feat: Add no-cache headers to API requests

Co-authored-by: mathieumoran1 <[email protected]>

routes/movies.js

@@ -291,6 +291,9 @@ router.get("/watchedMovies", async (req, res) => {
     const user = await User.findById(decoded.id).select("watchedMovies").lean(); // Get user by ID
     if (!user) return res.status(404).json({ message: "User not found" });
 
+    // User-specific: never allow shared/proxy caching.
+    res.set("Cache-Control", "private, no-store, must-revalidate");
+    res.set("Vary", "Authorization");
     res.status(200).json(user.watchedMovies); // Return the list of watched movies
   } catch (error) {
     res.status(500).json({ error: error.message });

routes/users.js

@@ -122,6 +122,10 @@ async function getOrInitActiveYear() {
 // Get user stats with watched movie titles and details from the movies collection
 router.get("/stats", verifyToken, async (req, res) => {
   try {
+    // Auth-scoped response: never allow caching.
+    res.set("Cache-Control", "private, no-store, must-revalidate");
+    res.set("Vary", "Authorization");
+
     // Fetch all users (only needed fields)
     const users = await User.find().select("name watchedMovies").lean();
     
@@ -192,6 +196,10 @@ router.get("/stats", verifyToken, async (req, res) => {
 // Returns: { years: number[], totals: { [year]: number }, completersByYear: { [year]: {name, watchedCount, totalMoviesCount}[] } }
 router.get("/completions", verifyToken, async (req, res) => {
   try {
+    // Auth-scoped response: never allow caching.
+    res.set("Cache-Control", "private, no-store, must-revalidate");
+    res.set("Vary", "Authorization");
+
     const yearsRaw = await Movie.distinct("year");
     const years = (Array.isArray(yearsRaw) ? yearsRaw : [])
       .map((y) => Number(y))