cheffish 1.1.2 → 1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0667c4e296b1e3be43fefe384509dbc22e10202b
-  data.tar.gz: 35be2921f6449bc5f84ff3b3a16e11e3b228e465
+  metadata.gz: 6069dfb9d003c9835d32584227f0db27ead80ffe
+  data.tar.gz: 76efdfb5364249fcb021c569c2ef5c6b07d4c1a6
 SHA512:
-  metadata.gz: 3c4f73cd2e4b8619091566b49638bc5db5e8b8e5d4bb85bf6b0230d9ec9dab7d4f5ea9b24284a01c97a46eb0b48fea91c95bd9dee4e86816b08989ad1c7fe135
-  data.tar.gz: 8b149e416f184c91e452448fde3f0ebd195d8a4c3ae7c11328238915e1c11f41d197a6a59b57b6c3673607aa18d9894442a5ede6c8743bfc7de4c92ead990133
+  metadata.gz: efffb6621cd8b3d4993a587bc099949b2bb7e8f19aaf66fb37d18a60c96149bf68d9ba829e7ec4a831ad917497c112403ee4797c1d4db50a8d740ca1ccdafc4b
+  data.tar.gz: 1b0e4bbf57b84a4f98eb223f8dd3993a733808a22ccb88bc553ad7e1d780265dc3563c8d71c5242bc9346e6af4bb4e7954bd645831fb102f071e7846f8f5fe3f

data/lib/cheffish/chef_run.rb

@@ -62,11 +62,24 @@ module Cheffish
     def logs
       @client ? client.chef_config[:log_location].string : nil
     end
+    def logged_warnings
+      logs.lines.select { |l| l =~ /^\[[^\]]*\] WARN:/ }.join("\n")
+    end
+    def logged_errors
+      logs.lines.select { |l| l =~ /^\[[^\]]*\] ERROR:/ }.join("\n")
+    end
+    def logged_info
+      logs.lines.select { |l| l =~ /^\[[^\]]*\] INFO:/ }.join("\n")
+    end
 
     def resources
       client.resource_collection
     end
 
+    def compile_recipe(&recipe)
+      client.load_block(&recipe)
+    end
+
     def converge
       begin
         client.converge

data/lib/cheffish/rspec.rb

@@ -0,0 +1,8 @@
+require 'cheffish/rspec/chef_run_support'
+require 'cheffish/rspec/repository_support'
+require 'cheffish/rspec/matchers'
+
+module Cheffish
+  module RSpec
+  end
+end

data/lib/cheffish/rspec/chef_run_support.rb

@@ -2,9 +2,9 @@ require 'chef_zero/rspec'
 require 'chef/server_api'
 require 'cheffish/rspec/repository_support'
 require 'uri'
-require 'cheffish/basic_chef_client'
-require 'cheffish/rspec/chef_run_wrapper'
+require 'cheffish/chef_run'
 require 'cheffish/rspec/recipe_run_wrapper'
+require 'cheffish/rspec/matchers'
 
 module Cheffish
   module RSpec
@@ -24,22 +24,10 @@ module Cheffish
         end
       end
 
-      def with_recipe(&block)
+      def with_converge(&recipe)
         before :each do
-          load_recipe(&block)
-        end
-
-        after :each do
-          if !chef_client.converge_failed? && !chef_client.converged?
-            raise "Never tried to converge!"
-          end
-        end
-      end
-
-      def with_converge(&block)
-        before :each do
-          load_recipe(&block) if block_given?
-          converge
+          r = recipe(&recipe)
+          r.converge
         end
       end
 
@@ -60,49 +48,28 @@ module Cheffish
         end
 
         def expect_recipe(&recipe)
-          expect(recipe(&recipe))
-        end
-
-        def recipe(&recipe)
-          RecipeRunWrapper.new(chef_config, &recipe)
-        end
-
-        def chef_client
-          @chef_client ||= ChefRunWrapper.new(chef_config)
-        end
-
-        def chef_run
-          converge if !chef_client.converged?
-          event_sink.events
-        end
-
-        def event_sink
-          chef_client.event_sink
+          r = recipe(&recipe)
+          r.converge
+          expect(r)
         end
 
-        def basic_chef_client
-          chef_client.client
+        def expect_converge(&recipe)
+          r = recipe(&recipe)
+          expect { r.converge }
         end
 
-        def load_recipe(&recipe)
-          chef_client.client.load_block(&recipe)
-        end
-
-        def run_recipe(&recipe)
-          load_recipe(&recipe)
-          converge
+        def recipe(&recipe)
+          RecipeRunWrapper.new(chef_config, &recipe)
         end
 
-        def reset_chef_client
-          @event_sink = nil
-          @basic_chef_client = nil
+        def converge(&recipe)
+          r = RecipeRunWrapper.new(chef_config, &recipe)
+          r.converge
+          r
         end
 
-        def converge
-          if chef_client.converged?
-            raise "Already converged! Cannot converge twice, that's bad mojo."
-          end
-          chef_client.converge
+        def chef_client
+          @chef_client ||= ChefRun.new(chef_config)
         end
       end
     end

data/lib/cheffish/rspec/matchers.rb

@@ -1,81 +1,4 @@
-RSpec::Matchers.define :have_updated do |resource_name, *expected_actions|
-  match do |actual|
-    actual_actions = actual.select { |event, resource, action| event == :resource_updated && resource.to_s == resource_name }.map { |event, resource, action| action }
-    expect(actual_actions).to eq(expected_actions)
-  end
-  failure_message do |actual|
-    updates = actual.select { |event, resource, action| event == :resource_updated }.to_a
-    result = "expected that the chef_run would #{expected_actions.join(',')} #{resource_name}."
-    if updates.size > 0
-      result << " Actual updates were #{updates.map { |event, resource, action| "#{resource.to_s} => #{action.inspect}" }.join(', ')}"
-    else
-      result << " Nothing was updated."
-    end
-    result
-  end
-  failure_message_when_negated do |actual|
-    updates = actual.select { |event, resource, action| event == :resource_updated }.to_a
-    result = "expected that the chef_run would not #{expected_actions.join(',')} #{resource_name}."
-    if updates.size > 0
-      result << " Actual updates were #{updates.map { |event, resource, action| "#{resource.to_s} => #{action.inspect}" }.join(', ')}"
-    else
-      result << " Nothing was updated."
-    end
-    result
-  end
-end
-
-RSpec::Matchers.define :be_idempotent do
-  match do |recipe|
-    @recipe = recipe
-    recipe.reset
-    recipe.converge
-    recipe.up_to_date?
-  end
-
-  failure_message {
-    "#{@recipe} is not idempotent!  Converging it a second time caused updates.\n#{@recipe.output_for_failure_message}"
-  }
-end
-
-
-RSpec::Matchers.define :update_acls do |acl_paths, expected_acls|
-
-  errors = []
-
-  match do |block|
-    orig_json = {}
-    Array(acl_paths).each do |acl_path|
-      orig_json[acl_path] = get(acl_path)
-    end
-
-    block.call
-
-    orig_json.each_pair do |acl_path, orig|
-      changed = get(acl_path)
-      expected_acls.each do |permission, hash|
-        hash.each do |type, actors|
-          actors.each do |actor|
-            if actor[0] == '-'
-              actor = actor[1..-1]
-              errors << "#{acl_path} expected to remove #{type} #{actor} from #{permission} permissions" if changed[permission][type].include?(actor)
-              orig[permission][type].delete(actor)
-            else
-              errors << "#{acl_path} expected to add #{type} #{actor} to #{permission} permissions" if !changed[permission][type].include?(actor)
-              changed[permission][type].delete(actor)
-            end
-          end
-        end
-      end
-      # After checking everything, see if the remaining acl is the same as before
-      errors << "#{acl_path} updated more than expected!\nActual:\n#{changed}\nExpected:\n#{orig}" if changed != orig
-    end
-    errors.size == 0
-  end
-
-  failure_message do |block|
-    errors.join("\n")
-  end
-
-  supports_block_expectations
-end
+require 'cheffish/rspec/matchers/have_updated'
+require 'cheffish/rspec/matchers/be_idempotent'
+require 'cheffish/rspec/matchers/partially_match'
+require 'cheffish/rspec/matchers/emit_no_warnings_or_errors'

