Function rewrite_http_header_block

crates/openshell-core/src/secrets.rs:927–984

Rewrite credential placeholders in an HTTP header block. Resolves `openshell:resolve:env:*` placeholders in the request line (path segments and query parameter values), header values (including Basic auth tokens), and returns a `RewriteResult` with the rewritten bytes and a redacted target for logging. Returns `Err` if any placeholder is detected but cannot be resolved (fail-closed behavior).

(
    raw: &[u8],
    resolver: Option<&SecretResolver>,
)

/// Returns `Err` if any placeholder is detected but cannot be resolved
/// (fail-closed behavior).
pub fn rewrite_http_header_block(
    raw: &[u8],
    resolver: Option<&SecretResolver>,
) -> Result<RewriteResult, UnresolvedPlaceholderError> {
    let Some(resolver) = resolver else {
        return Ok(RewriteResult {
            rewritten: raw.to_vec(),
            redacted_target: None,
        });
    };

    let Some(header_end) = raw.windows(4).position(|w| w == b"\r\n\r\n").map(|p| p + 4) else {
        return Ok(RewriteResult {
            rewritten: raw.to_vec(),
            redacted_target: None,
        });
    };

    let header_str = String::from_utf8_lossy(&raw[..header_end]);
    let mut lines = header_str.split("\r\n");
    let Some(request_line) = lines.next() else {
        return Ok(RewriteResult {
            rewritten: raw.to_vec(),
            redacted_target: None,
        });
    };

    // Rewrite request line (path + query params)
    let rl_result = rewrite_request_line(request_line, resolver)?;

    let mut output = Vec::with_capacity(raw.len());
    output.extend_from_slice(rl_result.line.as_bytes());
    output.extend_from_slice(b"\r\n");

    for line in lines {
        if line.is_empty() {
            break;
        }

        output.extend_from_slice(rewrite_header_line_checked(line, resolver)?.as_bytes());
        output.extend_from_slice(b"\r\n");
    }

    output.extend_from_slice(b"\r\n");
    output.extend_from_slice(&raw[header_end..]);

    // Fail-closed scan: check for any remaining unresolved placeholders or
    // provider-shaped aliases in both raw and percent-decoded header bytes.
    let output_header = String::from_utf8_lossy(&output[..output.len().min(header_end + 256)]);
    if contains_reserved_credential_marker(&output_header) {
        return Err(UnresolvedPlaceholderError { location: "header" });
    }

    Ok(RewriteResult {
        rewritten: output,
        redacted_target: rl_result.redacted_target,
    })
}