puppet 2.7.20 → 2.7.21

data/lib/puppet/network/http/webrick.rb

@@ -106,6 +106,7 @@ class Puppet::Network::HTTP::WEBrick
     results[:SSLCertificate] = host.certificate.content
     results[:SSLStartImmediately] = true
     results[:SSLEnable] = true
+    results[:SSLOptions] = OpenSSL::SSL::OP_NO_SSLv2
 
     raise Puppet::Error, "Could not find CA certificate" unless Puppet::SSL::Certificate.indirection.find(Puppet::SSL::CA_NAME)
 

data/lib/puppet/network/rest_authconfig.rb

@@ -13,7 +13,7 @@ module Puppet
       # to fileserver.conf
       { :acl => "/file" },
       { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
-      { :acl => "/report", :method => :save, :authenticated => true },
+      { :acl => "~ ^\/report\/([^\/]+)$", :method => :save, :allow => '$1', :authenticated => true },
       # These allow `auth any`, because if you can do them anonymously you
       # should probably also be able to do them when trusted.
       { :acl => "/certificate/ca", :method => :find, :authenticated => :any },

data/lib/puppet/parser/templatewrapper.rb

@@ -5,8 +5,6 @@ require 'erb'
 
 class Puppet::Parser::TemplateWrapper
   attr_writer :scope
-  attr_reader :file
-  attr_accessor :string
   include Puppet::Util
   Puppet::Util.logmethods(self)
 
@@ -14,18 +12,22 @@ class Puppet::Parser::TemplateWrapper
     @__scope__ = scope
   end
 
+  def file
+    @__file__
+  end
+
   def scope
     @__scope__
   end
 
   def script_line
     # find which line in the template (if any) we were called from
-    (caller.find { |l| l =~ /#{file}:/ }||"")[/:(\d+):/,1]
+    (caller.find { |l| l =~ /#{@__file__}:/ }||"")[/:(\d+):/,1]
   end
 
   # Should return true if a variable is defined, false if it is not
   def has_variable?(name)
-    scope.lookupvar(name.to_s, :file => file, :line => script_line) != :undefined
+    scope.lookupvar(name.to_s, :file => @__file__, :line => script_line) != :undefined
   end
 
   # Allow templates to access the defined classes
@@ -56,53 +58,51 @@ class Puppet::Parser::TemplateWrapper
   # the missing_method definition here until we declare the syntax finally
   # dead.
   def method_missing(name, *args)
-    value = scope.lookupvar(name.to_s,:file => file,:line => script_line)
+    value = scope.lookupvar(name.to_s,:file => @__file__,:line => script_line)
     if value != :undefined
       return value
     else
       # Just throw an error immediately, instead of searching for
       # other missingmethod things or whatever.
-      raise Puppet::ParseError.new("Could not find value for '#{name}'",@file,script_line)
+      raise Puppet::ParseError.new("Could not find value for '#{name}'", @__file__, script_line)
     end
   end
 
   def file=(filename)
-    unless @file = Puppet::Parser::Files.find_template(filename, scope.compiler.environment.to_s)
+    unless @__file__ = Puppet::Parser::Files.find_template(filename, scope.compiler.environment.to_s)
       raise Puppet::ParseError, "Could not find template '#{filename}'"
     end
 
     # We'll only ever not have a parser in testing, but, eh.
-    scope.known_resource_types.watch_file(file)
-
-    @string = File.read(file)
+    scope.known_resource_types.watch_file(@__file__)
   end
 
   def result(string = nil)
     if string
-      self.string = string
       template_source = "inline template"
     else
-      template_source = file
+      string = File.read(@__file__)
+      template_source = @__file__
     end
 
     # Expose all the variables in our scope as instance variables of the
     # current object, making it possible to access them without conflict
     # to the regular methods.
     benchmark(:debug, "Bound template variables for #{template_source}") do
-      scope.to_hash.each { |name, value|
+      scope.to_hash.each do |name, value|
         if name.kind_of?(String)
           realname = name.gsub(/[^\w]/, "_")
         else
           realname = name
         end
         instance_variable_set("@#{realname}", value)
-      }
+      end
     end
 
     result = nil
     benchmark(:debug, "Interpolated template #{template_source}") do
-      template = ERB.new(self.string, 0, "-")
-      template.filename = file
+      template = ERB.new(string, 0, "-")
+      template.filename = @__file__
       result = template.result(binding)
     end
 
