yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): Implement API response Cache-Control

Browse Source 
- Introduce `withCacheControl` utility function for API responses.
- Apply `private, no-store` to authentication and data modification (POST, PATCH, DELETE) routes.
- Apply `private, no-cache` to sensitive data retrieval (GET) routes.
- Enhance security by preventing caching of private user data.
- Ensure fresh data is always fetched for authenticated API responses.
This commit is contained in:
Yusuf İpek
2026-02-07 16:51:46 +03:00
parent 669f6fa9d2
commit 6e8170d080
24 changed files with 179 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/projects/[projectId]/members/[memberId]/route.ts
+5 -3
View File
@@ -3,7 +3,7 @@ import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string; memberId: string }> };
@@ -52,7 +52,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse(member);
const response = successResponse(member);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error updating member role:', error);
return apiErrors.internalError('Failed to update member role');
@@ -100,7 +101,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
await db.projectMember.delete({ where: { id: memberId } });
return successResponse({ message: 'Member removed' });
const response = successResponse({ message: 'Member removed' });
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error removing member:', error);
return apiErrors.internalError('Failed to remove member');
app/api/projects/[projectId]/members/route.ts
+7 -4
View File
@@ -3,7 +3,7 @@ import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string }> };
@@ -48,7 +48,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
select: { id: true, name: true, image: true },
});
return successResponse({ members, owner });
const response = successResponse({ members, owner });
return withCacheControl(response, 'private, max-age=60, stale-while-revalidate=120');
} catch (error) {
console.error('Error fetching project members:', error);
return apiErrors.internalError('Failed to fetch members');
@@ -102,7 +103,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
});
if (!userToInvite) {
return successResponse({ message: 'If the user exists, an invitation has been sent.' });
const response = successResponse({ message: 'If the user exists, an invitation has been sent.' });
return withCacheControl(response, 'private, no-store');
}
if (userToInvite.id === project.ownerId) {
@@ -129,7 +131,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse(member, 201);
const response = successResponse(member, 201);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error inviting project member:', error);
return apiErrors.internalError('Failed to invite member');
app/api/projects/[projectId]/route.ts
+8 -5
View File
@@ -1,10 +1,10 @@
import { NextRequest, NextResponse } from 'next/server';
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole, ProjectVisibility } from '@prisma/client';
import { rateLimit } from '@/lib/rate-limit';
import { cleanupProjectVoiceFiles } from '@/lib/r2-cleanup';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string }> };
@@ -107,7 +107,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
return apiErrors.forbidden('Access denied');
}
return successResponse(project);
const response = successResponse(project);
return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
} catch (error) {
console.error('Error fetching project:', error);
return apiErrors.internalError('Failed to fetch project');
@@ -149,7 +150,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse(project);
const response = successResponse(project);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error updating project:', error);
return apiErrors.internalError('Failed to update project');
@@ -184,7 +186,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
await db.project.delete({ where: { id: projectId } });
return successResponse({ message: 'Project deleted' });
const response = successResponse({ message: 'Project deleted' });
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error deleting project:', error);
return apiErrors.internalError('Failed to delete project');
app/api/projects/[projectId]/tags/[tagId]/route.ts
+5 -3
View File
@@ -2,7 +2,7 @@ import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string; tagId: string }> };
@@ -91,7 +91,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
data: updateData,
});
return successResponse(tag);
const response = successResponse(tag);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error updating tag:', error);
if ((error as { code?: string }).code === 'P2002') {
@@ -132,7 +133,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
await db.commentTag.delete({ where: { id: tagId } });
return successResponse({ message: 'Tag deleted' });
const response = successResponse({ message: 'Tag deleted' });
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error deleting tag:', error);
return apiErrors.internalError('Failed to delete tag');
app/api/projects/[projectId]/tags/route.ts
+5 -3
View File
@@ -2,7 +2,7 @@ import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string }> };
@@ -79,7 +79,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
});
}
return successResponse(tags);
const response = successResponse(tags);
return withCacheControl(response, 'private, max-age=120, stale-while-revalidate=300');
} catch (error) {
console.error('Error fetching tags:', error);
return apiErrors.internalError('Failed to fetch tags');
@@ -134,7 +135,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse(tag, 201);
const response = successResponse(tag, 201);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error creating tag:', error);
if ((error as { code?: string }).code === 'P2002') {
app/api/projects/[projectId]/videos/[videoId]/route.ts
+8 -4
View File
@@ -4,7 +4,7 @@ import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
import { rateLimit } from '@/lib/rate-limit';
import { cleanupVideoVoiceFiles } from '@/lib/r2-cleanup';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string; videoId: string }> };
@@ -57,10 +57,12 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
return apiErrors.forbidden('Access denied');
}
return successResponse({
const response = successResponse({
...video,
isAuthenticated: !!session?.user?.id,
});
return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
} catch (error) {
console.error('Error fetching video:', error);
return apiErrors.internalError('Failed to fetch video');
@@ -117,7 +119,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse(updatedVideo);
const response = successResponse(updatedVideo);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error updating video:', error);
return apiErrors.internalError('Failed to update video');
@@ -162,7 +165,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
await db.video.delete({ where: { id: videoId } });
return successResponse({ message: 'Video deleted' });
const response = successResponse({ message: 'Video deleted' });
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error deleting video:', error);
return apiErrors.internalError('Failed to delete video');
app/api/projects/[projectId]/videos/[videoId]/versions/route.ts
+5 -3
View File
@@ -4,7 +4,7 @@ import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
import { validateUrl, validateOptionalUrl } from '@/lib/validation';
import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string; videoId: string }> };
@@ -43,7 +43,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse({ versions });
const response = successResponse({ versions });
return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
} catch (error) {
console.error('Error fetching versions:', error);
return apiErrors.internalError('Failed to fetch versions');
@@ -133,7 +134,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
});
});
return successResponse(version, 201);
const response = successResponse(version, 201);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error creating version:', error);
return apiErrors.internalError('Failed to create version');
app/api/projects/[projectId]/videos/route.ts
+5 -3
View File
@@ -5,7 +5,7 @@ import { ProjectMemberRole } from '@prisma/client';
import { validateUrl, validateOptionalUrl } from '@/lib/validation';
import { rateLimit } from '@/lib/rate-limit';
import { notifyProjectOwner } from '@/lib/notifications';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string }> };
@@ -47,7 +47,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse({ videos });
const response = successResponse({ videos });
return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
} catch (error) {
console.error('Error fetching videos:', error);
return apiErrors.internalError('Failed to fetch videos');
@@ -149,7 +150,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
}).catch((err) => console.error('Notification failed:', err));
}
return successResponse(video, 201);
const response = successResponse(video, 201);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error creating video:', error);
return apiErrors.internalError('Failed to create video');