chef 18.7.10 → 18.8.46

data/spec/unit/secret_fetcher/azure_key_vault_spec.rb

@@ -1,149 +0,0 @@
-
-#
-# Author:: Marc Paradise <marc@chef.io>
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require_relative "../../spec_helper"
-require "chef/secret_fetcher"
-require "chef/secret_fetcher/azure_key_vault"
-require "net/http/responses"
-
-describe Chef::SecretFetcher::AzureKeyVault do
-  let(:config) { { vault: "my-vault" } }
-  let(:fetcher) { Chef::SecretFetcher::AzureKeyVault.new(config, nil) }
-  let(:secrets_response_body) { '{ "value" : "my secret value" }' }
-  let(:secrets_response_mock) do
-    rm = Net::HTTPSuccess.new("1.0", "400", "OK")
-    allow(rm).to receive(:body).and_return(secrets_response_body)
-    rm
-  end
-  let(:token_response_body) { %Q({"access_token":"#{access_token}","client_id":"#{client_id}","expires_in":"86294","expires_on":"1627761860","ext_expires_in":"86399","not_before":"1627675160","resource":"https://vault.azure.net","token_type":"Bearer"}) }
-  let(:access_token) { "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Im5PbzNaRHJPRFhFSzFqS1doWHNsSFJfS1hFZyIsImtpZCI6Im5PbzNaRHJPRFhFSzFqS1doWHNsSFJfS1hFZyJ9.eyJhdWQiOiJodHRwczovL3ZhdWx0LmF6dXJlLm5ldCIsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0L2E5ZTY2ZDhkLTA1ZTAtNGMwMC1iOWRkLWM0Yjc3M2U5MWNhNi8iLCJpYXQiOjE2Mjc2NzUxNjAsIm5iZiI6MTYyNzY3NTE2MCwiZXhwIjoxNjI3NzYxODYwLCJhaW8iOiJFMlpnWUhCWGplaTdWS214eEh6bjdoSWpNZFlMQUE9PSIsImFwcGlkIjoiNjU2Mjc1MjEtMzYzYi00ZDk2LTkyMTctMjcIsIm9pZCI6IjNiZjI1NjVhLWY4NWQtNDBiNy1hZWJkLTNlZDA1ZDA0N2FmNiIsInJoIjoiMC5BUk1BalczbXFlQUZBRXk1M2NTM2Mta2NwaUYxWW1VN05wWk5raGNuRGpuZEwxb1RBQUEuIiwic3ViIjoiM2JmMjU2NWEtZjg1ZC00MGI3LWFlYmQtM2VkMDVkMDQ3YWY2IiwidGlkIjoiYTllNjZkOGQtMDVlMC00YzAwLWI5ZGQtYzRiNzczZTkxY2E2IiwidXRpIjoibXlzeHpSRTV3ay1ibTFlYkNqc09BQSIsInZlciI6IjEuMCIsInhtc19taXJpZCI6Ii9zdWJzY3JpcHRpb25zLzYzNDJkZDZkLTc1NTQtNDJjOS04NTM2LTdkZmU3MmY1MWZhZC9yZXNvdXJjZWdyb3Vwcy9pbWFnZS1waXBlbGluZS1ydW5uZXItcWEtZWFzdHVzMi1yZy9wcm92aWRlcnMvTWljcm9zb2Z0Lk1hbmFnZWRJZGVudGl0eS91c2VyQXNzaWduZWRJZGVudGl0aWVzL2ltYWdlLXBpcGVsaW5lLXJ1bm5lci1xYS1lYXN0dXMyLW1pIn0.BquzjN6d0g4zlvkbkdVwNEfRxIXSmxYwCHMk6UG3iza2fVioiOrcoP4Cp9P5--AB4G_CAhIXaP7YIZs3mq05QiDjSvkVAM0t67UPGhEr66sNXkV72iZBnKca_auh6EHsjPfxeVHkE1wdrsncrYdKhzgO4IAj8Jg4N5qjcE2q-OkliadmEuTwrhPhq" }
-  let(:token_response_mock) do
-    rm = Net::HTTPSuccess.new("1.0", "400", "OK")
-    allow(rm).to receive(:body).and_return(token_response_body)
-    rm
-  end
-  let(:client_id) { SecureRandom.uuid }
-  let(:http_mock) { instance_double("Net::HTTP", :use_ssl= => nil) }
-  let(:token_uri) { URI.parse("http://169.254.169.254/metadata/identity/oauth2/token") }
-  let(:vault_name) { "my-vault" }
-  let(:secret_name) { "my-secret" }
-  let(:vault_secret_uri) { URI.parse("https://#{vault_name}.vault.azure.net/secrets/#{secret_name}/?api-version=7.2") }
-
-  before do
-    # Cache these up front so we can pass into allow statements without hitting:
-    #   URI received :parse with unexpected arguments
-    token_uri
-    vault_secret_uri
-  end
-
-  before do
-    allow(Net::HTTP).to receive(:new).and_return(http_mock)
-    allow(URI).to receive(:parse).with("http://169.254.169.254/metadata/identity/oauth2/token").and_return(token_uri)
-    allow(URI).to receive(:parse).with("https://#{vault_name}.vault.azure.net/secrets/#{secret_name}/?api-version=7.2").and_return(vault_secret_uri)
-    allow(http_mock).to receive(:get).with(token_uri, { "Metadata" => "true" }).and_return(token_response_mock)
