Module firehose_common 

shared auth/response/request-id plumbing for every Firehose-backed ingestion route Shared Kinesis Data Firehose HTTP Endpoint Delivery plumbing, reused by every Firehose-backed ingestion route (metrics, CloudWatch Logs, and any future signal).

Everything here is signal-agnostic — it only knows about the Firehose transport (access-key header, ack shape), not what’s inside a record. Firehose’s only credential channel is the non-standard X-Amz-Firehose-Access-Key header — it cannot send Authorization: Bearer. So a Firehose route cannot sit under the global Bearer auth_middleware; it has its own auth step that synthesizes a bearer header from the Firehose header and reuses the same AuthProvider (constant-time keyring check) verbatim.

Functions

firehose_auth_middleware

Firehose-specific auth: read X-Amz-Firehose-Access-Key, synthesize an Authorization: Bearer <key> header, and validate via the same AuthProvider the rest of the ingestion service uses (reuses the constant-time keyring check verbatim). On failure, return the Firehose error shape (non-200 JSON) so Firehose retries/spills rather than dropping data.