From 7c13bb1663697a16d1c42770e1411bd814fc0b3a Mon Sep 17 00:00:00 2001
From: timmy <timmy@stackchain.ai>
Date: Thu, 6 Aug 2026 13:47:27 +0000
Subject: [PATCH] fix: prevent caching live API responses (#109)

---
 src/main.py                    |  8 ++++++++
 tests/test_api_cache_policy.py | 30 ++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 tests/test_api_cache_policy.py

diff --git a/src/main.py b/src/main.py
index 29570a8..b04f38e 100644
--- a/src/main.py
+++ b/src/main.py
@@ -30,6 +30,14 @@ app.mount("/static", StaticFiles(directory=FRONTEND_DIR), name="static")
 app.include_router(frontend_router)
 
 
+@app.middleware("http")
+async def prevent_live_api_caching(request, call_next):
+    response = await call_next(request)
+    if request.url.path in {"/api/v1/context", "/api/v1/events"}:
+        response.headers["Cache-Control"] = "no-store"
+    return response
+
+
 @app.get("/healthz")
 def health() -> dict[str, str]:
     """Return process liveness without depending on Gitea."""
diff --git a/tests/test_api_cache_policy.py b/tests/test_api_cache_policy.py
new file mode 100644
index 0000000..c4a69fa
--- /dev/null
+++ b/tests/test_api_cache_policy.py
@@ -0,0 +1,30 @@
+import httpx
+import pytest
+
+from src import main
+
+
+@pytest.mark.anyio
+async def test_live_gitea_api_responses_cannot_be_stored_by_shared_caches(monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy"}
+
+    async def empty_collection():
+        return []
+
+    async def empty_events():
+        return []
+
+    monkeypatch.setattr(main, "current_user", user)
+    monkeypatch.setattr(main, "repos", empty_collection)
+    monkeypatch.setattr(main, "issues", empty_collection)
+    monkeypatch.setattr(main, "pull_requests", empty_collection)
+    monkeypatch.setattr(main, "activity_events", empty_events)
+
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        for path in ("/api/v1/context", "/api/v1/events"):
+            response = await client.get(path)
+
+            assert response.status_code == 200
+            assert response.headers["cache-control"] == "no-store"
-- 
2.43.0