fix(gateway): harden inbound auth schema and rename credential flags by aidandaly24 · Pull Request #598 · aws/agentcore-cli

aidandaly24 · 2026-03-23T03:08:14Z

Description

Hardens the Custom JWT authorizer schema and renames credential CLI flags for clarity. This is the foundational PR for the Custom JWT gateway feature — it tightens validation and fixes naming before the custom claims feature is added on top.

Schema hardening

HTTPS enforcement: OidcDiscoveryUrlSchema now rejects http:// URLs via .refine()
Strict mode: CustomJwtAuthorizerConfigSchema uses .strict() to reject unknown fields
Flexible constraints: allowedAudience and allowedClients are now individually optional, with a .superRefine() requiring at least one of allowedAudience, allowedClients, or allowedScopes
deployed-state.ts: Aligned with schema — allowedAudience/allowedClients optional, added allowedScopes

Flag rename (`--agent-client-` → `--client-`)

These are gateway-level OAuth credentials, not agent credentials. The agent prefix was misleading:

--agent-client-id → --client-id
--agent-client-secret → --client-secret
Updated across: CLI types, validation, GatewayPrimitive, TUI wizard state/handlers/props, useCreateMcp hook

TUI improvements

HTTPS validation on discovery URL input in the JWT wizard
Simplified validateCommaSeparated helper (removed unused fieldName param)
Renamed internal prop names (onAgentClientId → onClientId, etc.)
Updated prompt labels to remove "Agent" prefix

Test updates

Schema tests: HTTPS rejection, .strict() rejection, scope-only acceptance, all-empty rejection
Validation tests: HTTPS check, at-least-one constraint, renamed credential fields
Integration tests: Updated --agent-client-id/--agent-client-secret → --client-id/--client-secret

Related Issue

Extracted from #596

Documentation PR

N/A

Type of Change

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash · 2026-03-23T18:07:22Z

Code review

Found 1 issue:

TUI wizard still forces allowedClients to be non-empty, but the schema and CLI validation now allow it to be optional (only requiring at least one of audience/clients/scopes). The clients sub-step (subStep 2) applies customValidation={validateCommaSeparated} which rejects empty input and lacks the allowEmpty prop, unlike the audience and scopes steps which both have allowEmpty. A user who provides only audience + scopes will be blocked at the clients step.

agentcore-cli/src/cli/tui/screens/mcp/AddGatewayScreen.tsx

Lines 380 to 386 in 460ccf6

prompt="Allowed Clients (comma-separated, e.g., 7abc123def456)"
initialValue=""
onSubmit={onClients}
onCancel={onCancel}
customValidation={validateCommaSeparated}
/>
)}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

- Enforce HTTPS on OIDC discovery URL in schema and CLI validation - Make allowedAudience/allowedClients optional with at-least-one superRefine constraint (audience, clients, or scopes) - Add .strict() to CustomJwtAuthorizerConfigSchema - Rename --agent-client-id/--agent-client-secret to --client-id/--client-secret across CLI, TUI, and primitives - Add HTTPS validation to TUI discovery URL input - Update deployed-state schema to match (optional audience/clients, add allowedScopes) - Update unit tests for new validation rules and field names Constraint: OIDC spec requires HTTPS for discovery endpoints Rejected: Keep --agent-client-id naming | confusing since these are gateway-level OAuth credentials, not agent credentials Confidence: high Scope-risk: moderate

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

The schema allows allowedClients to be empty when audience or scopes are provided, but the TUI wizard sub-step still rejected empty input via customValidation. Add allowEmpty and placeholder to match the audience and scopes sub-steps, and remove the now-unused validateCommaSeparated helper. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash

Review comments addressed: clients step now allows empty input with allowEmpty prop.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

…th (#599) * feat(gateway): add custom claims validation and TUI wizard for JWT auth Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (#598) Confidence: high Scope-risk: moderate * fix(gateway): improve custom claim form navigation UX Enter now advances to the next field instead of immediately submitting, and up/down arrow keys navigate between fields for a more intuitive form experience. * fix(gateway): position cursor before placeholder in custom claim form When a text field is empty, the cursor now appears before the placeholder hint instead of after it, matching expected input behavior. * test(gateway): update claim form test for Enter-advances-fields behavior The test expected Enter to immediately submit and show a validation error, but Enter now advances to the next field. Updated the test to press Enter through all fields before expecting the submission validation error. * fix: restore CLIENT_ID env var and move inline import to top-level Restore writing both CLIENT_ID and CLIENT_SECRET to .env in createManagedOAuthCredential, matching main branch behavior. Move dynamic import of policyEnginePrimitive to a static top-level import per AGENTS.md conventions. * style: run prettier and fix test prop Run prettier on 3 files and add missing existingPolicyEngines prop to AddGatewayJwtConfig test defaults. * ci: retrigger checks

aidandaly24 · 2026-03-23T03:08:14Z

Description

Hardens the Custom JWT authorizer schema and renames credential CLI flags for clarity. This is the foundational PR for the Custom JWT gateway feature — it tightens validation and fixes naming before the custom claims feature is added on top.

