puppet 0.24.9 → 0.25.0

data/spec/unit/network/http_pool.rb

@@ -6,105 +6,21 @@
 require File.dirname(__FILE__) + '/../../spec_helper'
 require 'puppet/network/http_pool'
 
-describe Puppet::Network::HttpPool, " when adding certificate information to http instances" do
-    before do
-        @http = mock 'http'
-        [:cert_store=, :verify_mode=, :ca_file=, :cert=, :key=].each { |m| @http.stubs(m) }
-        @store = stub 'store'
-        [:add_file,:purpose=].each { |m| @store.stubs(m) }
+describe Puppet::Network::HttpPool do
+    after do
+        Puppet::Util::Cacher.expire
+        Puppet::Network::HttpPool.clear_http_instances
+        Puppet::Network::HttpPool.instance_variable_set("@ssl_host", nil)
     end
 
     it "should have keep-alive disabled" do
         Puppet::Network::HttpPool::HTTP_KEEP_ALIVE.should be_false
     end
 
-    it "should do nothing if no certificate is available" do
-        Puppet::Network::HttpPool.expects(:read_cert).returns(false)
-        @http.expects(:cert=).never
-        Puppet::Network::HttpPool.cert_setup(@http)
-    end
-
-    it "should add a certificate store" do
-        Puppet::Network::HttpPool.stubs(:read_cert).returns(true)
-        Puppet::Network::HttpPool.stubs(:key).returns(:mykey)
-        OpenSSL::X509::Store.expects(:new).returns(@store)
-        @http.expects(:cert_store=).with(@store)
-
-        Puppet::Network::HttpPool.cert_setup(@http)
-    end
-
-    it "should add the local CA cert to the certificate store" do
-        Puppet::Network::HttpPool.stubs(:read_cert).returns(true)
-        OpenSSL::X509::Store.expects(:new).returns(@store)
-        Puppet.settings.stubs(:value).with(:localcacert).returns("/some/file")
-        Puppet.settings.stubs(:value).with(:localcacert).returns("/some/file")
-        @store.expects(:add_file).with("/some/file")
-
-        Puppet::Network::HttpPool.stubs(:key).returns(:whatever)
-
-        Puppet::Network::HttpPool.cert_setup(@http)
-    end
-
-    it "should set the purpose of the cert store to OpenSSL::X509::PURPOSE_SSL_CLIENT" do
-        Puppet::Network::HttpPool.stubs(:read_cert).returns(true)
-        Puppet::Network::HttpPool.stubs(:key).returns(:mykey)
-        OpenSSL::X509::Store.expects(:new).returns(@store)
-
-        @store.expects(:purpose=).with(OpenSSL::X509::PURPOSE_SSL_CLIENT)
-
-        Puppet::Network::HttpPool.cert_setup(@http)
-    end
-
-    it "should add the client certificate" do
-        Puppet::Network::HttpPool.stubs(:read_cert).returns(true)
-        Puppet::Network::HttpPool.stubs(:cert).returns(:mycert)
-        Puppet::Network::HttpPool.stubs(:key).returns(:mykey)
-        OpenSSL::X509::Store.expects(:new).returns(@store)
-
-        @http.expects(:cert=).with(:mycert)
-
-        Puppet::Network::HttpPool.cert_setup(@http)
-    end
-
-    it "should add the client key" do
-        Puppet::Network::HttpPool.stubs(:read_cert).returns(true)
-        Puppet::Network::HttpPool.stubs(:key).returns(:mykey)
-        OpenSSL::X509::Store.expects(:new).returns(@store)
-
-        @http.expects(:key=).with(:mykey)
-
-        Puppet::Network::HttpPool.cert_setup(@http)
-    end
-
-    it "should set the verify mode to OpenSSL::SSL::VERIFY_PEER" do
-        Puppet::Network::HttpPool.stubs(:read_cert).returns(true)
-        Puppet::Network::HttpPool.stubs(:key).returns(:mykey)
-        OpenSSL::X509::Store.expects(:new).returns(@store)
-
-        @http.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
-
-        Puppet::Network::HttpPool.cert_setup(@http)
-    end
-
-    it "should set the ca file" do
-        Puppet::Network::HttpPool.stubs(:read_cert).returns(true)
-        Puppet.settings.stubs(:value).with(:localcacert).returns("/some/file")
-        OpenSSL::X509::Store.expects(:new).returns(@store)
-
-        @http.expects(:ca_file=).with("/some/file")
-
-        Puppet::Network::HttpPool.stubs(:key).returns(:whatever)
-
-        Puppet::Network::HttpPool.cert_setup(@http)
-    end
-
-    it "should set up certificate information when creating http instances" do
-        Puppet::Network::HttpPool.expects(:cert_setup).with { |i| i.is_a?(Net::HTTP) }
-        Puppet::Network::HttpPool.http_instance("one", "two")
-    end
-
-    after do
-        Puppet::Network::HttpPool.clear_http_instances
+    it "should use the global SSL::Host instance to get its certificate information" do
+        host = mock 'host'
+        Puppet::SSL::Host.expects(:localhost).with().returns host
+        Puppet::Network::HttpPool.ssl_host.should equal(host)
     end
 