@@ -110,6 +110,6 @@ class Puppet::Parser::TemplateWrapper
   end
 
   def to_s
-    "template[#{(file ? file : "inline")}]"
+    "template[#{(@__file__ ? @__file__ : "inline")}]"
   end
 end

data/lib/puppet/util/monkey_patches.rb

@@ -34,6 +34,21 @@ end
   end
 }
 
+if defined?(YAML::ENGINE) and YAML::ENGINE.yamler == 'psych'
+  def Psych.safely_load(str)
+    result = Psych.parse(str)
+    if invalid_node = result.find { |node| node.tag =~ /!map:(.*)/ || node.tag =~ /!ruby\/hash:(.*)/ }
+      raise ArgumentError, "Illegal YAML mapping found with tag #{invalid_node.tag}; please use !ruby/object:#{$1} instead"
+    else
+      result.to_ruby
+    end
+  end
+else
+  def YAML.safely_load(str)
+    self.load(str)
+  end
+end
+
 def YAML.dump(*args)
   ZAML.dump(*args)
 end
@@ -241,3 +256,46 @@ if RUBY_VERSION == '1.8.5'
     module_function :move
   end
 end
+
+# (#19151) Reject all SSLv2 ciphers and handshakes
+require 'openssl'
+class OpenSSL::SSL::SSLContext
+  if match = /^1\.8\.(\d+)/.match(RUBY_VERSION)
+    older_than_187 = match[1].to_i < 7
+  else
+    older_than_187 = false
+  end
+
+  alias __original_initialize initialize
+  private :__original_initialize
+
+  if older_than_187
+    def initialize(*args)
+      __original_initialize(*args)
+      if bitmask = self.options
+        self.options = bitmask | OpenSSL::SSL::OP_NO_SSLv2
+      else
+        self.options = OpenSSL::SSL::OP_NO_SSLv2
+      end
+      # These are the default ciphers in recent MRI versions.  See
+      # https://github.com/ruby/ruby/blob/v1_9_3_392/ext/openssl/lib/openssl/ssl-internal.rb#L26
+      self.ciphers = "ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW"
+    end
+  else
+    if DEFAULT_PARAMS[:options]
+      DEFAULT_PARAMS[:options] |= OpenSSL::SSL::OP_NO_SSLv2
+    else
+      DEFAULT_PARAMS[:options] = OpenSSL::SSL::OP_NO_SSLv2
+    end
+    DEFAULT_PARAMS[:ciphers] << ':!SSLv2'
+
+    def initialize(*args)
+      __original_initialize(*args)
+      params = {
+        :options => DEFAULT_PARAMS[:options],
+        :ciphers => DEFAULT_PARAMS[:ciphers],
+      }
+      set_params(params)
+    end
+  end
+end

data/lib/puppet/version.rb

@@ -6,7 +6,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 #
 module Puppet
-  PUPPETVERSION = '2.7.20'
+  PUPPETVERSION = '2.7.21'
 
   def self.version
     @puppet_version || PUPPETVERSION

data/spec/integration/indirector/catalog/compiler_spec.rb

@@ -11,6 +11,7 @@ describe Puppet::Resource::Catalog::Compiler do
     @catalog = Puppet::Resource::Catalog.new
     @catalog.add_resource(@one = Puppet::Resource.new(:file, "/one"))
     @catalog.add_resource(@two = Puppet::Resource.new(:file, "/two"))
+    Puppet::Resource::Catalog.indirection.terminus.stubs(:validate)
   end
 
   after { Puppet.settings.clear }

data/spec/integration/indirector/catalog/queue_spec.rb

@@ -6,7 +6,7 @@ require 'puppet/resource/catalog'
 describe "Puppet::Resource::Catalog::Queue", :if => Puppet.features.pson? do
   before do
     Puppet::Resource::Catalog.indirection.terminus(:queue)
-    @catalog = Puppet::Resource::Catalog.new
+    @catalog = Puppet::Resource::Catalog.new("foo")
 
