Document the config template and harden config validation

[aram356]

Closes #869. Closes #871.

Config-surface cleanup in four focused commits: document the app-config template, close deploy-validation gaps that let placeholder values through, and lean the config structs onto the validator crate's built-in validators instead of hand-rolled functions.

---

1 · Document trusted-server.example.toml and restore supported sections

Reworks the source-controlled app-config template (used by ts config init, embedded into the Cloudflare/Spin adapters via include_str!, and text-patched by ts audit).

• Required minimum stays active + documented: [[handlers]] (admin), [publisher], [ec].
• Every optional section/integration is commented out with a one-line description.
• Restores sections that still map to live config structs but had been dropped: [tester_cookie], [rewrite], [consent], [image_optimizer], [tinybird], [integrations.osano], publisher.max_buffered_body_bytes, sourcepoint.auth_cookie_name, DataDome protection fields, Prebid override rules.
• Keeps gpt/didomi/datadome/google_tag_manager as active enabled = false stubs so ts audit can flip them in place. All hosts are example.com.

2 · Reject fail-open placeholder config values at deploy validation

ts config validate/push route through TrustedServerAppConfig::validate → validate_settings_for_deploy. That path now rejects template placeholders that previously validated OK and only failed later at runtime:

• publisher.domain / cookie_domain / origin_url left at the example.com template defaults.
• request_signing.config_store_id / secret_store_id when the block is enabled (empty or the <management-...> placeholders).
• integrations.aps.pub_id when APS is enabled — non-empty via the built-in length(min = 1) validator, plus a custom validator for the reserved your-aps-publisher-id placeholder.

Why some checks use #[validate] and some don't: APS validates lazily through get_typed (enabled-gated), so an attribute fires only when APS is on. Publisher / request_signing stay in the deploy-only reject_placeholder_secrets — Publisher::validate() runs at parse time on the embedded example.com template (an attribute would reject the template itself), and request_signing rejection must be gated on the sibling enabled flag. This mirrors how the existing placeholder-secret rejection already works.

3 · Replace hand-rolled GTM/Prebid validators with the built-in regex validator

• GTM container_id and Prebid external_bundle_sha256 used custom validator functions that just ran a regex / hex-format check. Both now use #[validate(regex(...))] (validator 0.20 ships regex support + an AsRegex impl for LazyLock<Regex>); operator-facing messages preserved via message.
• Added a test per validator asserting the accepted and rejected inputs.

4 · Bound timeout_ms with the built-in range validator

testlight/datadome already constrain their timeouts via range; aps, prebid, adserver_mock, and auction did not. Added range(min = 1, max = 60000) (catches 0 and absurd values) for consistency. AuctionConfig now derives Validate and is wired via #[validate(nested)]; all existing configs use 500–2000 ms.

---

Intentionally left imperative

Tinybird, image-optimizer, proxy asset-route, creative-opportunities, and consent validators were not converted to attributes. Their logic interleaves normalize() mutation, charset checks, enabled-gating, cross-field rules, and contextual per-item error messages (e.g. "slot X must have positive width") with the one or two convertible checks. Converting them would fragment validation across #[validate] attrs and prepare_runtime/validate_runtime, cascade Validate derives up the parent chains, and downgrade contextual errors to generic ones — a regression, not a win. (consent additionally clamps rather than rejects, so a range attribute would change its behavior.) That code isn't reimplementing a built-in; it does things built-ins can't express.

Verification

• cargo test -p trusted-server-core --lib → 1631 pass, 0 fail (incl. new deploy-validation, GTM/Prebid regex, and timeout-range tests).
• cargo test --package trusted-server-cli … audit → pass (ts audit still patches the template).
• Settings::from_toml on the template → pass (deploy rejection is separate from parse).
• cargo clippy -p trusted-server-core --lib with -D warnings → clean.
• Integration fixture timeout values confirmed within range.

Not yet run: the full clippy-fastly / integration-parity CI gates — the clippy-fastly alias hits a pre-existing local env error compiling the JS build script, unrelated to these changes.

[ChristianPavilonis]

Summary

Reviewed the config hardening and template changes. I found one high-severity configuration compatibility regression and three medium validation/template gaps; details are inline.

[prk-Jr]

Summary

The configuration-template and validation hardening is well scoped, and all CI checks pass. One enabled APS configuration edge case still bypasses the new publisher-ID validation.

Blocking

🔧 wrench

• Reject whitespace-only APS publisher IDs: the built-in length validator accepts non-empty whitespace, while the custom validator trims only for placeholder comparison (crates/trusted-server-core/src/integrations/aps.rs:204).

CI Status

• fmt: PASS
• clippy / cargo checks: PASS
• rust tests: PASS
• js tests: PASS
• integration tests: PASS