puppet-parse 0.0.1 → 0.0.2

data/lib/vendor/puppet/indirector/catalog/yaml.rb

@@ -0,0 +1,22 @@
+require 'puppet/resource/catalog'
+require 'puppet/indirector/yaml'
+
+class Puppet::Resource::Catalog::Yaml < Puppet::Indirector::Yaml
+  desc "Store catalogs as flat files, serialized using YAML."
+
+  private
+
+  # Override these, because yaml doesn't want to convert our self-referential
+  # objects.  This is hackish, but eh.
+  def from_yaml(text)
+    if config = YAML.load(text)
+      return config
+    end
+  end
+
+  def to_yaml(config)
+    # We can't yaml-dump classes.
+    #config.edgelist_class = nil
+    YAML.dump(config)
+  end
+end

data/lib/vendor/puppet/indirector/certificate/ca.rb

@@ -0,0 +1,9 @@
+require 'puppet/indirector/ssl_file'
+require 'puppet/ssl/certificate'
+
+class Puppet::SSL::Certificate::Ca < Puppet::Indirector::SslFile
+  desc "Manage the CA collection of signed SSL certificates on disk."
+
+  store_in :signeddir
+  store_ca_at :cacert
+end

data/lib/vendor/puppet/indirector/certificate/disabled_ca.rb

@@ -0,0 +1,22 @@
+require 'puppet/indirector/code'
+require 'puppet/ssl/certificate'
+
+class Puppet::SSL::Certificate::DisabledCa < Puppet::Indirector::Code
+  desc "Manage SSL certificates on disk, but reject any remote access
+to the SSL data store.  Used when a master has an explicitly disabled
+CA to prevent clients getting confusing 'success' behaviour."
+
+  def initialize
+    @file = Puppet::SSL::Certificate.indirection.terminus(:file)
+  end
+
+  [:find, :head, :search, :save, :destroy].each do |name|
+    define_method(name) do |request|
+      if request.remote?
+        raise Puppet::Error, "this master is not a CA"
+      else
+        @file.send(name, request)
+      end
+    end
+  end
+end

data/lib/vendor/puppet/indirector/certificate/file.rb

@@ -0,0 +1,9 @@
+require 'puppet/indirector/ssl_file'
+require 'puppet/ssl/certificate'
+
+class Puppet::SSL::Certificate::File < Puppet::Indirector::SslFile
+  desc "Manage SSL certificates on disk."
+
+  store_in :certdir
+  store_ca_at :localcacert
+end

data/lib/vendor/puppet/indirector/certificate/rest.rb

@@ -0,0 +1,15 @@
+require 'puppet/ssl/certificate'
+require 'puppet/indirector/rest'
+
+class Puppet::SSL::Certificate::Rest < Puppet::Indirector::REST
+  desc "Find and save certificates over HTTP via REST."
+
+  use_server_setting(:ca_server)
+  use_port_setting(:ca_port)
+
+  def find(request)
+    return nil unless result = super
+    result.name = request.key unless result.name == request.key
+    result
+  end
+end

data/lib/vendor/puppet/indirector/certificate_request/ca.rb

@@ -0,0 +1,22 @@
+require 'puppet/indirector/ssl_file'
+require 'puppet/ssl/certificate_request'
+
+class Puppet::SSL::CertificateRequest::Ca < Puppet::Indirector::SslFile
+  desc "Manage the CA collection of certificate requests on disk."
+
+  store_in :csrdir
+
+  def save(request)
+    if host = Puppet::SSL::Host.indirection.find(request.key)
+      if Puppet[:allow_duplicate_certs]
+        Puppet.notice "#{request.key} already has a #{host.state} certificate; new certificate will overwrite it"
+      else
+        raise "#{request.key} already has a #{host.state} certificate; ignoring certificate request"
+      end
+    end
+
+    result = super
+    Puppet.notice "#{request.key} has a waiting certificate request"
+    result
+  end
+end

