feat: cache canvas media locally

api/main.py

@@ -1231,6 +1231,11 @@ def user_can_access_agent_run(run_id: str, user: dict | None) -> bool:
 JOB_PATH_RE = re.compile(r"^/jobs/([0-9a-f]{8,32})(?:/|$)")
 COPY_TO_JOB_PATH_RE = re.compile(r"^/asset-library/[^/]+/[^/]+/copy-to-job/([0-9a-f]{8,32})(?:/|$)")
 AGENT_RUN_PATH_RE = re.compile(r"^/agent-runs/([0-9a-f]{8,32})(?:/|$)")
+PRIVATE_MEDIA_PATH_RE = re.compile(
+    r"^/(jobs|agent-runs)/.+\.(jpg|jpeg|png|webp|mp4|mp3|wav)$",
+    re.IGNORECASE,
+)
+PRIVATE_MEDIA_CACHE_CONTROL = "private, max-age=2592000, immutable"
 
 
 def _extract_protected_job_id(path: str) -> str:
@@ -2139,6 +2144,19 @@ async def enforce_data_isolation(request: Request, call_next):
     return await call_next(request)
 
 
+@app.middleware("http")
+async def add_private_media_cache_headers(request: Request, call_next):
+    response = await call_next(request)
+    if (
+        request.method in {"GET", "HEAD"}
+        and response.status_code == 200
+        and PRIVATE_MEDIA_PATH_RE.match(request.url.path)
+    ):
+        response.headers.setdefault("Cache-Control", PRIVATE_MEDIA_CACHE_CONTROL)
+        response.headers.setdefault("X-Content-Type-Options", "nosniff")
+    return response
+
+
 @app.get("/auth/check")
 def auth_check(request: Request) -> Response:
     ensure_auth_configured()