Schema hardening

HTTPS enforcement: OidcDiscoveryUrlSchema now rejects http:// URLs via .refine()
Strict mode: CustomJwtAuthorizerConfigSchema uses .strict() to reject unknown fields
Flexible constraints: allowedAudience and allowedClients are now individually optional, with a .superRefine() requiring at least one of allowedAudience, allowedClients, or allowedScopes
deployed-state.ts: Aligned with schema — allowedAudience/allowedClients optional, added allowedScopes

Flag rename (`--agent-client-` → `--client-`)

These are gateway-level OAuth credentials, not agent credentials. The agent prefix was misleading:

--agent-client-id → --client-id
--agent-client-secret → --client-secret
Updated across: CLI types, validation, GatewayPrimitive, TUI wizard state/handlers/props, useCreateMcp hook

TUI improvements

HTTPS validation on discovery URL input in the JWT wizard
Simplified validateCommaSeparated helper (removed unused fieldName param)
Renamed internal prop names (onAgentClientId → onClientId, etc.)
Updated prompt labels to remove "Agent" prefix

Test updates

Schema tests: HTTPS rejection, .strict() rejection, scope-only acceptance, all-empty rejection
Validation tests: HTTPS check, at-least-one constraint, renamed credential fields
Integration tests: Updated --agent-client-id/--agent-client-secret → --client-id/--client-secret

Related Issue

Extracted from #596

Documentation PR

N/A

Type of Change

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash · 2026-03-23T18:07:22Z

Code review

Found 1 issue:

TUI wizard still forces allowedClients to be non-empty, but the schema and CLI validation now allow it to be optional (only requiring at least one of audience/clients/scopes). The clients sub-step (subStep 2) applies customValidation={validateCommaSeparated} which rejects empty input and lacks the allowEmpty prop, unlike the audience and scopes steps which both have allowEmpty. A user who provides only audience + scopes will be blocked at the clients step.

agentcore-cli/src/cli/tui/screens/mcp/AddGatewayScreen.tsx

Lines 380 to 386 in 460ccf6

prompt="Allowed Clients (comma-separated, e.g., 7abc123def456)"
initialValue=""
onSubmit={onClients}
onCancel={onCancel}
customValidation={validateCommaSeparated}
/>
)}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

- Enforce HTTPS on OIDC discovery URL in schema and CLI validation - Make allowedAudience/allowedClients optional with at-least-one superRefine constraint (audience, clients, or scopes) - Add .strict() to CustomJwtAuthorizerConfigSchema - Rename --agent-client-id/--agent-client-secret to --client-id/--client-secret across CLI, TUI, and primitives - Add HTTPS validation to TUI discovery URL input - Update deployed-state schema to match (optional audience/clients, add allowedScopes) - Update unit tests for new validation rules and field names Constraint: OIDC spec requires HTTPS for discovery endpoints Rejected: Keep --agent-client-id naming | confusing since these are gateway-level OAuth credentials, not agent credentials Confidence: high Scope-risk: moderate

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

The schema allows allowedClients to be empty when audience or scopes are provided, but the TUI wizard sub-step still rejected empty input via customValidation. Add allowEmpty and placeholder to match the audience and scopes sub-steps, and remove the now-unused validateCommaSeparated helper. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash

Review comments addressed: clients step now allows empty input with allowEmpty prop.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

…th (#599) * feat(gateway): add custom claims validation and TUI wizard for JWT auth Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (#598) Confidence: high Scope-risk: moderate * fix(gateway): improve custom claim form navigation UX Enter now advances to the next field instead of immediately submitting, and up/down arrow keys navigate between fields for a more intuitive form experience. * fix(gateway): position cursor before placeholder in custom claim form When a text field is empty, the cursor now appears before the placeholder hint instead of after it, matching expected input behavior. * test(gateway): update claim form test for Enter-advances-fields behavior The test expected Enter to immediately submit and show a validation error, but Enter now advances to the next field. Updated the test to press Enter through all fields before expecting the submission validation error. * fix: restore CLIENT_ID env var and move inline import to top-level Restore writing both CLIENT_ID and CLIENT_SECRET to .env in createManagedOAuthCredential, matching main branch behavior. Move dynamic import of policyEnginePrimitive to a static top-level import per AGENTS.md conventions. * style: run prettier and fix test prop Run prettier on 3 files and add missing existingPolicyEngines prop to AddGatewayJwtConfig test defaults. * ci: retrigger checks

aidandaly24 · 2026-03-23T03:08:14Z

Description

Hardens the Custom JWT authorizer schema and renames credential CLI flags for clarity. This is the foundational PR for the Custom JWT gateway feature — it tightens validation and fixes naming before the custom claims feature is added on top.

