range

[Kasinhou]

Description

Replace the /^20+/ regex guard (allowing also 201-209) with statusCode === 200 check. SSR only caches 200 renders.
No regression, the only difference is that 201-209 responses are no longer cached.

AI Disclosure (REQUIRED)

Were AI tools used in the creation of this PR?

• No (This PR does NOT include AI-generated or AI-assisted content that requires disclosure.)
• Yes (This PR includes AI-generated or AI-assisted content that requires disclosure.)

AI (Claude Opus 4.8) helped me investigate where saving to cache is called and when saving is skipped, and to
suggest the change. I reviewed and modified the code. The change is only a one-line guard in server.ts.

Checklist

This checklist provides a reminder of what we are going to look for when reviewing your PR. You do not need to complete this checklist prior creating your PR (draft PRs are always welcome).
However, reviewers may request that you complete any actions in this list if you have not done so. If you are unsure about an item in the checklist, don't hesitate to ask. We're here to help!

• My PR is created against the main branch of code (unless it is a backport or is fixing an issue specific to an older branch).
• My PR is small in size (e.g. less than 1,000 lines of code, not including comments & specs/tests), or I have provided reasons as to why that's not possible.
• My PR follows all coding best practices based on the Code Conventions Guide
• My PR passes ESLint validation using npm run lint
• My PR doesn't introduce circular dependencies (verified via npm run check-circ-deps)
• My PR includes TypeDoc comments for all new (or modified) public methods and classes. It also includes TypeDoc for large or complex private methods.
• My PR passes all specs/tests and includes new/updated specs or tests based on the Code Testing Guide.
• My PR aligns with Accessibility guidelines if it makes changes to the user interface.
• My PR uses i18n (internationalization) keys instead of hardcoded English text, to allow for translations.
• My PR includes details on how to test it. I've provided clear instructions to reviewers on how to successfully test this fix or feature.
• If my PR includes new libraries/dependencies (in package.json), I've made sure their licenses align with the DSpace BSD License based on the Licensing of Contributions documentation.
• If my PR includes new features or configurations, I've provided basic technical documentation in the PR itself.
• If my PR fixes an issue ticket, I've linked them together.

[tdonohue]

@Kasinhou : Thanks for this contribution. However, it looks (to me) like this overlaps with changes already suggested in #6352 by @saschaszott ...except this PR makes different changes.

I think we'll need some more discussion between these two PR to determine which approach seems better for DSpace. It looks like there's disagreement over whether to cache all 2xx responses, or just specifically 200. (Personally, I can see both arguments...so I'd like to gather feedback from others here.)

[vidiecan]

@tdonohue @saschaszott I would argue that, specifically for the SSR page cache, this is straightforward: only HTTP 200 (GET) responses should be eligible for caching.

This is not a general statement about HTTP caching. Caching redirects (301, 308) or negative responses (404, 410) can make sense, but that is best handled as a separate concern with dedicated TTLs.

The purpose of the SSR cache is to store successfully rendered HTML pages using GET, rather than broader HTTP success states. For example:

• 201 Created: A resource was created.
• 202 Accepted: Processing was accepted but may not have completed.
• 203 Non-Authoritative Information: The response was modified by an intermediary.
• 204 No Content: No response body.
• 205 Reset Content: No response body.
• 206 Partial Content: Only part of a representation.
• ...

These do not seem to provide a useful reason to cache the response as a complete SSR-generated HTML page.

As far as I know, DSpace SSR does not currently produce these statuses. But accepting the entire 2xx range does not seem to add any practical benefit, while potentially allowing unexpected caching behaviour in the future.

To be precise, HTTP 200 is a necessary, but not sufficient, condition for caching a successfully rendered page. A rendering failure could still produce HTTP 200 with an error message in the HTML, but that is a separate issue.

For this particular cache, feels like the safest and cleanest baseline to accept only 200.

This applies also to #6352

[saschaszott]

@vidiecan , @tdonohue : I hadn't really considered the existing regex (btw: it checks for 20X instead of 2XX). I just wanted to replace it with a simpler range comparison. If you think we should only check for an exact 200 response code, then we should go with that.

However, perhaps @atarix83 could also provide some feedback on this regex check? He originally added it in this commit: 6a58e49

[tdonohue]

👍 Thanks @Kasinhou and @vidiecan ! After reviewing @vidiecan 's notes again, and testing this PR myself, I think this is a better approach than the current code. I agree that other this is sufficient because SSR is not going to return these other 2xx response codes, and even if it did, there's nothing useful to "cache" (i.e. often no response body).

I've also verified that this change doesn't reintroduce #2333 (which is the ticket fixed by the code which added this check against 2xx response codes).

So, this small change looks good to me. I'm going to merge it immediately and attempt to auto-backport it to our maintenance branches.

[dspace-bot]

Successfully created backport PR for dspace-8_x:

• [Port dspace-8_x] Cache only 200 SSR responses, not the 200-209 range #6369

[dspace-bot]

Successfully created backport PR for dspace-9_x:

• [Port dspace-9_x] Cache only 200 SSR responses, not the 200-209 range #6370

[dspace-bot]

Successfully created backport PR for dspace-10_x:

• [Port dspace-10_x] Cache only 200 SSR responses, not the 200-209 range #6371