Skip to content

fix(gateway): harden inbound auth schema and rename credential flags#598

Merged
tejaskash merged 2 commits intoaws:mainfrom
aidandaly24:fix/inbound-auth-hardening
Mar 23, 2026
Merged

fix(gateway): harden inbound auth schema and rename credential flags#598
tejaskash merged 2 commits intoaws:mainfrom
aidandaly24:fix/inbound-auth-hardening

Conversation

@aidandaly24
Copy link
Copy Markdown
Contributor

@aidandaly24 aidandaly24 commented Mar 23, 2026

Description

Hardens the Custom JWT authorizer schema and renames credential CLI flags for clarity. This is the foundational PR for the Custom JWT gateway feature — it tightens validation and fixes naming before the custom claims feature is added on top.

Schema hardening

  • HTTPS enforcement: OidcDiscoveryUrlSchema now rejects http:// URLs via .refine()
  • Strict mode: CustomJwtAuthorizerConfigSchema uses .strict() to reject unknown fields
  • Flexible constraints: allowedAudience and allowedClients are now individually optional, with a .superRefine() requiring at least one of allowedAudience, allowedClients, or allowedScopes
  • deployed-state.ts: Aligned with schema — allowedAudience/allowedClients optional, added allowedScopes

Flag rename (--agent-client-* → --client-*)

These are gateway-level OAuth credentials, not agent credentials. The agent prefix was misleading:

  • --agent-client-id → --client-id
  • --agent-client-secret → --client-secret
  • Updated across: CLI types, validation, GatewayPrimitive, TUI wizard state/handlers/props, useCreateMcp hook

TUI improvements

  • HTTPS validation on discovery URL input in the JWT wizard
  • Simplified validateCommaSeparated helper (removed unused fieldName param)
  • Renamed internal prop names (onAgentClientId → onClientId, etc.)
  • Updated prompt labels to remove "Agent" prefix

Test updates

  • Schema tests: HTTPS rejection, .strict() rejection, scope-only acceptance, all-empty rejection
  • Validation tests: HTTPS check, at-least-one constraint, renamed credential fields
  • Integration tests: Updated --agent-client-id/--agent-client-secret → --client-id/--client-secret

Related Issue

Extracted from #596

Documentation PR

N/A

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Documentation update
  • Other (please describe):

Testing

How have you tested the change?

  • I ran npm run test:unit and npm run test:integ
  • I ran npm run typecheck
  • I ran npm run lint
  • If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

  • I have read the CONTRIBUTING document
  • I have added any necessary tests that prove my fix is effective or my feature works
  • I have updated the documentation accordingly
  • I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
  • My changes generate no new warnings
  • Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

@aidandaly24 aidandaly24 requested a review from a team March 23, 2026 03:08
@github-actions github-actions bot added the size/m PR size: M label Mar 23, 2026
aidandaly24 added a commit to aidandaly24/agentcore-cli that referenced this pull request Mar 23, 2026
@aidandaly24
feat(gateway): add custom claims validation and TUI wizard for JWT auth
23fbe63 
Add custom JWT claims validation support and a full TUI wizard flow
for configuring Custom JWT gateway authorization.

Schema:
- Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType,
  and CustomClaimValidation schemas with strict validation
- Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state
- Add --custom-claims CLI flag with JSON parsing and validation

TUI Wizard:
- Expand JWT config flow with custom claims manager (add/edit/done)
- Add claim name, operator, value, and value type sub-steps
- Show human-readable claim summary in confirm review
- Make client credentials optional (skip with empty Enter)

Testing:
- Add AddGatewayJwtConfig.test.tsx — full TUI component tests
- Add finishJwtConfig.test.ts — unit tests for config assembly
- Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows
- Add GatewayPrimitive.test.ts for custom claims round-trip
- Extend validate.test.ts with custom claims validation cases
- Add TUI integration test (add-gateway-jwt.test.ts)

Constraint: Stacked on fix/inbound-auth-hardening (aws#598)
Confidence: high
Scope-risk: moderate
This was referenced Mar 23, 2026
Merged
Closed
@tejaskash
Copy link
Copy Markdown
Contributor

tejaskash commented Mar 23, 2026

Code review

Found 1 issue:

  1. TUI wizard still forces allowedClients to be non-empty, but the schema and CLI validation now allow it to be optional (only requiring at least one of audience/clients/scopes). The clients sub-step (subStep 2) applies customValidation={validateCommaSeparated} which rejects empty input and lacks the allowEmpty prop, unlike the audience and scopes steps which both have allowEmpty. A user who provides only audience + scopes will be blocked at the clients step.

agentcore-cli/src/cli/tui/screens/mcp/AddGatewayScreen.tsx

Lines 380 to 386 in 460ccf6

prompt="Allowed Clients (comma-separated, e.g., 7abc123def456)"
initialValue=""
onSubmit={onClients}
onCancel={onCancel}
customValidation={validateCommaSeparated}
/>
)}

🤖 Generated with Claude Code

- If this code review was useful, please react with 👍. Otherwise, react with 👎.

