Function sanitize_request_headers

crates/openshell-router/src/backend.rs:106–149

(
    route: &ResolvedRoute,
    headers: &[(String, String)],
)

}

fn sanitize_request_headers(
    route: &ResolvedRoute,
    headers: &[(String, String)],
) -> Vec<(String, String)> {
    let mut allowed = HashSet::new();
    allowed.extend(
        COMMON_INFERENCE_REQUEST_HEADERS
            .iter()
            .map(|name| (*name).to_string()),
    );
    allowed.extend(
        route
            .passthrough_headers
            .iter()
            .map(|name| name.to_ascii_lowercase()),
    );
    allowed.extend(
        route
            .default_headers
            .iter()
            .map(|(name, _)| name.to_ascii_lowercase()),
    );

    // Vertex AI Anthropic rawPredict endpoints do not accept the
    // `anthropic-beta` header. Beta feature enablement for Vertex AI is
    // controlled through Google Cloud, not HTTP headers. Strip it here so
    // clients (e.g. Claude Code) that always send beta flags don't cause
    // HTTP 400 errors from the Vertex AI backend.
    let strip_anthropic_beta = is_vertex_anthropic_rawpredict_route(route);

    headers
        .iter()
        .filter_map(|(name, value)| {
            let name_lc = name.to_ascii_lowercase();
            if should_strip_request_header(&name_lc) || !allowed.contains(&name_lc) {
                return None;
            }
            if strip_anthropic_beta && name_lc == "anthropic-beta" {
                return None;
            }
            Some((name.clone(), value.clone()))
        })
        .collect()
}

fn should_strip_request_header(name: &str) -> bool {
    matches!(