data/lib/vendor/puppet/indirector/certificate_request/disabled_ca.rb

@@ -0,0 +1,22 @@
+require 'puppet/indirector/code'
+require 'puppet/ssl/certificate_request'
+
+class Puppet::SSL::CertificateRequest::DisabledCa < Puppet::Indirector::Code
+  desc "Manage SSL certificate requests on disk, but reject any remote access
+to the SSL data store. Used when a master has an explicitly disabled CA to
+prevent clients getting confusing 'success' behaviour."
+
+  def initialize
+    @file = Puppet::SSL::CertificateRequest.indirection.terminus(:file)
+  end
+
+  [:find, :head, :search, :save, :destroy].each do |name|
+    define_method(name) do |request|
+      if request.remote?
+        raise Puppet::Error, "this master is not a CA"
+      else
+        @file.send(name, request)
+      end
+    end
+  end
+end

data/lib/vendor/puppet/indirector/certificate_request/file.rb

@@ -0,0 +1,8 @@
+require 'puppet/indirector/ssl_file'
+require 'puppet/ssl/certificate_request'
+
+class Puppet::SSL::CertificateRequest::File < Puppet::Indirector::SslFile
+  desc "Manage the collection of certificate requests on disk."
+
+  store_in :requestdir
+end

data/lib/vendor/puppet/indirector/certificate_request/rest.rb

@@ -0,0 +1,9 @@
+require 'puppet/ssl/certificate_request'
+require 'puppet/indirector/rest'
+
+class Puppet::SSL::CertificateRequest::Rest < Puppet::Indirector::REST
+  desc "Find and save certificate requests over HTTP via REST."
+
+  use_server_setting(:ca_server)
+  use_port_setting(:ca_port)
+end

data/lib/vendor/puppet/indirector/certificate_revocation_list/ca.rb

@@ -0,0 +1,8 @@
+require 'puppet/indirector/ssl_file'
+require 'puppet/ssl/certificate_revocation_list'
+
+class Puppet::SSL::CertificateRevocationList::Ca < Puppet::Indirector::SslFile
+  desc "Manage the CA collection of certificate requests on disk."
+
+  store_at :cacrl
+end

data/lib/vendor/puppet/indirector/certificate_revocation_list/disabled_ca.rb

@@ -0,0 +1,22 @@
+require 'puppet/indirector/code'
+require 'puppet/ssl/certificate_revocation_list'
+
+class Puppet::SSL::CertificateRevocationList::DisabledCa < Puppet::Indirector::Code
+  desc "Manage SSL certificate revocation lists, but reject any remote access
+to the SSL data store. Used when a master has an explicitly disabled CA to
+prevent clients getting confusing 'success' behaviour."
+
+  def initialize
+    @file = Puppet::SSL::CertificateRevocationList.indirection.terminus(:file)
+  end
+
+  [:find, :head, :search, :save, :destroy].each do |name|
+    define_method(name) do |request|
+      if request.remote?
+        raise Puppet::Error, "this master is not a CA"
+      else
+        @file.send(name, request)
+      end
+    end
+  end
+end

data/lib/vendor/puppet/indirector/certificate_revocation_list/file.rb

@@ -0,0 +1,8 @@
+require 'puppet/indirector/ssl_file'
+require 'puppet/ssl/certificate_revocation_list'
+
+class Puppet::SSL::CertificateRevocationList::File < Puppet::Indirector::SslFile
+  desc "Manage the global certificate revocation list."
+
+  store_at :hostcrl
+end

data/lib/vendor/puppet/indirector/certificate_revocation_list/rest.rb

@@ -0,0 +1,9 @@
+require 'puppet/ssl/certificate_revocation_list'
+require 'puppet/indirector/rest'
+
+class Puppet::SSL::CertificateRevocationList::Rest < Puppet::Indirector::REST
+  desc "Find and save certificate revocation lists over HTTP via REST."
+
+  use_server_setting(:ca_server)
+  use_port_setting(:ca_port)
+end

