fix: add record files restriction option to enable cache-control header

[tmorrell]

❤️ Thank you for your contribution!

Description

InvenioRDM doesn't currently add cache-control headers to file links, which can result in weird behavior if a cache is put in front of the repo. This is because the cache-control headers are only added by default for non-restricted files (which makes sense) https://github.com/inveniosoftware/invenio-files-rest/blob/616dc34c38006433653211feb5a9e523b0d399e7/invenio_files_rest/helpers.py#L182. But because InvenioRDM doesn't pass this option, the cache-control headers are never added.

This should be reviewed carefully to make sure it doesn't have security implications.

Checklist

Ticks in all boxes and 🟢 on all GitHub actions status checks are required to merge:

• I'm aware of the code of conduct.
• I've created logical separate commits and followed the commit message format.
• I've added relevant test cases.
• I've added relevant documentation.
• I've marked translation strings.
• I've identified the copyright holder(s) and updated copyright headers for touched files (>15 lines contributions).
• I've NOT included third-party code (copy/pasted source code or new dependencies).
  • If you have added third-party code (copy/pasted or new dependencies), please reach out to an architect on Discord.

Reminder

By using GitHub, you have already agreed to the GitHub’s Terms of Service including that:

1. You license your contribution under the same terms as the current repository’s license.
2. You agree that you have the right to license your contribution under the current repository’s license.

[zzacharo]

shouldt that be assigned to the record resrtiction?

[egabancho]

🤔 By setting restricted=False, we are making send_stream to set the Cache-Control also to public here.

According to MDM

You should add the private directive for user-personalized content, especially for responses received after login and for sessions managed via cookies.

Maybe a good alternative would be to set restricted to the actual record/file restrictions, and then update send_stream/redirect_stream to set Cache-Control to public or private, respectively.

What do y'all think?

[egabancho]

About the changes required on Invenio-Files-Rest and Invenio-S3, we should check inveniosoftware/invenio-files-rest#283. There was some discussion there about using no-cache instead of private.