fix(gateway): enforce ms|s|m|h unit contract for upstream connect timeout

time.ParseDuration accepts units beyond the declared ms|s|m|h contract (ns, us, and compound durations like 1h30m), so an out-of-contract connect timeout could pass validation. Reject any value that is not a single ms|s|m|h duration as an invalid format, keeping the existing distinct invalid-format and non-positive messages.

Author: mehara-rothila

gateway/gateway-controller/pkg/config/api_validator.go

@@ -39,6 +39,8 @@ type APIValidator struct {
 	urlFriendlyNameRegex *regexp.Regexp
 	// upstreamRefRegex enforces the schema pattern for per-op upstream refs
 	upstreamRefRegex *regexp.Regexp
+	// connectTimeoutRegex enforces the ms|s|m|h unit contract for upstream connect timeouts
+	connectTimeoutRegex *regexp.Regexp
 	// policyValidator validates policy references and parameters
 	policyValidator *PolicyValidator
 }
@@ -50,6 +52,7 @@ func NewAPIValidator() *APIValidator {
 		versionRegex:         regexp.MustCompile(`^v?\d+(\.\d+)?(\.\d+)?$`),
 		urlFriendlyNameRegex: regexp.MustCompile(`^[a-zA-Z0-9\-_\. ]+$`),
 		upstreamRefRegex:     regexp.MustCompile(`^[a-zA-Z0-9\-_]+$`),
+		connectTimeoutRegex:  regexp.MustCompile(`^[+-]?\d+(\.\d+)?(ms|s|m|h)$`),
 	}
 }
 
@@ -383,6 +386,11 @@ func (v *APIValidator) validateUpstreamDefinitions(definitions *[]api.UpstreamDe
 						Field:   fmt.Sprintf("spec.upstreamDefinitions[%d].timeout.connect", i),
 						Message: fmt.Sprintf("Invalid timeout format: %v (expected format: '30s', '1m', '500ms')", err),
 					})
+				} else if !v.connectTimeoutRegex.MatchString(timeoutStr) {
+					errors = append(errors, ValidationError{
+						Field:   fmt.Sprintf("spec.upstreamDefinitions[%d].timeout.connect", i),
+						Message: fmt.Sprintf("Invalid timeout format: %q (expected units: ms, s, m, h)", timeoutStr),
+					})
 				} else if d <= 0 {
 					errors = append(errors, ValidationError{
 						Field:   fmt.Sprintf("spec.upstreamDefinitions[%d].timeout.connect", i),

gateway/gateway-controller/pkg/config/validator_test.go

@@ -867,6 +867,35 @@ func TestValidateUpstreamDefinitions_MalformedTimeout(t *testing.T) {
 	assert.Contains(t, errors[0].Message, "Invalid timeout format")
 }
 
+func TestValidateUpstreamDefinitions_TimeoutUnitContract(t *testing.T) {
+	validator := NewAPIValidator()
+
+	// time.ParseDuration accepts units outside the ms|s|m|h contract (ns, us, compounds);
+	// these must be rejected as invalid format, not silently accepted.
+	for _, badTimeout := range []string{"5ns", "100us", "1h30m"} {
+		connect := badTimeout
+		definitions := &[]api.UpstreamDefinition{
+			{
+				Name: "my-upstream",
+				Timeout: &api.UpstreamTimeout{
+					Connect: &connect,
+				},
+				Upstreams: []struct {
+					Url    string `json:"url" yaml:"url"`
+					Weight *int   `json:"weight,omitempty" yaml:"weight,omitempty"`
+				}{
+					{Url: "http://backend:8080"},
+				},
+			},
+		}
+
+		errors := validator.validateUpstreamDefinitions(definitions)
+		require.Len(t, errors, 1, "timeout %q must be rejected", badTimeout)
+		assert.Equal(t, "spec.upstreamDefinitions[0].timeout.connect", errors[0].Field)
+		assert.Contains(t, errors[0].Message, "Invalid timeout format")
+	}
+}
+
 func TestValidateUpstreamRef_ValidRef(t *testing.T) {
 	validator := NewAPIValidator()