-    allow(http_mock).to receive(:get).with(vault_secret_uri, { "Authorization" => "Bearer #{access_token}", "Content-Type" => "application/json" }).and_return(secrets_response_mock)
-  end
-
-  describe "#validate!" do
-    it "raises error when more than one is provided: :object_id, :client_id, :mi_res_id" do
-      expect { Chef::SecretFetcher::AzureKeyVault.new({ object_id: "abc", client_id: "abc", mi_res_id: "abc" }, nil).validate! }.to raise_error(Chef::Exceptions::Secret::ConfigurationInvalid)
-      expect { Chef::SecretFetcher::AzureKeyVault.new({ object_id: "abc", client_id: "abc" }, nil).validate! }.to raise_error(Chef::Exceptions::Secret::ConfigurationInvalid)
-      expect { Chef::SecretFetcher::AzureKeyVault.new({ object_id: "abc", mi_res_id: "abc" }, nil).validate! }.to raise_error(Chef::Exceptions::Secret::ConfigurationInvalid)
-      expect { Chef::SecretFetcher::AzureKeyVault.new({ client_id: "abc", mi_res_id: "abc" }, nil).validate! }.to raise_error(Chef::Exceptions::Secret::ConfigurationInvalid)
-    end
-  end
-
-  describe "#fetch_token" do
-    context "when Net::HTTPBadRequest is returned and the error description contains \"Identity not found\"" do
-      let(:token_response_mock) { Net::HTTPBadRequest.new("1.0", "400", "Bad Request") }
-
-      before do
-        allow(fetcher).to receive(:fetch_token).and_call_original
-        allow(token_response_mock).to receive(:body).and_return('{"error":"invalid_request","error_description":"Identity not found"}')
-      end
-
-      it "raises Chef::Exceptions::Secret::Azure::IdentityNotFound" do
-        expect { fetcher.send(:fetch_token) }.to raise_error(Chef::Exceptions::Secret::Azure::IdentityNotFound)
-      end
-    end
-
-    context "when :object_id is provided" do
-      let(:object_id) { SecureRandom.uuid }
-      let(:config) { { vault: "my-vault", object_id: object_id } }
-
-      it "adds client_id to request params" do
-        fetcher.send(:fetch_token)
-        expect(token_uri.query).to match(/object_id=#{object_id}/)
-      end
-    end
-
-    context "when :client_id is provided" do
-      let(:config) { { vault: "my-vault", client_id: client_id } }
-
-      it "adds client_id to request params" do
-        fetcher.send(:fetch_token)
-        expect(token_uri.query).to match(/client_id=#{client_id}/)
-      end
-    end
-
-    context "when :mi_res_id is provided" do
-      let(:mi_res_id) { SecureRandom.uuid }
-      let(:config) { { vault: "my-vault", mi_res_id: mi_res_id } }
-
-      it "adds client_id to request params" do
-        fetcher.send(:fetch_token)
-        expect(token_uri.query).to match(/mi_res_id=#{mi_res_id}/)
-      end
-    end
-  end
-
-  describe "#fetch" do
-    context "when vault name is only provided in the secret name" do
-      let(:secrets_response_body) { '{ "value" : "my secret value" }' }
-      let(:config) { {} }
-      it "fetches the value" do
-        expect(fetcher.fetch("my-vault/my-secret")).to eq "my secret value"
-      end
-    end
-
-    context "when vault name is not provided in the secret name" do
-      context "and vault name is not provided in config" do
-        let(:config) { {} }
-        it "raises a ConfigurationInvalid exception" do
-          expect { fetcher.fetch("my-secret") }.to raise_error(Chef::Exceptions::Secret::ConfigurationInvalid)
-        end
-      end
-
-      context "and vault name is provided in config" do
-        let(:config) { { vault: "my-vault" } }
-        it "fetches the value" do
