fix: harden read-only target diagnostics

internal/dockerclient/dockerclient_test.go

@@ -67,6 +67,43 @@ func TestDiagnosticChecksCoverSchemaAndAuthorityWithoutMutation(t *testing.T) {
 	}
 }
 
+func TestDiagnosticsAndEnableRejectMalformedManagedProxyTypesWithoutMutation(t *testing.T) {
+	for _, document := range []string{
+		`{"proxies":[]}`,
+		`{"proxies":{"default":[]}}`,
+		`{"proxies":{"default":{"httpProxy":42}}}`,
+		`{"proxies":{"default":{"httpsProxy":false}}}`,
+		`{"proxies":{"default":{"allProxy":{}}}}`,
+		`{"proxies":{"default":{"noProxy":[]}}}`,
+	} {
+		t.Run(document, func(t *testing.T) {
+			files := &countingFS{FileSystem: dockerclient.OSFileSystem{}}
+			a := newAdapterWithFS(t, files)
+			writeConfig(t, a.ConfigPath(), document)
+			before, err := os.ReadFile(a.ConfigPath())
+			if err != nil {
+				t.Fatal(err)
+			}
+			checks := a.DiagnosticChecks(context.Background(), activeProfile())
+			if checks[1].OK {
+				t.Fatalf("malformed schema passed diagnostics: %#v", checks)
+			}
+			writesBefore := files.writes
+			result := a.SetDesired(context.Background(), true, activeProfile())
+			if result.Err == nil {
+				t.Fatalf("enable accepted malformed schema: %#v", result)
+			}
+			after, err := os.ReadFile(a.ConfigPath())
+			if err != nil {
+				t.Fatal(err)
+			}
+			if string(after) != string(before) || files.writes != writesBefore {
+				t.Fatalf("malformed config was modified: writes %d -> %d", writesBefore, files.writes)
+			}
+		})
+	}
+}
+
 func TestDockerClientAdapterRunsReusableTargetContract(t *testing.T) {
 	targettest.Run(t, func(t *testing.T) targettest.Fixture {
 		a := newAdapter(t, nil)