feat: add ETag headers to KV read responses

Expose the existing Blake3-256 content hash as an ETag header on KV
read responses. The hash was already computed and stored during writes;
this change threads it through InvocationOutcome::KvRead and sets
ETag: "blake3-<hex>" in the HTTP response.

Enables client-side caching for the TinyCloud CLI.

Author: skgbafa

Cargo.lock

@@ -16,6 +16,7 @@ aws-types = "0.49"
 aws-smithy-http = "0.49"
 base64 = "0.13"
 futures = { default-features = false, version = "0.3", features = ["alloc", "std"] }
+hex.workspace = true
 hyper = "0.14" # Prometheus server
 lazy_static = "1.4.0"
 opentelemetry = { version = "0.29.1" }

Cargo.toml

@@ -11,6 +11,7 @@ use rocket::{
 use serde::{Deserialize, Serialize};
 use std::collections::{BTreeMap, HashMap};
 use tinycloud_core::{
+    hash::Hash,
     types::Metadata,
     util::{Capability, DelegationInfo},
     InvocationOutcome,
@@ -82,7 +83,8 @@ where
             InvocationOutcome::KvMetadata(meta) => meta.map(ObjectHeaders).respond_to(request),
             InvocationOutcome::KvWrite => ().respond_to(request),
             InvocationOutcome::KvRead(data) => {
-                data.map(|(md, c)| KVResponse(c, md)).respond_to(request)
+                data.map(|(md, hash, c)| KVResponse(c, md, hash))
+                    .respond_to(request)
             }
             InvocationOutcome::OpenSessions(sessions) => Json(
                 sessions
@@ -170,11 +172,11 @@ impl<'r> Responder<'r, 'static> for ObjectHeaders {
     }
 }
 
-pub struct KVResponse<R>(R, pub Metadata);
+pub struct KVResponse<R>(R, pub Metadata, pub Hash);
 
 impl<R> KVResponse<R> {
-    pub fn new(md: Metadata, reader: R) -> Self {
-        Self(reader, md)
+    pub fn new(md: Metadata, hash: Hash, reader: R) -> Self {
+        Self(reader, md, hash)
     }
 }
 
@@ -183,7 +185,9 @@ where
     R: 'static + AsyncRead + Send,
 {
     fn respond_to(self, r: &'r Request<'_>) -> rocket::response::Result<'static> {
+        let etag = format!("\"blake3-{}\"", hex::encode(self.2.as_ref()));
         Ok(Response::build_from(ObjectHeaders(self.1).respond_to(r)?)
+            .header(Header::new("ETag", etag))
             // must ensure that Metadata::respond_to does not set the body of the response
             .streamed_body(self.0.compat())
             .finalize())

src/auth_guards.rs

@@ -369,7 +369,7 @@ pub enum InvocationOutcome<R> {
     KvDelete,
     KvMetadata(Option<Metadata>),
     KvWrite,
-    KvRead(Option<(Metadata, Content<R>)>),
+    KvRead(Option<(Metadata, Hash, Content<R>)>),
     OpenSessions(HashMap<Hash, DelegationInfo>),
     /// Ordered delegation chain from leaf to root
     DelegationChain(Vec<DelegationInfo>),
@@ -729,23 +729,24 @@ async fn get_kv<C: ConnectionTrait, B: ImmutableReadStore>(
     space_id: &SpaceId,
     key: &Path,
     // TODO version: Option<(i64, Hash, i64)>,
-) -> Result<Option<(Metadata, Content<B::Readable>)>, EitherError<DbErr, B::Error>> {
+) -> Result<Option<(Metadata, Hash, Content<B::Readable>)>, EitherError<DbErr, B::Error>> {
     let e = match get_kv_entity(db, space_id, key)
         .await
         .map_err(EitherError::A)?
     {
         Some(entry) => entry,
         None => return Ok(None),
     };
+    let content_hash = e.value;
     let c = match store
-        .read(space_id, &e.value)
+        .read(space_id, &content_hash)
         .await
         .map_err(EitherError::B)?
     {
         Some(c) => c,
         None => return Ok(None),
     };
-    Ok(Some((e.metadata, c)))
+    Ok(Some((e.metadata, content_hash, c)))
 }
 
 async fn get_kv_entity<C: ConnectionTrait>(