data/lib/cheffish/rspec/matchers/be_idempotent.rb

@@ -0,0 +1,16 @@
+require 'rspec/matchers'
+
+RSpec::Matchers.define :be_idempotent do
+  match do |recipe|
+    @recipe = recipe
+    recipe.reset
+    recipe.converge
+    recipe.up_to_date?
+  end
+
+  failure_message {
+    "#{@recipe} is not idempotent!  Converging it a second time caused updates.\n#{@recipe.output_for_failure_message}"
+  }
+
+  supports_block_expectations
+end

data/lib/cheffish/rspec/matchers/emit_no_warnings_or_errors.rb

@@ -0,0 +1,15 @@
+require 'rspec/matchers'
+
+RSpec::Matchers.define :emit_no_warnings_or_errors do
+  match do |recipe|
+    @recipe = recipe
+    @warn_err = recipe.logs.lines.select { |l| l =~ /warn|err/i }.join("\n")
+    @warn_err.empty?
+  end
+
+  failure_message {
+    "#{@recipe} emitted warnings and errors!\n#{@warn_err}"
+  }
+
+  supports_block_expectations
+end

data/lib/cheffish/rspec/matchers/have_updated.rb

@@ -0,0 +1,37 @@
+require 'rspec/matchers'
+
+RSpec::Matchers.define :have_updated do |resource_name, *expected_actions|
+  match do |recipe|
+    @recipe = recipe
+    actual = @recipe.event_sink.events
+    actual_actions = actual.select { |event, resource, action| event == :resource_updated && resource.to_s == resource_name }.
+                               map { |event, resource, action| action }
+    expect(actual_actions).to eq(expected_actions)
+  end
+
+  failure_message do
+    actual = @recipe.event_sink.events
+    updates = actual.select { |event, resource, action| event == :resource_updated }.to_a
+    result = "expected that the chef_run would #{expected_actions.join(',')} #{resource_name}."
+    if updates.size > 0
+      result << " Actual updates were #{updates.map { |event, resource, action| "#{resource.to_s} => #{action.inspect}" }.join(', ')}"
+    else
+      result << " Nothing was updated."
+    end
+    result
+  end
+
+  failure_message_when_negated do
+    actual = @recipe.event_sink.events
+    updates = actual.select { |event, resource, action| event == :resource_updated }.to_a
+    result = "expected that the chef_run would not #{expected_actions.join(',')} #{resource_name}."
+    if updates.size > 0
+      result << " Actual updates were #{updates.map { |event, resource, action| "#{resource.to_s} => #{action.inspect}" }.join(', ')}"
+    else
+      result << " Nothing was updated."
+    end
+    result
+  end
+end
+
+RSpec::Matchers.define_negated_matcher :not_have_updated, :have_updated

data/lib/cheffish/rspec/matchers/partially_match.rb

@@ -0,0 +1,63 @@
+module Cheffish
+  module RSpec
+    module Matchers
+      class PartiallyMatch
+        include ::RSpec::Matchers::Composable
+
+        def initialize(example, expected)
+          @example = example
+          @expected = expected
+        end
+
+        def matches?(actual)
+          @actual = actual
+          partially_matches_values(@expected, actual)
+        end
+
+        def failure_message
+          "expected #{@actual} to match #{@expected}"
+        end
+
+        def failure_message_when_negated
+          "expected #{@actual} not to match #{@expected}"
+        end
+
+        protected
+
+        def partially_matches_values(expected, actual)
+          if Hash === actual
+            return partially_matches_hashes(expected, actual) if Hash === expected || Array === expected
+          elsif Array === expected && Enumerable === actual && !(Struct === actual)
+            return partially_matches_arrays(expected, actual)
+          end
+
+          return true if actual == expected
+
+          begin
+            expected === actual
+          rescue ArgumentError
+            # Some objects, like 0-arg lambdas on 1.9+, raise
+            # ArgumentError for `expected === actual`.
+            false
+          end
+        end
+
+        def partially_matches_hashes(expected, actual)
+          expected.all? { |key, value| partially_matches_values(value, actual[key]) }
+        end
+
+        def partially_matches_arrays(expected, actual)
+          expected.all? { |e| actual.any? { |a| partially_matches_values(e, a) } }
+        end
+      end
+    end
+  end
+end
+
+module RSpec
+  module Matchers
+    def partially_match(expected)
+      Cheffish::RSpec::Matchers::PartiallyMatch.new(self, expected)
+    end
+  end
+end

data/lib/cheffish/rspec/recipe_run_wrapper.rb

@@ -1,8 +1,8 @@
-require 'cheffish/rspec/chef_run_wrapper'
+require 'cheffish/chef_run'
 
 module Cheffish
   module RSpec
-    class RecipeRunWrapper < ChefRunWrapper
+    class RecipeRunWrapper < ChefRun
       def initialize(chef_config, &recipe)
         super(chef_config)
         @recipe = recipe

data/lib/cheffish/rspec/repository_support.rb

@@ -9,7 +9,7 @@ module Cheffish
         end
       end
 
-      RSpec.shared_context "with a chef repo" do
+      ::RSpec.shared_context "with a chef repo" do
         before :each do
           raise "Can only create one directory per test" if @repository_dir
           @repository_dir = Dir.mktmpdir('chef_repo')

data/lib/cheffish/version.rb

@@ -1,3 +1,3 @@
 module Cheffish
-  VERSION = '1.1.2'
+  VERSION = '1.2'
 end

data/spec/integration/chef_acl_spec.rb

@@ -9,34 +9,31 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
   describe Chef::Resource::ChefAcl do
     extend Cheffish::RSpec::ChefRunSupport
 
