fix(config): reject a config body that forgot the parameters wrapper (#605)

[padak]

Closes #605.

The half of #587 that #589 left standing

A component's configurationSchema describes the CONTENTS of configuration.parameters, while the Storage API POST takes the whole configuration object. #589 (v0.84.1) fixed one direction of that mismatch: a correctly nested body is no longer rejected. The other direction survived and is what #605 reports.

A flattened body -- the component's own fields sitting at the configuration root, no parameters wrapper -- matched the parameters-level schema, validated ok, and was POSTed verbatim. The result was a live configuration with no parameters key at all, which the Keboola UI and the component runtime both read as empty (blank boilerplate), while --push reported success and returned a config id. Silent shape corruption: nothing errors, and config detail looks superficially fine.

Reproduced on main before touching anything:

validation_status: ok
POSTed configuration: {'table': 'orders'}

Root cause

The whole-body exemption was decided from the body itself:

unwrapped = "parameters" in body and not schema_is_whole_body
target = body["parameters"] if unwrapped else body

"Body carries no parameters key" was read as "this is a flow-style config whose root IS what the schema describes". But that condition is also exactly what a forgotten wrapper looks like, so the one thing under test was also the thing granting itself the exemption -- the two cases are indistinguishable from the body alone.

Fix

Decide the exemption from the COMPONENT and the SCHEMA, never from the body:

schema_is_whole_body = (
    component_id in ROOT_LEVEL_CONFIG_COMPONENTS
    or "parameters" in (schema.get("properties") or {})
)
unwrapped = not schema_is_whole_body
target = body.get("parameters", {}) if unwrapped else body

• A body with no parameters key is validated as an empty parameters section, so the schema's required fields fail it.
• ROOT_LEVEL_CONFIG_COMPONENTS (new, in constants.py) carries the genuine root-level cases: keboola.flow / keboola.orchestrator, whose phases / tasks really are the configuration root.
• The error list gains a hint: line when the wrapper is missing -- otherwise the report reads 'db' is a required property to a caller who DID supply db, one level too high.
• Escape hatch unchanged: --no-validate for a component that legitimately takes a root-level body.

The POSTed body is still never altered -- unwrapping affects validation only, so runtime / storage / authorization siblings survive (the data loss that prompted #587).

Tests

New TestMissingParametersWrapper (4 cases), written failing-first -- 3 of the 4 failed before the fix:

• flattened body raises ConfigError and nothing reaches the Storage API
• the error list names the missing wrapper, not just the required field
• a body with no parameters against a schema with no required fields still creates (guards against inventing a failure for a legitimately storage-only config)
• the whole-body carve-out is keyed on the component: a non-flow component with a flow-shaped body is not exempt

tests/test_e2e.py::_test_config_new_push_schema_validation extended with the flattened-body case, mirroring how #589 covered its own fix.

Live verification

Against a real stack with a real AI Service schema (project conditional-flow-testing, keboola.ex-db-mysql), everything --dry-run -- no configuration created:

body	before	after
{"parameters": {"db": ...}, "runtime": ...}	ok	ok
{"db": ...} (no wrapper)	ok, created broken	failed + hint
keboola.flow {"phases": [], "tasks": []}	ok	ok (carve-out holds)

status: failed
  - parameters: 'db' is a required property
  - hint: the body has no 'parameters' key -- this component's schema describes the CONTENTS of configuration.parameters, so wrap it as {"parameters": {...}} (or pass --no-validate to skip this check)

Docs / release

• gotchas.md: the existing bullet documented this hole as expected behaviour ("a parameters-level body posted by mistake ... still validates ok, because it is indistinguishable from a flow-style config") -- rewritten, tagged since v0.85.1.
• Version bumped to 0.85.1 with a changelog entry; make version-sync run.
• make check green (lint, format, typecheck, skill, version, command-sync, changelog, error-codes, sentinel-guards, file-size, 5575 tests).

Note for the reporter

The first symptom in #605 -- a correctly nested body failing validation with <root>: 'venv' is a required property -- was #587, fixed in v0.84.1. The report was filed from v0.79.0, so upgrading resolves that half on its own; this PR covers the second half.

---

[devin-ai-integration]

Devin Review found 1 potential issue.