     describe "when managing http instances" do
@@ -115,7 +31,7 @@ describe Puppet::Network::HttpPool, " when adding certificate information to htt
         end
 
         before do
-            # All of hte cert stuff is tested elsewhere
+            # All of the cert stuff is tested elsewhere
             Puppet::Network::HttpPool.stubs(:cert_setup)
         end
 
@@ -150,7 +66,7 @@ describe Puppet::Network::HttpPool, " when adding certificate information to htt
             Puppet::Network::HttpPool.http_instance("me", 54321).open_timeout.should == 120
         end
 
-        describe "when http keep-alive is enabled" do
+        describe "and http keep-alive is enabled" do
             before do
                 Puppet::Network::HttpPool.stubs(:keep_alive?).returns true
             end
@@ -201,7 +117,7 @@ describe Puppet::Network::HttpPool, " when adding certificate information to htt
             end
         end
 
-        describe "when http keep-alive is disabled" do
+        describe "and http keep-alive is disabled" do
             before do
                 Puppet::Network::HttpPool.stubs(:keep_alive?).returns false
             end
@@ -213,26 +129,86 @@ describe Puppet::Network::HttpPool, " when adding certificate information to htt
             end
         end
 
-        # We mostly have to do this for testing, since in real life people
-        # won't change certs within a single process.
-        it "should remove its loaded certificate when clearing the cache" do
-            Puppet::Network::HttpPool.instance_variable_set("@cert", :yay)
+        after do
             Puppet::Network::HttpPool.clear_http_instances
-            # Can't use the accessor, because it will read the cert in
-            Puppet::Network::HttpPool.instance_variable_get("@cert").should be_nil
         end
+    end
 
-        # We mostly have to do this for testing, since in real life people
-        # won't change certs within a single process.
-        it "should remove its loaded key when clearing the cache" do
-            Puppet::Network::HttpPool.instance_variable_set("@key", :yay)
-            Puppet::Network::HttpPool.clear_http_instances
-            # Can't use the accessor, because it will read the cert in
-            Puppet::Network::HttpPool.instance_variable_get("@key").should be_nil
+    describe "when adding certificate information to http instances" do
+        before do
+            @http = mock 'http'
+            [:cert_store=, :verify_mode=, :ca_file=, :cert=, :key=].each { |m| @http.stubs(m) }
+            @store = stub 'store'
+
+            @cert = stub 'cert', :content => "real_cert"
+            @key = stub 'key', :content => "real_key"
+            @host = stub 'host', :certificate => @cert, :key => @key, :ssl_store => @store
+
+            Puppet[:confdir] = "/sometthing/else"
+            Puppet.settings.stubs(:value).returns "/some/file"
+            Puppet.settings.stubs(:value).with(:hostcert).returns "/host/cert"
+            Puppet.settings.stubs(:value).with(:localcacert).returns "/local/ca/cert"
+
+            FileTest.stubs(:exist?).with("/host/cert").returns true
+            FileTest.stubs(:exist?).with("/local/ca/cert").returns true
+
+            Puppet::Network::HttpPool.stubs(:ssl_host).returns @host
         end
 
