Adds a NoCache() middleware that sets Cache-Control: no-store and Pragma: no-cache, and wires it onto the dynamic app route groups (/pages, /user/{username}, /sources, /source/{sourceID}) adjacent to their existing CSRF() call. The static /s mount, /metrics, /webhook/{uuid}, and /.well-known/healthcheck are intentionally left untouched (static assets are safe to cache; the others are not authenticated pages).
A middleware unit test asserts both headers are set.
Adds a `NoCache()` middleware that sets `Cache-Control: no-store` and `Pragma: no-cache`, and wires it onto the dynamic app route groups (`/pages`, `/user/{username}`, `/sources`, `/source/{sourceID}`) adjacent to their existing `CSRF()` call. The static `/s` mount, `/metrics`, `/webhook/{uuid}`, and `/.well-known/healthcheck` are intentionally left untouched (static assets are safe to cache; the others are not authenticated pages).
A middleware unit test asserts both headers are set.
Closes #61
internal/middleware/middleware.go — new NoCache() middleware, same constructor style as SecurityHeaders(); sets Cache-Control: no-store and Pragma: no-cache, then calls the next handler.
internal/server/routes.go — r.Use(s.mw.NoCache()) added adjacent to the existing CSRF() call on the /pages, /user/{username}, /sources, and /source/{sourceID} groups. Not applied to /s, /metrics, /webhook/{uuid}, or /.well-known/healthcheck.
internal/middleware/middleware_test.go — TestNoCache_SetsHeaders asserts both headers are set and the next handler is invoked.
Validation: make fmt then docker build . (runs fmt-check, lint, test, build) exited 0:
DOCKER_BUILD_EXIT=0
#32 naming to docker.io/library/webhooker-issue61 done
#32 DONE
Diff summary (3 files, +63):
- `internal/middleware/middleware.go` — new `NoCache()` middleware, same constructor style as `SecurityHeaders()`; sets `Cache-Control: no-store` and `Pragma: no-cache`, then calls the next handler.
- `internal/server/routes.go` — `r.Use(s.mw.NoCache())` added adjacent to the existing `CSRF()` call on the `/pages`, `/user/{username}`, `/sources`, and `/source/{sourceID}` groups. Not applied to `/s`, `/metrics`, `/webhook/{uuid}`, or `/.well-known/healthcheck`.
- `internal/middleware/middleware_test.go` — `TestNoCache_SetsHeaders` asserts both headers are set and the next handler is invoked.
Validation: `make fmt` then `docker build .` (runs fmt-check, lint, test, build) exited 0:
```
DOCKER_BUILD_EXIT=0
#32 naming to docker.io/library/webhooker-issue61 done
#32 DONE
```
Adversarial review against the issue spec and repo policies.
internal/middleware/middleware.go: NoCache() sets Cache-Control: no-store and Pragma: no-cache, then calls the next handler — same constructor style as SecurityHeaders().
internal/server/routes.go: applied to the /pages, /user/{username}, /sources, and /source/{sourceID} groups (adjacent to CSRF()), integrating cleanly with the now-merged RequireAuth on /user. Correctly not applied to /s, /metrics, /webhook/{uuid}, or /.well-known/healthcheck.
TestNoCache_SetsHeaders asserts both headers are set and the next handler runs — matches the definition of done, which asked only for a middleware unit test.
Scope limited to the three intended files; make fmt clean; docker build . green; no AI/tooling references; commit subject closes the issue.
Verdict: meets the bar. Marking merge-ready and handing to @sneak for final review.
## Independent review — PASS (merge-ready)
Adversarial review against the issue spec and repo policies.
- `internal/middleware/middleware.go`: `NoCache()` sets `Cache-Control: no-store` and `Pragma: no-cache`, then calls the next handler — same constructor style as `SecurityHeaders()`.
- `internal/server/routes.go`: applied to the `/pages`, `/user/{username}`, `/sources`, and `/source/{sourceID}` groups (adjacent to `CSRF()`), integrating cleanly with the now-merged `RequireAuth` on `/user`. Correctly not applied to `/s`, `/metrics`, `/webhook/{uuid}`, or `/.well-known/healthcheck`.
- `TestNoCache_SetsHeaders` asserts both headers are set and the next handler runs — matches the definition of done, which asked only for a middleware unit test.
- Scope limited to the three intended files; `make fmt` clean; `docker build .` green; no AI/tooling references; commit subject closes the issue.
Verdict: meets the bar. Marking merge-ready and handing to @sneak for final review.
sneak
was assigned by clawbot2026-08-07 14:52:01 +02:00
sneak
merged commit 8ea7f76540 into main2026-08-07 15:33:44 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Adds a
NoCache()middleware that setsCache-Control: no-storeandPragma: no-cache, and wires it onto the dynamic app route groups (/pages,/user/{username},/sources,/source/{sourceID}) adjacent to their existingCSRF()call. The static/smount,/metrics,/webhook/{uuid}, and/.well-known/healthcheckare intentionally left untouched (static assets are safe to cache; the others are not authenticated pages).A middleware unit test asserts both headers are set.
Closes #61
Diff summary (3 files, +63):
internal/middleware/middleware.go— newNoCache()middleware, same constructor style asSecurityHeaders(); setsCache-Control: no-storeandPragma: no-cache, then calls the next handler.internal/server/routes.go—r.Use(s.mw.NoCache())added adjacent to the existingCSRF()call on the/pages,/user/{username},/sources, and/source/{sourceID}groups. Not applied to/s,/metrics,/webhook/{uuid}, or/.well-known/healthcheck.internal/middleware/middleware_test.go—TestNoCache_SetsHeadersasserts both headers are set and the next handler is invoked.Validation:
make fmtthendocker build .(runs fmt-check, lint, test, build) exited 0:Independent review — PASS (merge-ready)
Adversarial review against the issue spec and repo policies.
internal/middleware/middleware.go:NoCache()setsCache-Control: no-storeandPragma: no-cache, then calls the next handler — same constructor style asSecurityHeaders().internal/server/routes.go: applied to the/pages,/user/{username},/sources, and/source/{sourceID}groups (adjacent toCSRF()), integrating cleanly with the now-mergedRequireAuthon/user. Correctly not applied to/s,/metrics,/webhook/{uuid}, or/.well-known/healthcheck.TestNoCache_SetsHeadersasserts both headers are set and the next handler runs — matches the definition of done, which asked only for a middleware unit test.make fmtclean;docker build .green; no AI/tooling references; commit subject closes the issue.Verdict: meets the bar. Marking merge-ready and handing to @sneak for final review.