fix: treat only deleted servers as reusable for remote URL validation

internal/service/registry_service.go

@@ -298,12 +298,13 @@ func pickLatestVersion(versions []*apiv0.ServerResponse, allowDeleted bool) *api
 	return winner
 }
 
-// validateNoDuplicateRemoteURLs checks that no other server is using the same remote URLs
+// validateNoDuplicateRemoteURLs checks that no non-deleted server is using the same remote URLs
 func (s *registryServiceImpl) validateNoDuplicateRemoteURLs(ctx context.Context, tx pgx.Tx, serverDetail apiv0.ServerJSON) error {
 	// Check each remote URL in the new server for conflicts
 	for _, remote := range serverDetail.Remotes {
-		// Use filter to find servers with this remote URL
-		filter := &database.ServerFilter{RemoteURL: &remote.URL}
+		// Use a filter that only returns non-deleted servers with this remote URL
+		includeDeleted := false
+		filter := &database.ServerFilter{RemoteURL: &remote.URL, IncludeDeleted: &includeDeleted}
 
 		conflictingServers, _, err := s.db.ListServers(ctx, tx, filter, "", 1000)
 		if err != nil {
@@ -445,7 +446,7 @@ func (s *registryServiceImpl) updateAllVersionsStatusInTransaction(ctx context.C
 	if statusChange.NewStatus == model.StatusActive {
 		includeDeleted := true
 
-		// When transitioning to active, it means the current status is either deprecated or deleted, so it should include deleted server also
+		// Include deleted versions so we can revalidate any currently deleted versions before restoring them to active.
 		filter := &database.ServerFilter{Name: &serverName, IncludeDeleted: &includeDeleted}
 		versions, _, err := s.db.ListServers(ctx, tx, filter, "", 1000)
 		if err != nil {

internal/service/registry_service_test.go

@@ -41,6 +41,24 @@ func TestValidateNoDuplicateRemoteURLs(t *testing.T) {
 				{Type: "streamable-http", URL: "https://api.microsoft.com/mcp"},
 			},
 		},
+		"deleted": {
+			Schema:      model.CurrentSchemaURL,
+			Name:        "com.example/deleted-server",
+			Description: "A deleted server",
+			Version:     "1.0.0",
+			Remotes: []model.Transport{
+				{Type: "streamable-http", URL: "https://deleted.example.com/mcp"},
+			},
+		},
+		"deprecated": {
+			Schema:      model.CurrentSchemaURL,
+			Name:        "com.example/deprecated-server",
+			Description: "A deprecated server",
+			Version:     "1.0.0",
+			Remotes: []model.Transport{
+				{Type: "streamable-http", URL: "https://deprecated.example.com/mcp"},
+			},
+		},
 	}
 
 	testDB := database.NewTestDB(t)
@@ -52,6 +70,18 @@ func TestValidateNoDuplicateRemoteURLs(t *testing.T) {
 		require.NoError(t, err, "failed to create server: %v", err)
 	}
 
+	deletedServer := existingServers["deleted"]
+	_, err := service.UpdateServerStatus(ctx, deletedServer.Name, deletedServer.Version, &StatusChangeRequest{
+		NewStatus: model.StatusDeleted,
+	})
+	require.NoError(t, err)
+
+	deprecatedServer := existingServers["deprecated"]
+	_, err = service.UpdateServerStatus(ctx, deprecatedServer.Name, deprecatedServer.Version, &StatusChangeRequest{
+		NewStatus: model.StatusDeprecated,
+	})
+	require.NoError(t, err)
+
 	tests := []struct {
 		name         string
 		serverDetail apiv0.ServerJSON
@@ -97,6 +127,33 @@ func TestValidateNoDuplicateRemoteURLs(t *testing.T) {
 			expectError: true,
 			errorMsg:    "remote URL https://api.example.com/mcp is already used by server com.example/existing-server",
 		},
+		{
+			name: "duplicate remote URL used only by deleted server - should pass",
+			serverDetail: apiv0.ServerJSON{
+				Schema:      model.CurrentSchemaURL,
+				Name:        "com.example/new-server-with-deleted-conflict",
+				Description: "A new server reusing a deleted remote URL",
+				Version:     "1.0.0",
+				Remotes: []model.Transport{
+					{Type: "streamable-http", URL: "https://deleted.example.com/mcp"},
+				},
+			},
+			expectError: false,
+		},
+		{
+			name: "duplicate remote URL used by deprecated server - should fail",
+			serverDetail: apiv0.ServerJSON{
+				Schema:      model.CurrentSchemaURL,
+				Name:        "com.example/new-server-with-deprecated-conflict",
+				Description: "A new server reusing a deprecated remote URL",
+				Version:     "1.0.0",
+				Remotes: []model.Transport{
+					{Type: "streamable-http", URL: "https://deprecated.example.com/mcp"},
+				},
+			},
+			expectError: true,
+			errorMsg:    "remote URL https://deprecated.example.com/mcp is already used by server com.example/deprecated-server",
+		},
 		{
 			name: "updating same server with same URLs - should pass",
 			serverDetail: apiv0.ServerJSON{