Function parse_request_parts

crates/openshell-supervisor-network/src/sigv4.rs:135–195

Parse raw HTTP headers into components needed for `SigV4` signing. Only host, content-type, and content-length are included in the `SigV4` signature. Signing all headers causes failures when the proxy or transport modifies unsigned-by-convention headers (Connection, Accept-Encoding, etc.) between signing and delivery. Header names are lowercased for comparison and stored in lowered form in `all_

(header_str: &str)

/// case-insensitive header names, and this function is only used on the
/// `SigV4` signing path.
fn parse_request_parts(header_str: &str) -> RequestParts<'_> {
    // Headers stripped entirely — the SDK re-generates auth headers, and
    // `Expect` is handled by the proxy before forwarding.
    const STRIP_HEADERS: &[&str] = &[
        "authorization",
        "x-amz-date",
        "x-amz-security-token",
        "x-amz-content-sha256",
        "expect",
    ];
    // Headers forwarded but NOT signed — the proxy or transport may modify
    // them between signing and delivery, which would invalidate the signature.
    const UNSIGNED_HEADERS: &[&str] = &[
        "connection",
        "accept-encoding",
        "transfer-encoding",
        "user-agent",
        "amz-sdk-invocation-id",
        "amz-sdk-request",
    ];

    let lines: Vec<&str> = header_str.split("\r\n").collect();

    let (method, path, request_line) =
        lines
            .first()
            .map_or(("GET", "/", "GET / HTTP/1.1"), |first_line| {
                let parts: Vec<&str> = first_line.splitn(3, ' ').collect();
                if parts.len() >= 2 {
                    (parts[0], parts[1], *first_line)
                } else {
                    ("GET", "/", *first_line)
                }
            });

    let mut headers_to_sign: Vec<(String, String)> = Vec::new();
    let mut all_headers: Vec<(String, String)> = Vec::new();
    for line in lines.iter().skip(1) {
        if line.is_empty() {
            break;
        }
        if let Some((k, v)) = line.split_once(':') {
            let lower = k.trim().to_ascii_lowercase();
            if STRIP_HEADERS.iter().any(|s| lower.starts_with(s)) {
                continue;
            }
            all_headers.push((lower.clone(), v.trim().to_string()));
            if !UNSIGNED_HEADERS.iter().any(|s| lower.starts_with(s)) {
                headers_to_sign.push((lower, v.trim().to_string()));
            }
        }
    }

    RequestParts {
        method,
        path,
        request_line,
        headers_to_sign,