Method HandleProxy

cmd/cache-proxy/proxy.go:256–353

HandleProxy handles forward HTTP proxy requests from DuckDB httpfs. Expects absolute-form URIs (scheme + host + path in the request-line).

(w http.ResponseWriter, r *http.Request)

		_ = upstream.Close()
		_ = client.Close()
	}()
	go func() {
		defer close(clientDone)
		n, _ := io.Copy(client, upstream)
		recvFromUpstream = n
		_ = upstream.Close()
		_ = client.Close()
	}()

	go func() {
		<-upstreamDone
		<-clientDone
		span.SetAttributes(
			attribute.Int64("duckgres.connect.sent_bytes", sentToUpstream),
			attribute.Int64("duckgres.connect.recv_bytes", recvFromUpstream),
		)
		span.End()
		slog.Info("Forward-proxy CONNECT closed.",
			"target", target,
			"sent_bytes", sentToUpstream,
			"recv_bytes", recvFromUpstream,
			"duration_ms", time.Since(connectStart).Milliseconds())
	}()
}

// Hop-by-hop headers per RFC 7230 §6.1 — must not be forwarded.
var hopByHop = map[string]bool{
	"connection":          true,
	"keep-alive":          true,
	"proxy-authenticate":  true,
	"proxy-authorization": true,
	"te":                  true,
	"trailers":            true,
	"transfer-encoding":   true,
	"upgrade":             true,
}

// cachePassthroughHeader is added only by duckgres's worker-local router.
// It selects the proxy's observable-but-uncached request path and is stripped
// before the origin request so it cannot affect S3 or a SigV4 request.
const cachePassthroughHeader = "X-Duckgres-Cache-Passthrough"

func isInternalPropagationHeader(header string) bool {
	return strings.EqualFold(header, "traceparent") || strings.EqualFold(header, "tracestate")
}

// HandleProxy handles forward HTTP proxy requests from DuckDB httpfs.
// Expects absolute-form URIs (scheme + host + path in the request-line).
func (p *CacheProxy) HandleProxy(w http.ResponseWriter, r *http.Request) {
	inflightRequests.Inc()
	defer inflightRequests.Dec()
	r = r.WithContext(otel.GetTextMapPropagator().Extract(r.Context(), propagation.HeaderCarrier(r.Header)))

	// HTTPS via CONNECT tunnel — we can't cache encrypted traffic, but we must
	// still tunnel it so DuckDB can reach external HTTPS sources (e.g.
	// read_parquet('https://datasets.clickhouse.com/...')) while
	// http_proxy is set globally.
	if r.Method == http.MethodConnect {