feat(test): Extract config cleanup assertions into dedicated JUnit extension

Move DD_* environment variable and dd.* system property validation logic from DDJavaSpecification into a reusable CleanConfigStateExtension. Improves error reporting with detailed leak information.

Author: PerfectSlayer

utils/test-utils/src/main/java/datadog/trace/test/util/CleanConfigStateExtension.java

@@ -0,0 +1,80 @@
+package datadog.trace.test.util;
+
+import static org.junit.jupiter.api.AssertionFailureBuilder.assertionFailure;
+
+import datadog.environment.EnvironmentVariables;
+import de.thetaphi.forbiddenapis.SuppressForbidden;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.TreeMap;
+import java.util.function.Predicate;
+import java.util.stream.Collectors;
+import org.junit.jupiter.api.extension.AfterAllCallback;
+import org.junit.jupiter.api.extension.BeforeAllCallback;
+import org.junit.jupiter.api.extension.ExtensionContext;
+
+/**
+ * Asserts that no {@code DD_*} environment variable and no {@code dd.*} system property (minus a
+ * small allowlist) is set around a test class.
+ */
+@SuppressForbidden
+public class CleanConfigStateExtension implements BeforeAllCallback, AfterAllCallback {
+
+  private static final List<String> ALLOWED_SYS_PROPS =
+      Arrays.asList(
+          "dd.appsec.enabled", "dd.iast.enabled", "dd.integration.grizzly-filterchain.enabled");
+
+  private static final Predicate<String> DATADOG_ENV_VAR_FILTER = k -> k.startsWith("DD_");
+  private static final Predicate<Object> DATADOG_SYS_PROPERTIES_FILTER =
+      o -> {
+        String key = (String) o;
+        return key.startsWith("DD_") && !ALLOWED_SYS_PROPS.contains(key);
+      };
+
+  @Override
+  public void beforeAll(ExtensionContext context) {
+    assertClean("before");
+  }
+
+  @Override
+  public void afterAll(ExtensionContext context) {
+    assertClean("after");
+  }
+
+  private static void assertClean(String phase) {
+    Map<String, String> leakedEnv =
+        filterMap(EnvironmentVariables.getAll(), DATADOG_ENV_VAR_FILTER);
+    Map<Object, Object> leakedSys =
+        filterMap(System.getProperties(), DATADOG_SYS_PROPERTIES_FILTER);
+    if (!leakedEnv.isEmpty() || !leakedSys.isEmpty()) {
+      assertionFailure()
+          .message("Leaked Datadog configuration detected " + phase + " test class")
+          .reason(formatLeaks(leakedEnv, leakedSys))
+          .buildAndThrow();
+    }
+  }
+
+  private static <T> Map<T, T> filterMap(Map<T, T> map, Predicate<T> keyFilter) {
+    return map.entrySet().stream()
+        .filter(e -> keyFilter.test(e.getKey()))
+        .collect(Collectors.toMap(Entry::getKey, Entry::getValue, (a, b) -> a, TreeMap::new));
+  }
+
+  private static String formatLeaks(Map<String, String> env, Map<Object, Object> sys) {
+    StringBuilder sb = new StringBuilder();
+    if (!env.isEmpty()) {
+      sb.append("environment variables:");
+      env.forEach((k, v) -> sb.append("\n  ").append(k).append('=').append(v));
+    }
+    if (!sys.isEmpty()) {
+      if (sb.length() > 0) {
+        sb.append('\n');
+      }
+      sb.append("system properties:");
+      sys.forEach((k, v) -> sb.append("\n  ").append(k).append('=').append(v));
+    }
+    return sb.toString();
+  }
+}

utils/test-utils/src/main/java/datadog/trace/test/util/DDJavaSpecification.java

@@ -1,22 +1,21 @@
 package datadog.trace.test.util;
 
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import datadog.environment.EnvironmentVariables;
 import datadog.trace.junit.utils.config.WithConfigExtension;
 import datadog.trace.junit.utils.context.AllowContextTestingExtension;
 import de.thetaphi.forbiddenapis.SuppressForbidden;
-import java.util.Arrays;
 import java.util.List;
-import java.util.Map;
 import java.util.Set;
 import java.util.stream.Collectors;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.extension.ExtendWith;
 
-@ExtendWith({WithConfigExtension.class, AllowContextTestingExtension.class})
+@ExtendWith({
+  CleanConfigStateExtension.class,
+  WithConfigExtension.class,
+  AllowContextTestingExtension.class
+})
 @SuppressForbidden
 public class DDJavaSpecification {
 
@@ -27,13 +26,6 @@ public class DDJavaSpecification {
 
   @BeforeAll
   static void beforeAll() {
-    assertTrue(
-        EnvironmentVariables.getAll().entrySet().stream()
-            .noneMatch(e -> e.getKey().startsWith("DD_")));
-    assertTrue(
-        systemPropertiesExceptAllowed().entrySet().stream()
-            .noneMatch(e -> e.getKey().toString().startsWith("dd.")));
-
     if (getDDThreads().isEmpty()) {
       ignoreThreadCleanup = false;
     } else {
@@ -45,25 +37,9 @@ static void beforeAll() {
 
   @AfterAll
   static void afterAll() {
-    assertTrue(
-        EnvironmentVariables.getAll().entrySet().stream()
-            .noneMatch(e -> e.getKey().startsWith("DD_")));
-    assertTrue(
-        systemPropertiesExceptAllowed().entrySet().stream()
-            .noneMatch(e -> e.getKey().toString().startsWith("dd.")));
-
     checkThreads();
   }
 
-  private static Map<Object, Object> systemPropertiesExceptAllowed() {
-    List<String> allowlist =
-        Arrays.asList(
-            "dd.appsec.enabled", "dd.iast.enabled", "dd.integration.grizzly-filterchain.enabled");
-    return System.getProperties().entrySet().stream()
-        .filter(e -> !allowlist.contains(String.valueOf(e.getKey())))
-        .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
-  }
-
   @AfterEach
   void cleanup() {
     if (assertThreadsEachCleanup) {