Send Cache-Control: no-store on account and user-edit pages. OP-19674

Firefox serves these pages stale from the HTTP cache / bfcache on reload and
history-back; the Turbo meta only covers Turbo's own snapshot. no-store opts out
of both, fixing Firefox. Chrome revalidates and is already fresh on reload and
forward navigation, so those two specs pass there and act as cross-browser guards.

Author: dfriquet

app/controllers/application_controller.rb

@@ -178,6 +178,13 @@ def set_cache_buster
     end
   end
 
+  # Firefox serves these pages stale from the HTTP cache and bfcache on reload and
+  # history-back (the turbo-cache-control meta only governs Turbo's snapshot).
+  # no-store opts out of both so a fresh copy is always fetched.
+  def prevent_response_caching
+    response.cache_control.merge!(no_store: true)
+  end
+
   def tag_request
     context = { controller: self, request: }
     ::OpenProject::Appsignal.tag_request(context)

app/controllers/my_controller.rb

@@ -41,6 +41,7 @@ class MyController < ApplicationController
   before_action :require_login
   before_action :set_current_user
   before_action :check_password_confirmation, only: %i[update_account]
+  before_action :prevent_response_caching, only: :account
 
   no_authorization_required! :account,
                              :update_account,

app/controllers/users_controller.rb

@@ -36,6 +36,7 @@ class UsersController < ApplicationController
   layout "admin"
 
   before_action :authorize_global, except: %i[show deletion_info destroy]
+  before_action :prevent_response_caching, only: :edit
 
   # rubocop:disable Rails/LexicallyScopedActionFilter
   before_action :find_user, only: %i[show

spec/features/my/account_fresh_after_forward_nav_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# OP-19674: after an administrator changes a user's attributes out-of-band, the
+# account page must not be served stale. This example covers navigating away and
+# back to it through in-app menu links (a forward Turbo visit, not history).
+RSpec.describe "My account is fresh after navigating back to it", :js do
+  shared_let(:admin) { create(:admin) }
+  shared_let(:section) { create(:user_custom_field_section, name: "Professional info") }
+  shared_let(:job_title) { create(:user_custom_field, :string, name: "Job title", user_custom_field_section: section) }
+  shared_let(:alpha) { create(:department, name: "Alpha department", members: [admin]) }
+  shared_let(:beta) { create(:department, name: "Beta department") }
+
+  before do
+    section.update!(attribute_order: ["department", job_title.column_name])
+    admin.update!(custom_field_values: { job_title.id => "Old title" })
+    login_as admin
+
+    visit my_account_path
+    expect(page).to have_select("user[department_id]", disabled: true, selected: "Alpha department")
+    expect(page).to have_field("Job title", with: "Old title")
+
+    # An administrator moves the user and changes the job title out-of-band.
+    Departments::AddUserService.new(beta, user: admin)
+                               .call(user_id: admin.id, remove_from_previous_department: true)
+    admin.update!(custom_field_values: { job_title.id => "New title" })
+  end
+
+  it "shows the updated Department and Job title after navigating back via the menu" do
+    click_on "Notification and email"
+    expect(page).to have_current_path(my_notifications_path, wait: 10, ignore_query: true)
+
+    click_on "Account"
+    expect(page).to have_current_path(my_account_path, wait: 10, ignore_query: true)
+
+    expect(page).to have_select("user[department_id]", disabled: true, selected: "Beta department")
+    expect(page).to have_field("Job title", with: "New title")
+  end
+end

spec/features/my/account_fresh_after_reload_spec.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# OP-19674: after an administrator changes a user's attributes out-of-band, the
+# account page must not be served stale. This example covers a plain reload (Ctrl+R).
+RSpec.describe "My account is fresh after a reload", :js do
+  shared_let(:admin) { create(:admin) }
+  shared_let(:section) { create(:user_custom_field_section, name: "Professional info") }
+  shared_let(:job_title) { create(:user_custom_field, :string, name: "Job title", user_custom_field_section: section) }
+  shared_let(:alpha) { create(:department, name: "Alpha department", members: [admin]) }
+  shared_let(:beta) { create(:department, name: "Beta department") }
+
+  before do
+    section.update!(attribute_order: ["department", job_title.column_name])
+    admin.update!(custom_field_values: { job_title.id => "Old title" })
+    login_as admin
+
+    visit my_account_path
+    expect(page).to have_select("user[department_id]", disabled: true, selected: "Alpha department")
+    expect(page).to have_field("Job title", with: "Old title")
+
+    # An administrator moves the user and changes the job title out-of-band.
+    Departments::AddUserService.new(beta, user: admin)
+                               .call(user_id: admin.id, remove_from_previous_department: true)
+    admin.update!(custom_field_values: { job_title.id => "New title" })
+  end
+
+  it "shows the updated Department and Job title after reloading" do
+    page.refresh
+
+    expect(page).to have_select("user[department_id]", disabled: true, selected: "Beta department")
+    expect(page).to have_field("Job title", with: "New title")
+  end
+end