-          expect(fetcher.fetch("my-secret")).to eq "my secret value"
-        end
-      end
-    end
-
-    context "when an error response is received in the response body" do
-      let(:config) { { vault: "my-vault" } }
-      let(:secrets_response_body) { '{ "error" : { "code" : 404, "message" : "secret not found" } }' }
-      it "raises FetchFailed" do
-        expect { fetcher.fetch("my-secret") }.to raise_error(Chef::Exceptions::Secret::FetchFailed)
-      end
-    end
-  end
-end

data/spec/unit/secret_fetcher/hashi_vault_spec.rb

@@ -1,126 +0,0 @@
-#
-# Author:: Marc Paradise <marc@chef.io>
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require_relative "../../spec_helper"
-require "chef/secret_fetcher/hashi_vault"
-
-describe Chef::SecretFetcher::HashiVault do
-  let(:node) { {} }
-  let(:run_context) { double("run_context", node: node) }
-
-  context "when validating provided HashiVault configuration" do
-    it "raises ConfigurationInvalid when the :auth_method is not valid" do
-      fetcher = Chef::SecretFetcher::HashiVault.new( { auth_method: :invalid, vault_addr: "https://vault.example.com:8200" }, run_context)
-      expect { fetcher.validate! }.to raise_error(Chef::Exceptions::Secret::ConfigurationInvalid, /:auth_method/)
-    end
-
-    it "raises ConfigurationInvalid when the vault_addr is not provided" do
-      fetcher = Chef::SecretFetcher::HashiVault.new( { auth_method: :iam_role, role_name: "example-role" }, run_context)
-      expect { fetcher.validate! }.to raise_error(Chef::Exceptions::Secret::ConfigurationInvalid)
-    end
-
-    context "and using auth_method: :iam_role" do
-      it "raises ConfigurationInvalid when the role_name is not provided" do
-        fetcher = Chef::SecretFetcher::HashiVault.new( { auth_method: :iam_role, vault_addr: "https://vault.example.com:8200" }, run_context)
-        expect { fetcher.validate! }.to raise_error(Chef::Exceptions::Secret::ConfigurationInvalid)
-      end
-
-      it "obtains a token via AWS IAM auth to allow the gem to do its own validations when all required config is provided" do
-        fetcher = Chef::SecretFetcher::HashiVault.new( { auth_method: :iam_role, vault_addr: "https://vault.example.com:8200", role_name: "example-role" }, run_context)
-        allow(Aws::InstanceProfileCredentials).to receive(:new).and_return instance_double(Aws::InstanceProfileCredentials)
-        auth_double = instance_double(Vault::Authenticate)
-        expect(auth_double).to receive(:aws_iam)
-        allow(Vault).to receive(:auth).and_return(auth_double)
-        fetcher.validate!
-      end
-    end
-
-    context "and using auth_method: :token" do
-      it "raises ConfigurationInvalid when no token is provided" do
-        fetcher = Chef::SecretFetcher::HashiVault.new( { auth_method: :token, vault_addr: "https://vault.example.com:8200" }, run_context)
-        expect { fetcher.validate! }.to raise_error(Chef::Exceptions::Secret::ConfigurationInvalid)
-      end
-
-      it "authenticates using the token during validation when all configuration is correct" do
-        fetcher = Chef::SecretFetcher::HashiVault.new( { auth_method: :token, token: "t.1234abcd", vault_addr: "https://vault.example.com:8200" }, run_context)
-        auth = instance_double(Vault::Authenticate)
-        auth_double = instance_double(Vault::Authenticate)
-        expect(auth_double).to receive(:token)
-        allow(Vault).to receive(:auth).and_return(auth_double)
-        fetcher.validate!