+    #        let(:chef_config) { super().merge(log_level: :debug, stdout: STDOUT, stderr: STDERR, log_location: STDOUT) }
+
     context "Rights attributes" do
       when_the_chef_server 'has a node named x', :osc_compat => false do
         node 'x', {}
 
         it 'Converging chef_acl "nodes/x" changes nothing' do
-          expect {
-            run_recipe do
-              chef_acl 'nodes/x'
-            end
-          }.to update_acls('nodes/x/_acl', {})
+          expect_recipe {
+            chef_acl 'nodes/x'
+          }.to be_up_to_date
+          expect(get('nodes/x/_acl')).to partially_match({})
         end
 
         it 'Converging chef_acl "nodes/x" with "complete true" and no rights raises an error' do
-          expect {
-            run_recipe do
-              chef_acl 'nodes/x' do
-                complete true
-              end
+          expect_converge {
+            chef_acl 'nodes/x' do
+              complete true
             end
           }.to raise_error(RuntimeError)
         end
 
         it 'Removing all :grant rights from a node raises an error' do
-          expect {
-            run_recipe do
-              chef_acl 'nodes/x' do
-                remove_rights :grant, :users => 'pivotal', :groups => %w(admins users clients)
-              end
+          expect_converge {
+            chef_acl 'nodes/x' do
+              remove_rights :grant, users: %w(pivotal), groups:  %w(admins users clients)
             end
           }.to raise_error(RuntimeError)
         end
@@ -45,61 +42,57 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
           user 'blarghle', {}
 
           it 'Converging chef_acl "nodes/x" with user "blarghle" adds the user' do
-            expect {
-              run_recipe do
-                chef_acl 'nodes/x' do
-                  rights :read, :users => 'blarghle'
-                end
+            expect_recipe {
+              chef_acl 'nodes/x' do
+                rights :read, users: %w(blarghle)
               end
-            }.to update_acls('nodes/x/_acl', 'read' => { 'actors' => %w(blarghle) })
+            }.to be_updated
+            expect(get('nodes/x/_acl')).to partially_match('read' => { 'actors' => %w(blarghle) })
           end
 
           it 'Converging chef_acl "nodes/x" with "complete true" removes all ACLs except those specified' do
-            expect {
-              run_recipe do
-                chef_acl 'nodes/x' do
-                  rights :grant, :users => 'blarghle'
-                  complete true
-                end
+            expect_recipe {
+              chef_acl 'nodes/x' do
+                rights :grant, users: %w(blarghle)
+                complete true
               end
-            }.to update_acls('nodes/x/_acl', {
-              "create"=>{"actors"=>["-pivotal"], "groups"=>["-admins", "-users", "-clients"]},
-              "read"  =>{"actors"=>["-pivotal"], "groups"=>["-admins", "-users", "-clients"]},
-              "update"=>{"actors"=>["-pivotal"], "groups"=>["-admins", "-users"]},
-              "delete"=>{"actors"=>["-pivotal"], "groups"=>["-admins", "-users"]},
-              "grant" =>{"actors"=>["-pivotal", "blarghle"], "groups"=>["-admins"]}
-            })
+            }.to be_updated
+            expect(get('nodes/x/_acl')).to eq(
+              "create"=>{"actors"=>[], "groups"=>[]},
+              "read"  =>{"actors"=>[], "groups"=>[]},
+              "update"=>{"actors"=>[], "groups"=>[]},
+              "delete"=>{"actors"=>[], "groups"=>[]},
+              "grant" =>{"actors"=>["blarghle"], "groups"=>[]}
+            )
           end
         end
 
         it 'Converging chef_acl "nodes/x" with "complete true" removes all ACLs except those specified in :all' do
-          expect {
-            run_recipe do
-              chef_acl 'nodes/x' do
-                rights :all, :users => 'blarghle'
-                complete true
-              end
-            end
-          }.to update_acls('nodes/x/_acl', {
-            "create"=>{"actors"=>["-pivotal", "blarghle"], "groups"=>["-admins", "-users", "-clients"]},
-            "read"  =>{"actors"=>["-pivotal", "blarghle"], "groups"=>["-admins", "-users", "-clients"]},
-            "update"=>{"actors"=>["-pivotal", "blarghle"], "groups"=>["-admins", "-users"]},
-            "delete"=>{"actors"=>["-pivotal", "blarghle"], "groups"=>["-admins", "-users"]},
-            "grant" =>{"actors"=>["-pivotal", "blarghle"], "groups"=>["-admins"]}
-          })
+          expect_recipe {
+            chef_acl 'nodes/x' do
+              rights :all, users: %w(blarghle)
+              complete true
+            end
+          }.to be_updated
+          expect(get('nodes/x/_acl')).to eq(
+            "create"=>{"actors"=>["blarghle"], "groups"=>[]},
+            "read"  =>{"actors"=>["blarghle"], "groups"=>[]},
+            "update"=>{"actors"=>["blarghle"], "groups"=>[]},
+            "delete"=>{"actors"=>["blarghle"], "groups"=>[]},
+            "grant" =>{"actors"=>["blarghle"], "groups"=>[]}
+          )
         end
 
         context 'and a client "blarghle"' do
           user 'blarghle', {}
 
           it 'Converging chef_acl "nodes/x" with client "blarghle" adds the client' do
-            expect {
-              run_recipe do
-                chef_acl 'nodes/x' do
-                  rights :read, :clients => 'blarghle'
-                end
+            expect_recipe {
+              chef_acl 'nodes/x' do
+                rights :read, clients: %w(blarghle)
               end
-            }.to update_acls('nodes/x/_acl', 'read' => { 'actors' => %w(blarghle) })
+            }.to be_updated
+            expect(get('nodes/x/_acl')).to partially_match('read' => { 'actors' => %w(blarghle) })
           end
         end
 
@@ -107,13 +100,12 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
           group 'blarghle', {}
 
           it 'Converging chef_acl "nodes/x" with group "blarghle" adds the group' do
-            expect {
-              run_recipe do
-                chef_acl 'nodes/x' do
-                  rights :read, :groups => 'blarghle'
-                end
+            expect_recipe {
+              chef_acl 'nodes/x' do
+                rights :read, groups: %w(blarghle)
               end
-            }.to update_acls('nodes/x/_acl', 'read' => { 'groups' => %w(blarghle) })
+            }.to be_updated
+            expect(get('nodes/x/_acl')).to partially_match('read' => { 'groups' => %w(blarghle) })
           end
         end
 
