@Test
    public void findsExistingGatewayHeaders() {
        Model model = Model.assembler(getClass().getClassLoader())
                .discoverModels(getClass().getClassLoader())
                .addImport(getClass().getResource("cors-explicit-options.json"))
                .assemble()
                .unwrap();
        Node expectedNode = Node.parse(IoUtils.toUtf8String(
                getClass().getResourceAsStream("cors-with-custom-gateway-response-headers.openapi.json")));

        OpenApiConfig config = new OpenApiConfig();
        config.setService(ShapeId.from("example.smithy#MyService"));

        // Create an OpenAPI model.
        ObjectNode result = OpenApiConverter.create()
                .config(config)
                .addOpenApiMapper(new OpenApiMapper() {
                    @Override
                    public byte getOrder() {
                        return -127;
                    }

                    @Override
                    public OpenApi after(Context context, OpenApi openapi) {
                        // Inject a gateway response into the model.
                        return openapi.toBuilder()
                                .putExtension("x-amazon-apigateway-gateway-responses",
                                        Node.objectNodeBuilder()
                                                .withMember("ACCESS_DENIED",
                                                        Node.objectNode()
                                                                .withMember("statusCode", 403)
                                                                .withMember("responseParameters",
                                                                        Node.objectNode()
                                                                                .withMember(
                                                                                        "gatewayresponse.header.Access-Control-Allow-Origin",
                                                                                        "'domain.com'")
                                                                                .withMember(
                                                                                        "gatewayresponse.header.Foo",
                                                                                        "'baz'")))
                                                .build())
                                .build();
                    }
                })
                .convertToNode(model);

        Node.assertEquals(result, expectedNode);
    }
This test asserts two things: First, it ensures that any existing CORS headers
set on an explicitly added API Gateway integration are not overwritten
(i.e., the "Access-Control-Allow-Origin" is "domain.com" instead of https://foo.com).
Next, it asserts that any other headers in the gateway response show up in the
injected Access-Control-Expose-Headers header.
smithy-aws-apigateway-openapi/src/test/java/software/amazon/smithy/aws/apigateway/openapi/CorsTest.java