     @one = Puppet::Resource.new(:file, "/one")
     @two = Puppet::Resource.new(:file, "/two")

data/spec/integration/resource/catalog_spec.rb

@@ -48,6 +48,7 @@ describe Puppet::Resource::Catalog do
       Puppet::Resource::Catalog.indirection.stubs(:terminus).returns terminus
 
       node = mock 'node'
+      terminus.stubs(:validate)
       terminus.expects(:find).with { |request| request.options[:use_node] == node }
       Puppet::Resource::Catalog.indirection.find("me", :use_node => node)
     end

data/spec/unit/indirector/catalog/compiler_spec.rb

@@ -53,13 +53,22 @@ describe Puppet::Resource::Catalog::Compiler do
       @request = stub 'request', :key => @name, :node => @name, :options => {}
     end
 
-    it "should directly use provided nodes" do
+    it "should directly use provided nodes for a local request" do
       Puppet::Node.indirection.expects(:find).never
       @compiler.expects(:compile).with(@node)
       @request.stubs(:options).returns(:use_node => @node)
+      @request.stubs(:remote?).returns(false)
       @compiler.find(@request)
     end
 
+    it "rejects a provided node if the request is remote" do
+      @request.stubs(:options).returns(:use_node => @node)
+      @request.stubs(:remote?).returns(true)
+      expect {
+        @compiler.find(@request)
+      }.to raise_error Puppet::Error, /invalid option use_node/i
+    end
+
     it "should use the authenticated node name if no request key is provided" do
       @request.stubs(:key).returns(nil)
       Puppet::Node.indirection.expects(:find).with(@name).returns(@node)
@@ -99,6 +108,24 @@ describe Puppet::Resource::Catalog::Compiler do
       @compiler.find(@request)
     end
 
+    it "requires `facts_format` option if facts are passed in" do
+      facts = Puppet::Node::Facts.new("mynode", :afact => "avalue")
+      request = Puppet::Indirector::Request.new(:catalog, :find, "mynode", :facts => facts)
+      expect {
+        @compiler.find(request)
+      }.to raise_error ArgumentError, /no fact format provided for mynode/
+    end
+
+    it "rejects facts in the request from a different node" do
+      facts = Puppet::Node::Facts.new("differentnode", :afact => "avalue")
+      request = Puppet::Indirector::Request.new(
+        :catalog, :find, "mynode", :facts => facts, :facts_format => "unused"
+      )
+      expect {
+        @compiler.find(request)
+      }.to raise_error Puppet::Error, /fact definition for the wrong node/i
+    end
+
     it "should return the results of compiling as the catalog" do
       Puppet::Node.indirection.stubs(:find).returns(@node)
       config = mock 'config'
@@ -133,7 +160,7 @@ describe Puppet::Resource::Catalog::Compiler do
     before do
       Facter.stubs(:value).returns "something"
       @compiler = Puppet::Resource::Catalog::Compiler.new
-      @request = stub 'request', :options => {}
+      @request = Puppet::Indirector::Request.new(:catalog, :find, "hostname", nil)
 
       @facts = Puppet::Node::Facts.new('hostname', "fact" => "value", "architecture" => "i386")
       Puppet::Node::Facts.indirection.stubs(:save).returns(nil)

data/spec/unit/indirector/indirection_spec.rb

@@ -40,7 +40,7 @@ shared_examples_for "Indirection Delegator" do
       end
     end
 
-    request = stub 'request', :key => "me", :options => {}
+    request = Puppet::Indirector::Request.new(:indirection, :find, "me", nil)
 
     @indirection.stubs(:request).returns request
 
@@ -101,6 +101,16 @@ shared_examples_for "Delegation Authorizer" do
   end
 end
 
+shared_examples_for "Request validator" do
+  it "asks the terminus to validate the request" do
+    @terminus.expects(:validate).raises(Puppet::Indirector::ValidationError, "Invalid")
+    @terminus.expects(@method).never
+    expect {
+      @indirection.send(@method, "key")
+    }.to raise_error Puppet::Indirector::ValidationError
+  end
+end
+
 describe Puppet::Indirector::Indirection do
   describe "when initializing" do
     # (LAK) I've no idea how to test this, really.
@@ -141,6 +151,7 @@ describe Puppet::Indirector::Indirection do
     before :each do
       @terminus_class = mock 'terminus_class'
       @terminus = mock 'terminus'
+      @terminus.stubs(:validate)
       @terminus_class.stubs(:new).returns(@terminus)
       @cache = stub 'cache', :name => "mycache"
       @cache_class = mock 'cache_class'
@@ -211,6 +222,7 @@ describe Puppet::Indirector::Indirection do
 
