Harden configuration validation

internal/config/loader_strict_test.go

@@ -0,0 +1,91 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLoadersRejectTrailingYAMLDocuments(t *testing.T) {
+	dir := t.TempDir()
+	pipelinePath := filepath.Join(dir, "pipeline.yml")
+	campaignPath := filepath.Join(dir, "campaign.yml")
+	if err := os.WriteFile(pipelinePath, []byte("workspace:\n  root: /tmp/narratio\n---\nworkspace:\n  root: /other\n"), 0o644); err != nil {
+		t.Fatalf("write pipeline.yml: %v", err)
+	}
+	if err := os.WriteFile(campaignPath, []byte("campaign_id: sample-campaign\n---\nnull\n"), 0o644); err != nil {
+		t.Fatalf("write campaign.yml: %v", err)
+	}
+
+	tests := []struct {
+		name string
+		load func() error
+	}{
+		{
+			name: "pipeline",
+			load: func() error {
+				_, err := LoadPipeline(pipelinePath)
+				return err
+			},
+		},
+		{
+			name: "campaign",
+			load: func() error {
+				_, err := LoadCampaign(campaignPath)
+				return err
+			},
+		},
+		{
+			name: "remote session bytes",
+			load: func() error {
+				_, err := LoadSessionBytesWithOptions("s3://bucket/session.yml", []byte("session_id: 2026-05-03\n---\n# another document\nnull\n"), SessionLoadOptions{})
+				return err
+			},
+		},
+		{
+			name: "publish lock store",
+			load: func() error {
+				_, err := LoadPublishLockStoreBytes("s3://bucket/locks.yml", []byte("locks: []\n---\n{}\n"), nil, nil)
+				return err
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.load()
+			if err == nil || !strings.Contains(err.Error(), "exactly one YAML document") {
+				t.Fatalf("load error = %v, want exactly-one-document error", err)
+			}
+		})
+	}
+}
+
+func TestStrictYAMLRejectsParserExposedEmptyTrailingDocument(t *testing.T) {
+	var target struct {
+		Name string `yaml:"name"`
+	}
+	err := decodeStrictYAMLFromReader("test", "memory", strings.NewReader("name: one\n---\n"), &target)
+	if err == nil {
+		t.Fatal("decodeStrictYAMLFromReader() error = nil, want trailing-document error")
+	}
+	if !strings.Contains(err.Error(), "exactly one YAML document") {
+		t.Fatalf("decodeStrictYAMLFromReader() error = %v, want exactly-one-document error", err)
+	}
+}
+
+func TestStrictYAMLAcceptsSingleDocumentAndRejectsUnknownFields(t *testing.T) {
+	var target struct {
+		Name string `yaml:"name"`
+	}
+	if err := decodeStrictYAMLFromReader("test", "memory", strings.NewReader("name: one\n"), &target); err != nil {
+		t.Fatalf("decodeStrictYAMLFromReader(single document) error = %v", err)
+	}
+	if target.Name != "one" {
+		t.Fatalf("Name = %q, want one", target.Name)
+	}
+	if err := decodeStrictYAMLFromReader("test", "memory", strings.NewReader("unknown: one\n"), &target); err == nil || !strings.Contains(err.Error(), "strict decode failed") {
+		t.Fatalf("decodeStrictYAMLFromReader(unknown field) error = %v, want strict decode error", err)
+	}
+}