         after do
-            Puppet::Network::HttpPool.clear_http_instances
+            Puppet.settings.clear
+        end
+
+        it "should do nothing if no host certificate is on disk" do
+            FileTest.expects(:exist?).with("/host/cert").returns false
+            @http.expects(:cert=).never
+            Puppet::Network::HttpPool.cert_setup(@http)
+        end
+
+        it "should do nothing if no local certificate is on disk" do
+            FileTest.expects(:exist?).with("/local/ca/cert").returns false
+            @http.expects(:cert=).never
+            Puppet::Network::HttpPool.cert_setup(@http)
+        end
+
+        it "should add a certificate store from the ssl host" do
+            @http.expects(:cert_store=).with(@store)
+
+            Puppet::Network::HttpPool.cert_setup(@http)
+        end
+
+        it "should add the client certificate" do
+            @http.expects(:cert=).with("real_cert")
+
+            Puppet::Network::HttpPool.cert_setup(@http)
+        end
+
+        it "should add the client key" do
+            @http.expects(:key=).with("real_key")
+
+            Puppet::Network::HttpPool.cert_setup(@http)
+        end
+
+        it "should set the verify mode to OpenSSL::SSL::VERIFY_PEER" do
+            @http.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
+
+            Puppet::Network::HttpPool.cert_setup(@http)
+        end
+
+        it "should set the ca file" do
+            Puppet.settings.stubs(:value).returns "/some/file"
+            FileTest.stubs(:exist?).with(Puppet[:hostcert]).returns true
+
+            Puppet.settings.stubs(:value).with(:localcacert).returns "/ca/cert/file"
+            FileTest.stubs(:exist?).with("/ca/cert/file").returns true
+            @http.expects(:ca_file=).with("/ca/cert/file")
+
+            Puppet::Network::HttpPool.cert_setup(@http)
+        end
+
+        it "should set up certificate information when creating http instances" do
+            Puppet::Network::HttpPool.expects(:cert_setup).with { |i| i.is_a?(Net::HTTP) }
+            Puppet::Network::HttpPool.http_instance("one", "two")
         end
     end
 end

data/spec/unit/network/rest_authconfig.rb

@@ -0,0 +1,146 @@
+#!/usr/bin/env ruby
+
+require File.dirname(__FILE__) + '/../../spec_helper'
+
+require 'puppet/network/rest_authconfig'
+
+describe Puppet::Network::RestAuthConfig do
+
+    DEFAULT_ACL = [
+        { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+        # this one will allow all file access, and thus delegate
+        # to fileserver.conf
+        { :acl => "/file" },
+        { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
+        { :acl => "/report", :method => :save, :authenticated => true },
+        { :acl => "/certificate/ca", :method => :find, :authenticated => false },
+        { :acl => "/certificate/", :method => :find, :authenticated => false },
+        { :acl => "/certificate_request", :method => [:find, :save], :authenticated => false },
+    ]
+
+    before :each do
+        FileTest.stubs(:exists?).returns(true)
+        File.stubs(:stat).returns(stub('stat', :ctime => :now))
+        Time.stubs(:now).returns :now
+
+        @authconfig = Puppet::Network::RestAuthConfig.new("dummy", false)
+        @authconfig.stubs(:read)
+
+        @acl = stub_everything 'rights'
+        @authconfig.rights = @acl
+
+        @request = stub 'request', :indirection_name => "path", :key => "to/resource", :ip => "127.0.0.1",
+                                   :node => "me", :method => :save, :environment => :env, :authenticated => true
+    end
+
+    it "should use the puppet default rest authorization file" do
+        Puppet.expects(:[]).with(:rest_authconfig).returns("dummy")
+
+        Puppet::Network::RestAuthConfig.new(nil, false)
+    end
+
+    it "should read the config file when needed" do
+        @authconfig.expects(:read)
+
+        @authconfig.allowed?(@request)
+    end
+
+    it "should ask for authorization to the ACL subsystem" do
+        @acl.expects(:fail_on_deny).with("/path/to/resource", :node => "me", :ip => "127.0.0.1", :method => :save, :environment => :env, :authenticated => true)
+
+        @authconfig.allowed?(@request)
+    end
+
+    describe "when defining an acl with mk_acl" do
+        it "should create a new right for each default acl" do
+            @acl.expects(:newright).with(:path)
+            @authconfig.mk_acl(:acl => :path)
+        end
+
+        it "should allow everyone for each default right" do
+            @acl.expects(:allow).with(:path, "*")
+            @authconfig.mk_acl(:acl => :path)
+        end
+
+        it "should restrict the ACL to a method" do
+            @acl.expects(:restrict_method).with(:path, :method)
+            @authconfig.mk_acl(:acl => :path, :method => :method)
+        end
+
+        it "should restrict the ACL to a specific authentication state" do
+            @acl.expects(:restrict_authenticated).with(:path, :authentication)
+            @authconfig.mk_acl(:acl => :path, :authenticated => :authentication)
+        end
+    end
+
+    describe "when parsing the configuration file" do
+        it "should check for missing ACL after reading the authconfig file" do
+            File.stubs(:open)
+
+            @authconfig.expects(:insert_default_acl)
+
+            @authconfig.parse()
+        end
+    end
+
+    DEFAULT_ACL.each do |acl|
+        it "should insert #{acl} if not present" do
+            @authconfig.rights.stubs(:[]).returns(true)
+            @authconfig.rights.stubs(:[]).with(acl[:acl]).returns(nil)
+
+            @authconfig.expects(:mk_acl).with { |h| h[:acl] == acl[:acl] }
+
+            @authconfig.insert_default_acl
+        end
+
+        it "should not insert #{acl} if present" do
+            @authconfig.rights.stubs(:[]).returns(true)
+            @authconfig.rights.stubs(:[]).with(acl).returns(true)
+
+            @authconfig.expects(:mk_acl).never
+
+            @authconfig.insert_default_acl
+        end
+    end
+
+    it "should create default ACL entries if no file have been read" do
+        Puppet::Network::RestAuthConfig.any_instance.stubs(:exists?).returns(false)
+
+        Puppet::Network::RestAuthConfig.any_instance.expects(:insert_default_acl)
+
+        Puppet::Network::RestAuthConfig.main
+    end
+
+    describe "when adding default ACLs" do
+
+       DEFAULT_ACL.each do |acl|
+            it "should create a default right for #{acl[:acl]}" do
+                @authconfig.stubs(:mk_acl)
+                @authconfig.expects(:mk_acl).with(acl)
+                @authconfig.insert_default_acl
+            end
+        end
+
+        it "should log at info loglevel" do
+            Puppet.expects(:info).at_least_once
+            @authconfig.insert_default_acl
+        end
+
+        it "should create a last catch-all deny all rule" do
+            @authconfig.stubs(:mk_acl)
+            @acl.expects(:newright).with("/")
+            @authconfig.insert_default_acl
+        end
+
+        it "should create a last catch-all deny all rule for any authenticated request state" do
+            @authconfig.stubs(:mk_acl)
+            @acl.stubs(:newright).with("/")
+
+            @acl.expects(:restrict_authenticated).with("/", :any)
+
+            @authconfig.insert_default_acl
+        end
+
+    end
+
+end