       it_should_behave_like "Indirection Delegator"
       it_should_behave_like "Delegation Authorizer"
+      it_should_behave_like "Request validator"
 
       it "should return the results of the delegation" do
         @terminus.expects(:find).returns(@instance)
@@ -251,6 +263,7 @@ describe Puppet::Indirector::Indirection do
         before do
           @indirection.cache_class = :cache_terminus
           @cache_class.stubs(:new).returns(@cache)
+          @cache.stubs(:validate)
 
           @instance.stubs(:expired?).returns false
         end
@@ -384,6 +397,7 @@ describe Puppet::Indirector::Indirection do
 
       it_should_behave_like "Indirection Delegator"
       it_should_behave_like "Delegation Authorizer"
+      it_should_behave_like "Request validator"
 
       it "should return true if the head method returned true" do
         @terminus.expects(:head).returns(true)
@@ -501,6 +515,7 @@ describe Puppet::Indirector::Indirection do
 
       it_should_behave_like "Indirection Delegator"
       it_should_behave_like "Delegation Authorizer"
+      it_should_behave_like "Request validator"
 
       it "should return the result of removing the instance" do
         @terminus.stubs(:destroy).returns "yayness"
@@ -539,6 +554,7 @@ describe Puppet::Indirector::Indirection do
 
       it_should_behave_like "Indirection Delegator"
       it_should_behave_like "Delegation Authorizer"
+      it_should_behave_like "Request validator"
 
       it "should set the expiration date on any instances without one set" do
         @terminus.stubs(:search).returns([@instance])
@@ -707,6 +723,7 @@ describe Puppet::Indirector::Indirection do
     before do
       @indirection = Puppet::Indirector::Indirection.new(mock('model'), :test)
       @terminus = mock 'terminus'
+      @terminus.stubs(:validate)
       @terminus_class = stub 'terminus class', :new => @terminus
     end
 

data/spec/unit/indirector/terminus_spec.rb

@@ -1,250 +1,264 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/defaults'
 require 'puppet/indirector'
 require 'puppet/indirector/memory'
 
-describe Puppet::Indirector::Terminus, :'fails_on_ruby_1.9.2' => true do
-  before :each do
-    Puppet::Indirector::Terminus.stubs(:register_terminus_class)
-    @indirection = stub 'indirection', :name => :my_stuff, :register_terminus_type => nil
-    Puppet::Indirector::Indirection.stubs(:instance).with(:my_stuff).returns(@indirection)
-    @abstract_terminus = Class.new(Puppet::Indirector::Terminus) do
-      def self.to_s
-        "Testing::Abstract"
+describe Puppet::Indirector::Terminus do
+  before :all do
+    class Puppet::AbstractConcept
+      extend Puppet::Indirector
+      indirects :abstract_concept
+      attr_accessor :name
+      def initialize(name = "name")
+        @name = name
       end
     end
-    @terminus_class = Class.new(@abstract_terminus) do
-      def self.to_s
-        "MyStuff::TermType"
-      end
+
+    class Puppet::AbstractConcept::Freedom < Puppet::Indirector::Code
     end
-    @terminus = @terminus_class.new
   end
 
-  describe Puppet::Indirector::Terminus do
+  after :all do
+    # Remove the class, unlinking it from the rest of the system.
+    Puppet.send(:remove_const, :AbstractConcept)
+  end
 
-    it "should provide a method for setting terminus class documentation" do
-      @terminus_class.should respond_to(:desc)
-    end
+  let :terminus_class do Puppet::AbstractConcept::Freedom end
+  let :terminus       do terminus_class.new end
+  let :indirection    do Puppet::AbstractConcept.indirection end
+  let :model          do Puppet::AbstractConcept end
 
