Summary

The sso_entra_admin_groups setting in mcpgateway/config.py uses Annotated[list[str], NoDecode()] but is not included in the _parse_list_from_env field validator.

Details

All other list[str] settings with NoDecode are validated by _parse_list_from_env (line 1530):

• sso_trusted_domains ✅
• sso_auto_admin_domains ✅
• sso_github_admin_orgs ✅
• sso_google_admin_domains ✅
• insecure_queryparam_auth_allowed_hosts ✅

But sso_entra_admin_groups (line 259) is missing from this validator, despite using the same type annotation and description format ("CSV/JSON").

Fix

Add "sso_entra_admin_groups" to the @field_validator decorator at line 1530:

@field_validator(
    "sso_entra_admin_groups",  # Add this line
    "sso_trusted_domains",
    "sso_auto_admin_domains",
    "sso_github_admin_orgs",
    "sso_google_admin_domains",
    "insecure_queryparam_auth_allowed_hosts",
    mode="before",
)

Impact

Without this validator, environment variable values for SSO_ENTRA_ADMIN_GROUPS may not be properly parsed from CSV or JSON format strings.