Send Cache-Control: no-store on account and user-edit pages. OP-19674

Firefox serves these pages stale from the HTTP cache / bfcache on reload and
history-back; the Turbo meta only covers Turbo's own snapshot. no-store opts out
of both, fixing Firefox. Chrome revalidates and is already fresh on reload and
forward navigation, so those two examples pass there and act as cross-browser guards.

Author: dfriquet

app/controllers/application_controller.rb

@@ -178,6 +178,13 @@ def set_cache_buster
     end
   end
 
+  # Firefox serves these pages stale from the HTTP cache and bfcache on reload and
+  # history-back (the turbo-cache-control meta only governs Turbo's snapshot).
+  # no-store opts out of both so a fresh copy is always fetched.
+  def prevent_response_caching
+    response.cache_control.merge!(no_store: true)
+  end
+
   def tag_request
     context = { controller: self, request: }
     ::OpenProject::Appsignal.tag_request(context)

app/controllers/my_controller.rb

@@ -41,6 +41,7 @@ class MyController < ApplicationController
   before_action :require_login
   before_action :set_current_user
   before_action :check_password_confirmation, only: %i[update_account]
+  before_action :prevent_response_caching, only: :account
 
   no_authorization_required! :account,
                              :update_account,

app/controllers/users_controller.rb

@@ -36,6 +36,7 @@ class UsersController < ApplicationController
   layout "admin"
 
   before_action :authorize_global, except: %i[show deletion_info destroy]
+  before_action :prevent_response_caching, only: :edit
 
   # rubocop:disable Rails/LexicallyScopedActionFilter
   before_action :find_user, only: %i[show

spec/features/my/account_fresh_after_out_of_band_change_spec.rb

@@ -42,4 +42,24 @@ def expect_fresh_account
 
     expect_fresh_account
   end
+
+  # Green in Chrome (it revalidates on reload) but stale in Firefox, where the HTTP
+  # cache / bfcache serves the old page; fixed by `Cache-Control: no-store`.
+  it "is fresh after a reload" do
+    page.refresh
+
+    expect_fresh_account
+  end
+
+  # Navigating back to the account page through the menu is a fresh Turbo visit;
+  # this guards that it keeps fetching current data.
+  it "is fresh after navigating away and back via the menu" do
+    click_on "Notification and email"
+    expect(page).to have_current_path(my_notifications_path, wait: 10, ignore_query: true)
+
+    click_on "Account"
+    expect(page).to have_current_path(my_account_path, wait: 10, ignore_query: true)
+
+    expect_fresh_account
+  end
 end