Check for unknown config

cmd/spiffe-helper/config/config.go

@@ -3,10 +3,14 @@ package config
 import (
 	"errors"
 	"flag"
+	"fmt"
 	"io/fs"
 	"os"
+	"slices"
+	"strings"
 
 	"github.com/hashicorp/hcl"
+	"github.com/hashicorp/hcl/hcl/token"
 	"github.com/sirupsen/logrus"
 	"github.com/spiffe/spiffe-helper/pkg/sidecar"
 )
@@ -50,11 +54,15 @@ type Config struct {
 	// JWT configuration
 	JWTSVIDs          []JWTConfig `hcl:"jwt_svids"`
 	JWTBundleFilename string      `hcl:"jwt_bundle_file_name"`
+
+	UnusedKeyPositions map[string][]token.Pos `hcl:",unusedKeyPositions"`
 }
 
 type JWTConfig struct {
 	JWTAudience     string `hcl:"jwt_audience"`
 	JWTSVIDFilename string `hcl:"jwt_svid_file_name"`
+
+	UnusedKeyPositions map[string][]token.Pos `hcl:",unusedKeyPositions"`
 }
 
 // ParseConfig parses the given HCL file into a Config struct
@@ -87,6 +95,10 @@ func (c *Config) ParseConfigFlagOverrides(daemonModeFlag bool, daemonModeFlagNam
 }
 
 func (c *Config) ValidateConfig(log logrus.FieldLogger) error {
+	if err := c.checkForUnknownConfig(); err != nil {
+		return err
+	}
+
 	if err := validateOSConfig(c); err != nil {
 		return err
 	}
@@ -202,6 +214,21 @@ func (c *Config) ValidateConfig(log logrus.FieldLogger) error {
 	return nil
 }
 
+// checkForUnknownConfig looks for any unknown configuration keys and returns an error if one is found
+func (c *Config) checkForUnknownConfig() error {
+	if len(c.UnusedKeyPositions) != 0 {
+		return fmt.Errorf("unknown top level key(s): %s", mapKeysToString(c.UnusedKeyPositions))
+	}
+
+	for i, jwtSVID := range c.JWTSVIDs {
+		if len(jwtSVID.UnusedKeyPositions) != 0 {
+			return fmt.Errorf("unknown key(s) in jwt_svids[%d]: %s", i, mapKeysToString(jwtSVID.UnusedKeyPositions))
+		}
+	}
+
+	return nil
+}
+
 func NewSidecarConfig(config *Config, log logrus.FieldLogger) *sidecar.Config {
 	sidecarConfig := &sidecar.Config{
 		AddIntermediatesToBundle: config.AddIntermediatesToBundle,
@@ -274,3 +301,14 @@ func isFlagPassed(name string) bool {
 
 	return found
 }
+
+// mapKeysToString returns a comma separated string with all the keys from a map
+func mapKeysToString[V any](myMap map[string]V) string {
+	keys := make([]string, 0, len(myMap))
+	for key := range myMap {
+		keys = append(keys, key)
+	}
+
+	slices.Sort(keys)
+	return strings.Join(keys, ",")
+}

cmd/spiffe-helper/config/config_test.go

@@ -317,6 +317,74 @@ func TestValidateConfig(t *testing.T) {
 	}
 }
 
+func TestDetectsUnknownConfig(t *testing.T) {
+	tempDir := t.TempDir()
+	for _, tt := range []struct {
+		name        string
+		config      string
+		expectError string
+	}{
+		{
+			name: "Unknown configuration at top level",
+			config: `
+				agent_address = "/tmp"
+				foo = "bar"
+				bar = "foo"
+				`,
+			expectError: "unknown top level key(s): bar,foo",
+		},
+		{
+			name: "Unknown configuration in first jwt svid",
+			config: `
+				cmd = "echo"
+				jwt_svids = [
+						{
+							jwt_audience="your-audience",
+							jwt_svid_file_name="jwt_svid.token",
+							foo = "bar", 
+							bar = "foo"
+						}
+					    ]
+				`,
+			expectError: "unknown key(s) in jwt_svids[0]: bar,foo",
+		},
+		{
+			name: "Unknown configuration in second jwt svid",
+			config: `
+				cmd = "echo"
+				jwt_svids = [
+						{
+							jwt_audience = "your-audience-0",
+							jwt_svid_file_name="jwt_svid-0.token",
+						},
+						{
+							jwt_audience = "your-audience-1",
+							jwt_svid_file_name = "jwt_svid-1.token",
+							foo = "bar", 
+							bar = "foo"
+						}
+					    ]
+				`,
+			expectError: "unknown key(s) in jwt_svids[1]: bar,foo",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			configFile, err := os.CreateTemp(tempDir, "spiffe-helper")
+			require.NoError(t, err)
+
+			_, err = configFile.WriteString(tt.config)
+			require.NoError(t, err)
+
+			c, err := ParseConfig(configFile.Name())
+			require.NoError(t, err)
+
+			log, _ := test.NewNullLogger()
+			err = c.ValidateConfig(log)
+			require.EqualError(t, err, tt.expectError)
+		})
+	}
+}
+
 func TestDefaultAgentAddress(t *testing.T) {
 	for _, tt := range []struct {
 		name                 string

go.mod

@@ -3,7 +3,7 @@ module github.com/spiffe/spiffe-helper
 go 1.22.3
 
 require (
-	github.com/hashicorp/hcl v1.0.0
+	github.com/hashicorp/hcl v1.0.1-vault-5
 	github.com/spiffe/go-spiffe/v2 v2.4.0
 	github.com/stretchr/testify v1.9.0
 	golang.org/x/sys v0.26.0

go.sum

@@ -20,8 +20,8 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/hcl v1.0.1-vault-5 h1:kI3hhbbyzr4dldA8UdTb7ZlVVlI2DACdCfz31RPDgJM=
+github.com/hashicorp/hcl v1.0.1-vault-5/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=