data/lib/vendor/puppet/indirector/certificate_status/file.rb

@@ -0,0 +1,82 @@
+require 'puppet'
+require 'puppet/indirector/certificate_status'
+require 'puppet/ssl/certificate'
+require 'puppet/ssl/certificate_authority'
+require 'puppet/ssl/certificate_request'
+require 'puppet/ssl/host'
+require 'puppet/ssl/key'
+
+class Puppet::Indirector::CertificateStatus::File < Puppet::Indirector::Code
+  def ca
+    raise ArgumentError, "This process is not configured as a certificate authority" unless Puppet::SSL::CertificateAuthority.ca?
+    Puppet::SSL::CertificateAuthority.new
+  end
+
+  def destroy(request)
+    deleted = []
+    [
+      Puppet::SSL::Certificate,
+      Puppet::SSL::CertificateRequest,
+      Puppet::SSL::Key,
+    ].collect do |part|
+      if part.indirection.destroy(request.key)
+        deleted << "#{part}"
+      end
+    end
+
+    return "Nothing was deleted" if deleted.empty?
+    "Deleted for #{request.key}: #{deleted.join(", ")}"
+  end
+
+  def save(request)
+    if request.instance.desired_state == "signed"
+      certificate_request = Puppet::SSL::CertificateRequest.indirection.find(request.key)
+      raise Puppet::Error, "Cannot sign for host #{request.key} without a certificate request" unless certificate_request
+      ca.sign(request.key)
+    elsif request.instance.desired_state == "revoked"
+      certificate = Puppet::SSL::Certificate.indirection.find(request.key)
+      raise Puppet::Error, "Cannot revoke host #{request.key} because has it doesn't have a signed certificate" unless certificate
+      ca.revoke(request.key)
+    else
+      raise Puppet::Error, "State #{request.instance.desired_state} invalid; Must specify desired state of 'signed' or 'revoked' for host #{request.key}"
+    end
+
+  end
+
+  def search(request)
+    # Support historic interface wherein users provide classes to filter
+    # the search.  When used via the REST API, the arguments must be
+    # a Symbol or an Array containing Symbol objects.
+    klasses = case request.options[:for]
+    when Class
+      [request.options[:for]]
+    when nil
+      [
+        Puppet::SSL::Certificate,
+        Puppet::SSL::CertificateRequest,
+        Puppet::SSL::Key,
+      ]
+    else
+      [request.options[:for]].flatten.map do |klassname|
+        indirection.class.model(klassname.to_sym)
+      end
+    end
+
+    klasses.collect do |klass|
+      klass.indirection.search(request.key, request.options)
+    end.flatten.collect do |result|
+      result.name
+    end.uniq.collect &Puppet::SSL::Host.method(:new)
+  end
+
+  def find(request)
+    ssl_host = Puppet::SSL::Host.new(request.key)
+    public_key = Puppet::SSL::Certificate.indirection.find(request.key)
+
+    if ssl_host.certificate_request || public_key
+      ssl_host
+    else
+      nil
+    end
+  end
+end

data/lib/vendor/puppet/indirector/certificate_status/rest.rb

@@ -0,0 +1,10 @@
+require 'puppet/ssl/host'
+require 'puppet/indirector/rest'
+require 'puppet/indirector/certificate_status'
+
+class Puppet::Indirector::CertificateStatus::Rest < Puppet::Indirector::REST
+  desc "Sign, revoke, search for, or clean certificates & certificate requests over HTTP."
+
+  use_server_setting(:ca_server)
+  use_port_setting(:ca_port)
+end

data/lib/vendor/puppet/indirector/certificate_status.rb

@@ -0,0 +1,4 @@
+require 'puppet/indirector'
+
+class Puppet::Indirector::CertificateStatus
+end

