Choose how whole-set responses are cached and revalidated #916

Summary

Repeat requests for whole score sets rebuild the same response every time. This issue picks how those responses are stored, kept current and revalidated. The decision is posted here as a comment and uses the measurements from the profiling investigation. Making the largest score sets servable at all is streaming's job (#451, #770) and doesn't wait on this issue.

Scope

• Routes: the lean variant view (GET /score-sets/{urn}/variants), the score set CSV routes, and GET /score-sets/{urn}/variant-details.
• The lean view is the score set page's main data source. It takes no viewer, so every reader of a score set gets the same bytes.
• Requests with as_of stay uncached.
• Bulk download across score sets is the public data dump's job. The API serves people working with one score set at a time.

Options

Where the bytes come from:

• Build every time, made cheap by streaming
• Redis response cache (Cache public CSV responses (first consumer of the API cache) #771, mavedb-deployment#32)
• S3 objects named by data version, filled one of three ways:
  • during the first request;
  • by a worker job behind a 202 and a status URL, with no request time limit;
  • ahead of time by the worker when the score set's data changes.
• CloudFront in front of the S3 objects
• A CloudFront flat-rate plan in front of the API with caching off, for its included WAF and DDoS protection at a fixed price

How freshness is known:

• A TTL
• Invalidation events
• A data_version column on the score set, bumped by every writer that changes its data
• A body hash stored with the cached copy and served as a strong ETag

Decision criteria

1. The largest score set's page and downloads complete with no warm cache.
2. The added AWS cost is no more than the saving from running 2 API servers instead of 3.
3. No new stateful service unless it also serves the per-user rate limits, or nothing else covers the largest score sets.
4. Private data is never stored in or served from a shared cache.
5. S3 or CloudFront objects, if chosen, are reached only through short-lived URLs the API issues.

What to produce

A comment that:

• names the chosen combination and how it scores against each criterion;
• lists the implementation issues it creates or changes, including whether Cache public CSV responses (first consumer of the API cache) #771 stays as written.

Acceptance criteria

• The decision comment is posted, with a reason for each option not chosen.
• Implementation issues are filed or updated and linked here.