-      end
-    end
-
-    context "and using auth_method: :approle" do
-      it "raises ConfigurationInvalid message when :approle_name or :approle_id are not specified" do
-        fetcher = Chef::SecretFetcher::HashiVault.new( { auth_method: :approle, vault_addr: "https://vault.example.com:8200" }, run_context)
-        expect { fetcher.validate! }.to raise_error(Chef::Exceptions::Secret::ConfigurationInvalid)
-      end
-
-      it "authenticates using the approle_id and approle_secret_id during validation when all configuration is correct" do
-        fetcher = Chef::SecretFetcher::HashiVault.new({
-          auth_method: :approle,
-          approle_id: "idguid",
-          approle_secret_id: "secretguid",
-          vault_addr: "https://vault.example.com:8200" },
-          run_context)
-        auth = instance_double(Vault::Authenticate)
-        allow(auth).to receive(:approle)
-        allow(Vault).to receive(:auth).and_return(auth)
-        expect(auth).to receive(:approle).with("idguid", "secretguid")
-        fetcher.validate!
-      end
-
-      it "looks up the :role_id and :secret_id when all configuration is correct" do
-        fetcher = Chef::SecretFetcher::HashiVault.new({
-          auth_method: :approle,
-          approle_name: "myapprole",
-          token: "t.1234abcd",
-          vault_addr: "https://vault.example.com:8200" },
-          run_context)
-        approle = instance_double(Vault::AppRole)
-        auth = instance_double(Vault::Authenticate)
-        allow(Vault).to receive(:approle).and_return(approle)
-        allow(approle).to receive(:role_id).with("myapprole").and_return("idguid")
-        allow(approle).to receive(:create_secret_id).with("myapprole").and_return(Vault::Secret.new({
-          data: {
-            secret_id: "secretguid",
-            secret_id_accessor: "accessor_guid",
-            secret_id_ttl: 0,
-          },
-          lease_duration: 0,
-          lease_id: "",
-        }))
-        allow(Vault).to receive(:auth).and_return(auth)
-        expect(auth).to receive(:approle).with("idguid", "secretguid")
-        fetcher.validate!
-      end
-    end
-  end
-
-  context "when fetching a secret from Hashi Vault" do
-    it "raises an FetchFailed message when no secret is returned due to invalid engine path" do
-      fetcher = Chef::SecretFetcher::HashiVault.new( { auth_method: :invalid, vault_addr: "https://vault.example.com:8200" }, run_context)
-      logical_double = instance_double(Vault::Logical)
-      expect(logical_double).to receive(:read).and_return nil
-      expect(Vault).to receive(:logical).and_return(logical_double)
-      expect { fetcher.do_fetch("anything", nil) }.to raise_error(Chef::Exceptions::Secret::FetchFailed)
-    end
-  end
-end
-

data/spec/unit/secret_fetcher_spec.rb

@@ -1,82 +0,0 @@
-#
-# Author:: Marc Paradise <marc@chef.io>
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require "chef/secret_fetcher"
-require "chef/secret_fetcher/example"
-
-class SecretFetcherImpl < Chef::SecretFetcher::Base
-  def do_fetch(name, version)
-    name
-  end
-
-  def validate!; end
-end
-
-describe Chef::SecretFetcher do
-  let(:fetcher_impl) { SecretFetcherImpl.new({}, nil) }
-
-  before do
-    allow(Chef::SecretFetcher::Example).to receive(:new).and_return fetcher_impl
-  end
-
-  context ".for_service" do
-    it "resolves the example fetcher without error" do
-      Chef::SecretFetcher.for_service(:example, {}, nil)
-    end
-
-    it "resolves the Azure Key Vault fetcher without error" do
-      Chef::SecretFetcher.for_service(:azure_key_vault, { vault: "invalid" }, nil)
-    end
-
-    it "resolves the AWS fetcher without error" do
-      Chef::SecretFetcher.for_service(:aws_secrets_manager, { region: "invalid" }, nil)
-    end
-
-    it "raises Chef::Exceptions::Secret::MissingFetcher when service is blank" do
-      expect { Chef::SecretFetcher.for_service(nil, {}, nil) }.to raise_error(Chef::Exceptions::Secret::MissingFetcher)
-    end
-
-    it "raises Chef::Exceptions::Secret::MissingFetcher when service is nil" do
-      expect { Chef::SecretFetcher.for_service("", {}, nil) }.to raise_error(Chef::Exceptions::Secret::MissingFetcher)
-    end
-
-    it "raises Chef::Exceptions::Secret::InvalidFetcher for an unknown fetcher" do
-      expect { Chef::SecretFetcher.for_service(:bad_example, {}, nil) }.to raise_error(Chef::Exceptions::Secret::InvalidFetcherService)
-    end
-
-    it "ensures fetcher configuration is valid by invoking validate!" do
-      expect(fetcher_impl).to receive(:validate!)