data/lib/vendor/puppet/indirector/code.rb

@@ -0,0 +1,6 @@
+require 'puppet/indirector/terminus'
+
+# Do nothing, requiring that the back-end terminus do all
+# of the work.
+class Puppet::Indirector::Code < Puppet::Indirector::Terminus
+end

data/lib/vendor/puppet/indirector/couch.rb

@@ -0,0 +1,78 @@
+class Puppet::Indirector::Couch < Puppet::Indirector::Terminus
+
+  # The CouchRest database instance. One database instance per Puppet runtime
+  # should be sufficient.
+  #
+  def self.db; @db ||= CouchRest.database! Puppet[:couchdb_url] end
+  def db; self.class.db end
+
+  def find(request)
+    attributes_of get(request)
+  end
+
+  def initialize(*args)
+    raise "Couch terminus not supported without couchrest gem" unless Puppet.features.couchdb?
+    super
+  end
+
+  # Create or update the couchdb document with the request's data hash.
+  #
+  def save(request)
+    raise ArgumentError, "PUT does not accept options" unless request.options.empty?
+    update(request) || create(request)
+  end
+
+  private
+
+  # RKH:TODO: Do not depend on error handling, check if the document exists
+  # first. (Does couchrest support this?)
+  #
+  def get(request)
+    db.get(id_for(request))
+  rescue RestClient::ResourceNotFound
+    Puppet.debug "No couchdb document with id: #{id_for(request)}"
+    return nil
+  end
+
+  def update(request)
+    doc = get request
+    return unless doc
+    doc.merge!(hash_from(request))
+    doc.save
+    true
+  end
+
+  def create(request)
+    db.save_doc hash_from(request)
+  end
+
+  # The attributes hash that is serialized to CouchDB as JSON. It includes
+  # metadata that is used to help aggregate data in couchdb. Add
+  # model-specific attributes in subclasses.
+  #
+  def hash_from(request)
+    {
+      "_id"         => id_for(request),
+      "puppet_type" => document_type_for(request)
+    }
+  end
+
+  # The couchdb response stripped of metadata, used to instantiate the model
+  # instance that is returned by save.
+  #
+  def attributes_of(response)
+    response && response.reject{|k,v| k =~ /^(_rev|puppet_)/ }
+  end
+
+  def document_type_for(request)
+    request.indirection_name
+  end
+
+  # The id used to store the object in couchdb. Implemented in subclasses.
+  #
+  def id_for(request)
+    raise NotImplementedError
+  end
+
+end
+

data/lib/vendor/puppet/indirector/direct_file_server.rb

@@ -0,0 +1,19 @@
+require 'puppet/file_serving/terminus_helper'
+require 'puppet/indirector/terminus'
+
+class Puppet::Indirector::DirectFileServer < Puppet::Indirector::Terminus
+
+  include Puppet::FileServing::TerminusHelper
+
+  def find(request)
+    return nil unless FileTest.exists?(request.key)
+    instance = model.new(request.key)
+    instance.links = request.options[:links] if request.options[:links]
+    instance
+  end
+
+  def search(request)
+    return nil unless FileTest.exists?(request.key)
+    path2instances(request, request.key)
+  end
+end

data/lib/vendor/puppet/indirector/envelope.rb

@@ -0,0 +1,11 @@
+require 'puppet/indirector'
+
+# Provide any attributes or functionality needed for indirected
+# instances.
+module Puppet::Indirector::Envelope
+  attr_accessor :expiration
+
+  def expired?
+    expiration and expiration < Time.now
+  end
+end

