@startup-api/cloudflare 0.3.2 → 0.4.1

package/src/auth/atmosphereMark.ts

@@ -0,0 +1,7 @@
+/**
+ * Atmosphere (atproto) "union" logo mark, drawn on a `0 0 32 32` viewBox with `fill-rule: evenodd`.
+ * Shared by every server-rendered atproto icon so they never drift apart. The client-side
+ * `public/users/power-strip.js` keeps its own copy since it cannot import from `src/`.
+ */
+export const ATMOSPHERE_MARK_PATH =
+  'M16 0C18.1127 1.0372e-05 19.9555 1.15414 20.9332 2.8662C21.1045 3.16613 21.4647 3.31517 21.7979 3.22403C22.2761 3.09321 22.7795 3.02333 23.2992 3.02333C26.4347 3.02335 28.9765 5.56529 28.9765 8.70083C28.9765 9.22048 28.9066 9.72378 28.7758 10.2019C28.6846 10.5351 28.8337 10.8953 29.1336 11.0666C30.8458 12.0442 32 13.8872 32 16C32 16.0822 31.9981 16.1639 31.9946 16.2452C31.9946 16.2456 31.9944 16.246 31.9942 16.2463C31.9939 16.2465 31.9937 16.2469 31.9937 16.2473C31.8599 19.6701 29.2873 22.4 26.1329 22.4L25.9815 22.3979C24.3638 22.353 22.909 21.59 21.8719 20.3888C21.5701 20.0392 20.9949 20.0275 20.6799 20.3652C19.5117 21.6171 17.8474 22.4 16 22.4C12.4654 22.4 9.6 19.5346 9.6 16C9.6 12.4654 12.4654 9.6 16 9.6C17.4368 9.6 18.7629 10.0736 19.831 10.8731C20.0053 11.0036 20.2667 10.8843 20.2667 10.6667C20.2667 10.0776 20.7442 9.6 21.3333 9.6C21.9224 9.6 22.4 10.0776 22.4 10.6667V16C22.4158 18.5458 24.26 20.2666 26.1329 20.2667C27.9447 20.2667 29.7293 18.6564 29.8583 16.2467C29.8583 16.2466 29.8583 16.2464 29.8581 16.2463C29.858 16.2461 29.8579 16.2459 29.8579 16.2458C29.8591 16.2281 29.8597 16.2104 29.8606 16.1927C29.8634 16.1293 29.8654 16.0654 29.8658 16.001C29.8658 16.0006 29.866 16.0003 29.8663 16C29.8665 15.9997 29.8667 15.9994 29.8667 15.999C29.8663 14.5464 28.9914 13.2933 27.7308 12.7465L26.4045 12.1712C26.0876 12.0337 25.937 11.6696 26.0641 11.3484L26.5963 10.0042C26.7549 9.60324 26.8431 9.16479 26.8431 8.70083C26.8431 6.77399 25.3056 5.20644 23.3906 5.15792L23.2992 5.15667C22.8351 5.15667 22.3965 5.24487 21.9956 5.40354L20.6515 5.93568C20.3304 6.06282 19.9663 5.91222 19.8288 5.59538L19.2533 4.26917C18.7234 3.04774 17.5306 2.18836 16.1356 2.13583L16 2.13333C14.547 2.13333 13.2934 3.00824 12.7465 4.26896L12.1712 5.59529C12.0337 5.91217 11.6696 6.06282 11.3484 5.93568L10.0042 5.40354C9.62831 5.25477 9.21941 5.16798 8.7875 5.15771L8.70083 5.15667C6.74349 5.15667 5.15667 6.74349 5.15667 8.70083C5.15667 9.16475 5.24485 9.60323 5.40354 10.0042L5.93568 11.3484C6.06282 11.6696 5.91217 12.0337 5.59529 12.1712L4.26896 12.7465C3.00823 13.2934 2.13333 14.5469 2.13333 16C2.13333 17.4529 3.00832 18.7063 4.26917 19.2533L5.59538 19.8288C5.91222 19.9663 6.06282 20.3304 5.93568 20.6515L5.40354 21.9956C5.24487 22.3965 5.15667 22.835 5.15667 23.2992C5.15667 25.2565 6.74349 26.8433 8.70083 26.8433C9.1644 26.8433 9.60287 26.7551 10.0042 26.5963L11.3484 26.0641C11.6696 25.937 12.0337 26.0876 12.1712 26.4045L12.7465 27.7308C13.2934 28.9917 14.547 29.8667 16 29.8667C17.4529 