@@ -129,41 +121,38 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
           group 'g3', {}
 
           it 'Converging chef_acl "nodes/x" with multiple groups, users and clients in an acl makes the appropriate changes' do
-            expect {
-              run_recipe do
-                chef_acl 'nodes/x' do
-                  rights :create, :users => [ 'u1', 'u2', 'u3' ], :clients => [ 'c1', 'c2', 'c3' ], :groups => [ 'g1', 'g2', 'g3' ]
-                end
+            expect_recipe {
+              chef_acl 'nodes/x' do
+                rights :create, users:  [ 'u1', 'u2', 'u3' ], clients:  [ 'c1', 'c2', 'c3' ], groups:  [ 'g1', 'g2', 'g3' ]
               end
-            }.to update_acls('nodes/x/_acl',
+            }.to be_updated
+            expect(get('nodes/x/_acl')).to partially_match(
               'create' => { 'groups' => %w(g1 g2 g3), 'actors' => %w(u1 u2 u3 c1 c2 c3) }
             )
           end
 
           it 'Converging chef_acl "nodes/x" with multiple groups, users and clients across multiple "rights" groups makes the appropriate changes' do
-            expect {
-              run_recipe do
-                chef_acl 'nodes/x' do
-                  rights :create, :users => %w(u1), :clients => 'c1', :groups => 'g1'
-                  rights :create, :users => %w(u2 u3), :clients => %w(c2 c3), :groups => 'g2'
-                  rights :read, :users => 'u1'
-                  rights :read, :groups => 'g1'
-                end
+            expect_recipe {
+              chef_acl 'nodes/x' do
+                rights :create, users:  %w(u1), clients: %w(c1), groups: %w(g1)
+                rights :create, users:  %w(u2 u3), clients:  %w(c2 c3), groups: %w(g2)
+                rights :read, users: %w(u1)
+                rights :read, groups: %w(g1)
               end
-            }.to update_acls('nodes/x/_acl',
+            }.to be_updated
+            expect(get('nodes/x/_acl')).to partially_match(
               'create' => { 'groups' => %w(g1 g2), 'actors' => %w(u1 u2 u3 c1 c2 c3) },
               'read' => { 'groups' => %w(g1), 'actors' => %w(u1) }
             )
           end
 
           it 'Converging chef_acl "nodes/x" with rights [ :read, :create, :update, :delete, :grant ] modifies all rights' do
-            expect {
-              run_recipe do
-                chef_acl 'nodes/x' do
-                  rights [ :create, :read, :update, :delete, :grant ], :users => %w(u1 u2), :clients => 'c1', :groups => 'g1'
-                end
+            expect_recipe {
+              chef_acl 'nodes/x' do
+                rights [ :create, :read, :update, :delete, :grant ], users:  %w(u1 u2), clients: %w(c1), groups: %w(g1)
               end
-            }.to update_acls('nodes/x/_acl',
+            }.to be_updated
+            expect(get('nodes/x/_acl')).to partially_match(
               'create' => { 'groups' => %w(g1), 'actors' => %w(u1 u2 c1) },
               'read' => { 'groups' => %w(g1), 'actors' => %w(u1 u2 c1) },
               'update' => { 'groups' => %w(g1), 'actors' => %w(u1 u2 c1) },
@@ -173,13 +162,12 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
           end
 
           it 'Converging chef_acl "nodes/x" with rights :all modifies all rights' do
-            expect {
-              run_recipe do
-                chef_acl 'nodes/x' do
-                  rights :all, :users => %w(u1 u2), :clients => 'c1', :groups => 'g1'
-                end
+            expect_recipe {
+              chef_acl 'nodes/x' do
+                rights :all, users:  %w(u1 u2), clients: %w(c1), groups: %w(g1)
               end
-            }.to update_acls('nodes/x/_acl',
+            }.to be_updated
+            expect(get('nodes/x/_acl')).to partially_match(
               'create' => { 'groups' => %w(g1), 'actors' => %w(u1 u2 c1) },
               'read' => { 'groups' => %w(g1), 'actors' => %w(u1 u2 c1) },
               'update' => { 'groups' => %w(g1), 'actors' => %w(u1 u2 c1) },
@@ -190,10 +178,8 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
         end
 
         it 'Converging chef_acl "nodes/y" throws a 404' do
-          expect {
-            run_recipe do
-              chef_acl 'nodes/y'
-            end
+          expect_converge {
+            chef_acl 'nodes/y'
           }.to raise_error(Net::HTTPServerException)
         end
       end
@@ -205,13 +191,12 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
         end
 
         it 'Converging chef_acl "nodes/x" with that user changes nothing' do
-          expect {
-            run_recipe do
-              chef_acl 'nodes/x' do
-                rights :read, :users => 'blarghle'
-              end
+          expect_recipe {
+            chef_acl 'nodes/x' do
+              rights :read, users: %w(blarghle)
             end
-          }.to update_acls('nodes/x/_acl', {})
+          }.to be_up_to_date
+          expect(get('nodes/x/_acl')).to partially_match({})
         end
       end
 
@@ -227,22 +212,23 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
         end
 
         it 'Converging chef_acl "nodes/x" with remove_rights :all removes foo from everything' do
-          expect {
-            run_recipe do
-              chef_acl 'nodes/x' do
-                remove_rights :all, :users => 'foo'
-              end
-            end
-          }.to update_acls('nodes/x/_acl',
-                           'create' => { 'actors' => %w(-foo) },
-                           'read'   => { 'actors' => %w(-foo) },
-                           'update' => { 'actors' => %w(-foo) },
-                           'delete' => { 'actors' => %w(-foo) },
-                           'grant'  => { 'actors' => %w(-foo) },
+          expect_recipe {
+            chef_acl 'nodes/x' do
+              remove_rights :all, users: %w(foo)
+            end
+          }.to be_updated
+          expect(get('nodes/x/_acl')).to partially_match(
+                           'create' => { 'actors' => exclude('foo') },
+                           'read'   => { 'actors' => exclude('foo') },
+                           'update' => { 'actors' => exclude('foo') },
+                           'delete' => { 'actors' => exclude('foo') },
+                           'grant'  => { 'actors' => exclude('foo') },
           )
         end
       end
 
+      ::RSpec::Matchers.define_negated_matcher :exclude, :include
+
       context 'recursive' do
         when_the_chef_server 'has a nodes container with user blarghle in its acl', :osc_compat => false do
           user 'blarghle', {}
@@ -253,67 +239,70 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
 
           it 'Converging chef_acl "nodes" makes no changes' do
             expect {
-              run_recipe do
+              expect_recipe {
                 chef_acl 'nodes' do
-                  rights :read, :users => 'blarghle'
+                  rights :read, users: %w(blarghle)
                 end
-              end
-            }.to update_acls([ 'containers/nodes/_acl', 'nodes/x/_acl' ], {})
+                }.to be_up_to_date
+              }.to not_change { get('containers/nodes/_acl') }.
+               and not_change { get('nodes/x/_acl') }
           end
 
+          RSpec::Matchers.define_negated_matcher :not_change, :change
+
           it 'Converging chef_acl "nodes" with recursive :on_change makes no changes' do
             expect {
-              run_recipe do
+              expect_recipe {
                 chef_acl 'nodes' do
-                  rights :read, :users => 'blarghle'
+                  rights :read, users: %w(blarghle)
                   recursive :on_change
                 end
-              end
-            }.to update_acls([ 'containers/nodes/_acl', 'nodes/x/_acl' ], {})
+                }.to be_up_to_date
+              }.to not_change { get('containers/nodes/_acl') }.
+               and not_change { get('nodes/x/_acl') }
           end
 
           it 'Converging chef_acl "nodes" with recursive true changes nodes/x\'s acls' do
-            expect {
-              run_recipe do
-                chef_acl 'nodes' do
-                  rights :read, :users => 'blarghle'
-                  recursive true
-                end
+            expect_recipe {
+              chef_acl 'nodes' do
+                rights :read, users: %w(blarghle)
+                recursive true
               end
-            }.to update_acls('nodes/x/_acl', 'read' => { 'actors' => %w(blarghle) })
+            }.to be_updated
+            expect(get('nodes/x/_acl')).to partially_match('read' => { 'actors' => %w(blarghle) })
           end
 
