fix(auth): reject github.io domains in DNS/HTTP token exchange (org namespace takeover)

[SashaMIT]

Summary

• The GitHub token method grants io.github.<org>/* publish rights only to org Owners (active admin membership — github_at.go).
• The DNS/HTTP token methods grant reversed(domain)/* for any proven domain, with no github.io special-casing and an empty BlockedNamespaces list.
• <org>.github.io is served by GitHub Pages from the <org>/<org>.github.io repository. Push access to that one repository — routinely held by ordinary org members, a much weaker bar than Owner — is enough to serve a key at /.well-known/mcp-registry-auth, exchange it for a JWT, and publish under the org's entire io.github.<org>/* namespace.
• Reject github.io (and subdomains) at the shared ValidateDomainAndTimestamp seam used by both DNS and HTTP exchange; io.github.* publishers already have the GitHub method.

Impact if unsolved

Any org member with write access to the org's GitHub Pages repo (or an attacker compromising such a member) can mint MCP packages under the org's trusted namespace — supply-chain poisoning of every downstream user who installs <org>'s servers from the registry, bypassing the deliberate Owner-only gate.

Test plan

• New TestValidateDomainAndTimestampRejectsGitHubPages: rejects my-org.github.io (incl. mixed case and subdomains), still allows lookalikes (github.io.evil-example.com, my-org.github.io.example.com) and ordinary domains.
• Full internal/api/handlers/v0/auth package passes.

Made with Cursor

[rdimitrov]

Reviewed the authentication boundary, suffix matching, handler coverage, and compatibility impact. The issue is valid; this safely closes the GitHub Pages path to io.github organization namespace grants. Targeted auth tests, race tests, and merge-with-current-main checks pass. Approved.

[Copilot]

Pull request overview

Blocks GitHub Pages domains from DNS/HTTP authentication to prevent organization namespace takeover.

Changes:

• Rejects github.io and its subdomains case-insensitively.
• Adds coverage for blocked domains, lookalikes, and ordinary domains.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
internal/api/handlers/v0/auth/common.go	Adds shared GitHub Pages domain rejection.
internal/api/handlers/v0/auth/common_test.go	Tests rejection and allowed-domain behavior.