From cb19be925a46ea6a4f32a07c5b06e59893f08686 Mon Sep 17 00:00:00 2001
From: Mathieu Leplatre <mathieu@mozilla.com>
Date: Thu, 19 Mar 2026 18:09:13 +0100
Subject: [PATCH 1/2] RMST-208: introduce the
 record_cache_minimum_expires_seconds setting

---
 kinto-remote-settings/README.rst              | 11 +++++++--
 .../kinto_remote_settings/changes/views.py    | 22 ++++++++++++++++--
 .../tests/changes/test_changeset.py           | 23 ++++++++++++++++---
 3 files changed, 49 insertions(+), 7 deletions(-)

diff --git a/kinto-remote-settings/README.rst b/kinto-remote-settings/README.rst
index 618595fc..6469c828 100644
--- a/kinto-remote-settings/README.rst
+++ b/kinto-remote-settings/README.rst
@@ -33,8 +33,15 @@ Like `cache control in Kinto collections <https://kinto.readthedocs.io/en/stable
 
     kinto.monitor.changes.record_cache_expires_seconds = 60
 
-If cache busting query parameters then responses can be cached more agressively.
-If the setting below is set then a different cache control expiration will be set:
+If cache busting query parameters are present then responses can be cached more finely.
+
+When ``_expected=0``, the minimum TTL will be used (if defined):
+
+.. code-block:: ini
+
+    kinto.monitor.changes.record_cache_minimum_expires_seconds = 60
+
+With real timestamp values ``_expected=1773913097658``, the maximum will be used:
 
 .. code-block:: ini
 
diff --git a/kinto-remote-settings/src/kinto_remote_settings/changes/views.py b/kinto-remote-settings/src/kinto_remote_settings/changes/views.py
index 0f0549a3..36e8ce9b 100644
--- a/kinto-remote-settings/src/kinto_remote_settings/changes/views.py
+++ b/kinto-remote-settings/src/kinto_remote_settings/changes/views.py
@@ -157,10 +157,28 @@ def _handle_cache_expires(request, bid, cid):
     settings = request.registry.settings
     prefix = f"{bid}.{cid}.record_cache"
     default_expires = settings.get(f"{prefix}_expires_seconds")
+    minimum_expires = settings.get(f"{prefix}_minimum_expires_seconds", default_expires)
     maximum_expires = settings.get(f"{prefix}_maximum_expires_seconds", default_expires)
 
-    has_cache_busting = "_expected" in request.GET
-    cache_expires = maximum_expires if has_cache_busting else default_expires
+    if cache_bust_value := request.GET.get("_expected"):
+        # If cache busting value is "0", or starts with "9999" (random cache busts values
+        # in our libraries), then we reduce the CDN cache TTL. This should help our users
+        # when QA'ing their changes.
+        #
+        # Important:
+        # - `_expected=0` is used in the Rust client when polling changes:
+        #   https://github.com/mozilla/application-services/blob/3c2907c0d/components/remote_settings/src/client.rs#L657-L662
+        # - `_expected=0` is used in Desktop client on `.get()` with an empty DB
+        #   https://searchfox.org/firefox-main/rev/fa20ce29b1a82b/services/settings/RemoteSettingsClient.sys.mjs#496
+        #   https://searchfox.org/firefox-main/rev/fa20ce29b1a82b/services/settings/RemoteSettingsClient.sys.mjs#658-666
+        if cache_bust_value == "0" or cache_bust_value.startswith("9999"):
+            cache_expires = minimum_expires
+        else:
+            cache_expires = maximum_expires
+    else:
+        # If cache busting is not present, we use the default expires value.
+        # This can only happen in the /records endpoint since _expected is mandatory in /changeset.
+        cache_expires = default_expires
 
     if cache_expires is not None:
         request.response.cache_expires(seconds=int(cache_expires))
diff --git a/kinto-remote-settings/tests/changes/test_changeset.py b/kinto-remote-settings/tests/changes/test_changeset.py
index 6678276b..e6833f9e 100644
--- a/kinto-remote-settings/tests/changes/test_changeset.py
+++ b/kinto-remote-settings/tests/changes/test_changeset.py
@@ -28,6 +28,8 @@ def get_app_settings(cls, extras=None):
         settings["record_cache_expires_seconds"] = "180"
         settings["main.record_cache_expires_seconds"] = "360"
         settings["blocklists.certificates.record_cache_expires_seconds"] = 1234
+        settings["blocklists.certificates.record_cache_minimum_expires_seconds"] = 42
+        settings["blocklists.certificates.record_cache_maximum_expires_seconds"] = 3600
         return settings
 
     def test_changeset_is_accessible(self):
@@ -153,9 +155,24 @@ def test_limit_is_bounded(self):
     def test_extra_param_is_allowed(self):
         self.app.get(self.changeset_uri + "&_extra=abc", headers=self.headers)
 
-    def test_cache_control_headers_are_set(self):
-        resp = self.app.get(self.changeset_uri, headers=self.headers)
-        assert resp.headers["Cache-Control"] == "max-age=1234"
+    def test_cache_control_headers_are_set_to_maximum_if_expected_is_set(self):
+        resp = self.app.get(
+            "/buckets/blocklists/collections/certificates/changeset?_expected=1773913097658",
+            headers=self.headers,
+        )
+        assert resp.headers["Cache-Control"] == "max-age=3600"
+
+    def test_cache_control_headers_are_set_to_minimum_if_0_or_9999(self):
+        resp = self.app.get(
+            "/buckets/blocklists/collections/certificates/changeset?_expected=0",
+            headers=self.headers,
+        )
+        assert resp.headers["Cache-Control"] == "max-age=42"
+        resp = self.app.get(
+            "/buckets/blocklists/collections/certificates/changeset?_expected=99999996565",
+            headers=self.headers,
+        )
+        assert resp.headers["Cache-Control"] == "max-age=42"
 
     def test_cache_control_can_be_set_per_bucket(self):
         self.create_collection("main", "cfr")

From bff3f56e01084f42f33c545b23a23809155f3a64 Mon Sep 17 00:00:00 2001
From: Mathieu Leplatre <mathieu@mozilla.com>
Date: Thu, 19 Mar 2026 19:02:16 +0100
Subject: [PATCH 2/2] Fix make lint

---
 .secrets.baseline | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.secrets.baseline b/.secrets.baseline
index 7fe16380..64548141 100644
--- a/.secrets.baseline
+++ b/.secrets.baseline
@@ -182,7 +182,7 @@
         "filename": "kinto-remote-settings/README.rst",
         "hashed_secret": "3650b7f537d2e64041a1e2ae269361c7480737ab",
         "is_verified": false,
-        "line_number": 413
+        "line_number": 420
       }
     ],
     "kinto-remote-settings/tests/changes/config.ini": [
@@ -261,5 +261,5 @@
       }
     ]
   },
-  "generated_at": "2026-03-04T15:02:45Z"
+  "generated_at": "2026-03-19T18:01:04Z"
 }