Return Cache-Control headers for all API requests

api/app/controllers/spree/api/base_controller.rb

@@ -15,6 +15,7 @@ class BaseController < ActionController::Metal
       attr_accessor :current_api_user
 
       before_filter :set_content_type
+      before_filter :set_expiry
       before_filter :check_for_user_or_api_key, :if => :requires_authentication?
       before_filter :authenticate_user
       after_filter  :set_jsonp_format
@@ -55,6 +56,10 @@ def set_content_type
         headers["Content-Type"] = content_type
       end
 
+      def set_expiry
+        expires_in Spree::Api::Config[:cache_timeout].minutes
+      end
+
       def check_for_user_or_api_key
         # User is already authenticated with Spree, make request this way instead.
         return true if @current_api_user = try_spree_current_user || !Spree::Api::Config[:requires_authentication]

api/app/models/spree/api_configuration.rb

@@ -1,5 +1,6 @@
 module Spree
   class ApiConfiguration < Preferences::Configuration
     preference :requires_authentication, :boolean, :default => false
+    preference :cache_timeout, :integer, :default => 5
   end
 end

api/spec/controllers/spree/api/base_controller_spec.rb

@@ -19,6 +19,11 @@ def index
       json_response.should == { "products" => [] }
       response.status.should == 200
     end
+
+    it "sets cache control on the requests" do
+      api_get :index
+      response.headers["Cache-Control"].should == "max-age=300, private"
+    end
   end
 
   context "cannot make a request to the API" do