-    it "should support a class-level name attribute" do
-      @terminus_class.should respond_to(:name)
-    end
+  it "should provide a method for setting terminus class documentation" do
+    terminus_class.should respond_to(:desc)
+  end
 
-    it "should support a class-level indirection attribute" do
-      @terminus_class.should respond_to(:indirection)
-    end
+  it "should support a class-level name attribute" do
+    terminus_class.should respond_to(:name)
+  end
 
-    it "should support a class-level terminus-type attribute" do
-      @terminus_class.should respond_to(:terminus_type)
-    end
+  it "should support a class-level indirection attribute" do
+    terminus_class.should respond_to(:indirection)
+  end
 
-    it "should support a class-level model attribute" do
-      @terminus_class.should respond_to(:model)
-    end
+  it "should support a class-level terminus-type attribute" do
+    terminus_class.should respond_to(:terminus_type)
+  end
 
-    it "should accept indirection instances as its indirection" do
-      indirection = stub 'indirection', :is_a? => true, :register_terminus_type => nil
-      proc { @terminus_class.indirection = indirection }.should_not raise_error
-      @terminus_class.indirection.should equal(indirection)
-    end
+  it "should support a class-level model attribute" do
+    terminus_class.should respond_to(:model)
+  end
 
-    it "should look up indirection instances when only a name has been provided" do
-      indirection = mock 'indirection'
-      Puppet::Indirector::Indirection.expects(:instance).with(:myind).returns(indirection)
-      @terminus_class.indirection = :myind
-      @terminus_class.indirection.should equal(indirection)
-    end
+  it "should accept indirection instances as its indirection" do
+    # The test is that this shouldn't raise, and should preserve the object
+    # instance exactly, hence "equal", not just "==".
+    terminus_class.indirection = indirection
+    terminus_class.indirection.should equal indirection
+  end
 
-    it "should fail when provided a name that does not resolve to an indirection" do
-      Puppet::Indirector::Indirection.expects(:instance).with(:myind).returns(nil)
-      proc { @terminus_class.indirection = :myind }.should raise_error(ArgumentError)
+  it "should look up indirection instances when only a name has been provided" do
+    terminus_class.indirection = :abstract_concept
+    terminus_class.indirection.should equal indirection
+  end
 
-      # It shouldn't overwrite our existing one (or, more normally, it shouldn't set
-      # anything).
-      @terminus_class.indirection.should equal(@indirection)
-    end
+  it "should fail when provided a name that does not resolve to an indirection" do
+    expect {
+      terminus_class.indirection = :exploding_whales
+    }.to raise_error(ArgumentError, /Could not find indirection instance/)
+
+    # We should still have the default indirection.
+    terminus_class.indirection.should equal indirection
   end
 
-  describe Puppet::Indirector::Terminus, " when creating terminus classes" do
-    it "should associate the subclass with an indirection based on the subclass constant" do
-      @terminus.indirection.should equal(@indirection)
+  describe "when a terminus instance" do
+    it "should return the class's name as its name" do
+      terminus.name.should == :freedom
     end
 
-    it "should set the subclass's type to the abstract terminus name" do
-      @terminus.terminus_type.should == :abstract
+    it "should return the class's indirection as its indirection" do
+      terminus.indirection.should equal indirection
     end
 
-    it "should set the subclass's name to the indirection name" do
-      @terminus.name.should == :term_type
+    it "should set the instances's type to the abstract terminus type's name" do
+      terminus.terminus_type.should == :code
     end
 
-    it "should set the subclass's model to the indirection model" do
-      @indirection.expects(:model).returns :yay
-      @terminus.model.should == :yay
+    it "should set the instances's model to the indirection's model" do
+      terminus.model.should equal indirection.model
     end
   end
 
-  describe Puppet::Indirector::Terminus, " when a terminus instance" do
+  describe "when managing terminus classes" do
+    it "should provide a method for registering terminus classes" do
+      Puppet::Indirector::Terminus.should respond_to(:register_terminus_class)
+    end
 
-    it "should return the class's name as its name" do
-      @terminus.name.should == :term_type
+    it "should provide a method for returning terminus classes by name and type" do
+      terminus = stub 'terminus_type', :name => :abstract, :indirection_name => :whatever
+      Puppet::Indirector::Terminus.register_terminus_class(terminus)
+      Puppet::Indirector::Terminus.terminus_class(:whatever, :abstract).should equal(terminus)
     end
 