           it 'Converging chef_acl "" with recursive false does not change nodes/x\'s acls' do
-            expect {
-              run_recipe do
-                chef_acl '' do
-                  rights :read, :users => 'blarghle'
-                  recursive false
-                end
+            expect_recipe {
+              chef_acl '' do
+                rights :read, users: %w(blarghle)
+                recursive false
               end
-            }.to update_acls([ 'containers/nodes/_acl', 'nodes/x/_acl' ], {})
+            }.to be_updated
+            expect(get('containers/nodes/_acl')).to partially_match({})
+            expect(get('nodes/x/_acl')).to partially_match({})
           end
 
           it 'Converging chef_acl "" with recursive :on_change does not change nodes/x\'s acls' do
-            expect {
-              run_recipe do
-                chef_acl '' do
-                  rights :read, :users => 'blarghle'
-                  recursive :on_change
-                end
+            expect_recipe {
+              chef_acl '' do
+                rights :read, users: %w(blarghle)
+                recursive :on_change
               end
-            }.to update_acls([ 'containers/nodes/_acl', 'nodes/x/_acl' ], {})
+            }.to be_updated
+            expect(get('containers/nodes/_acl')).to partially_match({})
+            expect(get('nodes/x/_acl')).to partially_match({})
           end
 
           it 'Converging chef_acl "" with recursive true changes nodes/x\'s acls' do
-            expect {
-              run_recipe do
-                chef_acl '' do
-                  rights :read, :users => 'blarghle'
-                  recursive true
-                end
+            expect_recipe {
+              chef_acl '' do
+                rights :read, users: %w(blarghle)
+                recursive true
               end
-            }.to update_acls([ '/organizations/_acl', 'nodes/x/_acl' ], 'read' => { 'actors' => %w(blarghle) })
+            }.to be_updated
+            expect(get('/organizations/_acl')).to partially_match('read' => { 'actors' => %w(blarghle) })
+            expect(get('nodes/x/_acl')).to partially_match('read' => { 'actors' => %w(blarghle) })
           end
         end
       end
@@ -347,207 +336,192 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
 
           context 'relative paths' do
             it "chef_acl 'nodes/x' changes the acls" do
-              expect {
-                run_recipe do
-                  chef_acl "nodes/x" do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl "nodes/x" do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls("nodes/x/_acl", 'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              expect(get("nodes/x/_acl")).to partially_match('read' => { 'actors' => %w(u) })
             end
 
             it "chef_acl '*/*' changes the acls" do
-              expect {
-                run_recipe do
-                  chef_acl "*/*" do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl "*/*" do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls(%w(clients containers cookbooks data environments groups nodes roles).map { |type| "/organizations/foo/#{type}/x/_acl" },
-                               'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              %w(clients containers cookbooks data environments groups nodes roles).each do |type|
+                expect(get("/organizations/foo/#{type}/x/_acl")).to partially_match(
+                                 'read' => { 'actors' => %w(u) })
+              end
             end
           end
 
           context 'absolute paths' do
             %w(clients containers cookbooks data environments groups nodes roles sandboxes).each do |type|
               it "chef_acl '/organizations/foo/#{type}/x' changes the acl" do
-                expect {
-                  run_recipe do
-                    chef_acl "/organizations/foo/#{type}/x" do
-                      rights :read, :users => 'u'
-                    end
+                expect_recipe {
+                  chef_acl "/organizations/foo/#{type}/x" do
+                    rights :read, users: %w(u)
                   end
-                }.to update_acls("/organizations/foo/#{type}/x/_acl", 'read' => { 'actors' => %w(u) })
+                }.to be_updated
+                expect(get("/organizations/foo/#{type}/x/_acl")).to partially_match('read' => { 'actors' => %w(u) })
               end
             end
 
             %w(clients containers cookbooks data environments groups nodes roles sandboxes).each do |type|
               it "chef_acl '/organizations/foo/#{type}/x' changes the acl" do
-                expect {
-                  run_recipe do
-                    chef_acl "/organizations/foo/#{type}/x" do
-                      rights :read, :users => 'u'
-                    end
+                expect_recipe {
+                  chef_acl "/organizations/foo/#{type}/x" do
+                    rights :read, users: %w(u)
                   end
-                }.to update_acls("/organizations/foo/#{type}/x/_acl", 'read' => { 'actors' => %w(u) })
+                }.to be_updated
+                expect(get("/organizations/foo/#{type}/x/_acl")).to partially_match('read' => { 'actors' => %w(u) })
               end
             end
 
             %w(clients containers cookbooks data environments groups nodes roles).each do |type|
               it "chef_acl '/*/*/#{type}/*' changes the acl" do
-                expect {
-                  run_recipe do
-                    chef_acl "/*/*/#{type}/*" do
-                      rights :read, :users => 'u'
-                    end
+                expect_recipe {
+                  chef_acl "/*/*/#{type}/*" do
+                    rights :read, users: %w(u)
                   end
-                }.to update_acls("/organizations/foo/#{type}/x/_acl", 'read' => { 'actors' => %w(u) })
+                }.to be_updated
+                expect(get("/organizations/foo/#{type}/x/_acl")).to partially_match('read' => { 'actors' => %w(u) })
               end
             end
 
             it "chef_acl '/*/*/*/x' changes the acls" do
-              expect {
-                run_recipe do
-                  chef_acl "/*/*/*/x" do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl "/*/*/*/x" do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls(%w(clients containers cookbooks data environments groups nodes roles sandboxes).map { |type| "/organizations/foo/#{type}/x/_acl" },
-                               'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              %w(clients containers cookbooks data environments groups nodes roles sandboxes).each do |type|
+                expect(get("/organizations/foo/#{type}/x/_acl")).to partially_match(
+                                 'read' => { 'actors' => %w(u) })
+              end
             end
 
             it "chef_acl '/*/*/*/*' changes the acls" do
-              expect {
-                run_recipe do
-                  chef_acl "/*/*/*/*" do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl "/*/*/*/*" do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls(%w(clients containers cookbooks data environments groups nodes roles).map { |type| "/organizations/foo/#{type}/x/_acl" },
-                               'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              %w(clients containers cookbooks data environments groups nodes roles).each do |type|
+                expect(get("/organizations/foo/#{type}/x/_acl")).to partially_match(
+                                 'read' => { 'actors' => %w(u) })
+              end
             end
 
             it 'chef_acl "/organizations/foo/data_bags/x" changes the acl' do
-              expect {
-                run_recipe do
-                  chef_acl '/organizations/foo/data_bags/x' do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl '/organizations/foo/data_bags/x' do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls('/organizations/foo/data/x/_acl', 'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              expect(get('/organizations/foo/data/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
             end
 
             it 'chef_acl "/*/*/data_bags/*" changes the acl' do
-              expect {
-                run_recipe do
-                  chef_acl '/*/*/data_bags/*' do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl '/*/*/data_bags/*' do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls('/organizations/foo/data/x/_acl', 'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              expect(get('/organizations/foo/data/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
             end
 
