feat(api): Implement API response Cache-Control

- Introduce `withCacheControl` utility function for API responses.
- Apply `private, no-store` to authentication and data modification (POST, PATCH, DELETE) routes.
- Apply `private, no-cache` to sensitive data retrieval (GET) routes.
- Enhance security by preventing caching of private user data.
- Ensure fresh data is always fetched for authenticated API responses.

app/api/workspaces/[workspaceId]/members/[memberId]/route.ts

@@ -3,7 +3,7 @@ import { db } from '@/lib/db';
 import { auth } from '@/lib/auth';
 import { WorkspaceMemberRole } from '@prisma/client';
 import { rateLimit } from '@/lib/rate-limit';
-import { apiErrors, successResponse } from '@/lib/api-response';
+import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ workspaceId: string; memberId: string }> };
 
@@ -53,7 +53,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
             },
         });
 
-        return successResponse(member);
+        const response = successResponse(member);
+        return withCacheControl(response, 'private, no-store');
     } catch (error) {
         console.error('Error updating member role:', error);
         return apiErrors.internalError('Failed to update member role');
@@ -102,7 +103,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
 
         await db.workspaceMember.delete({ where: { id: memberId } });
 
-        return successResponse({ message: 'Member removed' });
+        const response = successResponse({ message: 'Member removed' });
+        return withCacheControl(response, 'private, no-store');
     } catch (error) {
         console.error('Error removing member:', error);
         return apiErrors.internalError('Failed to remove member');

app/api/workspaces/[workspaceId]/members/route.ts

@@ -3,7 +3,7 @@ import { db } from '@/lib/db';
 import { auth } from '@/lib/auth';
 import { WorkspaceMemberRole } from '@prisma/client';
 import { rateLimit } from '@/lib/rate-limit';
-import { apiErrors, successResponse } from '@/lib/api-response';
+import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ workspaceId: string }> };
 
@@ -49,7 +49,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             select: { id: true, name: true, image: true },
         });
 
-        return successResponse({ members, owner });
+        const response = successResponse({ members, owner });
+        return withCacheControl(response, 'private, max-age=60, stale-while-revalidate=120');
     } catch (error) {
         console.error('Error fetching workspace members:', error);
         return apiErrors.internalError('Failed to fetch members');
@@ -103,7 +104,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         });
 
         if (!userToInvite) {
-            return successResponse({ message: 'If the user exists, an invitation has been sent.' });
+            const response = successResponse({ message: 'If the user exists, an invitation has been sent.' });
+        return withCacheControl(response, 'private, no-store');
         }
 
         if (userToInvite.id === workspace.ownerId) {
@@ -130,7 +132,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             },
         });
 
-        return successResponse(member, 201);
+        const response = successResponse(member, 201);
+        return withCacheControl(response, 'private, no-store');
     } catch (error) {
         console.error('Error inviting workspace member:', error);
         return apiErrors.internalError('Failed to invite member');

app/api/workspaces/[workspaceId]/route.ts

@@ -3,7 +3,7 @@ import { db } from '@/lib/db';
 import { auth } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
 import { cleanupWorkspaceVoiceFiles } from '@/lib/r2-cleanup';
-import { apiErrors, successResponse } from '@/lib/api-response';
+import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ workspaceId: string }> };
 
@@ -71,7 +71,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             return apiErrors.forbidden('Access denied');
         }
 
-        return successResponse(workspace);
+        const response = successResponse(workspace);
+        return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
     } catch (error) {
         console.error('Error fetching workspace:', error);
         return apiErrors.internalError('Failed to fetch workspace');
@@ -112,7 +113,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
             },
         });
 
-        return successResponse(workspace);
+        const response = successResponse(workspace);
+        return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
     } catch (error) {
         console.error('Error updating workspace:', error);
         return apiErrors.internalError('Failed to update workspace');
@@ -147,7 +149,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
 
         await db.workspace.delete({ where: { id: workspaceId } });
 
-        return successResponse({ message: 'Workspace deleted' });
+        const response = successResponse({ message: 'Workspace deleted' });
+        return withCacheControl(response, 'private, no-store');
     } catch (error) {
         console.error('Error deleting workspace:', error);
         return apiErrors.internalError('Failed to delete workspace');

app/api/workspaces/route.ts

@@ -2,7 +2,7 @@ import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
 import { auth } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
-import { apiErrors, successResponse } from '@/lib/api-response';
+import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 // GET /api/workspaces - List all workspaces for the authenticated user
 export async function GET() {
@@ -28,7 +28,8 @@ export async function GET() {
             orderBy: { updatedAt: 'desc' },
         });
 
-        return successResponse({ workspaces });
+        const response = successResponse({ workspaces });
+        return withCacheControl(response, 'private, max-age=60, stale-while-revalidate=120');
     } catch (error) {
         console.error('Error fetching workspaces:', error);
         return apiErrors.internalError('Failed to fetch workspaces');
@@ -84,7 +85,8 @@ export async function POST(request: NextRequest) {
             },
         });
 
-        return successResponse(workspace, 201);
+        const response = successResponse(workspace, 201);
+        return withCacheControl(response, 'private, no-store');
     } catch (error) {
         console.error('Error creating workspace:', error);
         return apiErrors.internalError('Failed to create workspace');