-      Chef::SecretFetcher.for_service(:example, {}, nil)
-    end
-  end
-
-  context "#fetch" do
-    let(:fetcher) {
-      Chef::SecretFetcher.for_service(:example, { "key1" => "value1" }, nil)
-    }
-
-    it "fetches from the underlying service when secret name is provided " do
-      expect(fetcher_impl).to receive(:fetch).with("key1", "v1")
-      fetcher.fetch("key1", "v1")
-    end
-
-    it "raises an error when the secret name is not provided" do
-      expect { fetcher.fetch(nil) }.to raise_error(Chef::Exceptions::Secret::MissingSecretName)
-    end
-  end
-end

data/spec/unit/server_api_spec.rb

@@ -1,151 +0,0 @@
-require "spec_helper"
-
-SIGNING_KEY_DOT_PEM = "-----BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEA49TA0y81ps0zxkOpmf5V4/c4IeR5yVyQFpX3JpxO4TquwnRh
-8VSUhrw8kkTLmB3cS39Db+3HadvhoqCEbqPE6915kXSuk/cWIcNozujLK7tkuPEy
-YVsyTioQAddSdfe+8EhQVf3oHxaKmUd6waXrWqYCnhxgOjxocenREYNhZ/OETIei
-PbOku47vB4nJK/0GhKBytL2XnsRgfKgDxf42BqAi1jglIdeq8lAWZNF9TbNBU21A
-O1iuT7Pm6LyQujhggPznR5FJhXKRUARXBJZawxpGV4dGtdcahwXNE4601aXPra+x
-PcRd2puCNoEDBzgVuTSsLYeKBDMSfs173W1QYwIDAQABAoIBAGF05q7vqOGbMaSD
-2Q7YbuE/JTHKTBZIlBI1QC2x+0P5GDxyEFttNMOVzcs7xmNhkpRw8eX1LrInrpMk
-WsIBKAFFEfWYlf0RWtRChJjNl+szE9jQxB5FJnWtJH/FHa78tR6PsF24aQyzVcJP
-g0FGujBihwgfV0JSCNOBkz8MliQihjQA2i8PGGmo4R4RVzGfxYKTIq9vvRq/+QEa
-Q4lpVLoBqnENpnY/9PTl6JMMjW2b0spbLjOPVwDaIzXJ0dChjNXo15K5SHI5mALJ
-I5gN7ODGb8PKUf4619ez194FXq+eob5YJdilTFKensIUvt3YhP1ilGMM+Chi5Vi/
-/RCTw3ECgYEA9jTw4wv9pCswZ9wbzTaBj9yZS3YXspGg26y6Ohq3ZmvHz4jlT6uR
-xK+DDcUiK4072gci8S4Np0fIVS7q6ivqcOdzXPrTF5/j+MufS32UrBbUTPiM1yoO
-ECcy+1szl/KoLEV09bghPbvC58PFSXV71evkaTETYnA/F6RK12lEepcCgYEA7OSy
-bsMrGDVU/MKJtwqyGP9ubA53BorM4Pp9VVVSCrGGVhb9G/XNsjO5wJC8J30QAo4A
-s59ZzCpyNRy046AB8jwRQuSwEQbejSdeNgQGXhZ7aIVUtuDeFFdaIz/zjVgxsfj4
-DPOuzieMmJ2MLR4F71ocboxNoDI7xruPSE8dDhUCgYA3vx732cQxgtHwAkeNPJUz
-dLiE/JU7CnxIoSB9fYUfPLI+THnXgzp7NV5QJN2qzMzLfigsQcg3oyo6F2h7Yzwv
-GkjlualIRRzCPaCw4Btkp7qkPvbs1QngIHALt8fD1N69P3DPHkTwjG4COjKWgnJq
-qoHKS6Fe/ZlbigikI6KsuwKBgQCTlSLoyGRHr6oj0hqz01EDK9ciMJzMkZp0Kvn8
-OKxlBxYW+jlzut4MQBdgNYtS2qInxUoAnaz2+hauqhSzntK3k955GznpUatCqx0R
-b857vWviwPX2/P6+E3GPdl8IVsKXCvGWOBZWTuNTjQtwbDzsUepWoMgXnlQJSn5I
-YSlLxQKBgQD16Gw9kajpKlzsPa6XoQeGmZALT6aKWJQlrKtUQIrsIWM0Z6eFtX12
-2jjHZ0awuCQ4ldqwl8IfRogWMBkHOXjTPVK0YKWWlxMpD/5+bGPARa5fir8O1Zpo
-Y6S6MeZ69Rp89ma4ttMZ+kwi1+XyHqC/dlcVRW42Zl5Dc7BALRlJjQ==
------END RSA PRIVATE KEY-----".freeze
-
-describe Chef::ServerAPI do
-  let(:url) { "http://chef.example.com:4000" }
-  let(:key_path) { "/tmp/foo" }
-
-  let(:client) do
-    Chef::ServerAPI.new(url)
-  end
-
-  before do
-    Chef::Config[:node_name] = "silent-bob"
-    Chef::Config[:client_key] = CHEF_SPEC_DATA + "/ssl/private_key.pem"
-    Chef::Config[:http_retry_delay] = 0
-  end
-
-  describe "#initialize" do
-    it "uses the configured key file" do
-      allow(IO).to receive(:read).with(key_path).and_return(SIGNING_KEY_DOT_PEM)
