It's state, not config.

internal/api/v1/handlers_services.go

@@ -3,7 +3,9 @@ package v1
 import (
 	"encoding/json"
 	"fmt"
+	"net"
 	"net/http"
+	"strings"
 
 	"github.com/gorilla/mux"
 
@@ -48,6 +50,22 @@ func (api *API) ServicesRegister(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Validate routes
+	for i, r := range svc.Routes {
+		for _, p := range r.Paths {
+			if !strings.HasPrefix(p, "/") {
+				respondError(w, http.StatusBadRequest, fmt.Sprintf("Route %d: path prefix must start with /: %q", i, p))
+				return
+			}
+		}
+		for _, cidr := range r.IPAllow {
+			if _, _, err := net.ParseCIDR(cidr); err != nil {
+				respondError(w, http.StatusBadRequest, fmt.Sprintf("Route %d: invalid CIDR in ipAllow: %q", i, cidr))
+				return
+			}
+		}
+	}
+
 	if err := api.services.Register(svc); err != nil {
 		respondError(w, http.StatusBadRequest, fmt.Sprintf("Failed to register service: %v", err))
 		return