Disable cache storage on special route error responses

tests/live-data-cache-headers.test.ts

@@ -11,6 +11,7 @@ let AUTH_SESSION_COOKIE = "";
 let getConversationHomeRoute: (typeof import("../src/app/api/v1/conversations/home/route"))["GET"];
 let getConversationsRoute: (typeof import("../src/app/api/v1/conversations/route"))["GET"];
 let getFolderRoute: (typeof import("../src/app/api/v1/conversation-folders/[folderKey]/route"))["GET"];
+let getEventsRoute: (typeof import("../src/app/api/v1/events/route"))["GET"];
 let getProjectDetailRoute: (typeof import("../src/app/api/v1/projects/[projectId]/route"))["GET"];
 let getDevicesRoute: (typeof import("../src/app/api/v1/devices/route"))["GET"];
 let getSettingsRoute: (typeof import("../src/app/api/v1/settings/route"))["GET"];
@@ -35,6 +36,8 @@ let getMasterAgentPromptRoute: (typeof import("../src/app/api/v1/master-agent/pr
 let getMasterAgentMemoriesRoute: (typeof import("../src/app/api/v1/master-agent/memories/route"))["GET"];
 let getStorageConfigRoute: (typeof import("../src/app/api/v1/storage/config/route"))["GET"];
 let getAccountDetailRoute: (typeof import("../src/app/api/v1/accounts/[accountId]/route"))["GET"];
+let getOtaPackageRoute: (typeof import("../src/app/api/v1/user/ota/package/route"))["GET"];
+let getAttachmentDownloadRoute: (typeof import("../src/app/api/v1/attachments/[attachmentId]/download/route"))["GET"];
 
 async function setup() {
   if (runtimeRoot) return;
@@ -47,6 +50,7 @@ async function setup() {
     homeRoute,
     conversationsRoute,
     folderRoute,
+    eventsRoute,
     projectRoute,
     devicesRoute,
     settingsRoute,
@@ -71,6 +75,8 @@ async function setup() {
     masterAgentMemoriesRoute,
     storageConfigRoute,
     accountDetailRoute,
+    otaPackageRoute,
+    attachmentDownloadRoute,
     dataModule,
     authModule,
   ] =
@@ -78,6 +84,7 @@ async function setup() {
       import("../src/app/api/v1/conversations/home/route.ts"),
       import("../src/app/api/v1/conversations/route.ts"),
       import("../src/app/api/v1/conversation-folders/[folderKey]/route.ts"),
+      import("../src/app/api/v1/events/route.ts"),
       import("../src/app/api/v1/projects/[projectId]/route.ts"),
       import("../src/app/api/v1/devices/route.ts"),
       import("../src/app/api/v1/settings/route.ts"),
@@ -102,6 +109,8 @@ async function setup() {
       import("../src/app/api/v1/master-agent/memories/route.ts"),
       import("../src/app/api/v1/storage/config/route.ts"),
       import("../src/app/api/v1/accounts/[accountId]/route.ts"),
+      import("../src/app/api/v1/user/ota/package/route.ts"),
+      import("../src/app/api/v1/attachments/[attachmentId]/download/route.ts"),
       import("../src/lib/boss-data.ts"),
       import("../src/lib/boss-auth.ts"),
     ]);
@@ -109,6 +118,7 @@ async function setup() {
   getConversationHomeRoute = homeRoute.GET;
   getConversationsRoute = conversationsRoute.GET;
   getFolderRoute = folderRoute.GET;
+  getEventsRoute = eventsRoute.GET;
   getProjectDetailRoute = projectRoute.GET;
   getDevicesRoute = devicesRoute.GET;
   getSettingsRoute = settingsRoute.GET;
@@ -133,6 +143,8 @@ async function setup() {
   getMasterAgentMemoriesRoute = masterAgentMemoriesRoute.GET;
   getStorageConfigRoute = storageConfigRoute.GET;
   getAccountDetailRoute = accountDetailRoute.GET;
+  getOtaPackageRoute = otaPackageRoute.GET;
+  getAttachmentDownloadRoute = attachmentDownloadRoute.GET;
   createAuthSession = dataModule.createAuthSession;
   AUTH_SESSION_COOKIE = authModule.AUTH_SESSION_COOKIE;
 }
@@ -163,6 +175,47 @@ function assertNoStoreHeader(response: Response) {
   assert.equal(response.headers.get("Cache-Control"), "private, no-store, max-age=0");
 }
 
+test("event stream keeps SSE cache headers while unauthorized event JSON disables caching", async () => {
+  await setup();
+
+  const streamResponse = await getEventsRoute(
+    await createAuthedRequest("http://127.0.0.1:3000/api/v1/events"),
+  );
+  assert.equal(streamResponse.headers.get("Content-Type"), "text/event-stream; charset=utf-8");
+  assert.equal(streamResponse.headers.get("Cache-Control"), "no-cache, no-transform");
+  await streamResponse.body?.cancel();
+
+  const unauthorizedResponse = await getEventsRoute(
+    new NextRequest("http://127.0.0.1:3000/api/v1/events"),
+  );
+  assert.equal(unauthorizedResponse.status, 401);
+  assertNoStoreHeader(unauthorizedResponse);
+});
+
+test("download error JSON responses disable cache storage", async () => {
+  await setup();
+
+  const otaUnauthorizedResponse = await getOtaPackageRoute(
+    new NextRequest("http://127.0.0.1:3000/api/v1/user/ota/package"),
+  );
+  assert.equal(otaUnauthorizedResponse.status, 401);
+  assertNoStoreHeader(otaUnauthorizedResponse);
+
+  const attachmentUnauthorizedResponse = await getAttachmentDownloadRoute(
+    new NextRequest("http://127.0.0.1:3000/api/v1/attachments/missing/download"),
+    { params: Promise.resolve({ attachmentId: "missing" }) },
+  );
+  assert.equal(attachmentUnauthorizedResponse.status, 401);
+  assertNoStoreHeader(attachmentUnauthorizedResponse);
+
+  const attachmentNotFoundResponse = await getAttachmentDownloadRoute(
+    await createAuthedRequest("http://127.0.0.1:3000/api/v1/attachments/missing/download"),
+    { params: Promise.resolve({ attachmentId: "missing" }) },
+  );
+  assert.equal(attachmentNotFoundResponse.status, 404);
+  assertNoStoreHeader(attachmentNotFoundResponse);
+});
+
 test("live conversation and device routes disable cache storage", async () => {
   await setup();