@aidandaly24
fix(gateway): harden inbound auth schema and rename credential flags
2104fa0 
- Enforce HTTPS on OIDC discovery URL in schema and CLI validation
- Make allowedAudience/allowedClients optional with at-least-one
  superRefine constraint (audience, clients, or scopes)
- Add .strict() to CustomJwtAuthorizerConfigSchema
- Rename --agent-client-id/--agent-client-secret to
  --client-id/--client-secret across CLI, TUI, and primitives
- Add HTTPS validation to TUI discovery URL input
- Update deployed-state schema to match (optional audience/clients,
  add allowedScopes)
- Update unit tests for new validation rules and field names

Constraint: OIDC spec requires HTTPS for discovery endpoints
Rejected: Keep --agent-client-id naming | confusing since these are
  gateway-level OAuth credentials, not agent credentials
Confidence: high
Scope-risk: moderate
@aidandaly24 aidandaly24 force-pushed the fix/inbound-auth-hardening branch from 460ccf6 to 2104fa0 Compare March 23, 2026 19:25
aidandaly24 added a commit to aidandaly24/agentcore-cli that referenced this pull request Mar 23, 2026
@aidandaly24
feat(gateway): add custom claims validation and TUI wizard for JWT auth
8466d0d 
Add custom JWT claims validation support and a full TUI wizard flow
for configuring Custom JWT gateway authorization.

Schema:
- Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType,
  and CustomClaimValidation schemas with strict validation
- Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state
- Add --custom-claims CLI flag with JSON parsing and validation

TUI Wizard:
- Expand JWT config flow with custom claims manager (add/edit/done)
- Add claim name, operator, value, and value type sub-steps
- Show human-readable claim summary in confirm review
- Make client credentials optional (skip with empty Enter)

Testing:
- Add AddGatewayJwtConfig.test.tsx — full TUI component tests
- Add finishJwtConfig.test.ts — unit tests for config assembly
- Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows
- Add GatewayPrimitive.test.ts for custom claims round-trip
- Extend validate.test.ts with custom claims validation cases
- Add TUI integration test (add-gateway-jwt.test.ts)

Constraint: Stacked on fix/inbound-auth-hardening (aws#598)
Confidence: high
Scope-risk: moderate
@github-actions github-actions bot added size/m PR size: M and removed size/m PR size: M labels Mar 23, 2026
@aidandaly24 @claude
fix(tui): make allowedClients optional in JWT wizard
c19b916 
The schema allows allowedClients to be empty when audience or scopes
are provided, but the TUI wizard sub-step still rejected empty input
via customValidation. Add allowEmpty and placeholder to match the
audience and scopes sub-steps, and remove the now-unused
validateCommaSeparated helper.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@github-actions github-actions bot added size/m PR size: M and removed size/m PR size: M labels Mar 23, 2026
aidandaly24 added a commit to aidandaly24/agentcore-cli that referenced this pull request Mar 23, 2026
@aidandaly24
feat(gateway): add custom claims validation and TUI wizard for JWT auth
0cc16a3 
Add custom JWT claims validation support and a full TUI wizard flow
for configuring Custom JWT gateway authorization.

Schema:
- Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType,
  and CustomClaimValidation schemas with strict validation
- Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state
- Add --custom-claims CLI flag with JSON parsing and validation

TUI Wizard:
- Expand JWT config flow with custom claims manager (add/edit/done)
- Add claim name, operator, value, and value type sub-steps
- Show human-readable claim summary in confirm review
- Make client credentials optional (skip with empty Enter)

Testing:
- Add AddGatewayJwtConfig.test.tsx — full TUI component tests
- Add finishJwtConfig.test.ts — unit tests for config assembly
- Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows
- Add GatewayPrimitive.test.ts for custom claims round-trip
- Extend validate.test.ts with custom claims validation cases
- Add TUI integration test (add-gateway-jwt.test.ts)

Constraint: Stacked on fix/inbound-auth-hardening (aws#598)
Confidence: high
Scope-risk: moderate
tejaskash
tejaskash approved these changes Mar 23, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@tejaskash tejaskash left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review comments addressed: clients step now allows empty input with allowEmpty prop.

