Documentation
¶
Index ¶
Constants ¶
const ( HeaderRelayAPIKey = "X-WR-API-Key" HeaderProxyMode = "X-WR-Proxy-Mode" HeaderUpstreamHost = "X-WR-Upstream-Host" ProxyModeValueProxy = "Proxy" // HeaderUsage opts the caller into an inline relay_usage block on the // response ("full"). Relay-internal; stripped from the upstream // request by the X-WR-* denylist. HeaderUsage = "X-WR-Usage" UsageValueFull = "full" // HeaderEventTime overrides the usage Event timestamp (RFC3339). // Honored only under RELAY_DEV_TRUST_EVENT_TIME=1 — dev/replay // tooling. Stripped from the upstream request by the X-WR-* denylist. HeaderEventTime = "X-WR-Event-Time" // HeaderRequestTags carries caller-supplied observability tags as a // flat JSON object (string→string). Validated post-flight and landed // on the usage Event's tags field. Stripped from the upstream request // by the X-WR-* denylist. HeaderRequestTags = "X-WR-Request-Tags" )
Relay-internal control headers. Read at the inference edge by the mode classifier; never forwarded upstream.
Variables ¶
var HopByHop = []string{
"Connection",
"Keep-Alive",
"Proxy-Authenticate",
"Proxy-Authorization",
"TE",
"Trailers",
"Transfer-Encoding",
"Upgrade",
}
HopByHop is the canonical RFC 7230 hop-by-hop header set.
var StripDenylist = []string{
"Authorization",
"X-Api-Key",
"Cookie",
"X-WR-*",
}
StripDenylist is the negative strip set applied at the inference edge after the mode classifier has captured the relay-internal headers it needs. Everything else passes through to upstream — the relay does not police which vendor-specific headers callers send.
Authorization is denylisted at the edge for both modes:
- Normal mode: relay-key value, consumed by auth; adapter injects the upstream key on the outbound request.
- Proxy mode: caller's upstream key, captured by the classifier; the proxy forwarder re-attaches it on the outbound request.
Either way, ctx is the source of truth post-strip; nothing reads the raw inbound Authorization downstream.
Matching is case-insensitive. Trailing "*" is a prefix match.
Functions ¶
func Match ¶
Match reports whether name matches any pattern in patterns, case-insensitively. Patterns may be exact (e.g., "Authorization") or prefix-style with a trailing "*" (e.g., "X-WR-*").
func SafeUpstreamError ¶
SafeUpstreamError returns a user-safe error message for an upstream failure, redacting URLs, IP addresses, and other internal details. providerName is the public provider identifier (e.g. "openai").
func SanitizeUpstreamResponse ¶
SanitizeUpstreamResponse strips hop-by-hop headers from the upstream response before they are propagated back to the caller. Modifies h in place. Returns the same map.
Types ¶
This section is empty.
Source Files