fix(gateway): harden inbound auth schema and rename credential flags by aidandaly24 · Pull Request #598 · aws/agentcore-cli

aidandaly24 · 2026-03-23T03:08:14Z

Description

Hardens the Custom JWT authorizer schema and renames credential CLI flags for clarity. This is the foundational PR for the Custom JWT gateway feature — it tightens validation and fixes naming before the custom claims feature is added on top.

Schema hardening

HTTPS enforcement: OidcDiscoveryUrlSchema now rejects http:// URLs via .refine()
Strict mode: CustomJwtAuthorizerConfigSchema uses .strict() to reject unknown fields
Flexible constraints: allowedAudience and allowedClients are now individually optional, with a .superRefine() requiring at least one of allowedAudience, allowedClients, or allowedScopes
deployed-state.ts: Aligned with schema — allowedAudience/allowedClients optional, added allowedScopes

Flag rename (`--agent-client-` → `--client-`)

These are gateway-level OAuth credentials, not agent credentials. The agent prefix was misleading:

--agent-client-id → --client-id
--agent-client-secret → --client-secret
Updated across: CLI types, validation, GatewayPrimitive, TUI wizard state/handlers/props, useCreateMcp hook

TUI improvements

HTTPS validation on discovery URL input in the JWT wizard
Simplified validateCommaSeparated helper (removed unused fieldName param)
Renamed internal prop names (onAgentClientId → onClientId, etc.)
Updated prompt labels to remove "Agent" prefix

Test updates

Schema tests: HTTPS rejection, .strict() rejection, scope-only acceptance, all-empty rejection
Validation tests: HTTPS check, at-least-one constraint, renamed credential fields
Integration tests: Updated --agent-client-id/--agent-client-secret → --client-id/--client-secret

Related Issue

Extracted from #596

Documentation PR

N/A

Type of Change

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash · 2026-03-23T18:07:22Z

Code review

Found 1 issue:

TUI wizard still forces allowedClients to be non-empty, but the schema and CLI validation now allow it to be optional (only requiring at least one of audience/clients/scopes). The clients sub-step (subStep 2) applies customValidation={validateCommaSeparated} which rejects empty input and lacks the allowEmpty prop, unlike the audience and scopes steps which both have allowEmpty. A user who provides only audience + scopes will be blocked at the clients step.

agentcore-cli/src/cli/tui/screens/mcp/AddGatewayScreen.tsx

Lines 380 to 386 in 460ccf6

    
               prompt="Allowed Clients (comma-separated, e.g., 7abc123def456)" 
        
               initialValue="" 
        
               onSubmit={onClients} 
        
               onCancel={onCancel} 
        
               customValidation={validateCommaSeparated} 
        
             /> 
        
           )}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

- Enforce HTTPS on OIDC discovery URL in schema and CLI validation - Make allowedAudience/allowedClients optional with at-least-one superRefine constraint (audience, clients, or scopes) - Add .strict() to CustomJwtAuthorizerConfigSchema - Rename --agent-client-id/--agent-client-secret to --client-id/--client-secret across CLI, TUI, and primitives - Add HTTPS validation to TUI discovery URL input - Update deployed-state schema to match (optional audience/clients, add allowedScopes) - Update unit tests for new validation rules and field names Constraint: OIDC spec requires HTTPS for discovery endpoints Rejected: Keep --agent-client-id naming | confusing since these are gateway-level OAuth credentials, not agent credentials Confidence: high Scope-risk: moderate

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

The schema allows allowedClients to be empty when audience or scopes are provided, but the TUI wizard sub-step still rejected empty input via customValidation. Add allowEmpty and placeholder to match the audience and scopes sub-steps, and remove the now-unused validateCommaSeparated helper. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash

Review comments addressed: clients step now allows empty input with allowEmpty prop.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

aidandaly24 requested a review from a team March 23, 2026 03:08

github-actions bot added the size/m PR size: M label Mar 23, 2026

aidandaly24 had a problem deploying to e2e-testing March 23, 2026 03:08 — with GitHub Actions Failure

This was referenced Mar 23, 2026

feat(gateway): add custom claims validation and TUI wizard for JWT auth #599

Open

feat(gateway): add Custom JWT inbound auth for MCP gateways #596

Closed

aidandaly24 force-pushed the fix/inbound-auth-hardening branch from 460ccf6 to 2104fa0 Compare March 23, 2026 19:25

aidandaly24 had a problem deploying to e2e-testing March 23, 2026 19:25 — with GitHub Actions Failure

github-actions bot added size/m PR size: M and removed size/m PR size: M labels Mar 23, 2026

aidandaly24 had a problem deploying to e2e-testing March 23, 2026 19:48 — with GitHub Actions Failure

tejaskash approved these changes Mar 23, 2026

View reviewed changes

tejaskash merged commit bf1406c into aws:main Mar 23, 2026
16 of 18 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(gateway): harden inbound auth schema and rename credential flags#598

fix(gateway): harden inbound auth schema and rename credential flags#598
tejaskash merged 2 commits intoaws:mainfrom
aidandaly24:fix/inbound-auth-hardening

aidandaly24 commented Mar 23, 2026

Uh oh!

tejaskash commented Mar 23, 2026

Uh oh!

tejaskash left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

aidandaly24 commented Mar 23, 2026

Description

Schema hardening

Flag rename (--agent-client-* → --client-*)

TUI improvements

Test updates

Related Issue

Documentation PR

Type of Change

Testing

Checklist

Uh oh!

tejaskash commented Mar 23, 2026

Code review

Uh oh!

tejaskash left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Flag rename (`--agent-client-` → `--client-`)