             it "chef_acl '/organizations/foo/cookbooks/x/1.0.0' raises an error" do
-              expect {
-                run_recipe do
-                  chef_acl "/organizations/foo/cookbooks/x/1.0.0" do
-                    rights :read, :users => 'u'
-                  end
+              expect_converge {
+                chef_acl "/organizations/foo/cookbooks/x/1.0.0" do
+                  rights :read, users: %w(u)
                 end
               }.to raise_error(/ACLs cannot be set on children of \/organizations\/foo\/cookbooks\/x/)
             end
 
             it "chef_acl '/organizations/foo/cookbooks/*/*' raises an error" do
               pending
-              expect {
-                run_recipe do
-                  chef_acl "/organizations/foo/cookbooks/*/*" do
-                    rights :read, :users => 'u'
-                  end
+              expect_converge {
+                chef_acl "/organizations/foo/cookbooks/*/*" do
+                  rights :read, users: %w(u)
                 end
               }.to raise_error(/ACLs cannot be set on children of \/organizations\/foo\/cookbooks\/*/)
             end
 
             it 'chef_acl "/organizations/foo/data/x/y" raises an error' do
-              expect {
-                run_recipe do
-                  chef_acl '/organizations/foo/data/x/y' do
-                    rights :read, :users => 'u'
-                  end
+              expect_converge {
+                chef_acl '/organizations/foo/data/x/y' do
+                  rights :read, users: %w(u)
                 end
               }.to raise_error(/ACLs cannot be set on children of \/organizations\/foo\/data\/x/)
             end
 
             it 'chef_acl "/organizations/foo/data/*/*" raises an error' do
               pending
-              expect {
-                run_recipe do
-                  chef_acl '/organizations/foo/data/*/*' do
-                    rights :read, :users => 'u'
-                  end
+              expect_converge {
+                chef_acl '/organizations/foo/data/*/*' do
+                  rights :read, users: %w(u)
                 end
               }.to raise_error(/ACLs cannot be set on children of \/organizations\/foo\/data\/*/)
             end
 
             it 'chef_acl "/organizations/foo" changes the acl' do
-              expect {
-                run_recipe do
-                  chef_acl '/organizations/foo' do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl '/organizations/foo' do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls([ '/organizations/foo/organizations/_acl', '/organizations/foo/nodes/x/_acl' ], 'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              expect(get('/organizations/foo/organizations/_acl')).to partially_match('read' => { 'actors' => %w(u) })
+              expect(get('/organizations/foo/nodes/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
             end
 
             it 'chef_acl "/organizations/*" changes the acl' do
-              expect {
-                run_recipe do
-                  chef_acl '/organizations/*' do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl '/organizations/*' do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls([ '/organizations/foo/organizations/_acl', '/organizations/foo/nodes/x/_acl' ], 'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              expect(get('/organizations/foo/organizations/_acl')).to partially_match('read' => { 'actors' => %w(u) })
+              expect(get('/organizations/foo/nodes/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
             end
 
             it 'chef_acl "/users/x" changes the acl' do
-              expect {
-                run_recipe do
-                  chef_acl '/users/x' do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl '/users/x' do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls('/users/x/_acl', 'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              expect(get('/users/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
             end
 
             it 'chef_acl "/users/*" changes the acl' do
-              expect {
-                run_recipe do
-                  chef_acl '/users/*' do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl '/users/*' do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls('/users/x/_acl', 'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              expect(get('/users/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
             end
 
             it 'chef_acl "/*/x" changes the acl' do
-              expect {
-                run_recipe do
-                  chef_acl '/*/x' do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl '/*/x' do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls('/users/x/_acl', 'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              expect(get('/users/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
             end
 
             it 'chef_acl "/*/*" changes the acl' do
-              expect {
-                run_recipe do
-                  chef_acl '/*/*' do
-                    rights :read, :users => 'u'
-                  end
+              expect_recipe {
+                chef_acl '/*/*' do
+                  rights :read, users: %w(u)
                 end
-              }.to update_acls([ '/organizations/foo/organizations/_acl', '/users/x/_acl' ],
-                               'read' => { 'actors' => %w(u) })
+              }.to be_updated
+              expect(get('/organizations/foo/organizations/_acl')).to partially_match('read' => { 'actors' => %w(u) })
+              expect(get('/users/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
             end
           end
         end
@@ -558,14 +532,12 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
           end
 
           it "chef_acl '/organizations/foo/nodes/*' changes the acl" do
-            expect {
-              run_recipe do
-                chef_acl "/organizations/foo/nodes/*" do
-                  rights :read, :users => 'u'
-                end
+            expect_recipe {
+              chef_acl "/organizations/foo/nodes/*" do
+                rights :read, users: %w(u)
               end
-            }.to update_acls("/organizations/foo/nodes/x/_acl", 'read' => { 'actors' => %w(u) })
-            expect {}.not_to update_acls("/organizations/bar/nodes/x/_acl", 'read' => { 'actors' => %w(u) })
+            }.to be_updated
+            expect(get("/organizations/foo/nodes/x/_acl")).to partially_match('read' => { 'actors' => %w(u) })
           end
         end
 
@@ -575,14 +547,12 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
           end
 
           it "chef_acl '/organizations/foo/nodes/*' changes the acl" do
-            expect {
-              run_recipe do
-                chef_acl "/organizations/foo/nodes/*" do
-                  rights :read, :users => 'u'
-                end
+            expect_recipe {
+              chef_acl "/organizations/foo/nodes/*" do
+                rights :read, users: %w(u)
               end
-            }.to update_acls("/organizations/foo/nodes/x/_acl", 'read' => { 'actors' => %w(u) })
-            expect {}.not_to update_acls("/organizations/bar/nodes/x/_acl", 'read' => { 'actors' => %w(u) })
+            }.to be_updated
+            expect(get("/organizations/foo/nodes/x/_acl")).to partially_match('read' => { 'actors' => %w(u) })
           end
         end
       end
@@ -602,89 +572,88 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
 
         %w(clients containers cookbooks data environments groups nodes roles sandboxes).each do |type|
           it "chef_acl #{type}/x' changes the acl" do
-            expect {
-              run_recipe do
-                chef_acl "#{type}/x" do
-                  rights :read, :users => 'u'
-                end
+            expect_recipe {
+              chef_acl "#{type}/x" do
+                rights :read, users: %w(u)
               end
-            }.to update_acls("#{type}/x/_acl", 'read' => { 'actors' => %w(u) })
+            }.to be_updated
+            expect(get("#{type}/x/_acl")).to partially_match('read' => { 'actors' => %w(u) })
           end
         end
 