29.8667 18.7063 28.9918 19.2533 27.7308L19.6555 26.8037C19.8871 26.2698 20.5083 26.0256 21.0415 26.2589C21.561 26.4862 21.8066 27.0847 21.5966 27.6115L21.2104 28.5798C20.3374 30.5922 18.3333 32 16 32C13.8872 32 12.0442 30.8458 11.0666 29.1336C10.8953 28.8337 10.5351 28.6846 10.2019 28.7758C9.72378 28.9067 9.22049 28.9767 8.70083 28.9767C5.56528 28.9767 3.02333 26.4347 3.02333 23.2992C3.02333 22.7795 3.09321 22.2761 3.22403 21.7979C3.31516 21.4647 3.16613 21.1045 2.86619 20.9332C1.15412 19.9555 0 18.1127 0 16C5.927e-07 13.8873 1.1541 12.0443 2.8662 11.0666C3.16613 10.8953 3.31517 10.5351 3.22403 10.2019C3.09323 9.72379 3.02333 9.22047 3.02333 8.70083C3.02333 5.56528 5.56528 3.02333 8.70083 3.02333C9.22047 3.02334 9.72379 3.09323 10.2019 3.22404C10.5351 3.31517 10.8953 3.16614 11.0666 2.86621C12.0443 1.15411 13.8873 0 16 0ZM16 11.7333C13.6436 11.7333 11.7333 13.6436 11.7333 16C11.7333 18.3564 13.6436 20.2667 16 20.2667C18.3564 20.2667 20.2667 18.3564 20.2667 16C20.2667 13.6436 18.3564 11.7333 16 11.7333Z';

package/src/auth/atproto/crypto.ts

@@ -0,0 +1,119 @@
+/**
+ * Cryptographic primitives for the AT Protocol OAuth flow: base64url helpers, PKCE, and DPoP
+ * (RFC 9449) proof generation. atproto OAuth requires PKCE and sender-constrained (DPoP-bound)
+ * tokens, so every request to the authorization/token endpoints carries a freshly signed ES256
+ * proof-of-possession JWT. All of this runs on the WebCrypto API available in Workers.
+ */
+
+/** Encode raw bytes as unpadded base64url. */
+export function base64urlEncode(input: ArrayBuffer | Uint8Array): string {
+  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+  let str = '';
+  for (const b of bytes) str += String.fromCharCode(b);
+  return btoa(str).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+/** Encode a UTF-8 string as unpadded base64url. */
+export function base64urlEncodeString(value: string): string {
+  return base64urlEncode(new TextEncoder().encode(value));
+}
+
+/** A random unpadded-base64url token of `byteLength` random bytes (used for state, jti, PKCE verifier). */
+export function randomToken(byteLength = 32): string {
+  return base64urlEncode(crypto.getRandomValues(new Uint8Array(byteLength)));
+}
+
+export interface Pkce {
+  verifier: string;
+  challenge: string;
+}
+
+/** Generate a PKCE verifier and its S256 challenge. */
+export async function generatePkce(): Promise<Pkce> {
+  const verifier = randomToken(32);
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+  return { verifier, challenge: base64urlEncode(digest) };
+}
+
+const ES256_PARAMS = { name: 'ECDSA', namedCurve: 'P-256' } as const;
+
+/**
+ * Generate an ephemeral ES256 (P-256) keypair for DPoP and return its private JWK. The private JWK is
+ * persisted in the (encrypted) flow state so the same key can be reused for the token request and any
+ * later refresh; the public half is embedded in each proof's header.
