Reject unknown integration configuration IDs and fields

CHANGELOG.md

@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking:** Known `[integrations.*]` tables, `[tester_cookie]`, and `[tinybird]` now reject unknown fields, including in disabled integration blocks. Integration parse errors name the offending key. `ts config validate` and `ts config push` also reject unknown integration IDs and list the supported IDs; runtime startup warns and ignores unknown IDs for compatibility with stored configs. Before deploying the new binary, use the new CLI to run `ts config validate` on the current config, correct the reported fields and IDs, then push the cleaned config while the old binary is still running. On Fastly, wait for the config-store propagation window to elapse before activating the new binary; a successful push does not mean every point of presence (POP) has the new config. Stored unknown fields can otherwise prevent startup. Intentionally open payload maps remain supported. Lockr uses `app_id`; remove unsupported `organization_id` and `project_id` fields.
 - The attested Fastly wasm reports `x-ts-version` as the full 40-character source commit; deploy-pipeline builds keep the tag, branch or short-commit value described below.
 - **Breaking:** `ts --version` now prints `ts package=<version> source=<source> target=<triple> variant=default` instead of `ts <version>`. `source` is the full commit in attested release binaries, and otherwise the development ref, short commit or `unknown`. Update scripts that parse the old output.
 - **Breaking:** Creative rewrite proxy, click, CSS, `srcset`, sign-response, rebuild-response, and injected creative TSJS URLs are now absolute on `publisher.public_origin`. Review the [default authority, cookie scope, and coordinated upgrade/rollback warning for `public_origin`](docs/guide/configuration.md#publisher-configuration) before deployment. Existing root-relative signed proxy and click inputs remain accepted. TSJS bundle selection and hash calculation are unchanged.

crates/trusted-server-cli/tests/config_env_overlay.rs

@@ -729,3 +729,60 @@ fn pushed_envelope_sha_is_stable_for_one_context_key_allowlist() {
         );
     }
 }
+
+#[test]
+fn config_validate_and_push_reject_unknown_integration_ids_and_fields() {
+    let cases = [
+        ("prebdi", "enabled", true, "Unknown integration IDs: prebdi"),
+        (
+            "gpt",
+            "rewrite_scripts",
+            false,
+            "unknown field `rewrite_scripts`",
+        ),
+        ("gpt", "enable", false, "unknown field `enable`"),
+        ("osano", "made_up_key", false, "unknown field `made_up_key`"),
+    ];
+    for (id, field, field_value, expected) in cases {
+        for command in ["validate", "push"] {
+            let project = migrated_project();
+            let mut document = fs::read_to_string(&project.config_path)
+                .expect("should read valid config")
+                .parse::<DocumentMut>()
+                .expect("should parse valid config");
+            document["integrations"][id] = toml_edit::table();
+            document["integrations"][id][field] = value(field_value);
+            fs::write(&project.config_path, document.to_string())
+                .expect("should write invalid integration config");
+            let mut process = Command::new(env!("CARGO_BIN_EXE_ts"));
+            process
+                .args(["config", command, "--manifest"])
+                .arg(&project.manifest_path)
+                .arg("--app-config")
+                .arg(&project.config_path)
+                .current_dir(project.directory.path());
+            if command == "push" {
+                process.args(["--adapter", "axum", "--yes", "--no-diff"]);
+            }
+
+            let output = process.output().expect("should run config command");
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            assert!(
+                !output.status.success(),
+                "should reject {id}.{field} during {command}: {stderr}"
+            );
+            assert!(
+                stderr.contains(expected),
+                "should name {expected} during {command}: {stderr}"
+            );
+            assert!(
+                !project
+                    .directory
+                    .path()
+                    .join(".edgezero/local-config-trusted_server_config.json")
+                    .exists(),
+                "should reject invalid configuration before writing a local blob"
+            );
+        }
+    }
+}