-      Chef::Config[:client_key] = key_path
-
-      api = described_class.new(url)
-      expect(api.options[:signing_key_filename]).to eql(key_path)
-    end
-
-    it "allows a user to set a raw_key" do
-      api = described_class.new(url, raw_key: SIGNING_KEY_DOT_PEM)
-      expect(api.options[:signing_key_filename]).to be_nil
-      expect(api.options[:raw_key]).to eql(SIGNING_KEY_DOT_PEM)
-    end
-  end
-
-  context "versioned apis" do
-    let(:version_class) do
-      Class.new do
-        extend Chef::Mixin::VersionedAPIFactory
-
-        version_class_v0 = Class.new do
-          extend Chef::Mixin::VersionedAPI
-          minimum_api_version 0
-        end
-        add_versioned_api_class version_class_v0
-
-        version_class_v2 = Class.new do
-          extend Chef::Mixin::VersionedAPI
-          minimum_api_version 2
-        end
-        add_versioned_api_class version_class_v2
-      end
-    end
-
-    before do
-      Chef::ServerAPIVersions.instance.reset!
-    end
-
-    let(:versioned_client) do
-      Chef::ServerAPI.new(url, version_class: version_class)
-    end
-
-    it "on protocol negotiation it posts the same message body without doubly-encoding the json string" do
-      WebMock.disable_net_connect!
-      post_body = { bar: "baz" }
-      body_406 = '{"error":"invalid-x-ops-server-api-version","message":"Specified version 2 not supported","min_version":0,"max_version":1}'
-      stub_request(:post, "http://chef.example.com:4000/foo").with(body: post_body.to_json, headers: { "X-Ops-Server-Api-Version" => "2" }).to_return(status: [406, "Not Acceptable"], body: body_406 )
-      stub_request(:post, "http://chef.example.com:4000/foo").with(body: post_body.to_json, headers: { "X-Ops-Server-Api-Version" => "0" }).to_return(status: 200, body: "", headers: {})
-      versioned_client.post("foo", post_body)
-    end
-  end
-
-  context "retrying normal requests" do
-    it "500 on a post retries and posts correctly " do
-      WebMock.disable_net_connect!
-      post_body = { bar: "baz" }
-      headers = { "Accept" => "application/json", "Content-Type" => "application/json", "Accept-Encoding" => "gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "Content-Length" => "13", "Host" => "chef.example.com:4000", "X-Chef-Version" => Chef::VERSION, "X-Ops-Sign" => "algorithm=sha1;version=1.1;", "X-Ops-Userid" => "silent-bob" }
-      stub_request(:post, "http://chef.example.com:4000/foo").with(body: post_body.to_json, headers: headers).to_return(status: [500, "Internal Server Error"])
-      stub_request(:post, "http://chef.example.com:4000/foo").with(body: post_body.to_json, headers: headers).to_return(status: 200, body: "", headers: {})
-      client.post("foo", post_body)
-    end
-
-    it "500 on a put retries and puts correctly " do
-      WebMock.disable_net_connect!
