private ObjectNode updateIntegrationResponse(
            OperationShape shape,
            Map<CorsHeader, String> corsHeaders,
            Set<String> deduced,
            ObjectNode response
    ) {
        Map<CorsHeader, String> responseHeaders = new HashMap<>(corsHeaders);
        ObjectNode responseParams = response.getObjectMember(RESPONSE_PARAMETERS_KEY).orElseGet(Node::objectNode);

        // Created a sorted set of all headers exposed in the integration.
        Set<String> headersToExpose = new TreeSet<>(String.CASE_INSENSITIVE_ORDER);
        headersToExpose.addAll(deduced);
        responseParams.getStringMap()
                .keySet()
                .stream()
                .filter(parameterName -> parameterName.startsWith(HEADER_PREFIX))
                .map(parameterName -> parameterName.substring(HEADER_PREFIX.length()))
                .forEach(headersToExpose::add);
        String headersToExposeString = String.join(",", headersToExpose);

        // If there are exposed headers, then add a new header to the integration
        // that lists all of them. See https://fetch.spec.whatwg.org/#http-access-control-expose-headers.
        if (!headersToExposeString.isEmpty()) {
            responseHeaders.put(CorsHeader.EXPOSE_HEADERS, headersToExposeString);
            LOGGER.fine(() -> String.format("Adding `%s` header to `%s` with value of `%s`",
                    CorsHeader.EXPOSE_HEADERS,
                    shape.getId(),
                    headersToExposeString));
        }

        if (responseHeaders.isEmpty()) {
            LOGGER.fine(() -> "No headers are exposed by " + shape.getId());
            return response;
        }

        // Create an updated response that injects Access-Control-Expose-Headers.
        ObjectNode.Builder builder = responseParams.toBuilder();
        for (Map.Entry<CorsHeader, String> entry : responseHeaders.entrySet()) {
            builder.withMember(HEADER_PREFIX + entry.getKey(), "'" + entry.getValue() + "'");
        }

        return response.withMember(RESPONSE_PARAMETERS_KEY, builder.build());
    }
Adds CORS headers to REST integrations.

<p>If the service is a REST API that has the {@link CorsTrait}, then
integration responses will include a statically computed
Access-Control-Expose-Headers CORS headers that contains every header
exposed by the integration, and Access-Control-Allow-Credentials header
if the operation uses a security scheme that needs it, and
Access-Control-Allow-Origin header that is the result of
{@link CorsTrait#getOrigin()}.
smithy-aws-apigateway-openapi/src/main/java/software/amazon/smithy/aws/apigateway/openapi/AddCorsToRestIntegrations.java