Rewrite a Bedrock invocation path so the model segment is the operator-configured `route.model` rather than whatever the caller supplied. Returns the rewritten path on success, or `None` when the inbound path is not a recognized Bedrock invocation shape or when `route.model` is not a valid Bedrock model id. Why rewrite rather than reject: the inbound L7 pattern detector already accepts only `/mod
(route: &ResolvedRoute, path: &str)
| 910 | /// are rejected so a stale or hand-edited route store cannot produce |
| 911 | /// ambiguous or malformed upstream paths. |
| 912 | fn rewrite_bedrock_path(route: &ResolvedRoute, path: &str) -> Option<String> { |
| 913 | if !is_valid_bedrock_model_id(&route.model) { |
| 914 | return None; |
| 915 | } |
| 916 | let (_caller_model, action, query_tail) = parse_bedrock_invocation_path(path)?; |
| 917 | Some(format!("/model/{}{}{}", route.model, action, query_tail)) |
| 918 | } |
| 919 | |
| 920 | /// Defense-in-depth predicate matching the server-side |
| 921 | /// `validate_aws_bedrock_model_id` contract — see that function for the |