+ */
+export async function generateDpopKey(): Promise<JsonWebKey> {
+  const pair = (await crypto.subtle.generateKey(ES256_PARAMS, true, ['sign', 'verify'])) as CryptoKeyPair;
+  return (await crypto.subtle.exportKey('jwk', pair.privateKey)) as JsonWebKey;
+}
+
+/** The public portion of a DPoP JWK, as embedded in the proof header. */
+function publicJwk(jwk: JsonWebKey): JsonWebKey {
+  return { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+}
+
+/**
+ * Build a DPoP proof JWT bound to the given HTTP method and URL (htu is normalized to origin+path, per
+ * RFC 9449). When the server has issued a nonce it must be echoed back in the proof.
+ */
+export async function createDpopProof(privateJwk: JsonWebKey, htm: string, htu: string, nonce?: string): Promise<string> {
+  const key = await crypto.subtle.importKey('jwk', privateJwk, ES256_PARAMS, false, ['sign']);
+  const target = new URL(htu);
+  const header = { typ: 'dpop+jwt', alg: 'ES256', jwk: publicJwk(privateJwk) };
+  const payload: Record<string, unknown> = {
+    jti: randomToken(16),
+    htm: htm.toUpperCase(),
+    htu: target.origin + target.pathname,
+    iat: Math.floor(Date.now() / 1000),
+  };
+  if (nonce) payload.nonce = nonce;
+
+  const signingInput = `${base64urlEncodeString(JSON.stringify(header))}.${base64urlEncodeString(JSON.stringify(payload))}`;
+  const signature = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, key, new TextEncoder().encode(signingInput));
+  // WebCrypto ECDSA already returns the raw r||s signature that JOSE/ES256 expects.
+  return `${signingInput}.${base64urlEncode(signature)}`;
+}
+
+export interface DpopResult {
+  res: Response;
+  /** The most recent server-issued DPoP nonce, to be reused on the next request. */
+  nonce?: string;
+}
+
+/**
+ * POST to a DPoP-protected endpoint, transparently handling the `use_dpop_nonce` challenge: the first
+ * request is sent without (or with the cached) nonce; if the server demands a fresh nonce we retry once
+ * with it. Returns the final response and the latest nonce so the caller can chain requests (PAR →
+ * token) without re-fetching one.
+ */
+export async function dpopFetch(url: string, init: RequestInit, privateJwk: JsonWebKey, nonce?: string): Promise<DpopResult> {
+  let currentNonce = nonce;
+  const method = (init.method || 'POST').toUpperCase();
+
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const proof = await createDpopProof(privateJwk, method, url, currentNonce);
+    const headers = new Headers(init.headers);
+    headers.set('DPoP', proof);
+    const res = await fetch(url, { ...init, headers });
+    const serverNonce = res.headers.get('DPoP-Nonce') ?? undefined;
+
+    if ((res.status === 400 || res.status === 401) && serverNonce && attempt === 0) {
+      let needsNonce = false;
+      try {
+        const body = (await res.clone().json()) as { error?: string };
+        needsNonce = body?.error === 'use_dpop_nonce';
+      } catch {
+        // Non-JSON body; fall through and surface the original response.
+      }
+      if (needsNonce) {
+        currentNonce = serverNonce;
+        continue;
+      }
+    }
+
+    return { res, nonce: serverNonce ?? currentNonce };
+  }
+
+  // Unreachable: the loop either returns a response or retries exactly once then returns.
+  throw new Error('dpopFetch: exhausted retries');
+}

package/src/auth/atproto/identity.ts

@@ -0,0 +1,182 @@
+/**
+ * AT Protocol identity resolution. Given a user-supplied handle or DID we walk the full discovery
+ * chain — with NO hardcoded provider/PDS hosts — to find the authorization server that owns the
+ * identity:
+ *
+ *   handle ──▶ DID            (HTTPS `.well-known/atproto-did`, then DNS TXT `_atproto.<handle>` via DoH)
+ *   DID    ──▶ DID document   (did:plc via a PLC directory, did:web via the domain's `.well-known`)
+ *   DID doc──▶ PDS endpoint   (the `#atproto_pds` service)
+ *   PDS    ──▶ auth server    (`.well-known/oauth-protected-resource` → `.well-known/oauth-authorization-server`)
+ *
+ * The PLC directory and DNS-over-HTTPS resolver are generic, swappable infrastructure (overridable via
+ * env), not identity providers — every account hosts its own PDS and authorization server, which we
+ * discover dynamically here.