data/spec/unit/network/rest_authorization.rb

@@ -0,0 +1,43 @@
+#!/usr/bin/env ruby
+
+require File.dirname(__FILE__) + '/../../spec_helper'
+
+require 'puppet/network/rest_authorization'
+
+class RestAuthorized
+    include Puppet::Network::RestAuthorization
+end
+
+
+describe Puppet::Network::RestAuthorization do
+    before :each do
+        @auth = RestAuthorized.new
+        @authconig = stub 'authconfig'
+        @auth.stubs(:authconfig).returns(@authconfig)
+
+        @request = stub_everything 'request'
+        @request.stubs(:method).returns(:find)
+        @request.stubs(:node).returns("node")
+        @request.stubs(:ip).returns("ip")
+    end
+
+    describe "when testing request authorization" do
+        it "should delegate to the current rest authconfig" do
+            @authconfig.expects(:allowed?).with(@request).returns(true)
+
+            @auth.check_authorization(@request)
+        end
+
+        it "should raise an AuthorizationError if authconfig raises an AuthorizationError" do
+            @authconfig.expects(:allowed?).with(@request).raises(Puppet::Network::AuthorizationError.new("forbidden"))
+
+            lambda { @auth.check_authorization(@request) }.should raise_error(Puppet::Network::AuthorizationError)
+        end
+
+        it "should not raise an AuthorizationError if request is allowed" do
+            @authconfig.expects(:allowed?).with(@request).returns(true)
+
+            lambda { @auth.check_authorization(@request) }.should_not raise_error(Puppet::Network::AuthorizationError)
+        end
+    end
+end

