fix: prevent caching private shortlink responses

tests/private-redirect.test.ts

@@ -187,6 +187,16 @@ async function userSession(token: string, userId: string): Promise<SessionRow> {
   };
 }
 
+function expectPrivateNoStoreHeaders(response: Response): void {
+  expect(response.headers.get('cache-control')).toBe('no-store');
+  expect(
+    response.headers
+      .get('vary')
+      ?.split(',')
+      .map((value) => value.trim().toLowerCase()),
+  ).toContain('cookie');
+}
+
 describe('my.heygo.cc private shortlinks', () => {
   it('returns 404 with a login link when unauthenticated', async () => {
     const { response, db } = await fetchWorker('https://my.heygo.cc/foo', {
@@ -207,6 +217,7 @@ describe('my.heygo.cc private shortlinks', () => {
 
     expect(response.status).toBe(404);
     expect(response.headers.get('content-type')).toContain('text/html');
+    expectPrivateNoStoreHeaders(response);
     const body = await response.text();
     expect(body).toContain('Login to use your private links');
     expect(body).toContain('https://heygo.cc/app/login');
@@ -237,6 +248,7 @@ describe('my.heygo.cc private shortlinks', () => {
 
     expect(response.status).toBe(302);
     expect(response.headers.get('location')).toBe('https://example.com/foo-a');
+    expectPrivateNoStoreHeaders(response);
     expect(ctx.promises).toHaveLength(1);
     await Promise.all(ctx.promises);
     expect(db.runCalls).toHaveLength(1);
@@ -324,6 +336,7 @@ describe('my.heygo.cc private shortlinks', () => {
     });
 
     expect(response.status).toBe(404);
+    expectPrivateNoStoreHeaders(response);
     const body = await response.text();
     expect(body).toContain('Create this private link');
     // Must never query the public scope on my.heygo.cc.
@@ -353,6 +366,7 @@ describe('my.heygo.cc private shortlinks', () => {
 
     expect(response.status).toBe(200);
     expect(response.headers.get('content-type')).toContain('text/html');
+    expectPrivateNoStoreHeaders(response);
     const html = await response.text();
     expect(html).toContain('Private Note');
     expect(html).not.toContain('<script>');
@@ -369,6 +383,7 @@ describe('my.heygo.cc private shortlinks', () => {
 
     expect(response.status).toBe(404);
     expect(response.headers.get('content-type')).toContain('text/html');
+    expectPrivateNoStoreHeaders(response);
     const body = await response.text();
     expect(body).toContain('Create this private link');
   });
@@ -376,6 +391,7 @@ describe('my.heygo.cc private shortlinks', () => {
   it('handles the root path: unauthenticated 404 + login, authenticated 302 to app/private', async () => {
     const unauth = await fetchWorker('https://my.heygo.cc/');
     expect(unauth.response.status).toBe(404);
+    expectPrivateNoStoreHeaders(unauth.response);
     expect(await unauth.response.text()).toContain('Login to use your private links');
 
     const cookie = await sessionCookie('token-a');
@@ -386,6 +402,7 @@ describe('my.heygo.cc private shortlinks', () => {
     });
     expect(auth.response.status).toBe(302);
     expect(auth.response.headers.get('location')).toBe('https://heygo.cc/app/private');
+    expectPrivateNoStoreHeaders(auth.response);
   });
 
   it('does not trigger D1 private alias lookup for reserved paths', async () => {