data/lib/vendor/puppet/indirector/exec.rb

@@ -0,0 +1,48 @@
+require 'puppet/indirector/terminus'
+require 'puppet/util'
+
+class Puppet::Indirector::Exec < Puppet::Indirector::Terminus
+  # Look for external node definitions.
+  def find(request)
+    # Run the command.
+    unless output = query(request.key)
+      return nil
+    end
+
+    # Translate the output to ruby.
+    output
+  end
+
+  private
+
+  # Proxy the execution, so it's easier to test.
+  def execute(command, arguments)
+    Puppet::Util.execute(command,arguments)
+  end
+
+  # Call the external command and see if it returns our output.
+  def query(name)
+    external_command = command
+
+    # Make sure it's an arry
+    raise Puppet::DevError, "Exec commands must be an array" unless external_command.is_a?(Array)
+
+    # Make sure it's fully qualified.
+    raise ArgumentError, "You must set the exec parameter to a fully qualified command" unless Puppet::Util.absolute_path?(external_command[0])
+
+    # Add our name to it.
+    external_command << name
+    begin
+      output = execute(external_command, :combine => false)
+    rescue Puppet::ExecutionFailure => detail
+      raise Puppet::Error, "Failed to find #{name} via exec: #{detail}"
+    end
+
+    if output =~ /\A\s*\Z/ # all whitespace
+      Puppet.debug "Empty response for #{name} from #{self.name} terminus"
+      return nil
+    else
+      return output
+    end
+  end
+end

data/lib/vendor/puppet/indirector/face.rb

@@ -0,0 +1,137 @@
+require 'puppet/face'
+
+class Puppet::Indirector::Face < Puppet::Face
+  option "--terminus TERMINUS" do
+    summary "The indirector terminus to use."
+    description <<-EOT
+      Indirector faces expose indirected subsystems of Puppet. These
+      subsystems are each able to retrieve and alter a specific type of data
+      (with the familiar actions of `find`, `search`, `save`, and `destroy`)
+      from an arbitrary number of pluggable backends. In Puppet parlance,
+      these backends are called terminuses.
+
+      Almost all indirected subsystems have a `rest` terminus that interacts
+      with the puppet master's data. Most of them have additional terminuses
+      for various local data models, which are in turn used by the indirected
+      subsystem on the puppet master whenever it receives a remote request.
+
+      The terminus for an action is often determined by context, but
+      occasionally needs to be set explicitly. See the "Notes" section of this
+      face's manpage for more details.
+    EOT
+
+    before_action do |action, args, options|
+      set_terminus(options[:terminus])
+    end
+
+    after_action do |action, args, options|
+      indirection.reset_terminus_class
+    end
+  end
+
+  def self.indirections
+    Puppet::Indirector::Indirection.instances.collect { |t| t.to_s }.sort
+  end
+
+  def self.terminus_classes(indirection)
+    Puppet::Indirector::Terminus.terminus_classes(indirection.to_sym).collect { |t| t.to_s }.sort
+  end
+
+  def call_indirection_method(method, key, options)
+    begin
+      result = indirection.__send__(method, key, options)
+    rescue => detail
+      puts detail.backtrace if Puppet[:trace]
+      raise "Could not call '#{method}' on '#{indirection_name}': #{detail}"
+    end
+
+    return result
+  end
+
+  option "--extra HASH" do
+    summary "Extra arguments to pass to the indirection request"
+    description <<-EOT
+      A terminus can take additional arguments to refine the operation, which
+      are passed as an arbitrary hash to the back-end.  Anything passed as
+      the extra value is just send direct to the back-end.
+    EOT
+    default_to do Hash.new end
+  end
+
+  action :destroy do
+    summary "Delete an object."
+    arguments "<key>"
+    when_invoked {|key, options| call_indirection_method :destroy, key, options[:extra] }
+  end
+
+  action :find do
+    summary "Retrieve an object by name."
+    arguments "<key>"
+    when_invoked {|key, options| call_indirection_method :find, key, options[:extra] }
+  end
+
+  action :save do
+    summary "API only: create or overwrite an object."
+    arguments "<key>"
+    description <<-EOT
+      API only: create or overwrite an object. As the Faces framework does not
+      currently accept data from STDIN, save actions cannot currently be invoked
+      from the command line.
+    EOT
+    when_invoked {|key, options| call_indirection_method :save, key, options[:extra] }
+  end
+
+  action :search do
+    summary "Search for an object or retrieve multiple objects."
+    arguments "<query>"
+    when_invoked {|key, options| call_indirection_method :search, key, options[:extra] }
+  end
+
+  # Print the configuration for the current terminus class
+  action :info do
+    summary "Print the default terminus class for this face."
+    description <<-EOT
+      Prints the default terminus class for this subcommand. Note that different
+      run modes may have different default termini; when in doubt, specify the
+      run mode with the '--mode' option.
+    EOT
+
+    when_invoked do |options|
+      if t = indirection.terminus_class
+        "Run mode '#{Puppet.run_mode.name}': #{t}"
+      else
+        "No default terminus class for run mode '#{Puppet.run_mode.name}'"
+      end
+    end
+  end
+
+  attr_accessor :from
+
+  def indirection_name
+    @indirection_name || name.to_sym
+  end
+
+  # Here's your opportunity to override the indirection name.  By default it
+  # will be the same name as the face.
+  def set_indirection_name(name)
+    @indirection_name = name
+  end
+
+  # Return an indirection associated with a face, if one exists;
+  # One usually does.
+  def indirection
+    unless @indirection
+      @indirection = Puppet::Indirector::Indirection.instance(indirection_name)
+      @indirection or raise "Could not find terminus for #{indirection_name}"
+    end
+    @indirection
+  end
+
+  def set_terminus(from)
+    begin
+      indirection.terminus_class = from
+    rescue => detail
+      raise "Could not set '#{indirection.name}' terminus to '#{from}' (#{detail}); valid terminus types are #{self.class.terminus_classes(indirection.name).join(", ") }"
+    end
+  end
+end

