fix: prevent caching live API responses (#109)

src/main.py

@@ -30,6 +30,14 @@ app.mount("/static", StaticFiles(directory=FRONTEND_DIR), name="static")
 app.include_router(frontend_router)
 
 
+@app.middleware("http")
+async def prevent_live_api_caching(request, call_next):
+    response = await call_next(request)
+    if request.url.path in {"/api/v1/context", "/api/v1/events"}:
+        response.headers["Cache-Control"] = "no-store"
+    return response
+
+
 @app.get("/healthz")
 def health() -> dict[str, str]:
     """Return process liveness without depending on Gitea."""

tests/test_api_cache_policy.py

@@ -0,0 +1,30 @@
+import httpx
+import pytest
+
+from src import main
+
+
+@pytest.mark.anyio
+async def test_live_gitea_api_responses_cannot_be_stored_by_shared_caches(monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy"}
+
+    async def empty_collection():
+        return []
+
+    async def empty_events():
+        return []
+
+    monkeypatch.setattr(main, "current_user", user)
+    monkeypatch.setattr(main, "repos", empty_collection)
+    monkeypatch.setattr(main, "issues", empty_collection)
+    monkeypatch.setattr(main, "pull_requests", empty_collection)
+    monkeypatch.setattr(main, "activity_events", empty_events)
+
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        for path in ("/api/v1/context", "/api/v1/events"):
+            response = await client.get(path)
+
+            assert response.status_code == 200
+            assert response.headers["cache-control"] == "no-store"