refactor: single-pass Signature-Input walk for DetailsByTag

Build all MessageDetails from headers once instead of listing labels
and re-parsing per name; share psiSignatureFromInnerList with parse path.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: yaronf

signatures.go

@@ -976,13 +976,17 @@ func parseSignatureInput(input string, sigName string) (*psiSignature, error) {
 	}
 	memberForName, _ := sigs.Get(sigName)
 	fieldsList, ok := memberForName.(httpsfv.InnerList)
+	if !ok {
+		return nil, fmt.Errorf("Signature-Input: signature %s does not have an inner list", sigName)
+	}
+	return psiSignatureFromInnerList(sigName, fieldsList)
+}
+
+func psiSignatureFromInnerList(sigName string, fieldsList httpsfv.InnerList) (*psiSignature, error) {
 	osp, err := httpsfv.Marshal(fieldsList) // undocumented functionality
 	if err != nil {
 		return nil, fmt.Errorf("could not marshal inner list: %w", err)
 	}
-	if !ok {
-		return nil, fmt.Errorf("Signature-Input: signature %s does not have an inner list", sigName)
-	}
 	var f Fields
 	for _, ff := range fieldsList.Items {
 		f.f = append(f.f, field(ff))
@@ -999,6 +1003,53 @@ func parseSignatureInput(input string, sigName string) (*psiSignature, error) {
 	return &psiSignature{sigName, osp, f, params}, nil
 }
 
+// signatureDetailsListFromHeaders builds MessageDetails for each Signature-Input member
+// in a single SFV pass. Each label must also appear in Signature (RFC 9421). Missing
+// Signature / Signature-Input yields an empty list (same spirit as RequestSignatureNames).
+func signatureDetailsListFromHeaders(headers http.Header) ([]*MessageDetails, error) {
+	if headers == nil {
+		return nil, nil
+	}
+	normalized := normalizeHeaderNames(headers)
+	siVals := normalized["signature-input"] //nolint:staticcheck // SA1008: lowercase map keys by design
+	sigVals := normalized["signature"]     //nolint:staticcheck // SA1008: lowercase map keys by design
+	if len(siVals) == 0 || len(sigVals) == 0 {
+		return nil, nil
+	}
+	siDict, err := httpsfv.UnmarshalDictionary(siVals)
+	if err != nil {
+		return nil, fmt.Errorf("cannot parse Signature-Input: %w", err)
+	}
+	sigDict, err := httpsfv.UnmarshalDictionary(sigVals)
+	if err != nil {
+		return nil, fmt.Errorf("cannot parse Signature: %w", err)
+	}
+	var out []*MessageDetails
+	for _, name := range siDict.Names() {
+		if _, ok := sigDict.Get(name); !ok {
+			return nil, fmt.Errorf("Signature-Input label %q missing from Signature", name)
+		}
+		member, ok := siDict.Get(name)
+		if !ok {
+			return nil, fmt.Errorf("cannot read Signature-Input member %q", name)
+		}
+		inner, ok := member.(httpsfv.InnerList)
+		if !ok {
+			return nil, fmt.Errorf("Signature-Input: signature %s does not have an inner list", name)
+		}
+		psi, err := psiSignatureFromInnerList(name, inner)
+		if err != nil {
+			return nil, err
+		}
+		details, err := signatureDetails(name, psi)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, details)
+	}
+	return out, nil
+}
+
 func parseWantSignature(wantSignature string) ([]byte, error) {
 	wantSigItem, err := httpsfv.UnmarshalItem([]string{wantSignature})
 	if err != nil {

signtag.go

@@ -23,13 +23,11 @@ func RequestDetailsByTag(req *http.Request, tag string) (*MessageDetails, error)
 	if req == nil {
 		return nil, fmt.Errorf("nil request")
 	}
-	names, err := RequestSignatureNames(req, false)
+	all, err := signatureDetailsListFromHeaders(req.Header)
 	if err != nil {
 		return nil, err
 	}
-	return detailsByTag(names, tag, func(name string) (*MessageDetails, error) {
-		return RequestDetails(name, req)
-	})
+	return detailsByTag(all, tag)
 }
 
 // ResponseDetailsByTag returns MessageDetails for the unique Signature whose
@@ -41,13 +39,11 @@ func ResponseDetailsByTag(res *http.Response, tag string) (*MessageDetails, erro
 	if res == nil {
 		return nil, fmt.Errorf("nil response")
 	}
-	names, err := ResponseSignatureNames(res, false)
+	all, err := signatureDetailsListFromHeaders(res.Header)
 	if err != nil {
 		return nil, err
 	}
-	return detailsByTag(names, tag, func(name string) (*MessageDetails, error) {
-		return ResponseDetails(name, res)
-	})
+	return detailsByTag(all, tag)
 }
 
 // RequestDetailsListByTag returns MessageDetails for every Signature whose
@@ -57,13 +53,11 @@ func RequestDetailsListByTag(req *http.Request, tag string) ([]*MessageDetails,
 	if req == nil {
 		return nil, fmt.Errorf("nil request")
 	}
-	names, err := RequestSignatureNames(req, false)
+	all, err := signatureDetailsListFromHeaders(req.Header)
 	if err != nil {
 		return nil, err
 	}
-	return detailsListByTag(names, tag, func(name string) (*MessageDetails, error) {
-		return RequestDetails(name, req)
-	})
+	return detailsListByTag(all, tag), nil
 }
 
 // ResponseDetailsListByTag returns MessageDetails for every Signature whose
@@ -73,37 +67,27 @@ func ResponseDetailsListByTag(res *http.Response, tag string) ([]*MessageDetails
 	if res == nil {
 		return nil, fmt.Errorf("nil response")
 	}
-	names, err := ResponseSignatureNames(res, false)
+	all, err := signatureDetailsListFromHeaders(res.Header)
 	if err != nil {
 		return nil, err
 	}
-	return detailsListByTag(names, tag, func(name string) (*MessageDetails, error) {
-		return ResponseDetails(name, res)
-	})
+	return detailsListByTag(all, tag), nil
 }
 
-func detailsListByTag(names []string, tag string, detailsFn func(string) (*MessageDetails, error)) ([]*MessageDetails, error) {
+func detailsListByTag(all []*MessageDetails, tag string) []*MessageDetails {
 	var found []*MessageDetails
-	for _, name := range names {
-		details, err := detailsFn(name)
-		if err != nil {
-			return nil, fmt.Errorf("details for %q: %w", name, err)
-		}
+	for _, details := range all {
 		if details.Tag != nil && *details.Tag == tag {
 			found = append(found, details)
 		}
 	}
-	return found, nil
+	return found
 }
 
-func detailsByTag(names []string, tag string, detailsFn func(string) (*MessageDetails, error)) (*MessageDetails, error) {
+func detailsByTag(all []*MessageDetails, tag string) (*MessageDetails, error) {
 	var match *MessageDetails
 	n := 0
-	for _, name := range names {
-		details, err := detailsFn(name)
-		if err != nil {
-			return nil, fmt.Errorf("details for %q: %w", name, err)
-		}
+	for _, details := range all {
 		if details.Tag == nil || *details.Tag != tag {
 			continue
 		}