Fix reverse-proxy SSE/streaming fidelity (event: lines, gzip, header propagation, Host)

[pdettori]

Fixes #656.

Three reverse-proxy fidelity fixes so authbridge-proxy faithfully proxies streaming (SSE) responses — required for spec-compliant SSE clients (e.g. the Anthropic SDK) to work through the reverse proxy when a response-side StreamingResponder plugin (e.g. inference-parser) is active.

Commits

1. rewrite outbound Host header in the reverse-proxy Director — wrap the default Director to set req.Host = target.Host, so the backend receives its own host. Cloudflare-fronted backends (api.anthropic.com) reject a mismatched Host.
2. forward all inbound header mutations to the backend — propagate the full inbound header diff (set/replace/delete), not just Authorization, so a header a plugin sets on the inbound pipeline (e.g. x-api-key) actually reaches the backend. Content-Length/Content-Encoding stay managed by the body-rewrite path.
3. preserve the SSE event: line and strip Accept-Encoding — sseframe.Reader now captures the event: field (LastEvent()) and the streaming re-framer emits event: <type> before the data: lines; the Director strips the client's Accept-Encoding so Go's transport transparently decompresses upstream gzip (no Content-Encoding: gzip over re-emitted plaintext). Without these, SSE clients decode zero events.

Testing

go test ./authlib/listener/reverseproxy/... ./authlib/listener/internal/sseframe/... passes, including new tests: sseframe event capture; reverse-proxy event:-preservation, Accept-Encoding strip (verified via the Director's output), full inbound-header propagation, and Host rewrite. Validated end-to-end in the RC1 AuthBridge egress PoC (harness → AuthBridge → api.anthropic.com streaming agent leaf, 13/13 live on Kind).

Assisted-By: Claude Code

Summary by CodeRabbit

• New Features
  • Streaming SSE responses now preserve and relay upstream event: types alongside data: lines.
• Bug Fixes
  • Reverse proxy now rewrites Host to match the selected backend.
  • Request headers mutated during processing (including additions and deletions) are now consistently reflected downstream.
  • SSE streaming avoids compression-framing inconsistencies by stripping Accept-Encoding when response-body inspection is needed.
• Tests
  • Added regression coverage for event: preservation, Host rewriting, header mutation behavior, and Accept-Encoding handling in streaming paths.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 130627fb-aa8a-45cd-9da4-5b3202052249

📥 Commits

Reviewing files that changed from the base of the PR and between 3c86aac and fe2ad3b.

📒 Files selected for processing (2)

• authbridge/authlib/listener/reverseproxy/server.go
• authbridge/authlib/listener/reverseproxy/streaming_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• authbridge/authlib/listener/reverseproxy/streaming_test.go
• authbridge/authlib/listener/reverseproxy/server.go

---

📝 Walkthrough

Walkthrough

The reverse proxy now captures SSE event: fields, preserves them during response re-framing, conditionally strips compression requests, rewrites the backend host, and propagates complete inbound pipeline header mutations. Tests cover each behavior.

Changes

SSE reverse proxy behavior

Layer / File(s)	Summary
SSE event capture contract authbridge/authlib/listener/internal/sseframe/reader.go, authbridge/authlib/listener/internal/sseframe/reader_test.go	Reader captures the current frame’s event: value, clears it per frame, exposes LastEvent(), and tests capture, reset, and empty behavior.
Outbound request normalization and mutation propagation authbridge/authlib/listener/reverseproxy/server.go, authbridge/authlib/listener/reverseproxy/server_test.go, authbridge/authlib/listener/reverseproxy/streaming_test.go	The proxy rewrites Host, conditionally removes Accept-Encoding, and synchronizes pipeline-added, changed, and deleted headers with forwarded requests.
Streaming SSE re-framing authbridge/authlib/listener/reverseproxy/server.go, authbridge/authlib/listener/reverseproxy/streaming_test.go	Re-framed responses emit upstream event: lines before corresponding data: lines, with regression coverage for event preservation.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ReverseProxy
  participant InboundPipeline
  participant Backend
  participant streamingResponseBody
  Client->>ReverseProxy: Send streaming request
  ReverseProxy->>InboundPipeline: Run inbound pipeline
  InboundPipeline-->>ReverseProxy: Return mutated headers
  ReverseProxy->>Backend: Forward normalized request
  Backend-->>streamingResponseBody: Return SSE event and data lines
  streamingResponseBody-->>Client: Re-frame event and data lines

Loading

Possibly related PRs

• kagenti/kagenti-extensions#618: Both changes preserve or reconstruct upstream SSE event: lines during proxy streaming.

Suggested reviewers: cwiklik

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main reverse-proxy SSE/streaming fixes, including event lines, gzip handling, header propagation, and Host rewriting.
Linked Issues check	✅ Passed	The changes implement the linked issue’s required fixes and tests for SSE event preservation, Accept-Encoding handling, full header propagation, and Host rewriting.
Out of Scope Changes check	✅ Passed	The added tests and scoped pass-through Accept-Encoding behavior stay within the reported reverse-proxy streaming fidelity work.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[huang195]

Summary

Perfetto — three tight, correct fixes, each with a test that locks in the exact bug.

1. Host rewrite — the Director wrap sets req.Host = target.Host after calling the original director. Correct for Cloudflare/SNI-fronted backends (api.anthropic.com) that validate Host against the request line.
2. Full inbound-header diff propagation — the delete-then-set loop reconciles pctx.Headers (the canonical clone) against r.Header, so a plugin-set x-api-key and a plugin-deleted Authorization both reach the backend correctly. This is exactly what unblocks the #655 static-inject plugin — nice tie-in.
3. SSE event: preservation — sseframe.Reader now captures the event: field (reset per frame, last-event-wins per the SSE spec, copied out of the reused buffer) and the re-framer emits event: <type> before the data: lines. Together with the Accept-Encoding strip (so Go's transport transparently decompresses and the re-framer sees plaintext), this fixes SSE clients (Anthropic SDK) decoding zero typed events.

Tests cover the tricky parts: header set + delete, Host rewrite, event-line preservation, event-reset-per-frame, and the Accept-Encoding strip. One low, optional efficiency note inline (the strip is unconditional); nothing blocking. Bravo. 🇮🇹

Maintainer author, green CI, DCO signed.

Assisted-By: Claude Code