data/spec/unit/network/rights.rb

@@ -0,0 +1,519 @@
+#!/usr/bin/env ruby
+
+require File.dirname(__FILE__) + '/../../spec_helper'
+
+require 'puppet/network/rights'
+
+describe Puppet::Network::Rights do
+    before do
+        @right = Puppet::Network::Rights.new
+    end
+
+    [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |m|
+        it "should have a #{m} method" do
+            @right.should respond_to(m)
+        end
+
+        describe "when using #{m}" do
+            it "should delegate to the correct acl" do
+                acl = stub 'acl'
+                @right.stubs(:[]).returns(acl)
+
+                acl.expects(m).with("me")
+
+                @right.send(m, 'thisacl', "me")
+            end
+        end
+    end
+
+    it "should throw an error if type can't be determined" do
+        lambda { @right.newright("name") }.should raise_error
+    end
+
+    describe "when creating new namespace ACLs" do
+
+        it "should throw an error if the ACL already exists" do
+            @right.newright("[name]")
+
+            lambda { @right.newright("[name]") }.should raise_error
+        end
+
+        it "should create a new ACL with the correct name" do
+            @right.newright("[name]")
+
+            @right["name"].key.should == :name
+        end
+
+        it "should create an ACL of type Puppet::Network::AuthStore" do
+            @right.newright("[name]")
+
+            @right["name"].should be_a_kind_of(Puppet::Network::AuthStore)
+        end
+    end
+
+    describe "when creating new path ACLs" do
+        it "should not throw an error if the ACL already exists" do
+            @right.newright("/name")
+
+            lambda { @right.newright("/name")}.should_not raise_error
+        end
+
+        it "should throw an error if the acl uri path is not absolute" do
+            lambda { @right.newright("name")}.should raise_error
+        end
+
+        it "should create a new ACL with the correct path" do
+            @right.newright("/name")
+
+            @right["/name"].should_not be_nil
+        end
+
+        it "should create an ACL of type Puppet::Network::AuthStore" do
+            @right.newright("/name")
+
+            @right["/name"].should be_a_kind_of(Puppet::Network::AuthStore)
+        end
+    end
+
+    describe "when creating new regex ACLs" do
+        it "should not throw an error if the ACL already exists" do
+            @right.newright("~ .rb$")
+
+            lambda { @right.newright("~ .rb$")}.should_not raise_error
+        end
+
+        it "should create a new ACL with the correct regex" do
+            @right.newright("~ .rb$")
+
+            @right.include?(".rb$").should_not be_nil
+        end
+
+        it "should be able to lookup the regex" do
+            @right.newright("~ .rb$")
+
+            @right[".rb$"].should_not be_nil
+        end
+
+        it "should be able to lookup the regex by its full name" do
+            @right.newright("~ .rb$")
+
+            @right["~ .rb$"].should_not be_nil
+        end
+
+        it "should create an ACL of type Puppet::Network::AuthStore" do
+            @right.newright("~ .rb$").should be_a_kind_of(Puppet::Network::AuthStore)
+        end
+    end
+
+    describe "when checking ACLs existence" do
+        it "should return false if there are no matching rights" do
+            @right.include?("name").should be_false
+        end
+
+        it "should return true if a namespace rights exist" do
+            @right.newright("[name]")
+
+            @right.include?("name").should be_true
+        end
+
+        it "should return false if no matching namespace rights exist" do
+            @right.newright("[name]")
+
+            @right.include?("notname").should be_false
+        end
+
+        it "should return true if a path right exists" do
+            @right.newright("/name")
+
+            @right.include?("/name").should be_true
+        end
+
+        it "should return false if no matching path rights exist" do
+            @right.newright("/name")
+
+            @right.include?("/differentname").should be_false
+        end
+
+        it "should return true if a regex right exists" do
+            @right.newright("~ .rb$")
+
+            @right.include?(".rb$").should be_true
+        end
+
+        it "should return false if no matching path rights exist" do
+            @right.newright("~ .rb$")
+
+            @right.include?(".pp$").should be_false
+        end
+    end
+
+    describe "when checking if right is allowed" do
+        before :each do
+            @right.stubs(:right).returns(nil)
+
+            @pathacl = stub 'pathacl', :acl_type => :regex, :"<=>" => 1, :line => 0, :file => 'dummy'
+            Puppet::Network::Rights::Right.stubs(:new).returns(@pathacl)
+        end
+
