Add no-cache headers to draft blog posts

Fixes T2158.

Use Cache-Control headers for draft blog posts so that they are not
cached (since we want changes to be reflected immediately).

"Cache-Control" was used instead of Fastly's "Surrogate-Control" because
the former is a common standard that is not exclusive to Fastly.

Author: alarthast

blog/tests.py

@@ -406,6 +406,62 @@ def test_user_cannot_see_unpublished_entries(self):
         response = self.client.get(published_url)
         self.assertEqual(response.status_code, 200)
 
+    def test_drafts_have_no_cache_headers(self):
+        """
+        Test that unpublished entries have no-cache headers and that content
+        changes are immediately visible (not cached).
+        """
+        user = User.objects.create(username="staff", is_staff=True)
+        content_type = ContentType.objects.get_for_model(Entry)
+        change_permission = Permission.objects.get(
+            content_type=content_type, codename="change_entry"
+        )
+        user.user_permissions.add(change_permission)
+        self.client.force_login(user)
+
+        unpublished_entry = Entry.objects.create(
+            pub_date=self.tomorrow,
+            is_active=True,
+            headline="unpublished",
+            slug="unpublished",
+            body="draft 1",
+        )
+        unpublished_url = reverse(
+            "weblog:entry",
+            kwargs={
+                "year": unpublished_entry.pub_date.year,
+                "month": unpublished_entry.pub_date.strftime("%b").lower(),
+                "day": unpublished_entry.pub_date.day,
+                "slug": unpublished_entry.slug,
+            },
+        )
+
+        response = self.client.get(unpublished_url)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("Cache-Control", response.headers)
+        self.assertEqual(response.headers["Cache-Control"], "private, no-cache")
+
+    def test_published_blogs_do_not_have_cache_control_headers(self):
+        """
+        Test that published blog posts don't have explicit no-cache headers.
+        """
+        entry = Entry.objects.create(
+            pub_date=self.yesterday, is_active=True, headline="foo", slug="foo"
+        )
+        url = reverse(
+            "weblog:entry",
+            kwargs={
+                "year": entry.pub_date.year,
+                "month": entry.pub_date.strftime("%b").lower(),
+                "day": entry.pub_date.day,
+                "slug": entry.slug,
+            },
+        )
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)
+        self.assertNotIn("Cache-Control", response.headers)
+
 
 class SitemapTests(DateTimeMixin, TestCase):
     def test_sitemap(self):

blog/views.py

@@ -58,3 +58,9 @@ def get_queryset(self):
             return Entry.objects.all()
         else:
             return super().get_queryset()
+
+    def get(self, request, *args, **kwargs):
+        response = super().get(request, *args, **kwargs)
+        if not self.object.is_published():
+            response["Cache-Control"] = "private, no-cache"
+        return response