Function prepare_backend_request

crates/openshell-router/src/backend.rs:193–322

Build and send an HTTP request to the backend configured in `route`. Returns the prepared [`reqwest::RequestBuilder`] with auth, headers, model rewrite, and body applied. The caller decides whether to apply a total request timeout before sending. `stream_response` controls whether Vertex AI Anthropic routes upgrade the stored `:rawPredict` suffix to `:streamRawPredict` in the upstream URL. It mu

(
    client: &reqwest::Client,
    route: &ResolvedRoute,
    method: &str,
    path: &str,
    headers: &[(String, String)],
    body: bytes::Bytes,
    stream_response: bool,
)

/// passes `true`), but `:streamRawPredict` accepts both streaming and
/// non-streaming request bodies, so the behaviour is correct in all cases.
fn prepare_backend_request(
    client: &reqwest::Client,
    route: &ResolvedRoute,
    method: &str,
    path: &str,
    headers: &[(String, String)],
    body: bytes::Bytes,
    stream_response: bool,
) -> Result<(reqwest::RequestBuilder, String), RouterError> {
    // For AWS Bedrock routes the model id is encoded in the URL path
    // (`/model/{modelId}/invoke[-with-response-stream]`), not in the
    // JSON body. The caller's path can carry any model id; rewrite it
    // to the operator-configured `route.model` so a sandbox cannot
    // pick a different upstream model than what `inference set`
    // configured. If the path is not a recognized Bedrock shape on a
    // Bedrock route, reject the request rather than forwarding
    // verbatim.
    let rewritten_path: String;
    let path = if route_is_bedrock(route) {
        match rewrite_bedrock_path(route, path) {
            Some(p) => {
                rewritten_path = p;
                rewritten_path.as_str()
            }
            None => {
                return Err(RouterError::Internal(format!(
                    "AWS Bedrock route received unprocessable path '{path}' or invalid \
                     route.model; expected /model/<id>/invoke and a model id with no \
                     path separators, URL delimiters, percent escapes, traversal \
                     segments, whitespace, or control characters"
                )));
            }
        }
    } else {
        path
    };
    let url = build_provider_url(route, &route.model, path, stream_response);
    let headers = sanitize_request_headers(route, headers);

    let reqwest_method: reqwest::Method = method
        .parse()
        .map_err(|_| RouterError::Internal(format!("invalid HTTP method: {method}")))?;

    let mut builder = client.request(reqwest_method, &url);

    // Inject API key using the route's configured auth mechanism.
    match &route.auth {
        AuthHeader::Bearer => {
            builder = builder.bearer_auth(&route.api_key);
        }
        AuthHeader::Custom(header_name) => {
            builder = builder.header(*header_name, &route.api_key);
        }
        AuthHeader::None => {
            // Bridge-fronted upstream: no router-side auth injection.
            // The configured `endpoint` is expected to be a translating
            // bridge / proxy whose own pod holds operator-side
            // credentials. Used today by the `aws-bedrock` profile