+ */
+
+const DID_PREFIX = /^did:(plc|web):/;
+
+export interface AuthServerMetadata {
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  pushed_authorization_request_endpoint: string;
+  [key: string]: unknown;
+}
+
+export interface ResolvedIdentity {
+  did: string;
+  handle?: string;
+  pds: string;
+  authServer: AuthServerMetadata;
+}
+
+export interface ResolverOptions {
+  /** PLC directory base URL for resolving did:plc. Defaults to the canonical https://plc.directory. */
+  plcUrl?: string;
+  /** DNS-over-HTTPS endpoint (RFC 8484 JSON) for the `_atproto.<handle>` TXT fallback. */
+  dohUrl?: string;
+}
+
+const DEFAULT_PLC_URL = 'https://plc.directory';
+const DEFAULT_DOH_URL = 'https://cloudflare-dns.com/dns-query';
+
+async function fetchJson(url: string, init?: RequestInit): Promise<any> {
+  const res = await fetch(url, init);
+  if (!res.ok) throw new Error(`Request to ${url} failed: ${res.status} ${res.statusText}`);
+  return res.json();
+}
+
+/** Resolve a handle to a DID via the HTTPS well-known method, falling back to DNS TXT over DoH. */
+async function resolveHandleToDid(handle: string, options: ResolverOptions): Promise<string> {
+  // 1. HTTPS well-known (works for any host that serves it; no third-party dependency).
+  // Use `redirect: 'manual'` rather than `'error'`: the Cloudflare Workers runtime does not implement
+  // the `'error'` redirect mode and throws a TypeError when it is used, which would silently disable
+  // this method (and break resolution for *.bsky.social handles, which have no `_atproto` DNS record).
+  // With `'manual'`, a redirected response is not followed and `res.ok` is false, so we fall through.
+  try {
+    const res = await fetch(`https://${handle}/.well-known/atproto-did`, { redirect: 'manual' });
+    if (res.ok) {
+      const did = (await res.text()).trim();
+      if (DID_PREFIX.test(did)) return did;
+    }
+  } catch {
+    // Fall through to DNS-based resolution.
+  }
+
+  // 2. DNS TXT `_atproto.<handle>` via DNS-over-HTTPS.
+  try {
+    const dohUrl = new URL(options.dohUrl || DEFAULT_DOH_URL);
+    dohUrl.searchParams.set('name', `_atproto.${handle}`);
+    dohUrl.searchParams.set('type', 'TXT');
+    const data = await fetchJson(dohUrl.toString(), { headers: { accept: 'application/dns-json' } });
+    for (const answer of data.Answer ?? []) {
+      const txt = String(answer.data ?? '').replace(/^"|"$/g, '');
+      if (txt.startsWith('did=')) {
+        const did = txt.slice(4).trim();
+        if (DID_PREFIX.test(did)) return did;
+      }
+    }
+  } catch {
+    // Fall through to the error below.
+  }
+
+  throw new Error(`Could not resolve handle "${handle}" to a DID`);
+}
+
+/** Fetch and return the DID document for a did:plc or did:web identifier. */
+async function resolveDidDocument(did: string, options: ResolverOptions): Promise<any> {
+  if (did.startsWith('did:plc:')) {
+    const base = (options.plcUrl || DEFAULT_PLC_URL).replace(/\/$/, '');
+    return fetchJson(`${base}/${did}`);
+  }
+  if (did.startsWith('did:web:')) {
+    // did:web:example.com[:path...] → https://example.com[/path...]/did.json (or /.well-known/did.json).
