Function validateMCPBUrl

internal/validators/registries/mcpb.go:96–138

(fullURL string)

}

func validateMCPBUrl(fullURL string) error {
	parsedURL, err := url.Parse(fullURL)
	if err != nil {
		return fmt.Errorf("invalid MCPB package URL: %w", err)
	}

	host := strings.ToLower(parsedURL.Host)
	allowedHosts := []string{
		"github.com",
		"www.github.com",
		"gitlab.com",
		"www.gitlab.com",
	}

	isAllowed := false
	for _, allowed := range allowedHosts {
		if host == allowed {
			isAllowed = true
			break
		}
	}

	if !isAllowed {
		return fmt.Errorf("MCPB packages must be hosted on allowlisted providers (GitHub or GitLab). Host '%s' is not allowed", host)
	}

	// Validate URL path is a proper release URL with strict structure validation
	path := parsedURL.Path
	switch host {
	case "github.com", "www.github.com":
		// GitHub release URLs must match: /owner/repo/releases/download/tag/filename
		if !isValidGitHubReleaseURL(path) {
			return fmt.Errorf("GitHub MCPB packages must be release assets following the pattern '/owner/repo/releases/download/tag/filename'")
		}
	case "gitlab.com", "www.gitlab.com":
		// GitLab release URLs must match specific patterns
		if !isValidGitLabReleaseURL(path) {
			return fmt.Errorf("GitLab MCPB packages must be release assets following patterns '/owner/repo/-/releases/tag/downloads/filename' or '/owner/repo/-/package_files/id/download'")
		}
	}

	return nil
}

// isValidGitHubReleaseURL validates that a path follows the GitHub release asset pattern
// Pattern: /owner/repo/releases/download/tag/filename