yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): Implement API response Cache-Control

Browse Source 
- Introduce `withCacheControl` utility function for API responses.
- Apply `private, no-store` to authentication and data modification (POST, PATCH, DELETE) routes.
- Apply `private, no-cache` to sensitive data retrieval (GET) routes.
- Enhance security by preventing caching of private user data.
- Ensure fresh data is always fetched for authenticated API responses.
This commit is contained in:
Yusuf İpek
2026-02-07 16:51:46 +03:00
parent 669f6fa9d2
commit 6e8170d080
24 changed files with 179 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/projects/[projectId]/videos/[videoId]/route.ts
+8 -4
View File
@@ -4,7 +4,7 @@ import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
import { rateLimit } from '@/lib/rate-limit';
import { cleanupVideoVoiceFiles } from '@/lib/r2-cleanup';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string; videoId: string }> };
@@ -57,10 +57,12 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
return apiErrors.forbidden('Access denied');
}
return successResponse({
const response = successResponse({
...video,
isAuthenticated: !!session?.user?.id,
});
return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
} catch (error) {
console.error('Error fetching video:', error);
return apiErrors.internalError('Failed to fetch video');
@@ -117,7 +119,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse(updatedVideo);
const response = successResponse(updatedVideo);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error updating video:', error);
return apiErrors.internalError('Failed to update video');
@@ -162,7 +165,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
await db.video.delete({ where: { id: videoId } });
return successResponse({ message: 'Video deleted' });
const response = successResponse({ message: 'Video deleted' });
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error deleting video:', error);
return apiErrors.internalError('Failed to delete video');
app/api/projects/[projectId]/videos/[videoId]/versions/route.ts
+5 -3
View File
@@ -4,7 +4,7 @@ import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
import { validateUrl, validateOptionalUrl } from '@/lib/validation';
import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string; videoId: string }> };
@@ -43,7 +43,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse({ versions });
const response = successResponse({ versions });
return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
} catch (error) {
console.error('Error fetching versions:', error);
return apiErrors.internalError('Failed to fetch versions');
@@ -133,7 +134,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
});
});
return successResponse(version, 201);
const response = successResponse(version, 201);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error creating version:', error);
return apiErrors.internalError('Failed to create version');