fix: canonicalize payment audience default ports

Co-authored-by: codex <codex@users.noreply.github.com>

Author: AnkanMisra

gateway/config.go

@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"log"
+	"net"
 	"net/url"
 	"os"
 	"strings"
@@ -79,7 +80,18 @@ func normalizePaygateAudience() error {
 		return fmt.Errorf("PAYGATE_AUDIENCE must contain an origin only")
 	}
 
-	canonical := parsed.Scheme + "://" + strings.ToLower(parsed.Host)
+	hostname := strings.ToLower(parsed.Hostname())
+	port := parsed.Port()
+	if (parsed.Scheme == "https" && port == "443") || (parsed.Scheme == "http" && port == "80") {
+		port = ""
+	}
+	canonicalHost := hostname
+	if port != "" {
+		canonicalHost = net.JoinHostPort(hostname, port)
+	} else if strings.Contains(hostname, ":") {
+		canonicalHost = "[" + hostname + "]"
+	}
+	canonical := parsed.Scheme + "://" + canonicalHost
 	if err := os.Setenv("PAYGATE_AUDIENCE", canonical); err != nil {
 		return fmt.Errorf("failed to normalize PAYGATE_AUDIENCE: %w", err)
 	}

gateway/config_test.go

@@ -40,6 +40,11 @@ func TestNormalizePaygateAudience(t *testing.T) {
 	}{
 		{name: "canonical origin", value: "https://gateway.example.com", want: "https://gateway.example.com"},
 		{name: "normalizes case and trailing slash", value: " HTTPS://Gateway.Example.COM/ ", want: "https://gateway.example.com"},
+		{name: "strips default HTTPS port", value: "https://gateway.example.com:443", want: "https://gateway.example.com"},
+		{name: "strips default HTTP port", value: "http://localhost:80", want: "http://localhost"},
+		{name: "preserves non-default port", value: "https://gateway.example.com:8443", want: "https://gateway.example.com:8443"},
+		{name: "normalizes IPv6 default port", value: "https://[::1]:443", want: "https://[::1]"},
+		{name: "preserves IPv6 non-default port", value: "https://[::1]:8443", want: "https://[::1]:8443"},
 		{name: "rejects path", value: "https://gateway.example.com/api", wantErr: "origin only"},
 		{name: "rejects query", value: "https://gateway.example.com?tenant=a", wantErr: "origin only"},
 		{name: "rejects credentials", value: "https://user@gateway.example.com", wantErr: "credentials"},