Schema hardening

HTTPS enforcement: OidcDiscoveryUrlSchema now rejects http:// URLs via .refine()
Strict mode: CustomJwtAuthorizerConfigSchema uses .strict() to reject unknown fields
Flexible constraints: allowedAudience and allowedClients are now individually optional, with a .superRefine() requiring at least one of allowedAudience, allowedClients, or allowedScopes
deployed-state.ts: Aligned with schema — allowedAudience/allowedClients optional, added allowedScopes

Flag rename (`--agent-client-` → `--client-`)

These are gateway-level OAuth credentials, not agent credentials. The agent prefix was misleading:

--agent-client-id → --client-id
--agent-client-secret → --client-secret
Updated across: CLI types, validation, GatewayPrimitive, TUI wizard state/handlers/props, useCreateMcp hook

TUI improvements

HTTPS validation on discovery URL input in the JWT wizard
Simplified validateCommaSeparated helper (removed unused fieldName param)
Renamed internal prop names (onAgentClientId → onClientId, etc.)
Updated prompt labels to remove "Agent" prefix

Test updates

Schema tests: HTTPS rejection, .strict() rejection, scope-only acceptance, all-empty rejection
Validation tests: HTTPS check, at-least-one constraint, renamed credential fields
Integration tests: Updated --agent-client-id/--agent-client-secret → --client-id/--client-secret

Related Issue

Extracted from #596

Documentation PR

N/A

Type of Change

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash · 2026-03-23T18:07:22Z

Code review

Found 1 issue:

TUI wizard still forces allowedClients to be non-empty, but the schema and CLI validation now allow it to be optional (only requiring at least one of audience/clients/scopes). The clients sub-step (subStep 2) applies customValidation={validateCommaSeparated} which rejects empty input and lacks the allowEmpty prop, unlike the audience and scopes steps which both have allowEmpty. A user who provides only audience + scopes will be blocked at the clients step.

agentcore-cli/src/cli/tui/screens/mcp/AddGatewayScreen.tsx

Lines 380 to 386 in 460ccf6

prompt="Allowed Clients (comma-separated, e.g., 7abc123def456)"
initialValue=""
onSubmit={onClients}
onCancel={onCancel}
customValidation={validateCommaSeparated}
/>
)}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

- Enforce HTTPS on OIDC discovery URL in schema and CLI validation - Make allowedAudience/allowedClients optional with at-least-one superRefine constraint (audience, clients, or scopes) - Add .strict() to CustomJwtAuthorizerConfigSchema - Rename --agent-client-id/--agent-client-secret to --client-id/--client-secret across CLI, TUI, and primitives - Add HTTPS validation to TUI discovery URL input - Update deployed-state schema to match (optional audience/clients, add allowedScopes) - Update unit tests for new validation rules and field names Constraint: OIDC spec requires HTTPS for discovery endpoints Rejected: Keep --agent-client-id naming | confusing since these are gateway-level OAuth credentials, not agent credentials Confidence: high Scope-risk: moderate

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

The schema allows allowedClients to be empty when audience or scopes are provided, but the TUI wizard sub-step still rejected empty input via customValidation. Add allowEmpty and placeholder to match the audience and scopes sub-steps, and remove the now-unused validateCommaSeparated helper. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash

Review comments addressed: clients step now allows empty input with allowEmpty prop.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

…th (#599) * feat(gateway): add custom claims validation and TUI wizard for JWT auth Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (#598) Confidence: high Scope-risk: moderate * fix(gateway): improve custom claim form navigation UX Enter now advances to the next field instead of immediately submitting, and up/down arrow keys navigate between fields for a more intuitive form experience. * fix(gateway): position cursor before placeholder in custom claim form When a text field is empty, the cursor now appears before the placeholder hint instead of after it, matching expected input behavior. * test(gateway): update claim form test for Enter-advances-fields behavior The test expected Enter to immediately submit and show a validation error, but Enter now advances to the next field. Updated the test to press Enter through all fields before expecting the submission validation error. * fix: restore CLIENT_ID env var and move inline import to top-level Restore writing both CLIENT_ID and CLIENT_SECRET to .env in createManagedOAuthCredential, matching main branch behavior. Move dynamic import of policyEnginePrimitive to a static top-level import per AGENTS.md conventions. * style: run prettier and fix test prop Run prettier on 3 files and add missing existingPolicyEngines prop to AddGatewayJwtConfig test defaults. * ci: retrigger checks

aidandaly24 · 2026-03-23T03:08:14Z

Description

Hardens the Custom JWT authorizer schema and renames credential CLI flags for clarity. This is the foundational PR for the Custom JWT gateway feature — it tightens validation and fixes naming before the custom claims feature is added on top.

