feat(cache): Make http cache providers respect cache-control header

lib/util/http/cache/abstract-http-cache-provider.ts

@@ -1,11 +1,14 @@
 import { logger } from '../../../logger';
+import { regEx } from '../../regex';
 import { HttpCacheStats } from '../../stats';
 import type { GotOptions, HttpResponse } from '../types';
 import { copyResponse } from '../util';
 import { type HttpCache, HttpCacheSchema } from './schema';
 import type { HttpCacheProvider } from './types';
 
 export abstract class AbstractHttpCacheProvider implements HttpCacheProvider {
+  protected checkCacheControlHeader = true;
+
   protected abstract load(url: string): Promise<unknown>;
   protected abstract persist(url: string, data: HttpCache): Promise<void>;
 
@@ -16,7 +19,7 @@ export abstract class AbstractHttpCacheProvider implements HttpCacheProvider {
       return null;
     }
 
-    return httpCache as HttpCache;
+    return httpCache;
   }
 
   async setCacheHeaders<T extends Pick<GotOptions, 'headers'>>(
@@ -43,11 +46,28 @@ export abstract class AbstractHttpCacheProvider implements HttpCacheProvider {
     return Promise.resolve(null);
   }
 
+  private preventCaching<T>(resp: HttpResponse<T>): boolean {
+    if (this.checkCacheControlHeader === false) {
+      return false;
+    }
+
+    const isPublic = resp.headers?.['cache-control']
+      ?.toLocaleLowerCase()
+      .split(regEx(/\s*,\s*/))
+      .includes('public');
+
+    return !isPublic;
+  }
+
   async wrapServerResponse<T>(
     url: string,
     resp: HttpResponse<T>,
   ): Promise<HttpResponse<T>> {
     if (resp.statusCode === 200) {
+      if (this.preventCaching(resp)) {
+        return resp;
+      }
+
       const etag = resp.headers?.['etag'];
       const lastModified = resp.headers?.['last-modified'];
 

lib/util/http/cache/package-http-cache-provider.spec.ts

@@ -77,7 +77,10 @@ describe('util/http/cache/package-http-cache-provider', () => {
     expect(packageCache.set).not.toHaveBeenCalled();
 
     mockTime('2024-06-15T00:15:00.000Z');
-    httpMock.scope(url).get('').reply(200, 'new response', { etag: 'foobar' });
+    httpMock.scope(url).get('').reply(200, 'new response', {
+      etag: 'foobar',
+      'cache-control': 'max-age=180, public',
+    });
 
     const res2 = await http.get(url, { cacheProvider });
     expect(res2.body).toBe('new response');
@@ -88,10 +91,10 @@ describe('util/http/cache/package-http-cache-provider', () => {
     const cacheProvider = new PackageHttpCacheProvider({
       namespace: '_test-namespace',
     });
-    httpMock
-      .scope(url)
-      .get('')
-      .reply(200, 'fetched response', { etag: 'foobar' });
+    httpMock.scope(url).get('').reply(200, 'fetched response', {
+      etag: 'foobar',
+      'cache-control': 'max-age=180, public',
+    });
 
     const res = await http.get(url, { cacheProvider });
 
@@ -109,4 +112,21 @@ describe('util/http/cache/package-http-cache-provider', () => {
       },
     });
   });
+
+  it('prevents caching when cache-control is private', async () => {
+    mockTime('2024-06-15T00:00:00.000Z');
+
+    const cacheProvider = new PackageHttpCacheProvider({
+      namespace: '_test-namespace',
+    });
+
+    httpMock.scope(url).get('').reply(200, 'private response', {
+      'cache-control': 'max-age=180, private',
+    });
+
+    const res = await http.get(url, { cacheProvider });
+
+    expect(res.body).toBe('private response');
+    expect(packageCache.set).not.toHaveBeenCalled();
+  });
 });

lib/util/http/cache/repository-http-cache-provider.ts

@@ -3,6 +3,8 @@ import { AbstractHttpCacheProvider } from './abstract-http-cache-provider';
 import type { HttpCache } from './schema';
 
 export class RepositoryHttpCacheProvider extends AbstractHttpCacheProvider {
+  protected override checkCacheControlHeader = false;
+
   override load(url: string): Promise<unknown> {
     const cache = getCache();
     cache.httpCache ??= {};