fix(health): prevent caching of rejected requests

CHANGES.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- `createHealthHandler()` includes `cache-control: no-store` and JSON
+  content-type headers on `404` and `405` responses.
 - `@openstatus/health`: Probes no longer start work if an async `skip`
   returns `false` after the timeout. The completed timeout report stays unchanged.
 

packages/health/src/handler.test.ts

@@ -31,13 +31,33 @@ test("createHealthHandler() answers HEAD without a body", async () => {
   assert.equal(await res.text(), "");
 });
 
-test("createHealthHandler() rejects other methods with 405", async () => {
-  const handler = createHealthHandler({ probes: [ok] });
-  const res = await handler(
-    new Request("http://localhost/health", { method: "POST" }),
-  );
-  assert.equal(res.status, 405);
-  assert.equal(res.headers.get("allow"), "GET, HEAD");
+test("createHealthHandler() rejects requests without caching or running probes", async () => {
+  let runs = 0;
+  const handler = createHealthHandler({
+    path: "/health",
+    probes: [{ name: "a", run: () => runs++ }],
+  });
+  for (
+    const { path, method, status, allow } of [
+      { path: "/other", method: "GET", status: 404, allow: null },
+      { path: "/other", method: "HEAD", status: 404, allow: null },
+      { path: "/other", method: "POST", status: 404, allow: null },
+      { path: "/health", method: "POST", status: 405, allow: "GET, HEAD" },
+    ]
+  ) {
+    const res = await handler(
+      new Request(`http://localhost${path}`, { method }),
+    );
+    assert.equal(res.status, status);
+    assert.equal(res.headers.get("allow"), allow);
+    assert.equal(res.headers.get("cache-control"), "no-store");
+    assert.equal(
+      res.headers.get("content-type"),
+      "application/json; charset=utf-8",
+    );
+    assert.equal(await res.text(), "");
+    assert.equal(runs, 0);
+  }
 });
 
 test("createHealthHandler() passes the request to extend", async () => {

packages/health/src/handler.ts

@@ -1,4 +1,5 @@
 import { createHealthResponder } from "./responder.ts";
+import { healthHeaders } from "./response.ts";
 import type { HealthRouteOptions } from "./types.ts";
 
 export type HealthHandler<Req extends Request = Request> = (
@@ -17,11 +18,16 @@ export function createHealthHandler<Req extends Request = Request>(
   const path = options.path;
   return (request: Req): Promise<Response> => {
     if (path != null && !matchesPath(request.url, path)) {
-      return Promise.resolve(new Response(null, { status: 404 }));
+      return Promise.resolve(
+        new Response(null, { status: 404, headers: healthHeaders }),
+      );
     }
     if (request.method !== "GET" && request.method !== "HEAD") {
       return Promise.resolve(
-        new Response(null, { status: 405, headers: { allow: "GET, HEAD" } }),
+        new Response(null, {
+          status: 405,
+          headers: { ...healthHeaders, allow: "GET, HEAD" },
+        }),
       );
     }
     return responder.toResponse(request, request.method);