Schema hardening

HTTPS enforcement: OidcDiscoveryUrlSchema now rejects http:// URLs via .refine()
Strict mode: CustomJwtAuthorizerConfigSchema uses .strict() to reject unknown fields
Flexible constraints: allowedAudience and allowedClients are now individually optional, with a .superRefine() requiring at least one of allowedAudience, allowedClients, or allowedScopes
deployed-state.ts: Aligned with schema — allowedAudience/allowedClients optional, added allowedScopes

Flag rename (`--agent-client-` → `--client-`)

These are gateway-level OAuth credentials, not agent credentials. The agent prefix was misleading:

--agent-client-id → --client-id
--agent-client-secret → --client-secret
Updated across: CLI types, validation, GatewayPrimitive, TUI wizard state/handlers/props, useCreateMcp hook

TUI improvements

HTTPS validation on discovery URL input in the JWT wizard
Simplified validateCommaSeparated helper (removed unused fieldName param)
Renamed internal prop names (onAgentClientId → onClientId, etc.)
Updated prompt labels to remove "Agent" prefix

Test updates

Schema tests: HTTPS rejection, .strict() rejection, scope-only acceptance, all-empty rejection
Validation tests: HTTPS check, at-least-one constraint, renamed credential fields
Integration tests: Updated --agent-client-id/--agent-client-secret → --client-id/--client-secret

Related Issue

Extracted from #596

Documentation PR

N/A

Type of Change

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash · 2026-03-23T18:07:22Z

Code review

Found 1 issue:

TUI wizard still forces allowedClients to be non-empty, but the schema and CLI validation now allow it to be optional (only requiring at least one of audience/clients/scopes). The clients sub-step (subStep 2) applies customValidation={validateCommaSeparated} which rejects empty input and lacks the allowEmpty prop, unlike the audience and scopes steps which both have allowEmpty. A user who provides only audience + scopes will be blocked at the clients step.

agentcore-cli/src/cli/tui/screens/mcp/AddGatewayScreen.tsx

Lines 380 to 386 in 460ccf6

prompt="Allowed Clients (comma-separated, e.g., 7abc123def456)"
initialValue=""
onSubmit={onClients}
onCancel={onCancel}
customValidation={validateCommaSeparated}
/>
)}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

- Enforce HTTPS on OIDC discovery URL in schema and CLI validation - Make allowedAudience/allowedClients optional with at-least-one superRefine constraint (audience, clients, or scopes) - Add .strict() to CustomJwtAuthorizerConfigSchema - Rename --agent-client-id/--agent-client-secret to --client-id/--client-secret across CLI, TUI, and primitives - Add HTTPS validation to TUI discovery URL input - Update deployed-state schema to match (optional audience/clients, add allowedScopes) - Update unit tests for new validation rules and field names Constraint: OIDC spec requires HTTPS for discovery endpoints Rejected: Keep --agent-client-id naming | confusing since these are gateway-level OAuth credentials, not agent credentials Confidence: high Scope-risk: moderate

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

The schema allows allowedClients to be empty when audience or scopes are provided, but the TUI wizard sub-step still rejected empty input via customValidation. Add allowEmpty and placeholder to match the audience and scopes sub-steps, and remove the now-unused validateCommaSeparated helper. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash

Review comments addressed: clients step now allows empty input with allowEmpty prop.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

…th (#599) * feat(gateway): add custom claims validation and TUI wizard for JWT auth Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (#598) Confidence: high Scope-risk: moderate * fix(gateway): improve custom claim form navigation UX Enter now advances to the next field instead of immediately submitting, and up/down arrow keys navigate between fields for a more intuitive form experience. * fix(gateway): position cursor before placeholder in custom claim form When a text field is empty, the cursor now appears before the placeholder hint instead of after it, matching expected input behavior. * test(gateway): update claim form test for Enter-advances-fields behavior The test expected Enter to immediately submit and show a validation error, but Enter now advances to the next field. Updated the test to press Enter through all fields before expecting the submission validation error. * fix: restore CLIENT_ID env var and move inline import to top-level Restore writing both CLIENT_ID and CLIENT_SECRET to .env in createManagedOAuthCredential, matching main branch behavior. Move dynamic import of policyEnginePrimitive to a static top-level import per AGENTS.md conventions. * style: run prettier and fix test prop Run prettier on 3 files and add missing existingPolicyEngines prop to AddGatewayJwtConfig test defaults. * ci: retrigger checks

aidandaly24 · 2026-03-23T03:08:14Z

Description

Hardens the Custom JWT authorizer schema and renames credential CLI flags for clarity. This is the foundational PR for the Custom JWT gateway feature — it tightens validation and fixes naming before the custom claims feature is added on top.

Schema hardening

HTTPS enforcement: OidcDiscoveryUrlSchema now rejects http:// URLs via .refine()
Strict mode: CustomJwtAuthorizerConfigSchema uses .strict() to reject unknown fields
Flexible constraints: allowedAudience and allowedClients are now individually optional, with a .superRefine() requiring at least one of allowedAudience, allowedClients, or allowedScopes
deployed-state.ts: Aligned with schema — allowedAudience/allowedClients optional, added allowedScopes

Flag rename (`--agent-client-` → `--client-`)

These are gateway-level OAuth credentials, not agent credentials. The agent prefix was misleading:

--agent-client-id → --client-id
--agent-client-secret → --client-secret
Updated across: CLI types, validation, GatewayPrimitive, TUI wizard state/handlers/props, useCreateMcp hook