@tejaskash tejaskash merged commit bf1406c into aws:main Mar 23, 2026
16 of 18 checks passed
aidandaly24 added a commit to aidandaly24/agentcore-cli that referenced this pull request Mar 23, 2026
@aidandaly24
feat(gateway): add custom claims validation and TUI wizard for JWT auth
e4e9bea 
Add custom JWT claims validation support and a full TUI wizard flow
for configuring Custom JWT gateway authorization.

Schema:
- Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType,
  and CustomClaimValidation schemas with strict validation
- Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state
- Add --custom-claims CLI flag with JSON parsing and validation

TUI Wizard:
- Expand JWT config flow with custom claims manager (add/edit/done)
- Add claim name, operator, value, and value type sub-steps
- Show human-readable claim summary in confirm review
- Make client credentials optional (skip with empty Enter)

Testing:
- Add AddGatewayJwtConfig.test.tsx — full TUI component tests
- Add finishJwtConfig.test.ts — unit tests for config assembly
- Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows
- Add GatewayPrimitive.test.ts for custom claims round-trip
- Extend validate.test.ts with custom claims validation cases
- Add TUI integration test (add-gateway-jwt.test.ts)

Constraint: Stacked on fix/inbound-auth-hardening (aws#598)
Confidence: high
Scope-risk: moderate
aidandaly24 added a commit to aidandaly24/agentcore-cli that referenced this pull request Mar 23, 2026
@aidandaly24
feat(gateway): add custom claims validation and TUI wizard for JWT auth
24625e3 
Add custom JWT claims validation support and a full TUI wizard flow
for configuring Custom JWT gateway authorization.

Schema:
- Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType,
  and CustomClaimValidation schemas with strict validation
- Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state
- Add --custom-claims CLI flag with JSON parsing and validation

TUI Wizard:
- Expand JWT config flow with custom claims manager (add/edit/done)
- Add claim name, operator, value, and value type sub-steps
- Show human-readable claim summary in confirm review
- Make client credentials optional (skip with empty Enter)

Testing:
- Add AddGatewayJwtConfig.test.tsx — full TUI component tests
- Add finishJwtConfig.test.ts — unit tests for config assembly
- Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows
- Add GatewayPrimitive.test.ts for custom claims round-trip
- Extend validate.test.ts with custom claims validation cases
- Add TUI integration test (add-gateway-jwt.test.ts)

Constraint: Stacked on fix/inbound-auth-hardening (aws#598)
Confidence: high
Scope-risk: moderate
aidandaly24 added a commit to aidandaly24/agentcore-cli that referenced this pull request Mar 24, 2026
@aidandaly24
feat(gateway): add custom claims validation and TUI wizard for JWT auth
23cc5be 
Add custom JWT claims validation support and a full TUI wizard flow
for configuring Custom JWT gateway authorization.

Schema:
- Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType,
  and CustomClaimValidation schemas with strict validation
- Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state
- Add --custom-claims CLI flag with JSON parsing and validation

TUI Wizard:
- Expand JWT config flow with custom claims manager (add/edit/done)
- Add claim name, operator, value, and value type sub-steps
- Show human-readable claim summary in confirm review
- Make client credentials optional (skip with empty Enter)

Testing:
- Add AddGatewayJwtConfig.test.tsx — full TUI component tests
- Add finishJwtConfig.test.ts — unit tests for config assembly
- Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows
- Add GatewayPrimitive.test.ts for custom claims round-trip
- Extend validate.test.ts with custom claims validation cases
- Add TUI integration test (add-gateway-jwt.test.ts)

Constraint: Stacked on fix/inbound-auth-hardening (aws#598)
Confidence: high
Scope-risk: moderate
aidandaly24 added a commit to aidandaly24/agentcore-cli that referenced this pull request Mar 24, 2026
@aidandaly24
feat(gateway): add custom claims validation and TUI wizard for JWT auth
3379d3f 
Add custom JWT claims validation support and a full TUI wizard flow
for configuring Custom JWT gateway authorization.

