fix: hide cached auth-only result pages [skip-ci]

Author: yoshifuminakamura

result_server/routes/admin.py

@@ -10,6 +10,7 @@
     Blueprint,
     abort,
     flash,
+    make_response,
     redirect,
     render_template,
     request,
@@ -22,6 +23,12 @@
 admin_bp = Blueprint("admin", __name__, url_prefix="/admin")
 
 
+def _add_no_store_headers(response):
+    response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate, max-age=0"
+    response.headers["Pragma"] = "no-cache"
+    return response
+
+
 def _get_users_with_totp_status():
     """全ユーザーを取得し、各ユーザーに has_totp フラグを付与して返す。"""
     store = get_user_store()
@@ -41,11 +48,11 @@ def admin_required(f):
     @wraps(f)
     def decorated(*args, **kwargs):
         if not session.get("authenticated"):
-            return redirect(url_for("auth.login"))
+            return _add_no_store_headers(make_response(redirect(url_for("auth.login"))))
         affiliations = session.get("user_affiliations", [])
         if "admin" not in affiliations:
             abort(403)
-        return f(*args, **kwargs)
+        return _add_no_store_headers(make_response(f(*args, **kwargs)))
 
     return decorated
 

result_server/routes/estimated.py

@@ -1,6 +1,6 @@
 from flask import (
     Blueprint, render_template, request, session,
-    redirect, url_for, flash, abort, current_app
+    redirect, url_for, flash, abort, current_app, make_response
 )
 from utils.results_loader import load_estimated_results_table, get_filter_options, ESTIMATED_FIELD_MAP
 from routes.results import extract_query_params
@@ -11,10 +11,29 @@
 estimated_bp = Blueprint("estimated", __name__)
 
 
+def _render_estimated_auth_required():
+    systems_info = get_all_systems_info()
+    response = make_response(render_template(
+        "estimated_results.html",
+        rows=[], columns=[],
+        authenticated=False, systems_info=systems_info,
+        pagination={"page": 1, "per_page": 100, "total": 0, "total_pages": 1},
+        filter_options={"systems": [], "codes": [], "exps": []},
+        current_system=None, current_code=None,
+        current_exp=None, current_per_page=100,
+    ))
+    response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate, max-age=0"
+    response.headers["Pragma"] = "no-cache"
+    return response
+
+
 # GET /estimated/
 @estimated_bp.route("/", methods=["GET"], strict_slashes=False)
 def estimated_results():
     authenticated = session.get("authenticated", False)
+    if not authenticated:
+        return _render_estimated_auth_required()
+
     email = session.get("user_email")
 
     store = get_user_store()
@@ -58,19 +77,24 @@ def estimated_results():
         field_map=ESTIMATED_FIELD_MAP,
     )
     systems_info = get_all_systems_info()
-    return render_template(
+    response = make_response(render_template(
         "estimated_results.html",
         rows=rows, columns=columns,
         authenticated=authenticated, systems_info=systems_info,
         pagination=pagination_info, filter_options=filter_options,
         current_system=filter_system, current_code=filter_code,
         current_exp=filter_exp, current_per_page=per_page,
-    )
+    ))
+    response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate, max-age=0"
+    response.headers["Pragma"] = "no-cache"
+    return response
 
 
 # GET /estimated/<filename>
 @estimated_bp.route("/<filename>")
 def show_estimated_result(filename):
+    if not session.get("authenticated", False):
+        abort(403, "Authentication required to view estimated data")
     estimated_dir = current_app.config["ESTIMATED_DIR"]
     check_file_permission(filename, estimated_dir)
     return load_result_file(filename, estimated_dir)

result_server/routes/results.py

@@ -2,7 +2,7 @@
 
 from flask import (
     Blueprint, render_template, request, session,
-    redirect, url_for, flash, abort, current_app
+    redirect, url_for, flash, abort, current_app, make_response
 )
 from utils.results_loader import load_results_table, load_single_result, load_multiple_results, get_filter_options, ALLOWED_PER_PAGE, DEFAULT_PER_PAGE
 from utils.user_store import get_user_store
@@ -14,6 +14,22 @@
 results_bp = Blueprint("results", __name__)
 
 
+def _render_confidential_auth_required():
+    systems_info = get_all_systems_info()
+    response = make_response(render_template(
+        "results_confidential.html",
+        rows=[], columns=[], systems_info=systems_info,
+        pagination={"page": 1, "per_page": DEFAULT_PER_PAGE, "total": 0, "total_pages": 1},
+        filter_options={"systems": [], "codes": [], "exps": []},
+        current_system=None, current_code=None,
+        current_exp=None, current_per_page=DEFAULT_PER_PAGE,
+        authenticated=False,
+    ))
+    response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate, max-age=0"
+    response.headers["Pragma"] = "no-cache"
+    return response
+
+
 def extract_query_params():
     """request.args から page, per_page, system, code, exp を一括抽出する。
 