         %w(clients containers cookbooks data environments groups nodes roles).each do |type|
           it "chef_acl '#{type}/*' changes the acl" do
-            expect {
-              run_recipe do
-                chef_acl "#{type}/*" do
-                  rights :read, :users => 'u'
-                end
+            expect_recipe {
+              chef_acl "#{type}/*" do
+                rights :read, users: %w(u)
               end
-            }.to update_acls("#{type}/x/_acl", 'read' => { 'actors' => %w(u) })
+            }.to be_updated
+            expect(get("#{type}/x/_acl")).to partially_match('read' => { 'actors' => %w(u) })
           end
         end
 
         it "chef_acl '*/x' changes the acls" do
-          expect {
-            run_recipe do
-              chef_acl "*/x" do
-                rights :read, :users => 'u'
-              end
-            end
-          }.to update_acls(%w(clients containers cookbooks data environments groups nodes roles sandboxes).map { |type| "#{type}/x/_acl" },
-                           'read' => { 'actors' => %w(u) })
+          expect_recipe {
+            chef_acl "*/x" do
+              rights :read, users: %w(u)
+            end
+          }.to be_updated
+          %w(clients containers cookbooks data environments groups nodes roles sandboxes).each do |type|
+            expect(get("#{type}/x/_acl")).to partially_match(
+                             'read' => { 'actors' => %w(u) })
+          end
         end
 
         it "chef_acl '*/*' changes the acls" do
-          expect {
-            run_recipe do
-              chef_acl "*/*" do
-                rights :read, :users => 'u'
-              end
-            end
-          }.to update_acls(%w(clients containers cookbooks data environments groups nodes roles).map { |type| "#{type}/x/_acl" },
-                           'read' => { 'actors' => %w(u) })
+          expect_recipe {
+            chef_acl "*/*" do
+              rights :read, users: %w(u)
+            end
+          }.to be_updated
+          %w(clients containers cookbooks data environments groups nodes roles).each do |type|
+            expect(get("#{type}/x/_acl")).to partially_match(
+                             'read' => { 'actors' => %w(u) })
+          end
         end
 
         it "chef_acl 'groups/*' changes the acl" do
-          expect {
-            run_recipe do
-              chef_acl "groups/*" do
-                rights :read, :users => 'u'
-              end
-            end
-          }.to update_acls(%w(admins billing-admins clients users x).map { |n| "groups/#{n}/_acl" },
-                           'read' => { 'actors' => %w(u) })
+          expect_recipe {
+            chef_acl "groups/*" do
+              rights :read, users: %w(u)
+            end
+          }.to be_updated
+          %w(admins billing-admins clients users x).each do |n|
+            expect(get("groups/#{n}/_acl")).to partially_match(
+                             'read' => { 'actors' => %w(u) })
+          end
         end
 
         it 'chef_acl "data_bags/x" changes the acl' do
-          expect {
-            run_recipe do
-              chef_acl 'data_bags/x' do
-                rights :read, :users => 'u'
-              end
+          expect_recipe {
+            chef_acl 'data_bags/x' do
+              rights :read, users: %w(u)
             end
-          }.to update_acls('data/x/_acl', 'read' => { 'actors' => %w(u) })
+          }.to be_updated
+          expect(get('data/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
         end
 
         it 'chef_acl "data_bags/*" changes the acl' do
-          expect {
-            run_recipe do
-              chef_acl 'data_bags/*' do
-                rights :read, :users => 'u'
-              end
+          expect_recipe {
+            chef_acl 'data_bags/*' do
+              rights :read, users: %w(u)
             end
-          }.to update_acls('data/x/_acl', 'read' => { 'actors' => %w(u) })
+          }.to be_updated
+          expect(get('data/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
         end
 
         it 'chef_acl "" changes the organization acl' do
-          expect {
-            run_recipe do
-              chef_acl '' do
-                rights :read, :users => 'u'
-              end
+          expect_recipe {
+            chef_acl '' do
+              rights :read, users: %w(u)
             end
-          }.to update_acls([ '/organizations/_acl', 'nodes/x/_acl' ], 'read' => { 'actors' => %w(u) })
+          }.to be_updated
+          expect(get('/organizations/_acl')).to partially_match('read' => { 'actors' => %w(u) })
+          expect(get('nodes/x/_acl')).to partially_match('read' => { 'actors' => %w(u) })
         end
       end
     end
@@ -707,57 +676,54 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
 
         %w(clients containers cookbooks data environments groups nodes roles sandboxes).each do |type|
           it "chef_acl '/organizations/foo/#{type}' changes the acl" do
-            expect {
-              run_recipe do
-                chef_acl "/organizations/foo/#{type}" do
-                  rights :read, :users => 'u'
-                end
+            expect_recipe {
+              chef_acl "/organizations/foo/#{type}" do
+                rights :read, users: %w(u)
               end
-            }.to update_acls("/organizations/foo/containers/#{type}/_acl", 'read' => { 'actors' => %w(u) })
+            }.to be_updated
+            expect(get("/organizations/foo/containers/#{type}/_acl")).to partially_match('read' => { 'actors' => %w(u) })
           end
         end
 
         %w(clients containers cookbooks data environments groups nodes roles).each do |type|
           it "chef_acl '/*/*/#{type}' changes the acl" do
-            expect {
-              run_recipe do
-                chef_acl "/*/*/#{type}" do
-                  rights :read, :users => 'u'
-                end
+            expect_recipe {
+              chef_acl "/*/*/#{type}" do
+                rights :read, users: %w(u)
               end
-            }.to update_acls("/organizations/foo/containers/#{type}/_acl", 'read' => { 'actors' => %w(u) })
+            }.to be_updated
+            expect(get("/organizations/foo/containers/#{type}/_acl")).to partially_match('read' => { 'actors' => %w(u) })
           end
         end
 
         it "chef_acl '/*/*/*' changes the acls" do
-          expect {
-            run_recipe do
-              chef_acl "/*/*/*" do
-                rights :read, :users => 'u'
-              end
-            end
-          }.to update_acls(%w(clients containers cookbooks data environments groups nodes roles sandboxes).map { |type| "/organizations/foo/containers/#{type}/_acl" },
-                           'read' => { 'actors' => %w(u) })
+          expect_recipe {
+            chef_acl "/*/*/*" do
+              rights :read, users: %w(u)
+            end
+          }.to be_updated
+          %w(clients containers cookbooks data environments groups nodes roles sandboxes).each do |type|
+            expect(get("/organizations/foo/containers/#{type}/_acl")).to partially_match(
+                             'read' => { 'actors' => %w(u) })
+          end
         end
 
         it 'chef_acl "/organizations/foo/data_bags" changes the acl' do
-          expect {
-            run_recipe do
-              chef_acl '/organizations/foo/data_bags' do
-                rights :read, :users => 'u'
-              end
+          expect_recipe {
+            chef_acl '/organizations/foo/data_bags' do
+              rights :read, users: %w(u)
             end
-          }.to update_acls('/organizations/foo/containers/data/_acl', 'read' => { 'actors' => %w(u) })
+          }.to be_updated
+          expect(get('/organizations/foo/containers/data/_acl')).to partially_match('read' => { 'actors' => %w(u) })
         end
 
         it 'chef_acl "/*/*/data_bags" changes the acl' do
-          expect {
-            run_recipe do
-              chef_acl '/*/*/data_bags' do
-                rights :read, :users => 'u'
-              end
+          expect_recipe {
+            chef_acl '/*/*/data_bags' do
+              rights :read, users: %w(u)
             end
-          }.to update_acls('/organizations/foo/containers/data/_acl', 'read' => { 'actors' => %w(u) })
+          }.to be_updated
+          expect(get('/organizations/foo/containers/data/_acl')).to partially_match('read' => { 'actors' => %w(u) })
         end
       end
 
