fix(preview): opt preview and toolbar responses out of the route cache (#1855)

* fix(preview): opt preview and toolbar responses out of the route cache

Cache-Control: private, no-store only governs browsers and downstream
proxies. With route caching enabled, the shared edge cache (Workers
Cache) follows the route-cache options instead, so a valid preview
response was stored in the shared cache and served on hits without any
token verification — draft content stayed reachable until TTL/purge,
even after token expiry. Toolbar-injected editor HTML had the same gap.

Verified empirically on a stock Cloudflare deploy: preview URL request
1 was MISS with private, no-store, requests 2+ were shared-cache HITs.

The middleware now calls context.cache.set(false) for any request
carrying a _preview param and whenever the editor toolbar is injected.
Read defensively so Astro versions without route caching are unaffected.

* refactor(preview): use the typed route-cache API directly

EmDash requires Astro 6+, which always provides context.cache, so the
structural RouteCacheLike interface, the type assertion, and the
optional call were unnecessary hedging. Type the helper against
APIContext["cache"] and drop the "absent cache" test.

Author: swissky

.changeset/preview-route-cache-optout.md

@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Fixes preview and editor-toolbar responses being stored in the shared edge cache when route caching is enabled: requests with a `_preview` token and toolbar-injected editor pages now opt out of the route cache, so draft content is no longer served from the cache without token verification and toolbar markup no longer leaks to anonymous visitors.

packages/core/src/astro/middleware/request-context.ts

@@ -10,6 +10,7 @@
  * - Toolbar injection: floating pill for authenticated editors
  */
 
+import type { APIContext } from "astro";
 import { defineMiddleware } from "astro:middleware";
 
 import { resolveSecretsCached } from "#config/secrets.js";
@@ -18,11 +19,31 @@ import { verifyPreviewToken, parseContentId } from "../../preview/tokens.js";
 import { getRequestContext, runWithContext } from "../../request-context.js";
 import { renderToolbar } from "../../visual-editing/toolbar.js";
 
+/** Astro's route-cache handle. EmDash requires Astro 6+, so it's always present. */
+type RouteCache = APIContext["cache"];
+
+/**
+ * Opt the current request out of Astro's route cache (e.g. Workers Cache on
+ * Cloudflare). `Cache-Control` headers do NOT cover this: the adapter derives
+ * the shared-cache TTL from the route-cache options (on Cloudflare via
+ * `Cloudflare-CDN-Cache-Control`), so session-specific responses must
+ * explicitly disable it or they get stored in the shared cache and served to
+ * anonymous visitors without ever invoking the middleware again. With no cache
+ * provider configured this is a no-op (`NoopAstroCache`/`DisabledAstroCache`).
+ */
+function optOutOfRouteCache(cache: RouteCache): void {
+	cache.set(false);
+}
+
 /**
  * Inject toolbar HTML into a response if it's an HTML page.
  * Returns the original response if not HTML.
  */
-async function injectToolbar(response: Response, toolbarHtml: string): Promise<Response> {
+async function injectToolbar(
+	response: Response,
+	toolbarHtml: string,
+	routeCache: RouteCache,
+): Promise<Response> {
 	const contentType = response.headers.get("content-type");
 	if (!contentType?.includes("text/html")) return response;
 
@@ -37,7 +58,10 @@ async function injectToolbar(response: Response, toolbarHtml: string): Promise<R
 	// Toolbar-injected HTML is session-specific (its presence reveals an active
 	// editor session); it must never be stored in a shared CDN cache and served
 	// to anonymous visitors. Mirrors the preview branch's guard (#1398).
+	// `Cache-Control` covers browsers/downstream proxies; the route-cache
+	// opt-out covers the shared edge cache, which ignores `Cache-Control`.
 	result.headers.set("Cache-Control", "private, no-store");
+	optOutOfRouteCache(routeCache);
 	return result;
 }
 
@@ -86,6 +110,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Astro context includes currentLocale when i18n is configured
 	const locale = (context as { currentLocale?: string }).currentLocale;
 
+	const routeCache = context.cache;
+
 	// Verify preview token if present.
 	// The preview secret is resolved via `resolveSecretsCached`: env wins,
 	// otherwise a DB-stored value is read (or generated on first need).
@@ -122,6 +148,15 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 			// Preview responses must not be cached -- draft content could leak past token expiry.
 			// Clone the response before modifying headers — the original may be immutable.
+			// `Cache-Control` only governs browsers/downstream proxies; the shared
+			// edge cache follows the route-cache options, so opt out of those too —
+			// otherwise the draft response is stored in the shared cache and served
+			// on cache hits without token verification until TTL/purge. Opt out for
+			// any request carrying a `_preview` param (valid or not): those URLs are
+			// per-token, so cached copies are useless at best and drafts at worst.
+			if (hasPreviewToken) {
+				optOutOfRouteCache(routeCache);
+			}
 			if (preview) {
 				response = new Response(response.body, response);
 				response.headers.set("Cache-Control", "private, no-store");
@@ -133,7 +168,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					editMode,
 					isPreview: !!preview,
 				});
-				return injectToolbar(response, toolbarHtml);
+				return injectToolbar(response, toolbarHtml, routeCache);
 			}
 