+    const rest = did.slice('did:web:'.length);
+    const segments = rest.split(':').map((s) => decodeURIComponent(s));
+    const host = segments.shift();
+    if (!host) throw new Error(`Malformed did:web identifier: ${did}`);
+    const path = segments.length ? `/${segments.join('/')}/did.json` : '/.well-known/did.json';
+    return fetchJson(`https://${host}${path}`);
+  }
+  throw new Error(`Unsupported DID method: ${did}`);
+}
+
+/** Extract the PDS service endpoint from a DID document. */
+function getPdsEndpoint(didDoc: any): string {
+  const services: any[] = Array.isArray(didDoc?.service) ? didDoc.service : [];
+  const pds = services.find(
+    (s) => s?.id === '#atproto_pds' || (typeof s?.id === 'string' && s.id.endsWith('#atproto_pds')) || s?.type === 'AtprotoPersonalDataServer',
+  );
+  const endpoint = typeof pds?.serviceEndpoint === 'string' ? pds.serviceEndpoint : pds?.serviceEndpoint?.uri;
+  if (!endpoint) throw new Error('DID document does not advertise an atproto PDS endpoint');
+  return endpoint.replace(/\/$/, '');
+}
+
+/** Extract the primary handle (`at://<handle>`) from a DID document's alsoKnownAs, if present. */
+function getHandle(didDoc: any): string | undefined {
+  const aka: string[] = Array.isArray(didDoc?.alsoKnownAs) ? didDoc.alsoKnownAs : [];
+  const at = aka.find((a) => typeof a === 'string' && a.startsWith('at://'));
+  return at ? at.slice('at://'.length) : undefined;
+}
+
+/** Resolve a PDS to its authorization server metadata via the protected-resource indirection. */
+async function resolveAuthServer(pds: string): Promise<AuthServerMetadata> {
+  const protectedResource = await fetchJson(new URL('/.well-known/oauth-protected-resource', pds).toString());
+  const issuer: string | undefined = protectedResource?.authorization_servers?.[0];
+  if (!issuer) throw new Error(`PDS ${pds} does not declare an authorization server`);
+
+  const metadata = (await fetchJson(new URL('/.well-known/oauth-authorization-server', issuer).toString())) as AuthServerMetadata;
+  if (!metadata.authorization_endpoint || !metadata.token_endpoint || !metadata.pushed_authorization_request_endpoint) {
+    throw new Error(`Authorization server ${issuer} is missing required OAuth endpoints (PAR is mandatory for atproto)`);
+  }
+  return metadata;
+}
+
+/**
+ * Full identity → authorization-server resolution. Accepts a handle (optionally `@`-prefixed) or a DID.
+ */
+export async function resolveIdentity(input: string, options: ResolverOptions = {}): Promise<ResolvedIdentity> {
+  const cleaned = input.trim().replace(/^@/, '');
+  if (!cleaned) throw new Error('Empty atproto identifier');
+
+  const isDid = cleaned.startsWith('did:');
+  let handle: string | undefined = isDid ? undefined : cleaned;
+  const did = isDid ? cleaned : await resolveHandleToDid(cleaned, options);
+
+  const didDoc = await resolveDidDocument(did, options);
+  const pds = getPdsEndpoint(didDoc);
+  if (!handle) handle = getHandle(didDoc);
+
+  const authServer = await resolveAuthServer(pds);
+  return { did, handle, pds, authServer };
+}
+
+/**
+ * Fetch a public actor profile record from the user's PDS to populate display name and avatar. Best
+ * effort: getRecord is an unauthenticated read, and any failure falls back to the handle/DID.
+ */
+export async function fetchProfile(pds: string, did: string, handle?: string): Promise<{ name?: string; picture?: string }> {
+  try {
+    const url = new URL('/xrpc/com.atproto.repo.getRecord', pds);
+    url.searchParams.set('repo', did);
+    url.searchParams.set('collection', 'app.bsky.actor.profile');
+    url.searchParams.set('rkey', 'self');
+
+    const res = await fetch(url.toString());
+    if (!res.ok) return { name: handle };
+
+    const data = (await res.json()) as { value?: { displayName?: string; avatar?: { ref?: { $link?: string } } } };
+    const value = data.value ?? {};
+    let picture: string | undefined;
+    const cid = value.avatar?.ref?.$link;
+    if (cid) {
+      const blob = new URL('/xrpc/com.atproto.sync.getBlob', pds);
+      blob.searchParams.set('did', did);
+      blob.searchParams.set('cid', cid);
+      picture = blob.toString();
+    }
+    return { name: value.displayName || handle, picture };
+  } catch {
+    return { name: handle };
+  }
+}

package/src/auth/errorPage.ts

@@ -0,0 +1,73 @@
+/**
+ * Styled error page for the auth flow.
