Merge branch 'fix/mcp-hosted-gateway-connectivity' into 'enterprise'

fix(mcp): support hosted MCP gateways (Databricks)

See merge request dkinternal/testgen/dataops-testgen!548

Author: ci bot

testgen/mcp/server.py

@@ -110,6 +110,9 @@ def _build_transport_security() -> TransportSecuritySettings:
         host_pattern = host if ":" in host else f"{host}:*"
         allowed_hosts.add(host_pattern)
         allowed_origins.update({f"http://{host_pattern}", f"https://{host_pattern}"})
+        bare = host.split(":", 1)[0]
+        allowed_hosts.add(bare)
+        allowed_origins.update({f"http://{bare}", f"https://{bare}"})
 
     return TransportSecuritySettings(
         enable_dns_rebinding_protection=True,

testgen/server/__init__.py

@@ -180,6 +180,17 @@ def run_server() -> None:
     if settings.API_TLS_ENABLED:
         ssl_kwargs["ssl_certfile"] = settings.SSL_CERT_FILE
         ssl_kwargs["ssl_keyfile"] = settings.SSL_KEY_FILE
+        # uvicorn defaults ssl_ciphers to "TLSv1", which restricts TLS 1.2 to legacy
+        # CBC/SHA-1 suites with no AEAD. Hardened TLS clients (e.g. the Databricks
+        # Unity Catalog HTTP-connection gateway) negotiate TLS 1.2 with an AEAD-only
+        # policy and find no shared cipher, so the handshake fails before any request
+        # is sent. Offer a modern AEAD cipher set (Mozilla intermediate).
+        ssl_kwargs["ssl_ciphers"] = (
+            "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:"
+            "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:"
+            "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:"
+            "DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
+        )
 
     LOG.info(
         "Starting server on %s:%s (TLS: %s, MCP: %s)",

testgen/settings.py

@@ -634,7 +634,8 @@ def _default_ui_base_url() -> str:
 Extra Host header values accepted by MCP DNS rebinding protection (comma-separated).
 BASE_URL's hostname and loopback are always allowed; this adds more for multi-domain
 deployments or reverse proxies that rewrite Host. Entries without a port (`tg.example.com`)
-get an automatic `:*` wildcard; entries with a port are matched literally
+are allowed both with an automatic `:*` port wildcard and bare, so gateways that send an
+Origin with no port are accepted; entries with a port are matched literally
 (`tg.example.com:8080`) or with explicit wildcard (`tg.example.com:*`).
 Only affects MCP routes — the parent FastAPI app does not validate Host headers.
 

tests/unit/mcp/test_transport_security.py

@@ -30,14 +30,20 @@ def test_loopback_and_base_url_always_present():
     assert "https://localhost:*" in settings.allowed_origins
 
 
-def test_extra_host_without_port_gets_wildcard():
-    """An extras entry without `:` gets `:*` automatically appended."""
+def test_extra_host_without_port_gets_wildcard_and_bare():
+    """An extras entry without `:` is allowed both with a `:*` port wildcard and bare.
+
+    The bare (port-less) form is required because some MCP gateways (e.g. Databricks)
+    send an Origin with no port, which the `:*` wildcard does not match.
+    """
     settings = _build_with("http://localhost:8530", extras=["tg.example.com"])
 
     assert "tg.example.com:*" in settings.allowed_hosts
-    assert "tg.example.com" not in settings.allowed_hosts  # bare entry should NOT be present
+    assert "tg.example.com" in settings.allowed_hosts
     assert "http://tg.example.com:*" in settings.allowed_origins
     assert "https://tg.example.com:*" in settings.allowed_origins
+    assert "http://tg.example.com" in settings.allowed_origins
+    assert "https://tg.example.com" in settings.allowed_origins
 
 
 def test_extra_host_with_explicit_port_preserved_literally():