Add unit tests for distinct SSRF rejection paths

Add tests that explicitly exercise the token mismatch path (recognized
header with wrong value) and the missing header path (no recognized
SSRF header present) to verify both branches produce the expected
403 response.

Also fix doc comment to use Err(HttpError) instead of Err((u16, String)).

Author: reyhankoyun

aws_secretsmanager_provider/src/lib.rs

@@ -715,6 +715,36 @@ mod tests {
         assert_eq!(status, StatusCode::BAD_REQUEST);
     }
 
+    // Verify that a request with a recognized SSRF header but wrong value is rejected (token mismatch path).
+    #[tokio::test]
+    async fn ssrf_token_mismatch() {
+        let (status, body) = run_requests_with_headers(
+            vec![("GET", "/secretsmanager/get?secretId=MyTest")],
+            vec![("X-Aws-Parameters-Secrets-Token", "wrong-value")],
+        )
+        .await
+        .expect("request failed")
+        .pop()
+        .unwrap();
+        assert_eq!(status, StatusCode::FORBIDDEN);
+        assert_eq!(body, "Bad Token");
+    }
+
+    // Verify that a request with no recognized SSRF header at all is rejected (missing header path).
+    #[tokio::test]
+    async fn ssrf_token_missing_header() {
+        let (status, body) = run_requests_with_headers(
+            vec![("GET", "/secretsmanager/get?secretId=MyTest")],
+            vec![("X-Unrelated-Header", "some-value")],
+        )
+        .await
+        .expect("request failed")
+        .pop()
+        .unwrap();
+        assert_eq!(status, StatusCode::FORBIDDEN);
+        assert_eq!(body, "Bad Token");
+    }
+
     // Verify max conn is enforced (max conn set to 1 for testing)
     #[tokio::test]
     async fn max_conn_test() {

aws_secretsmanager_provider/src/server.rs

@@ -227,7 +227,7 @@ impl Server {
     /// # Returns
     ///
     /// * `Ok(())` - For health checks or when the request has the correct token.
-    /// * `Err((u16, String))` - A 400 or 403 error code (if header is set or token is missing or wrong) and error message.
+    /// * `Err(HttpError)` - A 400 or 403 error code (if header is set or token is missing or wrong) and error message.
     #[doc(hidden)]
     fn validate_token(
         &self,