feat: add HTTP caching for unauthenticated OpenAPI spec inspection

Cache spec fetch responses when no custom headers are forwarded, using public s-maxage=3600 with stale-while-revalidate. Requests with auth headers bypass the cache to avoid leaking credentials.

Rhys Sullivan committed 8 months ago

Commit ff126951 parent 8adfbf21 file · +27 −16Browse files

Unified · Split

executor/apps/web/src/app/api/openapi/inspect/route.ts+27−16

   "referer",
 ]);
-function noStoreJson(payload: unknown, status: number): Response {
+function jsonResponse(
+  payload: unknown,
+  status: number,
+  options?: { cacheable?: boolean },
+): Response {
+  const cacheable = options?.cacheable === true;
   return Response.json(payload, {
     status,
     headers: {
-      "cache-control": "no-store",
+      "cache-control": cacheable
+        ? "public, s-maxage=3600, stale-while-revalidate=86400"
+        : "no-store",
     },
   });
 }
 export async function POST(request: Request): Promise<Response> {
   const parsedRequest = requestSchema.safeParse(await request.json().catch(() => null));
   if (!parsedRequest.success) {
-    return noStoreJson({ detail: "Invalid OpenAPI inspection request" }, 400);
+    return jsonResponse({ detail: "Invalid OpenAPI inspection request" }, 400);
   }
   let parsedUrl: URL;
   try {
     parsedUrl = new URL(parsedRequest.data.specUrl);
   } catch {
-    return noStoreJson({ detail: "Spec URL is invalid" }, 400);
+    return jsonResponse({ detail: "Spec URL is invalid" }, 400);
   }
   const protocol = parsedUrl.protocol.toLowerCase();
   const localAllowed = process.env.NODE_ENV !== "production";
   if (parsedUrl.username || parsedUrl.password) {
-    return noStoreJson({ detail: "Credentials in spec URL are not allowed" }, 400);
+    return jsonResponse({ detail: "Credentials in spec URL are not allowed" }, 400);
   }
   if (protocol !== "https:" && protocol !== "http:") {
-    return noStoreJson({ detail: "Spec URL must use https:// (or http:// for localhost in dev)" }, 400);
+    return jsonResponse({ detail: "Spec URL must use https:// (or http:// for localhost in dev)" }, 400);
   }
   if (protocol === "http:" && !(localAllowed && isLocalHost(hostname))) {
-    return noStoreJson({ detail: "Spec URL must use https://" }, 400);
+    return jsonResponse({ detail: "Spec URL must use https://" }, 400);
   }
   if (isPrivateIp(hostname) && !(localAllowed && isLocalHost(hostname))) {
-    return noStoreJson({ detail: "Private or local hosts are not allowed" }, 400);
+    return jsonResponse({ detail: "Private or local hosts are not allowed" }, 400);
   }
   if (!isIP(normalizeIpHost(hostname)) && !isPublicDnsHostname(hostname)) {
-    return noStoreJson({ detail: "Spec host must be a public DNS host" }, 400);
+    return jsonResponse({ detail: "Spec host must be a public DNS host" }, 400);
   }
+  const forwardedHeaders = sanitizeForwardHeaders(parsedRequest.data.headers);
+  const cacheableRequest = Object.keys(forwardedHeaders).length === 0;
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), INSPECTION_TIMEOUT_MS);
       method: "GET",
       headers: {
         Accept: "application/json, application/yaml, text/yaml, text/plain;q=0.9, */*;q=0.8",
-        ...sanitizeForwardHeaders(parsedRequest.data.headers),
+        ...forwardedHeaders,
       },
       signal: controller.signal,
-      cache: "no-store",
+      cache: cacheableRequest ? "force-cache" : "no-store",
+      ...(cacheableRequest ? { next: { revalidate: 3600 } } : {}),
     });
     if (!response.ok) {
       const detail = extractErrorDetail(await response.text().catch(() => ""));
-      return noStoreJson({
+      return jsonResponse({
         status: response.status,
         statusText: response.statusText,
         detail,
       contentType,
     });
-    return noStoreJson({
+    return jsonResponse({
       status: response.status,
       statusText: response.statusText,
       spec: inspected.spec,
       inferredAuth: inspected.inferredAuth,
-    }, 200);
+    }, 200, { cacheable: cacheableRequest });
   } catch (error) {
     if (isAbortError(error)) {
-      return noStoreJson({ detail: "Request timed out while fetching spec" }, 504);
+      return jsonResponse({ detail: "Request timed out while fetching spec" }, 504);
     }
     const detail = error instanceof Error ? error.message : "Failed to fetch spec";
-    return noStoreJson({ detail }, 502);
+    return jsonResponse({ detail }, 502);
   } finally {
     clearTimeout(timeoutId);
   }