fix(gateway): check only header names against the token rule

A query parameter name can hold any character once percent-encoded
(RFC 3986), and the AgentCore API only limits it to 1-64 characters,
so names such as api:key and auth[token] are valid. Apply the HTTP
token rule only when the effective location is HEADER, including an
unset location, and keep the length checks for query names.

Author: mquang-amazon

src/projectSchemas/gateway.test.ts

@@ -276,6 +276,16 @@ describe("gateway custom validation", () => {
       },
       { parameterName: "X-Pets-Key" },
     ],
+    [
+      "a query parameter name with a colon",
+      githubPassthrough,
+      { location: "QUERY_PARAMETER", parameterName: "api:key" },
+    ],
+    [
+      "a query parameter name with brackets",
+      githubPassthrough,
+      { location: "QUERY_PARAMETER", parameterName: "auth[token]" },
+    ],
   ])("accepts %s", (_case, target, placement) => {
     expect(
       targetIssues({ ...target, outboundAuth: { ...apiKeyAuth, ...placement } }),
@@ -295,16 +305,22 @@ describe("gateway custom validation", () => {
       "Too big: expected string to have <=64 characters",
     ],
     [
-      "a parameterName with a colon",
-      { parameterName: "Authorization: " },
+      "a query parameter name over 64 characters",
+      { location: "QUERY_PARAMETER", parameterName: "x".repeat(65) },
+      ["outboundAuth", "parameterName"],
+      "Too big: expected string to have <=64 characters",
+    ],
+    [
+      "a HEADER parameterName with a colon",
+      { location: "HEADER", parameterName: "Authorization: " },
       ["outboundAuth", "parameterName"],
-      "parameterName must be a header or query parameter name, with no spaces or colons.",
+      "A HEADER API key's parameterName must be an HTTP header name, with no spaces or colons.",
     ],
     [
-      "a parameterName with spaces",
+      "a parameterName with spaces when location defaults to HEADER",
       { parameterName: "x api key" },
       ["outboundAuth", "parameterName"],
-      "parameterName must be a header or query parameter name, with no spaces or colons.",
+      "A HEADER API key's parameterName must be an HTTP header name, with no spaces or colons.",
     ],
     [
       "an empty API key prefix",

src/projectSchemas/gateway.ts

@@ -48,9 +48,10 @@ export const OutboundAuthTypeSchema = z.enum([
   "JWT_PASSTHROUGH",
 ]);
 export type OutboundAuthType = z.infer<typeof OutboundAuthTypeSchema>;
-// An HTTP token (RFC 9110 tchar), also safe as a query parameter name. Rejects spaces and
-// colons, so "Authorization: " fails validation instead of the CloudFormation deploy.
-const API_KEY_PARAMETER_NAME_PATTERN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+// An HTTP header name (RFC 9110 token). Rejects spaces and colons, so "Authorization: " fails
+// validation instead of the CloudFormation deploy. Query parameter names have no such rule: any
+// character can be percent-encoded (RFC 3986), so they're only length-checked.
+const HTTP_HEADER_NAME_PATTERN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
 export const OutboundAuthSchema = z
   .object({
     type: OutboundAuthTypeSchema.default("NONE"),
@@ -59,15 +60,7 @@ export const OutboundAuthSchema = z
     service: z.string().min(1).max(64).optional(),
     region: z.string().min(1).max(32).optional(),
     location: z.enum(["HEADER", "QUERY_PARAMETER"]).optional(),
-    parameterName: z
-      .string()
-      .min(1)
-      .max(64)
-      .regex(
-        API_KEY_PARAMETER_NAME_PATTERN,
-        "parameterName must be a header or query parameter name, with no spaces or colons.",
-      )
-      .optional(),
+    parameterName: z.string().min(1).max(64).optional(),
     prefix: z.string().min(1).max(64).optional(),
   })
   .strict();
@@ -465,6 +458,21 @@ export const AgentCoreGatewayTargetSchema = z
           path: ["outboundAuth", "parameterName"],
         });
       }
+      // location defaults to HEADER, so an unset location is checked as a header name.
+      const parameterName = data.outboundAuth?.parameterName;
+      if (
+        data.outboundAuth?.type === "API_KEY" &&
+        data.outboundAuth.location !== "QUERY_PARAMETER" &&
+        parameterName !== undefined &&
+        !HTTP_HEADER_NAME_PATTERN.test(parameterName)
+      ) {
+        ctx.addIssue({
+          code: "custom",
+          message:
+            "A HEADER API key's parameterName must be an HTTP header name, with no spaces or colons.",
+          path: ["outboundAuth", "parameterName"],
+        });
+      }
     }
   });
 export type AgentCoreGatewayTarget = z.infer<typeof AgentCoreGatewayTargetSchema>;