@Override
                    public OpenApi after(Context context, OpenApi openapi) {
                        // Inject a gateway response into the model.
                        return openapi.toBuilder()
                                .putExtension("x-amazon-apigateway-gateway-responses",
                                        Node.objectNodeBuilder()
                                                .withMember("ACCESS_DENIED",
                                                        Node.objectNode()
                                                                .withMember("statusCode", 403)
                                                                .withMember("responseParameters",
                                                                        Node.objectNode()
                                                                                .withMember(
                                                                                        "gatewayresponse.header.Access-Control-Allow-Origin",
                                                                                        "'domain.com'")
                                                                                .withMember(
                                                                                        "gatewayresponse.header.Foo",
                                                                                        "'baz'")))
                                                .build())
                                .build();
                    }
This test asserts two things: First, it ensures that any existing CORS headers
set on an explicitly added API Gateway integration are not overwritten
(i.e., the "Access-Control-Allow-Origin" is "domain.com" instead of https://foo.com).
Next, it asserts that any other headers in the gateway response show up in the
injected Access-Control-Expose-Headers header.
smithy-aws-apigateway-openapi/src/test/java/software/amazon/smithy/aws/apigateway/openapi/CorsTest.java