fix(node): prevent caching of authorized blob content

Set Cache-Control to no-store so private content is not reused after an identity change, and assert the response header.

Fixup for fc2d043.
Refs #407

Author: euxaristia

README.md

@@ -343,6 +343,7 @@ POST /{owner}/{repo}/git-upload-pack
 REST blob reads serve file content only; directory and gitlink paths return 404.
 Body delivery has its own allowance equal to `GITLAWB_GIT_SERVICE_TIMEOUT_SECS`.
 If delivery exceeds it, the response is interrupted and its admission slots are released.
+Blob responses use `Cache-Control: no-store` because they may contain private content.
 
 Signed write routes include:
 

crates/gitlawb-node/src/api/repos.rs

@@ -624,6 +624,10 @@ pub async fn get_blob(
         std::time::Duration::from_secs(state.config.git_service_timeout_secs),
     );
     let mut response = Response::new(axum::body::Body::from_stream(stream));
+    response.headers_mut().insert(
+        header::CACHE_CONTROL,
+        axum::http::HeaderValue::from_static("no-store"),
+    );
     response.headers_mut().insert(
         header::CONTENT_TYPE,
         axum::http::HeaderValue::from_static(mime),
@@ -4069,6 +4073,7 @@ mod tests {
             "application/json; charset=utf-8"
         );
         assert_eq!(response.headers()[header::CONTENT_LENGTH], "13");
+        assert_eq!(response.headers()[header::CACHE_CONTROL], "no-store");
         let bytes = response.into_body().collect().await.unwrap().to_bytes();
         assert_eq!(&bytes[..], b"{\"hello\":123}");
     }