fix: Body-aware successful responses lack private cache control

.changelog/private-body-receipts.md

@@ -0,0 +1,6 @@
+---
+"mpp": patch
+---
+
+Mark successful body-bound payment responses as private while preserving existing
+`Cache-Control` directives, preventing shared caches from storing payment receipts.

src/server/middleware.rs

@@ -395,6 +395,19 @@ where
             let req = Request::from_parts(parts, http_body_util::Full::new(body));
             let mut resp = inner.call(req).await?;
 
+            // Receipt responses MUST be Cache-Control: private (spec §11.10).
+            let existing_cc = resp
+                .headers()
+                .get_all(header::CACHE_CONTROL)
+                .iter()
+                .filter_map(|v| v.to_str().ok())
+                .collect::<Vec<_>>()
+                .join(", ");
+            let cache_control = with_private_cache_control(Some(existing_cc.as_str()));
+            if let Ok(val) = HeaderValue::from_str(&cache_control) {
+                resp.headers_mut().insert(header::CACHE_CONTROL, val);
+            }
+
             if let Ok(val) = HeaderValue::from_str(&receipt_header) {
                 resp.headers_mut().insert(PAYMENT_RECEIPT_HEADER, val);
             }
@@ -875,7 +888,12 @@ mod tests {
         fn call(&mut self, req: Request<http_body_util::Full<Bytes>>) -> Self::Future {
             Box::pin(async move {
                 let body = req.into_body().collect().await.unwrap().to_bytes();
-                Ok(Response::new(body.to_vec()))
+                let mut response = Response::new(body.to_vec());
+                response.headers_mut().insert(
+                    header::CACHE_CONTROL,
+                    HeaderValue::from_static("max-age=60"),
+                );
+                Ok(response)
             })
         }
     }
@@ -936,6 +954,10 @@ mod tests {
             resp.headers().get(PAYMENT_RECEIPT_HEADER).unwrap(),
             "mock-receipt-token"
         );
+        assert_eq!(
+            resp.headers().get(header::CACHE_CONTROL).unwrap(),
+            "max-age=60, private"
+        );
         assert_eq!(
             verify_body.lock().unwrap().as_deref(),
             Some(br#"{"query":"paid"}"#.as_slice())