Add basic auth

tests/test_frontend_static.py

@@ -3,7 +3,13 @@ import logging
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
 
-from app.frontend_static import register_frontend_missing_fallback, register_frontend_static_routes
+from app.frontend_static import (
+    ASSET_CACHE_CONTROL,
+    INDEX_CACHE_CONTROL,
+    STATIC_FILE_CACHE_CONTROL,
+    register_frontend_missing_fallback,
+    register_frontend_static_routes,
+)
 
 
 def test_missing_dist_logs_error_and_keeps_app_running(tmp_path, caplog):
@@ -57,10 +63,12 @@ def test_valid_dist_serves_static_and_spa_fallback(tmp_path):
         root_response = client.get("/")
         assert root_response.status_code == 200
         assert "index page" in root_response.text
+        assert root_response.headers["cache-control"] == INDEX_CACHE_CONTROL
 
         manifest_response = client.get("/site.webmanifest")
         assert manifest_response.status_code == 200
         assert manifest_response.headers["content-type"].startswith("application/manifest+json")
+        assert manifest_response.headers["cache-control"] == "no-store"
         manifest = manifest_response.json()
         assert manifest["start_url"] == "http://testserver/"
         assert manifest["scope"] == "http://testserver/"
@@ -71,14 +79,22 @@ def test_valid_dist_serves_static_and_spa_fallback(tmp_path):
         file_response = client.get("/robots.txt")
         assert file_response.status_code == 200
         assert file_response.text == "User-agent: *"
+        assert file_response.headers["cache-control"] == STATIC_FILE_CACHE_CONTROL
+
+        explicit_index_response = client.get("/index.html")
+        assert explicit_index_response.status_code == 200
+        assert "index page" in explicit_index_response.text
+        assert explicit_index_response.headers["cache-control"] == INDEX_CACHE_CONTROL
 
         missing_response = client.get("/channel/some-route")
         assert missing_response.status_code == 200
         assert "index page" in missing_response.text
+        assert missing_response.headers["cache-control"] == INDEX_CACHE_CONTROL
 
         asset_response = client.get("/assets/app.js")
         assert asset_response.status_code == 200
         assert "console.log('ok');" in asset_response.text
+        assert asset_response.headers["cache-control"] == ASSET_CACHE_CONTROL
 
 
 def test_webmanifest_uses_forwarded_origin_headers(tmp_path):