@@ -776,25 +742,25 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
 
         %w(clients containers cookbooks data environments groups nodes roles sandboxes).each do |type|
           it "chef_acl #{type}' changes the acl" do
-            expect {
-              run_recipe do
-                chef_acl "#{type}" do
-                  rights :read, :users => 'u'
-                end
+            expect_recipe {
+              chef_acl "#{type}" do
+                rights :read, users: %w(u)
               end
-            }.to update_acls("containers/#{type}/_acl", 'read' => { 'actors' => %w(u) })
+            }.to be_updated
+            expect(get("containers/#{type}/_acl")).to partially_match('read' => { 'actors' => %w(u) })
           end
         end
 
         it "chef_acl '*' changes the acls" do
-          expect {
-            run_recipe do
-              chef_acl "*" do
-                rights :read, :users => 'u'
-              end
-            end
-          }.to update_acls(%w(clients containers cookbooks data environments groups nodes roles sandboxes).map { |type| "containers/#{type}/_acl" },
-                           'read' => { 'actors' => %w(u) })
+          expect_recipe {
+            chef_acl "*" do
+              rights :read, users: %w(u)
+            end
+          }.to be_updated
+          %w(clients containers cookbooks data environments groups nodes roles sandboxes).each do |type|
+            expect(get("containers/#{type}/_acl")).to partially_match(
+                             'read' => { 'actors' => %w(u) })
+          end
         end
       end
     end
@@ -814,53 +780,54 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
         end
 
         it 'chef_acl with remove_rights "u" removes the user\'s rights' do
-          expect {
-            run_recipe do
-              chef_acl "nodes/x" do
-                remove_rights :read, :users => 'u'
-              end
+          expect_recipe {
+            chef_acl "nodes/x" do
+              remove_rights :read, users: %w(u)
             end
-          }.to update_acls("nodes/x/_acl", 'read' => { 'actors' => %w(-u) })
+          }.to be_updated
+          expect(get("nodes/x/_acl")).to partially_match('read' => { 'actors' => exclude('u') })
         end
 
         it 'chef_acl with remove_rights "c" removes the client\'s rights' do
-          expect {
-            run_recipe do
-              chef_acl "nodes/x" do
-                remove_rights :read, :clients => 'c'
-              end
+          expect_recipe {
+            chef_acl "nodes/x" do
+              remove_rights :read, clients: %w(c)
             end
-          }.to update_acls("nodes/x/_acl", 'read' => { 'actors' => %w(-c) })
+          }.to be_updated
+          expect(get("nodes/x/_acl")).to partially_match('read' => { 'actors' => exclude('c') })
         end
 
         it 'chef_acl with remove_rights "g" removes the group\'s rights' do
-          expect {
-            run_recipe do
-              chef_acl "nodes/x" do
-                remove_rights :read, :groups => 'g'
-              end
+          expect_recipe {
+            chef_acl "nodes/x" do
+              remove_rights :read, groups: %w(g)
             end
-          }.to update_acls("nodes/x/_acl", 'read' => { 'groups' => %w(-g) })
+          }.to be_updated
+          expect(get("nodes/x/_acl")).to partially_match(
+            'read' => { 'groups' => exclude('g') }
+          )
         end
 
         it 'chef_acl with remove_rights [ :create, :read ], "u", "c", "g" removes all three' do
-          expect {
-            run_recipe do
-              chef_acl "nodes/x" do
-                remove_rights [ :create, :read ], :users => 'u', :clients => 'c', :groups => 'g'
-              end
-            end
-          }.to update_acls("nodes/x/_acl", 'create' => { 'actors' => %w(-u -c), 'groups' => %w(-g) }, 'read' => { 'actors' => %w(-u -c), 'groups' => %w(-g) })
+          expect_recipe {
+            chef_acl "nodes/x" do
+              remove_rights [ :create, :read ], users: %w(u), clients: %w(c), groups: %w(g)
+            end
+          }.to be_updated
+          expect(get("nodes/x/_acl")).to partially_match(
+            'create' => { 'actors' => exclude('u').and(exclude('c')), 'groups' => exclude('g') },
+            'read'   => { 'actors' => exclude('u').and(exclude('c')), 'groups' => exclude('g') }
+          )
         end
 
         it 'chef_acl with remove_rights "u2", "c2", "g2" has no effect' do
           expect {
-            run_recipe do
+            expect_recipe {
               chef_acl "nodes/x" do
-                remove_rights :read, :users => 'u2', :clients => 'c2', :groups => 'g2'
+                remove_rights :read, users: %w(u2), clients: %w(c2), groups: %w(g2)
               end
-            end
-          }.to update_acls("nodes/x/_acl", {})
+            }.to be_up_to_date
+          }.not_to change { get("nodes/x/_acl") }
         end
       end
     end
@@ -870,13 +837,12 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
       node 'data_bags', {}
 
       it 'Converging chef_acl "nodes/data_bags" with user "blarghle" adds the user' do
-        expect {
-          run_recipe do
-            chef_acl 'nodes/data_bags' do
-              rights :read, :users => 'blarghle'
-            end
+        expect_recipe {
+          chef_acl 'nodes/data_bags' do
+            rights :read, users: %w(blarghle)
           end
-        }.to update_acls('nodes/data_bags/_acl', 'read' => { 'actors' => %w(blarghle) })
+        }.to be_updated
+        expect(get('nodes/data_bags/_acl')).to partially_match('read' => { 'actors' => %w(blarghle) })
       end
     end
 
@@ -887,13 +853,12 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
       end
 
       it 'Converging chef_acl "/organizations/foo/nodes/data_bags" with user "blarghle" adds the user' do
-        expect {
-          run_recipe do
-            chef_acl '/organizations/foo/nodes/data_bags' do
-              rights :read, :users => 'blarghle'
-            end
+        expect_recipe {
+          chef_acl '/organizations/foo/nodes/data_bags' do
+            rights :read, users: %w(blarghle)
           end
-        }.to update_acls('/organizations/foo/nodes/data_bags/_acl', 'read' => { 'actors' => %w(blarghle) })
+        }.to be_updated
+        expect(get('/organizations/foo/nodes/data_bags/_acl')).to partially_match('read' => { 'actors' => %w(blarghle) })
       end
     end
 
@@ -902,13 +867,12 @@ if Gem::Version.new(ChefZero::VERSION) >= Gem::Version.new('3.1')
       user 'blarghle', {}
 
       it 'Converging chef_acl "/users/data_bags" with user "blarghle" adds the user' do
-        expect {
-          run_recipe do
-            chef_acl '/users/data_bags' do
-              rights :read, :users => 'blarghle'
-            end
+        expect_recipe {
+          chef_acl '/users/data_bags' do
+            rights :read, users: %w(blarghle)
           end
-        }.to update_acls('/users/data_bags/_acl', 'read' => { 'actors' => %w(blarghle) })
+        }.to be_updated
+        expect(get('/users/data_bags/_acl')).to partially_match('read' => { 'actors' => %w(blarghle) })
       end
     end
   end