+        it "should delegate to fail_on_deny" do
+            @right.expects(:fail_on_deny).with("namespace", :node => "host.domain.com", :ip => "127.0.0.1")
+
+            @right.allowed?("namespace", "host.domain.com", "127.0.0.1")
+        end
+
+        it "should return true if fail_on_deny doesn't fail" do
+            @right.stubs(:fail_on_deny)
+            @right.allowed?("namespace", :args).should be_true
+        end
+
+        it "should return false if fail_on_deny raises an AuthorizationError" do
+            @right.stubs(:fail_on_deny).raises(Puppet::Network::AuthorizationError.new("forbidden"))
+            @right.allowed?("namespace", :args1, :args2).should be_false
+        end
+
+        it "should first check namespace rights" do
+            acl = stub 'acl', :acl_type => :name, :key => :namespace
+            Puppet::Network::Rights::Right.stubs(:new).returns(acl)
+
+            @right.newright("[namespace]")
+            acl.expects(:match?).returns(true)
+            acl.expects(:allowed?).with { |node,ip,h| node == "node" and ip == "ip" }.returns(true)
+
+            @right.fail_on_deny("namespace", { :node => "node", :ip => "ip" } )
+        end
+
+        it "should then check for path rights if no namespace match" do
+            acl = stub 'nmacl', :acl_type => :name, :key => :namespace, :"<=>" => -1, :line => 0, :file => 'dummy'
+            acl.stubs(:match?).returns(false)
+            Puppet::Network::Rights::Right.stubs(:new).with("[namespace]").returns(acl)
+
+            @right.newright("[namespace]")
+            @right.newright("/path/to/there", 0, nil)
+
+            @pathacl.stubs(:match?).returns(true)
+
+            acl.expects(:allowed?).never
+            @pathacl.expects(:allowed?).returns(true)
+
+            @right.fail_on_deny("/path/to/there", {})
+        end
+
+        it "should pass the match? return to allowed?" do
+            @right.newright("/path/to/there")
+
+            @pathacl.expects(:match?).returns(:match)
+            @pathacl.expects(:allowed?).with { |node,ip,h| h[:match] == :match }.returns(true)
+
+            @right.fail_on_deny("/path/to/there", {})
+        end
+
+        describe "with namespace acls" do
+            it "should raise an error if this namespace right doesn't exist" do
+                lambda{ @right.fail_on_deny("namespace") }.should raise_error
+            end
+        end
+
+        describe "with path acls" do
+            before :each do
+                @long_acl = stub 'longpathacl', :name => "/path/to/there", :acl_type => :regex, :line => 0, :file => 'dummy'
+                Puppet::Network::Rights::Right.stubs(:new).with("/path/to/there", 0, nil).returns(@long_acl)
+
+                @short_acl = stub 'shortpathacl', :name => "/path/to", :acl_type => :regex, :line => 0, :file => 'dummy'
+                Puppet::Network::Rights::Right.stubs(:new).with("/path/to", 0, nil).returns(@short_acl)
+
+                @long_acl.stubs(:"<=>").with(@short_acl).returns(0)
+                @short_acl.stubs(:"<=>").with(@long_acl).returns(0)
+            end
+
+            it "should select the first match" do
+                @right.newright("/path/to/there", 0)
+                @right.newright("/path/to", 0)
+
+                @long_acl.stubs(:match?).returns(true)
+                @short_acl.stubs(:match?).returns(true)
+
+                @long_acl.expects(:allowed?).returns(true)
+                @short_acl.expects(:allowed?).never
+
+                @right.fail_on_deny("/path/to/there/and/there", {})
+            end
+
+            it "should select the first match that doesn't return :dunno" do
+                @right.newright("/path/to/there", 0, nil)
+                @right.newright("/path/to", 0, nil)
+
+                @long_acl.stubs(:match?).returns(true)
+                @short_acl.stubs(:match?).returns(true)
+
+                @long_acl.expects(:allowed?).returns(:dunno)
+                @short_acl.expects(:allowed?).returns(true)
+
+                @right.fail_on_deny("/path/to/there/and/there", {})
+            end
+
+            it "should not select an ACL that doesn't match" do
+                @right.newright("/path/to/there", 0)
+                @right.newright("/path/to", 0)
+
+                @long_acl.stubs(:match?).returns(false)
+                @short_acl.stubs(:match?).returns(true)
+
+                @long_acl.expects(:allowed?).never
+                @short_acl.expects(:allowed?).returns(true)
+
+                @right.fail_on_deny("/path/to/there/and/there", {})
+            end
+
+            it "should not raise an AuthorizationError if allowed" do
+                @right.newright("/path/to/there", 0)
+
+                @long_acl.stubs(:match?).returns(true)
+                @long_acl.stubs(:allowed?).returns(true)
+