TUI improvements

HTTPS validation on discovery URL input in the JWT wizard
Simplified validateCommaSeparated helper (removed unused fieldName param)
Renamed internal prop names (onAgentClientId → onClientId, etc.)
Updated prompt labels to remove "Agent" prefix

Test updates

Schema tests: HTTPS rejection, .strict() rejection, scope-only acceptance, all-empty rejection
Validation tests: HTTPS check, at-least-one constraint, renamed credential fields
Integration tests: Updated --agent-client-id/--agent-client-secret → --client-id/--client-secret

Related Issue

Extracted from #596

Documentation PR

N/A

Type of Change

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash · 2026-03-23T18:07:22Z

Code review

Found 1 issue:

TUI wizard still forces allowedClients to be non-empty, but the schema and CLI validation now allow it to be optional (only requiring at least one of audience/clients/scopes). The clients sub-step (subStep 2) applies customValidation={validateCommaSeparated} which rejects empty input and lacks the allowEmpty prop, unlike the audience and scopes steps which both have allowEmpty. A user who provides only audience + scopes will be blocked at the clients step.

agentcore-cli/src/cli/tui/screens/mcp/AddGatewayScreen.tsx

Lines 380 to 386 in 460ccf6

prompt="Allowed Clients (comma-separated, e.g., 7abc123def456)"
initialValue=""
onSubmit={onClients}
onCancel={onCancel}
customValidation={validateCommaSeparated}
/>
)}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

- Enforce HTTPS on OIDC discovery URL in schema and CLI validation - Make allowedAudience/allowedClients optional with at-least-one superRefine constraint (audience, clients, or scopes) - Add .strict() to CustomJwtAuthorizerConfigSchema - Rename --agent-client-id/--agent-client-secret to --client-id/--client-secret across CLI, TUI, and primitives - Add HTTPS validation to TUI discovery URL input - Update deployed-state schema to match (optional audience/clients, add allowedScopes) - Update unit tests for new validation rules and field names Constraint: OIDC spec requires HTTPS for discovery endpoints Rejected: Keep --agent-client-id naming | confusing since these are gateway-level OAuth credentials, not agent credentials Confidence: high Scope-risk: moderate

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

The schema allows allowedClients to be empty when audience or scopes are provided, but the TUI wizard sub-step still rejected empty input via customValidation. Add allowEmpty and placeholder to match the audience and scopes sub-steps, and remove the now-unused validateCommaSeparated helper. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash

Review comments addressed: clients step now allows empty input with allowEmpty prop.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

…th (#599) * feat(gateway): add custom claims validation and TUI wizard for JWT auth Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (#598) Confidence: high Scope-risk: moderate * fix(gateway): improve custom claim form navigation UX Enter now advances to the next field instead of immediately submitting, and up/down arrow keys navigate between fields for a more intuitive form experience. * fix(gateway): position cursor before placeholder in custom claim form When a text field is empty, the cursor now appears before the placeholder hint instead of after it, matching expected input behavior. * test(gateway): update claim form test for Enter-advances-fields behavior The test expected Enter to immediately submit and show a validation error, but Enter now advances to the next field. Updated the test to press Enter through all fields before expecting the submission validation error. * fix: restore CLIENT_ID env var and move inline import to top-level Restore writing both CLIENT_ID and CLIENT_SECRET to .env in createManagedOAuthCredential, matching main branch behavior. Move dynamic import of policyEnginePrimitive to a static top-level import per AGENTS.md conventions. * style: run prettier and fix test prop Run prettier on 3 files and add missing existingPolicyEngines prop to AddGatewayJwtConfig test defaults. * ci: retrigger checks

aidandaly24 · 2026-03-23T03:08:14Z

Description

Hardens the Custom JWT authorizer schema and renames credential CLI flags for clarity. This is the foundational PR for the Custom JWT gateway feature — it tightens validation and fixes naming before the custom claims feature is added on top.

Schema hardening

HTTPS enforcement: OidcDiscoveryUrlSchema now rejects http:// URLs via .refine()
Strict mode: CustomJwtAuthorizerConfigSchema uses .strict() to reject unknown fields
Flexible constraints: allowedAudience and allowedClients are now individually optional, with a .superRefine() requiring at least one of allowedAudience, allowedClients, or allowedScopes
deployed-state.ts: Aligned with schema — allowedAudience/allowedClients optional, added allowedScopes

Flag rename (`--agent-client-` → `--client-`)

These are gateway-level OAuth credentials, not agent credentials. The agent prefix was misleading:

--agent-client-id → --client-id
--agent-client-secret → --client-secret
Updated across: CLI types, validation, GatewayPrimitive, TUI wizard state/handlers/props, useCreateMcp hook

TUI improvements

HTTPS validation on discovery URL input in the JWT wizard
Simplified validateCommaSeparated helper (removed unused fieldName param)
Renamed internal prop names (onAgentClientId → onClientId, etc.)
Updated prompt labels to remove "Agent" prefix

