fix: derive file ETags from current source content

src/server/routes/file-etag.ts

@@ -1,17 +1,17 @@
 import { createHash } from "crypto";
 
-// Build an ETag that fingerprints the upstream content (?v=<sha>), the file
+// Build an ETag that fingerprints the current upstream content (commit and blob SHA), the file
 // path, and the anonymization config the user has saved. Without the config
 // part the browser kept serving bytes anonymized under an older term list
 // (#439). The path is folded in so two different files inside the same repo
 // can never collide.
 export function fileETag(
-  versionParam: string | undefined,
+  sourceFingerprint: string | undefined,
   filePath: string,
   options: unknown
 ): string {
   const h = createHash("sha1");
-  h.update(versionParam || "");
+  h.update(sourceFingerprint || "");
   h.update("|");
   h.update(filePath || "");
   h.update("|");

src/server/routes/file.ts

@@ -132,7 +132,7 @@ router.get(
         );
       }
       const etag = fileETag(
-        req.query.v as string | undefined,
+        `${repo.model.source.commit || ""}:${await f.sha() || ""}`,
         anonymizedPath,
         repo.model.options
       );