[TheAlexLichter]

Problem

Void's auth middleware copies the session lookup's cache-control: no-store and pragma: no-cache onto every signed-in response. This overwrites the route's own policy. So signed-in data can never be revalidated: private, no-cache plus an ETag never gives a 304.

signed-in GET /report   (route sends private, no-cache + ETag)
  route ──► auth middleware ──► Cache-Control: no-store    ✗ never a 304

What this PR changes

route Cache-Control (signed-in)        before      after
────────────────────────────────────   ─────────   ──────────────────────────
no-store                               no-store    kept (no pragma)
private, no-cache   (+ any max-age)    no-store    kept → etag() answers 304
private  /  private, max-age=60        no-store    no-store
private="set-cookie" / no-cache="…"    no-store    no-store
no-cache  /  public  /  none           no-store    no-store
anonymous request                      unchanged   unchanged

• A kept policy also skips the cookie-rotation fallback (private, no-store). The rotated Set-Cookie is still sent.
• Directive parsing keeps quoted values intact. A comma inside no-cache="a,private" does not make a bare private.

Decisions

Question	Choice	Why
Keep bare private?	No	The browser can reuse it without asking the Worker. After sign-out, the next account on the same browser can see it.
Keep private, no-cache?	Yes	Shared caches can't store it, and the browser must ask before each reuse. This is the 304 case.
Send Clear-Site-Data on sign-out?	Not here	Separate product decision.

Known limits

• The app sends the 304, not Void. Use Hono's etag() middleware.
• A hand-written ETag must differ per user. Otherwise user B can get a 304 for user A's cached page.
• The browser Back button can show a kept private, no-cache page after sign-out. Pages that must not stay in the browser cache should keep the default no-store.

Shared caches stay safe: ISR and dispatch skip requests with credentials, and they never store private, no-cache or no-store.

Testing

Test	Covers
auth-isr-cache-policy.test.ts (real Better Auth)	kept and no-store tables, quoted values, case and tab variants, etag() 304 end to end
auth-middleware.test.ts	cookie rotation with kept and not-kept policies
vp run test, vp run check, lint, fmt	pass

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://fix-auth-keep-route-cache-control-void-cloud.voidzero-docs.workers.dev (commit 8b0c224)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://df23b703-void-cloud.voidzero-docs.workers.dev	8b0c224	2026-10-13T04:53:25.509Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://f3f844a1-void-cloud.voidzero-docs.workers.dev	8af5b3f	2026-10-12T11:11:13.953Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://9a40282f-void-cloud.voidzero-docs.workers.dev	76ad922	2026-10-12T08:47:40.309Z	Visit the dashboard ↗