 			return response;
@@ -147,7 +182,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			editMode: false,
 			isPreview: false,
 		});
-		return injectToolbar(response, toolbarHtml);
+		return injectToolbar(response, toolbarHtml, routeCache);
 	}
 
 	return next();

packages/core/tests/unit/astro/request-context-route-cache.test.ts

@@ -0,0 +1,98 @@
+/**
+ * Regression tests: preview and toolbar responses must opt out of Astro's
+ * route cache, not just set `Cache-Control`.
+ *
+ * `Cache-Control: private, no-store` governs browsers and downstream
+ * proxies, but the shared edge cache (e.g. Workers Cache on Cloudflare)
+ * follows the route-cache options — on Cloudflare the adapter emits
+ * `Cloudflare-CDN-Cache-Control` from them. Verified on a stock deploy:
+ * a valid preview URL was a MISS on request 1 and a shared-cache HIT on
+ * requests 2+, i.e. draft content was served without any token
+ * verification until TTL/purge, even after token expiry.
+ *
+ * The fix calls `context.cache.set(false)` for requests carrying a
+ * `_preview` param and for toolbar-injected editor responses.
+ */
+import { describe, it, expect, vi } from "vitest";
+
+vi.mock("astro:middleware", () => ({
+	defineMiddleware: (handler: unknown) => handler,
+}));
+
+import onRequest from "../../../src/astro/middleware/request-context.js";
+
+function buildContext(opts: {
+	pathname?: string;
+	search?: string;
+	user?: { id: string; role: number } | null;
+	editCookie?: boolean;
+	cache: { set: (input: unknown) => void };
+}) {
+	const url = new URL(`https://example.com${opts.pathname ?? "/blog"}${opts.search ?? ""}`);
+	return {
+		request: new Request(url),
+		url,
+		cookies: {
+			get: vi.fn((name: string) =>
+				name === "emdash-edit-mode" && opts.editCookie ? { value: "true" } : undefined,
+			),
+			set: vi.fn(),
+		},
+		locals: { user: opts.user ?? null },
+		cache: opts.cache,
+	} as unknown as Parameters<typeof onRequest>[0];
+}
+
+const htmlResponse = () =>
+	new Response("<html><body>hello</body></html>", {
+		headers: { "content-type": "text/html" },
+	});
+
+describe("route-cache opt-out for preview and toolbar responses", () => {
+	it("opts out of the route cache when a _preview param is present", async () => {
+		const cache = { set: vi.fn() };
+		// No emdash.db on locals — token can't be verified, but the response
+		// still must not be stored under the per-token URL.
+		const context = buildContext({ search: "?_preview=some-token", cache });
+
+		await onRequest(context, async () => htmlResponse());
+
+		expect(cache.set).toHaveBeenCalledWith(false);
+	});
+
+	it("opts out of the route cache when the toolbar is injected", async () => {
+		const cache = { set: vi.fn() };
+		const context = buildContext({ user: { id: "u1", role: 30 }, cache });
+
+		const response = await onRequest(context, async () => htmlResponse());
+
+		// Confirm we're on the actual-injection path.
+		expect(await response.text()).toContain('id="emdash-toolbar"');
+		expect(cache.set).toHaveBeenCalledWith(false);
+	});
+
+	it("leaves the route cache alone for editor requests without injection (non-HTML)", async () => {
+		const cache = { set: vi.fn() };
+		const context = buildContext({
+			pathname: "/api/data.json",
+			user: { id: "u1", role: 30 },
+			cache,
+		});
+
+		await onRequest(
+			context,
+			async () => new Response('{"ok":true}', { headers: { "content-type": "application/json" } }),
+		);
+
+		expect(cache.set).not.toHaveBeenCalled();
+	});
+
+	it("leaves the route cache alone for anonymous requests without CMS signals", async () => {
+		const cache = { set: vi.fn() };
+		const context = buildContext({ cache });
+
+		await onRequest(context, async () => htmlResponse());
+
+		expect(cache.set).not.toHaveBeenCalled();
+	});
+});

packages/core/tests/unit/astro/request-context-toolbar-cache.test.ts

@@ -24,6 +24,7 @@ function editorRequestContext(pathname = "/blog") {
 		url: new URL(`https://example.com${pathname}`),
 		cookies: { get: vi.fn(() => undefined), set: vi.fn() },
 		locals: { user: { id: "u1", role: 30 } },
+		cache: { set: vi.fn() },
 	} as unknown as Parameters<typeof onRequest>[0];
 }