Schema:
- Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType,
  and CustomClaimValidation schemas with strict validation
- Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state
- Add --custom-claims CLI flag with JSON parsing and validation

TUI Wizard:
- Expand JWT config flow with custom claims manager (add/edit/done)
- Add claim name, operator, value, and value type sub-steps
- Show human-readable claim summary in confirm review
- Make client credentials optional (skip with empty Enter)

Testing:
- Add AddGatewayJwtConfig.test.tsx — full TUI component tests
- Add finishJwtConfig.test.ts — unit tests for config assembly
- Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows
- Add GatewayPrimitive.test.ts for custom claims round-trip
- Extend validate.test.ts with custom claims validation cases
- Add TUI integration test (add-gateway-jwt.test.ts)

Constraint: Stacked on fix/inbound-auth-hardening (aws#598)
Confidence: high
Scope-risk: moderate
aidandaly24 added a commit to aidandaly24/agentcore-cli that referenced this pull request Mar 24, 2026
@aidandaly24
feat(gateway): add custom claims validation and TUI wizard for JWT auth
8005978 
Add custom JWT claims validation support and a full TUI wizard flow
for configuring Custom JWT gateway authorization.

Schema:
- Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType,
  and CustomClaimValidation schemas with strict validation
- Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state
- Add --custom-claims CLI flag with JSON parsing and validation

TUI Wizard:
- Expand JWT config flow with custom claims manager (add/edit/done)
- Add claim name, operator, value, and value type sub-steps
- Show human-readable claim summary in confirm review
- Make client credentials optional (skip with empty Enter)

Testing:
- Add AddGatewayJwtConfig.test.tsx — full TUI component tests
- Add finishJwtConfig.test.ts — unit tests for config assembly
- Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows
- Add GatewayPrimitive.test.ts for custom claims round-trip
- Extend validate.test.ts with custom claims validation cases
- Add TUI integration test (add-gateway-jwt.test.ts)

Constraint: Stacked on fix/inbound-auth-hardening (aws#598)
Confidence: high
Scope-risk: moderate
tejaskash pushed a commit that referenced this pull request Mar 24, 2026
@aidandaly24
feat(gateway): add custom claims validation and TUI wizard for JWT au…
b1c8a50 
…th (#599)

* feat(gateway): add custom claims validation and TUI wizard for JWT auth

Add custom JWT claims validation support and a full TUI wizard flow
for configuring Custom JWT gateway authorization.

Schema:
- Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType,
  and CustomClaimValidation schemas with strict validation
- Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state
- Add --custom-claims CLI flag with JSON parsing and validation

TUI Wizard:
- Expand JWT config flow with custom claims manager (add/edit/done)
- Add claim name, operator, value, and value type sub-steps
- Show human-readable claim summary in confirm review
- Make client credentials optional (skip with empty Enter)

Testing:
- Add AddGatewayJwtConfig.test.tsx — full TUI component tests
- Add finishJwtConfig.test.ts — unit tests for config assembly
- Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows
- Add GatewayPrimitive.test.ts for custom claims round-trip
- Extend validate.test.ts with custom claims validation cases
- Add TUI integration test (add-gateway-jwt.test.ts)

Constraint: Stacked on fix/inbound-auth-hardening (#598)
Confidence: high
Scope-risk: moderate

* fix(gateway): improve custom claim form navigation UX

Enter now advances to the next field instead of immediately submitting,
and up/down arrow keys navigate between fields for a more intuitive form
experience.

* fix(gateway): position cursor before placeholder in custom claim form

When a text field is empty, the cursor now appears before the placeholder
hint instead of after it, matching expected input behavior.

* test(gateway): update claim form test for Enter-advances-fields behavior

The test expected Enter to immediately submit and show a validation error,
but Enter now advances to the next field. Updated the test to press Enter
through all fields before expecting the submission validation error.

* fix: restore CLIENT_ID env var and move inline import to top-level

Restore writing both CLIENT_ID and CLIENT_SECRET to .env in
createManagedOAuthCredential, matching main branch behavior.
Move dynamic import of policyEnginePrimitive to a static top-level
import per AGENTS.md conventions.

* style: run prettier and fix test prop

Run prettier on 3 files and add missing existingPolicyEngines
prop to AddGatewayJwtConfig test defaults.

* ci: retrigger checks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tejaskash tejaskash tejaskash approved these changes

Assignees

No one assigned

Labels

size/m PR size: M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@aidandaly24 @tejaskash