p14

internal/httpapp/app.go

@@ -143,26 +143,32 @@ func New(cfg Config) (*App, error) {
 func (a *App) Router() http.Handler {
 	// Middleware chain order (outer to inner):
 	// 1. CORS (handles preflight)
-	// 2. Security headers
-	// 3. Request size limit (10MB)
-	// 4. Content-Type validation
-	// 5. Rate limiting
-	// 6. Error recovery
-	// 7. Request ID
-	// 8. Logging
-	// 9. Audit
-	// 10. Authentication
-	// 11. Routes
+	// 2. Compression (gzip)
+	// 3. Security headers
+	// 4. Request size limit (10MB)
+	// 5. Content-Type validation
+	// 6. Rate limiting
+	// 7. Caching (for GET requests)
+	// 8. Error recovery
+	// 9. Request ID
+	// 10. Logging
+	// 11. Audit
+	// 12. Authentication
+	// 13. Routes
 	return a.corsMiddleware(
-		a.securityHeadersMiddleware(
-			a.requestSizeMiddleware(10 * 1024 * 1024)(
-				a.validateContentTypeMiddleware(
-					a.rateLimitMiddleware(
-						a.errorMiddleware(
-							requestID(
-								logging(
-									a.auditMiddleware(
-										a.authMiddleware(a.mux),
+		a.compressionMiddleware(
+			a.securityHeadersMiddleware(
+				a.requestSizeMiddleware(10 * 1024 * 1024)(
+					a.validateContentTypeMiddleware(
+						a.rateLimitMiddleware(
+							a.cacheMiddleware(
+								a.errorMiddleware(
+									requestID(
+										logging(
+											a.auditMiddleware(
+												a.authMiddleware(a.mux),
+											),
+										),
 									),
 								),
 							),