Skip to content

fix: widen gateway.domain validation to accept RFC-1123 topology hostnames#8044

Merged
lpcox merged 3 commits into
mainfrom
copilot/gateway-domain-validation-fix
Jun 24, 2026
Merged

fix: widen gateway.domain validation to accept RFC-1123 topology hostnames#8044
lpcox merged 3 commits into
mainfrom
copilot/gateway-domain-validation-fix

Conversation

Copilot AI commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

In network-isolation topology mode (gh-aw v0.81.2+), MCP_GATEWAY_DOMAIN is set to a container hostname like awmg-mcpg. Although ${MCP_GATEWAY_DOMAIN} is schema-valid, the validator re-runs post-expansion against the same narrow enum, so the resolved literal awmg-mcpg is rejected and the gateway aborts on startup.

Changes

  • validation_schema.go — Add domainHostnamePattern (^[a-z0-9]([a-z0-9-]*[a-z0-9])?$) and accept RFC-1123 single-label hostnames in validateStringPatterns alongside the existing localhost/host.docker.internal/${VAR} forms. Updated error message accordingly.

  • schema/mcp-gateway-config.schema.json — Switch domain.oneOfanyOf (required because localhost matches both the enum branch and the new hostname pattern) and add a third branch for RFC-1123 single-label hostnames. Updated field description.

  • validation_schema_test.go / validation_string_patterns_test.go — Add regression cases for awmg-mcpg at both the JSON-schema validation layer and the Go validateStringPatterns layer; update the existing error-message assertion.

After this fix, the following config passes validation where it previously aborted:

{
  "gateway": {
    "port": 8080,
    "domain": "awmg-mcpg",
    "agentId": "${MCP_GATEWAY_AGENT_ID}"
  }
}

GitHub Advanced Security started work on behalf of lpcox June 24, 2026 13:58 View session
GitHub Advanced Security finished work on behalf of lpcox June 24, 2026 13:59
…names

The `gateway.domain` validator rejected any resolved value that wasn't
exactly `localhost`, `host.docker.internal`, or a `${VAR}` expression.
This blocked the network-isolation topology mode (gh-aw v0.81.2+) where
`MCP_GATEWAY_DOMAIN` is set to the container hostname `awmg-mcpg`.

Changes:
- Add `domainHostnamePattern` regex for RFC-1123 single-label hostnames
  (e.g. `awmg-mcpg`, `my-service`) to `validation_schema.go`
- Update `validateStringPatterns` to also accept RFC-1123 single-label
  hostnames after env-var expansion
- Update error message to mention topology hostname as a valid form
- Switch embedded JSON schema `domain.oneOf` → `anyOf` (avoids
  `localhost` matching both the enum and new hostname pattern) and add
  a third branch for RFC-1123 single-label hostnames
- Update description in the JSON schema to document the new form
- Add `awmg-mcpg` topology hostname test cases to:
  - `validation_schema_test.go` (TestValidateJSONSchema + TestValidateStringPatterns)
  - `validation_string_patterns_test.go` (TestValidateStringPatternsComprehensive)
- Update the existing error-message assertion for the `"invalid domain -
  other string"` test case to match the new message

Closes #8043
GitHub Advanced Security started work on behalf of lpcox June 24, 2026 14:13 View session
GitHub Advanced Security finished work on behalf of lpcox June 24, 2026 14:13
Restore the original ^\\$\\{...\\}$ escaping for the variable expression
branch of gateway.domain in the JSON schema. The escaping was inadvertently
simplified to ^\\${...}$ during Python-based JSON serialization; restoring
it to match the upstream schema form for clarity and ECMA 262 compatibility.
GitHub Advanced Security started work on behalf of lpcox June 24, 2026 14:16 View session
Copilot AI changed the title [WIP] Fix gateway domain validation for network-isolation topology fix: widen gateway.domain validation to accept RFC-1123 topology hostnames Jun 24, 2026
Copilot AI requested a review from lpcox June 24, 2026 14:16
Copilot finished work on behalf of lpcox June 24, 2026 14:16
GitHub Advanced Security finished work on behalf of lpcox June 24, 2026 14:16
@lpcox lpcox marked this pull request as ready for review June 24, 2026 14:29
Copilot AI review requested due to automatic review settings June 24, 2026 14:29

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes gateway startup failures in network-isolation topology mode by widening gateway.domain validation to allow RFC-1123 single-label container hostnames (e.g., awmg-mcpg) after ${MCP_GATEWAY_DOMAIN} expansion.

Changes:

  • Extend Go-side validateStringPatterns domain validation to accept RFC-1123 single-label hostnames via a new domainHostnamePattern.
  • Update the embedded JSON schema to validate gateway.domain using anyOf and a new RFC-1123 single-label hostname pattern branch.
  • Add regression tests covering awmg-mcpg at both the schema-validation and Go pattern-validation layers, and update the expected error-message substring.
Show a summary per file
File Description
internal/config/validation_string_patterns_test.go Adds comprehensive pattern-validation test cases accepting topology-style single-label hostnames.
internal/config/validation_schema.go Introduces domainHostnamePattern and expands gateway.domain validation/error messaging to allow RFC-1123 single-label hostnames.
internal/config/validation_schema_test.go Adds schema + Go-layer regression tests for domain: "awmg-mcpg" and updates the error message assertion.
internal/config/schema/mcp-gateway-config.schema.json Switches domain from oneOf to anyOf, adds RFC-1123 single-label hostname pattern branch, and updates the field description.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 4/4 changed files
  • Comments generated: 0

@lpcox lpcox merged commit e5f3ffa into main Jun 24, 2026
40 checks passed
@lpcox lpcox deleted the copilot/gateway-domain-validation-fix branch June 24, 2026 14:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants