sneak/webhooker
1
0
Fork 0
Code Issues 13 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add NoCache middleware for authenticated pages (closes #61) #75

Merged
sneak merged 1 commits from issue-61-no-store into main 2026-08-07 15:33:44 +02:00
Conversation 2 Commits 1 Files Changed 3 +63
clawbot commented 2026-08-07 14:49:02 +02:00
Collaborator
Copy Link

Adds a NoCache() middleware that sets Cache-Control: no-store and Pragma: no-cache, and wires it onto the dynamic app route groups (/pages, /user/{username}, /sources, /source/{sourceID}) adjacent to their existing CSRF() call. The static /s mount, /metrics, /webhook/{uuid}, and /.well-known/healthcheck are intentionally left untouched (static assets are safe to cache; the others are not authenticated pages).

A middleware unit test asserts both headers are set.

Closes #61

Adds a `NoCache()` middleware that sets `Cache-Control: no-store` and `Pragma: no-cache`, and wires it onto the dynamic app route groups (`/pages`, `/user/{username}`, `/sources`, `/source/{sourceID}`) adjacent to their existing `CSRF()` call. The static `/s` mount, `/metrics`, `/webhook/{uuid}`, and `/.well-known/healthcheck` are intentionally left untouched (static assets are safe to cache; the others are not authenticated pages). A middleware unit test asserts both headers are set. Closes #61
clawbot added 1 commit 2026-08-07 14:49:02 +02:00
Add NoCache middleware for authenticated pages (closes #61)
All checks were successful
check / check (push) Successful in 5s
Details
995d1e7a8f
clawbot commented 2026-08-07 14:49:09 +02:00
Author
Collaborator
Copy Link

Diff summary (3 files, +63):

  • internal/middleware/middleware.go — new NoCache() middleware, same constructor style as SecurityHeaders(); sets Cache-Control: no-store and Pragma: no-cache, then calls the next handler.
  • internal/server/routes.go — r.Use(s.mw.NoCache()) added adjacent to the existing CSRF() call on the /pages, /user/{username}, /sources, and /source/{sourceID} groups. Not applied to /s, /metrics, /webhook/{uuid}, or /.well-known/healthcheck.
  • internal/middleware/middleware_test.go — TestNoCache_SetsHeaders asserts both headers are set and the next handler is invoked.

Validation: make fmt then docker build . (runs fmt-check, lint, test, build) exited 0:

DOCKER_BUILD_EXIT=0
#32 naming to docker.io/library/webhooker-issue61 done
#32 DONE
Diff summary (3 files, +63): - `internal/middleware/middleware.go` — new `NoCache()` middleware, same constructor style as `SecurityHeaders()`; sets `Cache-Control: no-store` and `Pragma: no-cache`, then calls the next handler. - `internal/server/routes.go` — `r.Use(s.mw.NoCache())` added adjacent to the existing `CSRF()` call on the `/pages`, `/user/{username}`, `/sources`, and `/source/{sourceID}` groups. Not applied to `/s`, `/metrics`, `/webhook/{uuid}`, or `/.well-known/healthcheck`. - `internal/middleware/middleware_test.go` — `TestNoCache_SetsHeaders` asserts both headers are set and the next handler is invoked. Validation: `make fmt` then `docker build .` (runs fmt-check, lint, test, build) exited 0: ``` DOCKER_BUILD_EXIT=0 #32 naming to docker.io/library/webhooker-issue61 done #32 DONE ```
clawbot commented 2026-08-07 14:52:00 +02:00
Author
Collaborator
Copy Link

Independent review — PASS (merge-ready)

Adversarial review against the issue spec and repo policies.

  • internal/middleware/middleware.go: NoCache() sets Cache-Control: no-store and Pragma: no-cache, then calls the next handler — same constructor style as SecurityHeaders().
  • internal/server/routes.go: applied to the /pages, /user/{username}, /sources, and /source/{sourceID} groups (adjacent to CSRF()), integrating cleanly with the now-merged RequireAuth on /user. Correctly not applied to /s, /metrics, /webhook/{uuid}, or /.well-known/healthcheck.
  • TestNoCache_SetsHeaders asserts both headers are set and the next handler runs — matches the definition of done, which asked only for a middleware unit test.
  • Scope limited to the three intended files; make fmt clean; docker build . green; no AI/tooling references; commit subject closes the issue.

Verdict: meets the bar. Marking merge-ready and handing to @sneak for final review.

## Independent review — PASS (merge-ready) Adversarial review against the issue spec and repo policies. - `internal/middleware/middleware.go`: `NoCache()` sets `Cache-Control: no-store` and `Pragma: no-cache`, then calls the next handler — same constructor style as `SecurityHeaders()`. - `internal/server/routes.go`: applied to the `/pages`, `/user/{username}`, `/sources`, and `/source/{sourceID}` groups (adjacent to `CSRF()`), integrating cleanly with the now-merged `RequireAuth` on `/user`. Correctly not applied to `/s`, `/metrics`, `/webhook/{uuid}`, or `/.well-known/healthcheck`. - `TestNoCache_SetsHeaders` asserts both headers are set and the next handler runs — matches the definition of done, which asked only for a middleware unit test. - Scope limited to the three intended files; `make fmt` clean; `docker build .` green; no AI/tooling references; commit subject closes the issue. Verdict: meets the bar. Marking merge-ready and handing to @sneak for final review.
sneak was assigned by clawbot 2026-08-07 14:52:01 +02:00
sneak merged commit 8ea7f76540 into main 2026-08-07 15:33:44 +02:00
sneak deleted branch issue-61-no-store 2026-08-07 15:33:45 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
clawbot sneak
No Assignees sneak
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/webhooker#75
Delete Branch "issue-61-no-store"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?