yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 09:36:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): Implement API response Cache-Control

Browse Source 
- Introduce `withCacheControl` utility function for API responses.
- Apply `private, no-store` to authentication and data modification (POST, PATCH, DELETE) routes.
- Apply `private, no-cache` to sensitive data retrieval (GET) routes.
- Enhance security by preventing caching of private user data.
- Ensure fresh data is always fetched for authenticated API responses.
This commit is contained in:
Yusuf İpek
2026-02-07 16:51:46 +03:00
parent 669f6fa9d2
commit 6e8170d080
24 changed files with 179 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/workspaces/[workspaceId]/route.ts
+7 -4
View File
@@ -3,7 +3,7 @@ import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { rateLimit } from '@/lib/rate-limit';
import { cleanupWorkspaceVoiceFiles } from '@/lib/r2-cleanup';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ workspaceId: string }> };
@@ -71,7 +71,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
return apiErrors.forbidden('Access denied');
}
return successResponse(workspace);
const response = successResponse(workspace);
return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
} catch (error) {
console.error('Error fetching workspace:', error);
return apiErrors.internalError('Failed to fetch workspace');
@@ -112,7 +113,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse(workspace);
const response = successResponse(workspace);
return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
} catch (error) {
console.error('Error updating workspace:', error);
return apiErrors.internalError('Failed to update workspace');
@@ -147,7 +149,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
await db.workspace.delete({ where: { id: workspaceId } });
return successResponse({ message: 'Workspace deleted' });
const response = successResponse({ message: 'Workspace deleted' });
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error deleting workspace:', error);
return apiErrors.internalError('Failed to delete workspace');