data/lib/vendor/puppet/indirector/facts/active_record.rb

@@ -0,0 +1,36 @@
+require 'puppet/rails/fact_name'
+require 'puppet/rails/fact_value'
+require 'puppet/rails/host'
+require 'puppet/indirector/active_record'
+
+class Puppet::Node::Facts::ActiveRecord < Puppet::Indirector::ActiveRecord
+  use_ar_model Puppet::Rails::Host
+
+  # Find the Rails host and pull its facts as a Facts instance.
+  def find(request)
+    return nil unless host = ar_model.find_by_name(request.key, :include => {:fact_values => :fact_name})
+
+    facts = Puppet::Node::Facts.new(host.name)
+    facts.values = host.get_facts_hash.inject({}) do |hash, ary|
+      # Convert all single-member arrays into plain values.
+      param = ary[0]
+      values = ary[1].collect { |v| v.value }
+      values = values[0] if values.length == 1
+      hash[param] = values
+      hash
+    end
+
+    facts
+  end
+
+  # Save the values from a Facts instance as the facts on a Rails Host instance.
+  def save(request)
+    facts = request.instance
+
+    host = ar_model.find_by_name(facts.name) || ar_model.create(:name => facts.name)
+
+    host.merge_facts(facts.values)
+
+    host.save
+  end
+end

data/lib/vendor/puppet/indirector/facts/couch.rb

@@ -0,0 +1,31 @@
+require 'puppet/node/facts'
+require 'puppet/indirector/couch'
+class Puppet::Node::Facts::Couch < Puppet::Indirector::Couch
+
+  # Return the facts object or nil if there is no document
+  def find(request)
+    doc = super
+    doc ? model.new(doc['_id'], doc['facts']) : nil
+  end
+
+  private
+
+  # Facts values are stored to the document's 'facts' attribute. Hostname is
+  # stored to 'name'
+  #
+  def hash_from(request)
+    super.merge('facts' => request.instance.values)
+  end
+
+  # Facts are stored to the 'node' document.
+  def document_type_for(request)
+    'node'
+  end
+
+  # The id used to store the object in couchdb.
+  def id_for(request)
+    request.key.to_s
+  end
+
+end
+