fix: harden authorization config and E2E cleanup

Co-authored-by: codex <codex@users.noreply.github.com>

Author: AnkanMisra

gateway/config.go

@@ -69,6 +69,9 @@ func normalizePaygateAudience() error {
 	if parsed.Scheme != "http" && parsed.Scheme != "https" {
 		return fmt.Errorf("PAYGATE_AUDIENCE scheme must be http or https")
 	}
+	if parsed.Hostname() == "" {
+		return fmt.Errorf("PAYGATE_AUDIENCE must have a non-empty host")
+	}
 	if parsed.User != nil {
 		return fmt.Errorf("PAYGATE_AUDIENCE must not contain credentials")
 	}

gateway/config_test.go

@@ -44,6 +44,7 @@ func TestNormalizePaygateAudience(t *testing.T) {
 		{name: "rejects query", value: "https://gateway.example.com?tenant=a", wantErr: "origin only"},
 		{name: "rejects credentials", value: "https://user@gateway.example.com", wantErr: "credentials"},
 		{name: "rejects unsupported scheme", value: "javascript://gateway.example.com", wantErr: "http or https"},
+		{name: "rejects empty hostname", value: "https://:443", wantErr: "non-empty host"},
 	}
 
 	for _, test := range tests {

run_e2e.sh

@@ -6,13 +6,14 @@ E2E_TMP_DIR="$(mktemp -d)"
 
 # Function to cleanup background processes on exit
 cleanup() {
+    local exit_code=$?
     echo "Stopping services..."
     # Use a portable check for jobs since xargs -r is not available on all macOS versions
     if [ -n "$(jobs -p)" ]; then
         jobs -p | xargs kill 2>/dev/null
     fi
     rm -rf "$E2E_TMP_DIR"
-    exit
+    exit "$exit_code"
 }
 
 trap cleanup EXIT