-      put_body = { bar: "baz" }
-      headers = { "Accept" => "application/json", "Content-Type" => "application/json", "Accept-Encoding" => "gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "Content-Length" => "13", "Host" => "chef.example.com:4000", "X-Chef-Version" => Chef::VERSION, "X-Ops-Sign" => "algorithm=sha1;version=1.1;", "X-Ops-Userid" => "silent-bob" }
-      stub_request(:put, "http://chef.example.com:4000/foo").with(body: put_body.to_json, headers: headers).to_return(status: [500, "Internal Server Error"])
-      stub_request(:put, "http://chef.example.com:4000/foo").with(body: put_body.to_json, headers: headers).to_return(status: 200, body: "", headers: {})
-      client.put("foo", put_body)
-    end
-
-    it "500 on a get retries and gets correctly " do
-      WebMock.disable_net_connect!
-      headers = { "Accept" => "application/json", "Accept-Encoding" => "gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "Host" => "chef.example.com:4000", "X-Chef-Version" => Chef::VERSION, "X-Ops-Sign" => "algorithm=sha1;version=1.1;", "X-Ops-Userid" => "silent-bob" }
-      stub_request(:get, "http://chef.example.com:4000/foo").with(headers: headers).to_return(status: [500, "Internal Server Error"])
-      stub_request(:get, "http://chef.example.com:4000/foo").with(headers: headers).to_return(status: 200, body: "", headers: {})
-      client.get("foo")
-    end
-
-    it "406 on a post does protocol negotiation" do
-      WebMock.disable_net_connect!
-      post_body = { bar: "baz" }
-      body_406 = '{"error":"invalid-x-ops-server-api-version","message":"Specified version 2 not supported","min_version":0,"max_version":1}'
-      stub_request(:post, "http://chef.example.com:4000/foo").with(body: post_body.to_json, headers: { "X-Ops-Server-Api-Version" => "2" }).to_return(status: [406, "Not Acceptable"], body: body_406 )
-      stub_request(:post, "http://chef.example.com:4000/foo").with(body: post_body.to_json, headers: { "X-Ops-Server-Api-Version" => "0" }).to_return(status: 200, body: "", headers: {})
-      client.post("foo", post_body)
-    end
-
-    it "406 on a put does protocol negotiation" do
-      WebMock.disable_net_connect!
-      put_body = { bar: "baz" }
-      body_406 = '{"error":"invalid-x-ops-server-api-version","message":"Specified version 2 not supported","min_version":0,"max_version":1}'
-      stub_request(:put, "http://chef.example.com:4000/foo").with(body: put_body.to_json, headers: { "X-Ops-Server-Api-Version" => "2" }).to_return(status: [406, "Not Acceptable"], body: body_406 )
-      stub_request(:put, "http://chef.example.com:4000/foo").with(body: put_body.to_json, headers: { "X-Ops-Server-Api-Version" => "0" }).to_return(status: 200, body: "", headers: {})
-      client.put("foo", put_body)
-    end
-
-    it "406 on a get does protocol negotiation" do
-      WebMock.disable_net_connect!
-      body_406 = '{"error":"invalid-x-ops-server-api-version","message":"Specified version 2 not supported","min_version":0,"max_version":1}'
-      stub_request(:get, "http://chef.example.com:4000/foo").with(headers: { "X-Ops-Server-Api-Version" => "2" }).to_return(status: [406, "Not Acceptable"], body: body_406 )
-      stub_request(:get, "http://chef.example.com:4000/foo").with(headers: { "X-Ops-Server-Api-Version" => "0" }).to_return(status: 200, body: "", headers: {})
-      client.get("foo")
-    end
-  end
-end

data/spec/unit/server_api_versions_spec.rb

@@ -1,66 +0,0 @@
-#
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require "spec_helper"
-
-describe Chef::ServerAPIVersions do
-  before do
-    Chef::ServerAPIVersions.instance.reset!
-  end
-
-  describe "#reset!" do
-    it "resets the version information" do
-      Chef::ServerAPIVersions.instance.set_versions({ "min_version" => 0, "max_version" => 2 })
-      Chef::ServerAPIVersions.instance.reset!
-      expect(Chef::ServerAPIVersions.instance.min_server_version).to be_nil
-    end
-
-    it "resets the unversioned flag" do
-      Chef::ServerAPIVersions.instance.unversioned!
-      Chef::ServerAPIVersions.instance.reset!
