s3-proxy: expose x-amz-restore header via CORS

[fiskus]

Summary

Adds x-amz-restore to Access-Control-Expose-Headers in s3-proxy/nginx.conf, so browser JS can read S3 object restore (Glacier rehydration) state from cross-origin HEAD responses.

Split out from #4921 (Glacier rehydration UX). s3-proxy is a separately built and deployed component from the catalog bundle, so this is kept as its own independently reviewable, revertable, and deployable PR.

Test plan

• Deploy s3-proxy, issue a cross-origin HEAD against a restored/restoring Glacier object, confirm x-amz-restore is readable from the browser.

Greptile Summary

This PR adds x-amz-restore to the Access-Control-Expose-Headers list in the s3-proxy nginx configuration, enabling browser JavaScript to read the Glacier rehydration/restore status from cross-origin HEAD responses.

• The single-line change appends x-amz-restore to the existing comma-separated expose-headers list in the S3-proxying location block.
• The surrounding config already strips Access-Control-Expose-Headers from upstream S3 responses via proxy_hide_header (line 59), so there is no risk of duplicate headers.

Confidence Score: 5/5

This is a safe, purely additive one-line change to the CORS expose-headers list with no functional side effects.

The change appends one well-known, read-only Amazon S3 response header (x-amz-restore) to the existing expose list. It does not alter any routing, authentication, or proxying logic. The existing proxy_hide_header directives already prevent duplicate headers from upstream, so the addition slots in cleanly.

No files require special attention.

Important Files Changed

Filename	Overview
s3-proxy/nginx.conf	Adds x-amz-restore to Access-Control-Expose-Headers; change is minimal, correct, and consistent with the existing header stripping (proxy_hide_header) that prevents duplicates.

Sequence Diagram

sequenceDiagram
    participant Browser
    participant s3-proxy (nginx)
    participant S3 (amazonaws.com)

    Browser->>s3-proxy (nginx): HEAD /bucket.s3.amazonaws.com/key (cross-origin)
    s3-proxy (nginx)->>S3 (amazonaws.com): Proxy HEAD request
    S3 (amazonaws.com)-->>s3-proxy (nginx): Response with x-amz-restore header
    Note over s3-proxy (nginx): proxy_hide_header strips upstream Access-Control-* headers
    Note over s3-proxy (nginx): add_header injects Access-Control-Expose-Headers (now includes x-amz-restore)
    s3-proxy (nginx)-->>Browser: Response with Access-Control-Expose-Headers: ..., x-amz-restore
    Note over Browser: JS can now read response.headers.get('x-amz-restore')

Loading

_{Reviews (1): Last reviewed commit: "s3-proxy: expose x-amz-restore header vi..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.50%. Comparing base (f9b6e02) to head (8fe0161).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4953   +/-   ##
=======================================
  Coverage   46.50%   46.50%           
=======================================
  Files         832      832           
  Lines       34090    34090           
  Branches     5833     5833           
=======================================
  Hits        15854    15854           
  Misses      16237    16237           
  Partials     1999     1999           

Flag	Coverage Δ
api-python	93.14% <ø> (ø)
catalog	21.55% <ø> (ø)
lambda	96.63% <ø> (ø)
py-shared	98.02% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.