+                lambda { @right.fail_on_deny("/path/to/there/and/there", {}) }.should_not raise_error(Puppet::Network::AuthorizationError)
+            end
+
+            it "should raise an AuthorizationError if the match is denied" do
+                @right.newright("/path/to/there", 0, nil)
+
+                @long_acl.stubs(:match?).returns(true)
+                @long_acl.stubs(:allowed?).returns(false)
+
+                lambda{ @right.fail_on_deny("/path/to/there", {}) }.should raise_error(Puppet::Network::AuthorizationError)
+            end
+
+            it "should raise an AuthorizationError if no path match" do
+                lambda { @right.fail_on_deny("/nomatch", {}) }.should raise_error(Puppet::Network::AuthorizationError)
+            end
+        end
+
+        describe "with regex acls" do
+            before :each do
+                @regex_acl1 = stub 'regex_acl1', :name => "/files/(.*)/myfile", :acl_type => :regex, :line => 0, :file => 'dummy'
+                Puppet::Network::Rights::Right.stubs(:new).with("~ /files/(.*)/myfile", 0, nil).returns(@regex_acl1)
+
+                @regex_acl2 = stub 'regex_acl2', :name => "/files/(.*)/myfile/", :acl_type => :regex, :line => 0, :file => 'dummy'
+                Puppet::Network::Rights::Right.stubs(:new).with("~ /files/(.*)/myfile/", 0, nil).returns(@regex_acl2)
+
+                @regex_acl1.stubs(:"<=>").with(@regex_acl2).returns(0)
+                @regex_acl2.stubs(:"<=>").with(@regex_acl1).returns(0)
+            end
+
+            it "should select the first match" do
+                @right.newright("~ /files/(.*)/myfile", 0)
+                @right.newright("~ /files/(.*)/myfile/", 0)
+
+                @regex_acl1.stubs(:match?).returns(true)
+                @regex_acl2.stubs(:match?).returns(true)
+
+                @regex_acl1.expects(:allowed?).returns(true)
+                @regex_acl2.expects(:allowed?).never
+
+                @right.fail_on_deny("/files/repository/myfile/other", {})
+            end
+
+            it "should select the first match that doesn't return :dunno" do
+                @right.newright("~ /files/(.*)/myfile", 0)
+                @right.newright("~ /files/(.*)/myfile/", 0)
+
+                @regex_acl1.stubs(:match?).returns(true)
+                @regex_acl2.stubs(:match?).returns(true)
+
+                @regex_acl1.expects(:allowed?).returns(:dunno)
+                @regex_acl2.expects(:allowed?).returns(true)
+
+                @right.fail_on_deny("/files/repository/myfile/other", {})
+            end
+
+            it "should not select an ACL that doesn't match" do
+                @right.newright("~ /files/(.*)/myfile", 0)
+                @right.newright("~ /files/(.*)/myfile/", 0)
+
+                @regex_acl1.stubs(:match?).returns(false)
+                @regex_acl2.stubs(:match?).returns(true)
+
+                @regex_acl1.expects(:allowed?).never
+                @regex_acl2.expects(:allowed?).returns(true)
+
+                @right.fail_on_deny("/files/repository/myfile/other", {})
+            end
+
+            it "should not raise an AuthorizationError if allowed" do
+                @right.newright("~ /files/(.*)/myfile", 0)
+
+                @regex_acl1.stubs(:match?).returns(true)
+                @regex_acl1.stubs(:allowed?).returns(true)
+
+                lambda { @right.fail_on_deny("/files/repository/myfile/other", {}) }.should_not raise_error(Puppet::Network::AuthorizationError)
+            end
+
+            it "should raise an error if no regex acl match" do
+                lambda{ @right.fail_on_deny("/path", {}) }.should raise_error(Puppet::Network::AuthorizationError)
+            end
+
+            it "should raise an AuthorizedError on deny" do
+                lambda { @right.fail_on_deny("/path", {}) }.should raise_error(Puppet::Network::AuthorizationError)
+            end
+
+        end
+    end
+
+    describe Puppet::Network::Rights::Right do
+        before :each do
+            @acl = Puppet::Network::Rights::Right.new("/path",0, nil)
+        end
+
+        describe "with path" do
+            it "should say it's a regex ACL" do
+                @acl.acl_type.should == :regex
+            end
+
+            it "should match up to its path length" do
+                @acl.match?("/path/that/works").should_not be_nil
+            end
+
+            it "should match up to its path length" do
+                @acl.match?("/paththatalsoworks").should_not be_nil
+            end
+
+            it "should return nil if no match" do
+                @acl.match?("/notpath").should be_nil
+            end
+        end
+
+        describe "with regex" do
+            before :each do
+                @acl = Puppet::Network::Rights::Right.new("~ .rb$",0, nil)
+            end