Test updates

Schema tests: HTTPS rejection, .strict() rejection, scope-only acceptance, all-empty rejection
Validation tests: HTTPS check, at-least-one constraint, renamed credential fields
Integration tests: Updated --agent-client-id/--agent-client-secret → --client-id/--client-secret

Related Issue

Extracted from #596

Documentation PR

N/A

Type of Change

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash · 2026-03-23T18:07:22Z

Code review

Found 1 issue:

TUI wizard still forces allowedClients to be non-empty, but the schema and CLI validation now allow it to be optional (only requiring at least one of audience/clients/scopes). The clients sub-step (subStep 2) applies customValidation={validateCommaSeparated} which rejects empty input and lacks the allowEmpty prop, unlike the audience and scopes steps which both have allowEmpty. A user who provides only audience + scopes will be blocked at the clients step.

agentcore-cli/src/cli/tui/screens/mcp/AddGatewayScreen.tsx

Lines 380 to 386 in 460ccf6

prompt="Allowed Clients (comma-separated, e.g., 7abc123def456)"
initialValue=""
onSubmit={onClients}
onCancel={onCancel}
customValidation={validateCommaSeparated}
/>
)}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

- Enforce HTTPS on OIDC discovery URL in schema and CLI validation - Make allowedAudience/allowedClients optional with at-least-one superRefine constraint (audience, clients, or scopes) - Add .strict() to CustomJwtAuthorizerConfigSchema - Rename --agent-client-id/--agent-client-secret to --client-id/--client-secret across CLI, TUI, and primitives - Add HTTPS validation to TUI discovery URL input - Update deployed-state schema to match (optional audience/clients, add allowedScopes) - Update unit tests for new validation rules and field names Constraint: OIDC spec requires HTTPS for discovery endpoints Rejected: Keep --agent-client-id naming | confusing since these are gateway-level OAuth credentials, not agent credentials Confidence: high Scope-risk: moderate

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

The schema allows allowedClients to be empty when audience or scopes are provided, but the TUI wizard sub-step still rejected empty input via customValidation. Add allowEmpty and placeholder to match the audience and scopes sub-steps, and remove the now-unused validateCommaSeparated helper. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash

Review comments addressed: clients step now allows empty input with allowEmpty prop.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

…th (#599) * feat(gateway): add custom claims validation and TUI wizard for JWT auth Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (#598) Confidence: high Scope-risk: moderate * fix(gateway): improve custom claim form navigation UX Enter now advances to the next field instead of immediately submitting, and up/down arrow keys navigate between fields for a more intuitive form experience. * fix(gateway): position cursor before placeholder in custom claim form When a text field is empty, the cursor now appears before the placeholder hint instead of after it, matching expected input behavior. * test(gateway): update claim form test for Enter-advances-fields behavior The test expected Enter to immediately submit and show a validation error, but Enter now advances to the next field. Updated the test to press Enter through all fields before expecting the submission validation error. * fix: restore CLIENT_ID env var and move inline import to top-level Restore writing both CLIENT_ID and CLIENT_SECRET to .env in createManagedOAuthCredential, matching main branch behavior. Move dynamic import of policyEnginePrimitive to a static top-level import per AGENTS.md conventions. * style: run prettier and fix test prop Run prettier on 3 files and add missing existingPolicyEngines prop to AddGatewayJwtConfig test defaults. * ci: retrigger checks

aidandaly24 · 2026-03-23T03:08:14Z

Description

Hardens the Custom JWT authorizer schema and renames credential CLI flags for clarity. This is the foundational PR for the Custom JWT gateway feature — it tightens validation and fixes naming before the custom claims feature is added on top.

Schema hardening

HTTPS enforcement: OidcDiscoveryUrlSchema now rejects http:// URLs via .refine()
Strict mode: CustomJwtAuthorizerConfigSchema uses .strict() to reject unknown fields
Flexible constraints: allowedAudience and allowedClients are now individually optional, with a .superRefine() requiring at least one of allowedAudience, allowedClients, or allowedScopes
deployed-state.ts: Aligned with schema — allowedAudience/allowedClients optional, added allowedScopes

Flag rename (`--agent-client-` → `--client-`)

These are gateway-level OAuth credentials, not agent credentials. The agent prefix was misleading:

--agent-client-id → --client-id
--agent-client-secret → --client-secret
Updated across: CLI types, validation, GatewayPrimitive, TUI wizard state/handlers/props, useCreateMcp hook

TUI improvements

HTTPS validation on discovery URL input in the JWT wizard
Simplified validateCommaSeparated helper (removed unused fieldName param)
Renamed internal prop names (onAgentClientId → onClientId, etc.)
Updated prompt labels to remove "Agent" prefix

Test updates

Schema tests: HTTPS rejection, .strict() rejection, scope-only acceptance, all-empty rejection
Validation tests: HTTPS check, at-least-one constraint, renamed credential fields
Integration tests: Updated --agent-client-id/--agent-client-secret → --client-id/--client-secret