+ *
+ * Auth error messages frequently embed UNTRUSTED text from outside our trust boundary: the
+ * user-supplied handle, and raw response bodies from a user's PDS or authorization server
+ * (e.g. `Token request failed: 400 <body>`). Protection is layered:
+ *
+ *   1. Encode  — the untrusted message is HTML-escaped with `he` (a battle-tested, dependency-free
+ *                output encoder) before it ever reaches the markup. We do not hand-roll escaping.
+ *   2. Contain — the page is served under a restrictive Content-Security-Policy (no script may run)
+ *                plus `nosniff`, so even an encoding bypass cannot execute code or be re-sniffed.
+ *
+ * Theming matches the rest of the app: we link `/users/style.css` and use its CSS variables, so the
+ * page follows the user's OS / chosen theme via `prefers-color-scheme` exactly like profile.html.
+ * The CSP allows `style-src 'self'` for that same-origin stylesheet; scripts remain fully blocked.
+ */
+import { escape as escapeHtml } from 'he';
+
+/** Hard cap on rendered detail length — external bodies can be arbitrarily large. */
+const MAX_DETAIL_LENGTH = 300;
+
+/**
+ * Content-Security-Policy for the error page. `default-src 'none'` blocks every resource type
+ * (scripts, images, frames, connections). We additively allow `style-src 'self' 'unsafe-inline'`
+ * for the linked `style.css` (same-origin) and the page's own inline `<style>`. With no `script-src`,
+ * no inline or external script can ever run — neutralizing HTML/script injection as a class.
+ * `frame-ancestors 'none'` is listed explicitly because it does NOT fall back to `default-src`, and
+ * without it the page could be framed by another origin (clickjacking) — unwanted for an auth endpoint.
+ */
+const CONTENT_SECURITY_POLICY =
+  "default-src 'none'; style-src 'self' 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
+
+/** Render a minimal styled "sign-in failed" page that matches the app theme. */
+export function renderAuthError(message: string, status = 500, usersPath = '/users/'): Response {
+  const text = typeof message === 'string' ? message : String(message ?? '');
+  const bounded = text.length > MAX_DETAIL_LENGTH ? `${text.slice(0, MAX_DETAIL_LENGTH - 1)}…` : text;
+  const detail = escapeHtml(bounded).trim();
+  const stylesheet = `${escapeHtml(usersPath)}style.css`;
+  const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Sign-in failed</title>
+<link rel="stylesheet" href="${stylesheet}" />
+<style>
+  body { margin: 0; padding: 1rem; box-sizing: border-box; min-height: 100vh; display: flex; align-items: center; justify-content: center; background: var(--bg); color: var(--text); }
+  .auth-card { background: var(--surface); border: 1px solid var(--border); padding: 2rem; border-radius: 12px; box-shadow: 0 8px 30px rgba(0,0,0,0.08); width: 360px; max-width: 100%; box-sizing: border-box; }
+  .auth-card h1 { font-size: 1.15rem; margin: 0 0 0.75rem; color: var(--danger); }
+  .auth-card p { font-size: 0.9rem; color: var(--text-secondary); margin: 0 0 1rem; line-height: 1.45; }
+  .auth-card .detail { background: var(--surface-muted); border: 1px solid var(--border); border-radius: 8px; padding: 0.6rem 0.7rem; font-size: 0.82rem; color: var(--text-faint); word-break: break-word; white-space: pre-wrap; }
+</style>
+</head>
+<body>
+  <div class="auth-card">
+    <h1>Sign-in failed</h1>
+    <p>We couldn't complete your sign-in. Please return to the sign-in page and try again.</p>
+    ${detail ? `<div class="detail">${detail}</div>` : ''}
+  </div>
+</body>
+</html>`;
+  return new Response(html, {
+    status,
+    headers: {
+      'Content-Type': 'text/html; charset=utf-8',
+      'Content-Security-Policy': CONTENT_SECURITY_POLICY,
+      'X-Content-Type-Options': 'nosniff',
+      'Referrer-Policy': 'no-referrer',
+      // Reflects a user handle / remote server message — never let a browser or intermediary cache it.
+      'Cache-Control': 'no-store',
+    },
+  });
+}