@@ -77,6 +93,8 @@ def _render_results_list(public_only, template_name, redirect_endpoint):
 
     if not public_only:
         authenticated = session.get("authenticated", False)
+        if not authenticated:
+            return _render_confidential_auth_required()
         email = session.get("user_email")
         store = get_user_store()
         affs = store.get_affiliations(email) if email else []
@@ -99,14 +117,18 @@ def _render_results_list(public_only, template_name, redirect_endpoint):
 
     filter_options = get_filter_options(received_dir, filter_code=filter_code, **filter_kwargs)
     systems_info = get_all_systems_info()
-    return render_template(
+    response = make_response(render_template(
         template_name,
         rows=rows, columns=columns, systems_info=systems_info,
         pagination=pagination_info, filter_options=filter_options,
         current_system=filter_system, current_code=filter_code,
         current_exp=filter_exp, current_per_page=per_page,
         **template_extra,
-    )
+    ))
+    if not public_only:
+        response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate, max-age=0"
+        response.headers["Pragma"] = "no-cache"
+    return response
 
 
 # ==========================================

result_server/templates/estimated_results.html

@@ -12,6 +12,7 @@
 {% endblock %}
 
 {% block content %}
+{% if authenticated %}
 {% include "_filter_dropdowns.html" %}
 </div>
 
@@ -134,4 +135,5 @@
     window.location.href = url;
 }
 </script>
+{% endif %}
 {% endblock %}

result_server/templates/results_confidential.html

@@ -12,5 +12,7 @@
 {% endblock %}
 
 {% block content %}
+{% if authenticated %}
 {% include "_results_table.html" %}
+{% endif %}
 {% endblock %}

result_server/tests/test_pagination.py

@@ -428,6 +428,9 @@ def test_estimated_route_redirect(self, flask_app, tmp_dir):
         """推定結果ルートのページ範囲外リダイレクト"""
         self._make_estimated_files(tmp_dir, 5)
         with flask_app.test_client() as client:
+            with client.session_transaction() as sess:
+                sess["authenticated"] = True
+                sess["user_email"] = "user@example.com"
             resp = client.get("/estimated/?page=999")
             assert resp.status_code == 302
 
@@ -436,6 +439,32 @@ def test_estimated_route_redirect(self, flask_app, tmp_dir):
 # 既存機能の互換性テスト
 # ============================================================
 
+class TestEstimatedAuth:
+    def test_estimated_route_hides_table_when_unauthenticated(self, flask_app, tmp_dir):
+        uid = str(uuid.uuid4())
+        _write_json(tmp_dir, f"estimate_20250101_000000_{uid}.json", {
+            "code": "qws",
+            "current_system": {"system": "SysA", "fom": 1.0, "target_nodes": "1", "scaling_method": "m", "benchmark": {"system": "SysA", "fom": 1.0, "nodes": "1"}},
+            "future_system": {"system": "SysB", "fom": 2.0, "target_nodes": "2", "scaling_method": "m", "benchmark": {"system": "SysB", "fom": 2.0, "nodes": "2"}},
+            "performance_ratio": 2.0,
+        })
+        with flask_app.test_client() as client:
+            resp = client.get("/estimated/")
+        assert resp.status_code == 200
+        html = resp.get_data(as_text=True)
+        assert "Authentication required to view estimated data." in html
+        assert '<table id="resultsTable"' not in html
+        assert "no-store" in resp.headers.get("Cache-Control", "")
+
+    def test_estimated_json_requires_authentication(self, flask_app, tmp_dir):
+        uid = str(uuid.uuid4())
+        fname = f"estimate_20250101_000000_{uid}.json"
+        _write_json(tmp_dir, fname, {"code": "qws", "system": "SysA", "exp": "CASE0"})
+        with flask_app.test_client() as client:
+            resp = client.get(f"/estimated/{fname}")
+        assert resp.status_code == 403
+
+
 class TestExistingFeatureCompatibility:
     def test_load_results_table_returns_3_tuple(self, flask_app, tmp_dir):
         """load_results_table が (rows, columns, pagination_info) を返す"""

result_server/tests/test_usage_route.py

@@ -105,10 +105,25 @@ def _write_result(directory, filename, data):
 
 
 class TestUsageRoute:
+    def test_confidential_results_hides_table_when_unauthenticated(self, client, tmp_dirs):
+        received, _ = tmp_dirs
+        _write_result(
+            received,
+            "result_20260401_123456_aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee.json",
+            {"code": "qws", "system": "Fugaku", "Exp": "CASE0", "FOM": 1.0},
+        )
+        resp = client.get("/results/confidential")
+        text = resp.get_data(as_text=True)
+        assert resp.status_code == 200
+        assert "Authentication required to view confidential data." in text
+        assert '<table id="resultsTable"' not in text
+        assert "no-store" in resp.headers.get("Cache-Control", "")
+
     def test_unauthenticated_user_is_redirected_to_login(self, client):
         resp = client.get("/results/usage")
         assert resp.status_code == 302
         assert "/auth/login" in resp.headers["Location"]
+        assert "no-store" in resp.headers.get("Cache-Control", "")
 
     def test_non_admin_user_gets_403(self, client):
         _login_session(client, "user@example.com", ["dev"])
@@ -120,6 +135,7 @@ def test_admin_user_can_access_usage_page(self, client):
         resp = client.get("/results/usage")
         assert resp.status_code == 200
         assert "Usage Report" in resp.get_data(as_text=True)
+        assert "no-store" in resp.headers.get("Cache-Control", "")
 
     def test_usage_route_uses_default_parameters(self, app, client, monkeypatch):
         _login_session(client, "admin@example.com", ["admin"])