Related Issue

Extracted from #596

Documentation PR

N/A

Type of Change

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash · 2026-03-23T18:07:22Z

Code review

Found 1 issue:

TUI wizard still forces allowedClients to be non-empty, but the schema and CLI validation now allow it to be optional (only requiring at least one of audience/clients/scopes). The clients sub-step (subStep 2) applies customValidation={validateCommaSeparated} which rejects empty input and lacks the allowEmpty prop, unlike the audience and scopes steps which both have allowEmpty. A user who provides only audience + scopes will be blocked at the clients step.

agentcore-cli/src/cli/tui/screens/mcp/AddGatewayScreen.tsx

Lines 380 to 386 in 460ccf6

prompt="Allowed Clients (comma-separated, e.g., 7abc123def456)"
initialValue=""
onSubmit={onClients}
onCancel={onCancel}
customValidation={validateCommaSeparated}
/>
)}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

- Enforce HTTPS on OIDC discovery URL in schema and CLI validation - Make allowedAudience/allowedClients optional with at-least-one superRefine constraint (audience, clients, or scopes) - Add .strict() to CustomJwtAuthorizerConfigSchema - Rename --agent-client-id/--agent-client-secret to --client-id/--client-secret across CLI, TUI, and primitives - Add HTTPS validation to TUI discovery URL input - Update deployed-state schema to match (optional audience/clients, add allowedScopes) - Update unit tests for new validation rules and field names Constraint: OIDC spec requires HTTPS for discovery endpoints Rejected: Keep --agent-client-id naming | confusing since these are gateway-level OAuth credentials, not agent credentials Confidence: high Scope-risk: moderate

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

The schema allows allowedClients to be empty when audience or scopes are provided, but the TUI wizard sub-step still rejected empty input via customValidation. Add allowEmpty and placeholder to match the audience and scopes sub-steps, and remove the now-unused validateCommaSeparated helper. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash

Review comments addressed: clients step now allows empty input with allowEmpty prop.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

…th (#599) * feat(gateway): add custom claims validation and TUI wizard for JWT auth Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (#598) Confidence: high Scope-risk: moderate * fix(gateway): improve custom claim form navigation UX Enter now advances to the next field instead of immediately submitting, and up/down arrow keys navigate between fields for a more intuitive form experience. * fix(gateway): position cursor before placeholder in custom claim form When a text field is empty, the cursor now appears before the placeholder hint instead of after it, matching expected input behavior. * test(gateway): update claim form test for Enter-advances-fields behavior The test expected Enter to immediately submit and show a validation error, but Enter now advances to the next field. Updated the test to press Enter through all fields before expecting the submission validation error. * fix: restore CLIENT_ID env var and move inline import to top-level Restore writing both CLIENT_ID and CLIENT_SECRET to .env in createManagedOAuthCredential, matching main branch behavior. Move dynamic import of policyEnginePrimitive to a static top-level import per AGENTS.md conventions. * style: run prettier and fix test prop Run prettier on 3 files and add missing existingPolicyEngines prop to AddGatewayJwtConfig test defaults. * ci: retrigger checks

aidandaly24 · 2026-03-23T03:08:14Z

Description

Hardens the Custom JWT authorizer schema and renames credential CLI flags for clarity. This is the foundational PR for the Custom JWT gateway feature — it tightens validation and fixes naming before the custom claims feature is added on top.

Schema hardening

HTTPS enforcement: OidcDiscoveryUrlSchema now rejects http:// URLs via .refine()
Strict mode: CustomJwtAuthorizerConfigSchema uses .strict() to reject unknown fields
Flexible constraints: allowedAudience and allowedClients are now individually optional, with a .superRefine() requiring at least one of allowedAudience, allowedClients, or allowedScopes
deployed-state.ts: Aligned with schema — allowedAudience/allowedClients optional, added allowedScopes

Flag rename (`--agent-client-` → `--client-`)

These are gateway-level OAuth credentials, not agent credentials. The agent prefix was misleading:

--agent-client-id → --client-id
--agent-client-secret → --client-secret
Updated across: CLI types, validation, GatewayPrimitive, TUI wizard state/handlers/props, useCreateMcp hook

TUI improvements

HTTPS validation on discovery URL input in the JWT wizard
Simplified validateCommaSeparated helper (removed unused fieldName param)
Renamed internal prop names (onAgentClientId → onClientId, etc.)
Updated prompt labels to remove "Agent" prefix

Test updates

Schema tests: HTTPS rejection, .strict() rejection, scope-only acceptance, all-empty rejection
Validation tests: HTTPS check, at-least-one constraint, renamed credential fields
Integration tests: Updated --agent-client-id/--agent-client-secret → --client-id/--client-secret

Related Issue

Extracted from #596

Documentation PR

N/A

Type of Change

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash · 2026-03-23T18:07:22Z

Code review

Found 1 issue:

TUI wizard still forces allowedClients to be non-empty, but the schema and CLI validation now allow it to be optional (only requiring at least one of audience/clients/scopes). The clients sub-step (subStep 2) applies customValidation={validateCommaSeparated} which rejects empty input and lacks the allowEmpty prop, unlike the audience and scopes steps which both have allowEmpty. A user who provides only audience + scopes will be blocked at the clients step.

agentcore-cli/src/cli/tui/screens/mcp/AddGatewayScreen.tsx

Lines 380 to 386 in 460ccf6

prompt="Allowed Clients (comma-separated, e.g., 7abc123def456)"
initialValue=""
onSubmit={onClients}
onCancel={onCancel}
customValidation={validateCommaSeparated}
/>
)}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

- Enforce HTTPS on OIDC discovery URL in schema and CLI validation - Make allowedAudience/allowedClients optional with at-least-one superRefine constraint (audience, clients, or scopes) - Add .strict() to CustomJwtAuthorizerConfigSchema - Rename --agent-client-id/--agent-client-secret to --client-id/--client-secret across CLI, TUI, and primitives - Add HTTPS validation to TUI discovery URL input - Update deployed-state schema to match (optional audience/clients, add allowedScopes) - Update unit tests for new validation rules and field names Constraint: OIDC spec requires HTTPS for discovery endpoints Rejected: Keep --agent-client-id naming | confusing since these are gateway-level OAuth credentials, not agent credentials Confidence: high Scope-risk: moderate

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

The schema allows allowedClients to be empty when audience or scopes are provided, but the TUI wizard sub-step still rejected empty input via customValidation. Add allowEmpty and placeholder to match the audience and scopes sub-steps, and remove the now-unused validateCommaSeparated helper. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

tejaskash

Review comments addressed: clients step now allows empty input with allowEmpty prop.

Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (aws#598) Confidence: high Scope-risk: moderate

…th (#599) * feat(gateway): add custom claims validation and TUI wizard for JWT auth Add custom JWT claims validation support and a full TUI wizard flow for configuring Custom JWT gateway authorization. Schema: - Add ClaimMatchOperator, ClaimMatchValue, InboundTokenClaimValueType, and CustomClaimValidation schemas with strict validation - Add customClaims to CustomJwtAuthorizerConfigSchema and deployed-state - Add --custom-claims CLI flag with JSON parsing and validation TUI Wizard: - Expand JWT config flow with custom claims manager (add/edit/done) - Add claim name, operator, value, and value type sub-steps - Show human-readable claim summary in confirm review - Make client credentials optional (skip with empty Enter) Testing: - Add AddGatewayJwtConfig.test.tsx — full TUI component tests - Add finishJwtConfig.test.ts — unit tests for config assembly - Extend useAddGatewayWizard.test.tsx with JWT + custom claims flows - Add GatewayPrimitive.test.ts for custom claims round-trip - Extend validate.test.ts with custom claims validation cases - Add TUI integration test (add-gateway-jwt.test.ts) Constraint: Stacked on fix/inbound-auth-hardening (#598) Confidence: high Scope-risk: moderate * fix(gateway): improve custom claim form navigation UX Enter now advances to the next field instead of immediately submitting, and up/down arrow keys navigate between fields for a more intuitive form experience. * fix(gateway): position cursor before placeholder in custom claim form When a text field is empty, the cursor now appears before the placeholder hint instead of after it, matching expected input behavior. * test(gateway): update claim form test for Enter-advances-fields behavior The test expected Enter to immediately submit and show a validation error, but Enter now advances to the next field. Updated the test to press Enter through all fields before expecting the submission validation error. * fix: restore CLIENT_ID env var and move inline import to top-level Restore writing both CLIENT_ID and CLIENT_SECRET to .env in createManagedOAuthCredential, matching main branch behavior. Move dynamic import of policyEnginePrimitive to a static top-level import per AGENTS.md conventions. * style: run prettier and fix test prop Run prettier on 3 files and add missing existingPolicyEngines prop to AddGatewayJwtConfig test defaults. * ci: retrigger checks

aidandaly24 requested a review from a teamMarch 23, 2026 03:08

github-actionsBot added the size/m PR size: M label Mar 23, 2026

aidandaly24 had a problem deploying to e2e-testing March 23, 2026 03:08 — with GitHub Actions Failure

This was referenced Mar 23, 2026
feat(gateway): add custom claims validation and TUI wizard for JWT auth #599
Merged
feat(gateway): add Custom JWT inbound auth for MCP gateways #596
Closed

aidandaly24 force-pushed the fix/inbound-auth-hardening branch from 460ccf6 to 2104fa0Compare March 23, 2026 19:25

aidandaly24 had a problem deploying to e2e-testing March 23, 2026 19:25 — with GitHub Actions Failure

github-actionsBot added size/m PR size: M and removed size/m PR size: M labels Mar 23, 2026

aidandaly24 had a problem deploying to e2e-testing March 23, 2026 19:48 — with GitHub Actions Failure

tejaskash approved these changes Mar 23, 2026
View reviewed changes

tejaskash merged commit bf1406c into aws:mainMar 23, 2026
16 of 18 checks passed