Susana Ferreira b7635b5036 fix(aibridge): strip proxy headers from bridge requests to fix Bedrock SigV4 signing (#26019) ...

## Problem

On bridge routes, aibridge acts as a client and originates new outbound
requests via the SDK. Proxy headers (`X-Forwarded-For`,
`X-Forwarded-Host`, etc.) from the inbound client request were forwarded
on the outbound request. The SigV4 signer signs all headers present, so
any in-transit modification by an egress proxy (e.g. appending an IP to
`X-Forwarded-For`) invalidated the signature, causing AWS Bedrock to
reject the request with:

> 403: "The request signature we calculated does not match the signature
you provided."

## Changes

- Strip proxy headers in `PrepareClientHeaders` on bridge routes
- Add unit test for proxy header stripping in `client_headers_test.go`
- Add integration test that verifies SigV4 signature remains valid after
an egress proxy modifies headers in transit
- Add integration test that verifies passthrough routes still set
forwarded headers correctly

Related to internal [Slack
thread](https://codercom.slack.com/archives/C096PFVBZKN/p1779919049215969).

> 🤖 Generated by Coder Agents, modified and reviewed by @ssncferreira

2026-06-04 10:15:38 +02:00

..

integrationtest

fix(aibridge): strip proxy headers from bridge requests to fix Bedrock SigV4 signing (#26019)

2026-06-04 10:15:38 +02:00

testutil

feat: serve 503 sentinel for disabled providers (#25794)

2026-05-29 10:24:16 +02:00