From ff98bea151a67f3e7b44fc58bd0ed69162ef5e19 Mon Sep 17 00:00:00 2001
From: MarSeventh <1193267292@qq.com>
Date: Wed, 29 Apr 2026 15:59:03 +0800
Subject: [PATCH] fix: prevent cached manage API mutations

---
 functions/api/manage/_middleware.js | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/functions/api/manage/_middleware.js b/functions/api/manage/_middleware.js
index d6b1592e..3f421fd8 100644
--- a/functions/api/manage/_middleware.js
+++ b/functions/api/manage/_middleware.js
@@ -1,10 +1,32 @@
 import { authenticate, AUTH_SCOPE } from "../../utils/auth/authCore.js";
 
+const DEFAULT_MANAGE_CACHE_CONTROL = 'private, no-store, max-age=0';
+
+function withDefaultCacheControl(response) {
+  if (response.headers.has('Cache-Control')) {
+    return response;
+  }
+
+  const headers = new Headers(response.headers);
+  headers.set('Cache-Control', DEFAULT_MANAGE_CACHE_CONTROL);
+
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
 async function errorHandling(context) {
   try {
-    return await context.next();
+    return withDefaultCacheControl(await context.next());
   } catch (err) {
-    return new Response(`${err.message}\n${err.stack}`, { status: 500 });
+    return new Response(`${err.message}\n${err.stack}`, {
+      status: 500,
+      headers: {
+        'Cache-Control': DEFAULT_MANAGE_CACHE_CONTROL,
+      },
+    });
   }
 }