-      expect(Chef::ServerAPIVersions.instance.unversioned?).to be false
-    end
-  end
-
-  describe "#min_server_version" do
-    it "returns nil if no versions have been recorded" do
-      expect(Chef::ServerAPIVersions.instance.min_server_version).to be_nil
-    end
-    it "returns 0 if unversioned" do
-      Chef::ServerAPIVersions.instance.unversioned!
-      expect(Chef::ServerAPIVersions.instance.min_server_version).to eq(0)
-    end
-    it "returns the correct value" do
-      Chef::ServerAPIVersions.instance.set_versions({ "min_version" => 0, "max_version" => 2 })
-      expect(Chef::ServerAPIVersions.instance.min_server_version).to eq(0)
-    end
-  end
-
-  describe "#max_server_version" do
-    it "returns nil if no versions have been recorded" do
-      expect(Chef::ServerAPIVersions.instance.max_server_version).to be_nil
-    end
-    it "returns 0 if unversioned" do
-      Chef::ServerAPIVersions.instance.unversioned!
-      expect(Chef::ServerAPIVersions.instance.min_server_version).to eq(0)
-    end
-    it "returns the correct value" do
-      Chef::ServerAPIVersions.instance.set_versions({ "min_version" => 0, "max_version" => 2 })
-      expect(Chef::ServerAPIVersions.instance.max_server_version).to eq(2)
-    end
-  end
-end

data/spec/unit/shell/model_wrapper_spec.rb

@@ -1,96 +0,0 @@
-#
-# Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require "spec_helper"
-require "ostruct"
-
-describe Shell::ModelWrapper do
-  before do
-    @model = OpenStruct.new(name: "Chef::Node")
-    @wrapper = Shell::ModelWrapper.new(@model)
-  end
-
-  describe "when created with an explicit model_symbol" do
-    before do
-      @model = OpenStruct.new(name: "Chef::ApiClient")
-      @wrapper = Shell::ModelWrapper.new(@model, :client)
-    end
-
-    it "uses the explicit model symbol" do
-      expect(@wrapper.model_symbol).to eq(:client)
-    end
-  end
-
-  it "determines the model symbol from the class name" do
-    expect(@wrapper.model_symbol).to eq(:node)
-  end
-
-  describe "when listing objects" do
-    before do
-      @node_1 = Chef::Node.new
-      @node_1.name("sammich")
-      @node_2 = Chef::Node.new
-      @node_2.name("yummy")
-      @server_response = { node_1: @node_1, node_2: @node_2 }
-      @wrapper = Shell::ModelWrapper.new(Chef::Node)
-      allow(Chef::Node).to receive(:list).and_return(@server_response)
-    end
-
-    it "lists fully inflated objects without the resource IDs" do
-      expect(@wrapper.all.size).to eq(2)
-      expect(@wrapper.all).to include(@node_1, @node_2)
-    end
-
-    it "maps the listed nodes when given a block" do
-      expect(@wrapper.all(&:name).sort.reverse).to eq(%w{yummy sammich})
-    end
-  end
-
-  describe "when searching for objects" do
-    before do
-      @node_1 = Chef::Node.new
-      @node_1.name("sammich")
-      @node_2 = Chef::Node.new
-      @node_2.name("yummy")
-      @server_response = { node_1: @node_1, node_2: @node_2 }
-      @wrapper = Shell::ModelWrapper.new(Chef::Node)
-
-      # Creating a Chef::Search::Query object tries to read the private key...
-      @searcher = double("Chef::Search::Query #{__FILE__}:#{__LINE__}")
-      allow(Chef::Search::Query).to receive(:new).and_return(@searcher)
-    end
-
-    it "falls back to listing the objects when the 'query' is :all" do
-      allow(Chef::Node).to receive(:list).and_return(@server_response)
-      expect(@wrapper.find(:all)).to include(@node_1, @node_2)
-    end
-
-    it "searches for objects using the given query string" do
-      expect(@searcher).to receive(:search).with(:node, "name:app*").and_yield(@node_1).and_yield(@node_2)
-      expect(@wrapper.find("name:app*")).to include(@node_1, @node_2)
-    end
-
-    it "creates a 'AND'-joined query string from a HASH" do
-      # Hash order woes
-      expect(@searcher).to receive(:search).with(:node, "name:app* AND name:app*").and_yield(@node_1).and_yield(@node_2)
-      expect(@wrapper.find(:name => "app*", "name" => "app*")).to include(@node_1, @node_2)
-    end
-
-  end
-
-end