+
+            it "should say it's a regex ACL" do
+                @acl.acl_type.should == :regex
+            end
+
+            it "should match as a regex" do
+                @acl.match?("this shoud work.rb").should_not be_nil
+            end
+
+            it "should return nil if no match" do
+                @acl.match?("do not match").should be_nil
+            end
+        end
+
+        it "should allow all rest methods by default" do
+            @acl.methods.should == Puppet::Network::Rights::Right::ALL
+        end
+
+        it "should allow only authenticated request by default" do
+            @acl.authentication.should be_true
+        end
+
+        it "should allow modification of the methods filters" do
+            @acl.restrict_method(:save)
+
+            @acl.methods.should == [:save]
+        end
+
+        it "should stack methods filters" do
+            @acl.restrict_method(:save)
+            @acl.restrict_method(:destroy)
+
+            @acl.methods.should == [:save, :destroy]
+        end
+
+        it "should raise an error if the method is already filtered" do
+            @acl.restrict_method(:save)
+
+            lambda { @acl.restrict_method(:save) }.should raise_error
+        end
+
+        it "should allow setting an environment filters" do
+            Puppet::Node::Environment.stubs(:new).with(:environment).returns(:env)
+
+            @acl.restrict_environment(:environment)
+
+            @acl.environment.should == [:env]
+        end
+
+        ["on", "yes", "true", true].each do |auth|
+            it "should allow filtering on authenticated requests with '#{auth}'" do
+                @acl.restrict_authenticated(auth)
+
+                @acl.authentication.should be_true
+            end
+        end
+
+        ["off", "no", "false", false].each do |auth|
+            it "should allow filtering on unauthenticated requests with '#{auth}'" do
+                @acl.restrict_authenticated(auth)
+
+                @acl.authentication.should be_false
+            end
+        end
+
+        ["all", "any", :all, :any].each do |auth|
+            it "should not use request authenticated state filtering with '#{auth}'" do
+                @acl.restrict_authenticated(auth)
+
+                @acl.authentication.should be_nil
+            end
+        end
+
+        describe "when checking right authorization" do
+            it "should return :dunno if this right is not restricted to the given method" do
+                @acl.restrict_method(:destroy)
+
+                @acl.allowed?("me","127.0.0.1", { :method => :save } ).should == :dunno
+            end
+
+            it "should return allow/deny if this right is restricted to the given method" do
+                @acl.restrict_method(:save)
+                @acl.allow("127.0.0.1")
+
+                @acl.allowed?("me","127.0.0.1", { :method => :save }).should be_true
+            end
+
+            it "should return :dunno if this right is not restricted to the given environment" do
+                Puppet::Node::Environment.stubs(:new).returns(:production)
+
+                @acl.restrict_environment(:production)
+
+                @acl.allowed?("me","127.0.0.1", { :method => :save, :environment => :development }).should == :dunno
+            end
+
+            it "should return :dunno if this right is not restricted to the given request authentication state" do
+                @acl.restrict_authenticated(true)
+
+                @acl.allowed?("me","127.0.0.1", { :method => :save, :authenticated => false }).should == :dunno
+            end
+
+            it "should return allow/deny if this right is restricted to the given request authentication state" do
+                @acl.restrict_authenticated(false)
+                @acl.allow("127.0.0.1")
+
+                @acl.allowed?("me","127.0.0.1", { :authenticated => false }).should be_true
+            end
+
+            it "should interpolate allow/deny patterns with the given match" do
+                @acl.expects(:interpolate).with(:match)
+
+                @acl.allowed?("me","127.0.0.1", { :method => :save, :match => :match, :authenticated => true })
+            end
+
+            it "should reset interpolation after the match" do
+                @acl.expects(:reset_interpolation)
+
+                @acl.allowed?("me","127.0.0.1", { :method => :save, :match => :match, :authenticated => true })
+            end
+
+            # mocha doesn't allow testing super...
+            # it "should delegate to the AuthStore for the result" do
+            #     @acl.method(:save)
+            #
+            #     @acl.expects(:allowed?).with("me","127.0.0.1")
+            #
+            #     @acl.allowed?("me","127.0.0.1", :save)
+            # end
+        end
+    end
+
+end