-    it "should return the class's indirection as its indirection" do
-      @terminus.indirection.should equal(@indirection)
+    it "should set up autoloading for any terminus class types requested" do
+      Puppet::Indirector::Terminus.expects(:instance_load).with(:test2, "puppet/indirector/test2")
+      Puppet::Indirector::Terminus.terminus_class(:test2, :whatever)
     end
 
-    it "should set the instances's type to the abstract terminus type's name" do
-      @terminus.terminus_type.should == :abstract
+    it "should load terminus classes that are not found" do
+      # Set up instance loading; it would normally happen automatically
+      Puppet::Indirector::Terminus.instance_load :test1, "puppet/indirector/test1"
+
+      Puppet::Indirector::Terminus.instance_loader(:test1).expects(:load).with(:yay)
+      Puppet::Indirector::Terminus.terminus_class(:test1, :yay)
     end
 
-    it "should set the instances's model to the indirection's model" do
-      @indirection.expects(:model).returns :yay
-      @terminus.model.should == :yay
+    it "should fail when no indirection can be found" do
+      Puppet::Indirector::Indirection.expects(:instance).with(:abstract_concept).returns(nil)
+      expect {
+        class Puppet::AbstractConcept::Physics < Puppet::Indirector::Code
+        end
+      }.to raise_error(ArgumentError, /Could not find indirection instance/)
     end
-  end
-end
 
-# LAK: This could reasonably be in the Indirection instances, too.  It doesn't make
-# a whole heckuva lot of difference, except that with the instance loading in
-# the Terminus base class, we have to have a check to see if we're already
-# instance-loading a given terminus class type.
-describe Puppet::Indirector::Terminus, " when managing terminus classes" do
-  it "should provide a method for registering terminus classes" do
-    Puppet::Indirector::Terminus.should respond_to(:register_terminus_class)
-  end
+    it "should register the terminus class with the terminus base class" do
+      Puppet::Indirector::Terminus.expects(:register_terminus_class).with do |type|
+        type.indirection_name == :abstract_concept and type.name == :intellect
+      end
 
-  it "should provide a method for returning terminus classes by name and type" do
-    terminus = stub 'terminus_type', :name => :abstract, :indirection_name => :whatever
-    Puppet::Indirector::Terminus.register_terminus_class(terminus)
-    Puppet::Indirector::Terminus.terminus_class(:whatever, :abstract).should equal(terminus)
+      begin
+        class Puppet::AbstractConcept::Intellect < Puppet::Indirector::Code
+        end
+      ensure
+        Puppet::AbstractConcept.send(:remove_const, :Intellect) rescue nil
+      end
+    end
   end
 
-  it "should set up autoloading for any terminus class types requested" do
-    Puppet::Indirector::Terminus.expects(:instance_load).with(:test2, "puppet/indirector/test2")
-    Puppet::Indirector::Terminus.terminus_class(:test2, :whatever)
-  end
+  describe "when parsing class constants for indirection and terminus names" do
+    before :each do
+      Puppet::Indirector::Terminus.stubs(:register_terminus_class)
+    end
 
-  it "should load terminus classes that are not found" do
-    # Set up instance loading; it would normally happen automatically
-    Puppet::Indirector::Terminus.instance_load :test1, "puppet/indirector/test1"
+    let :subclass do
+      subclass = mock 'subclass'
+      subclass.stubs(:to_s).returns("TestInd::OneTwo")
+      subclass.stubs(:mark_as_abstract_terminus)
+      subclass
+    end
 
-    Puppet::Indirector::Terminus.instance_loader(:test1).expects(:load).with(:yay)
-    Puppet::Indirector::Terminus.terminus_class(:test1, :yay)
-  end
+    it "should fail when anonymous classes are used" do
+      expect {
+        Puppet::Indirector::Terminus.inherited(Class.new)
+      }.to raise_error(Puppet::DevError, /Terminus subclasses must have associated constants/)
+    end
 
-  it "should fail when no indirection can be found", :'fails_on_ruby_1.9.2' => true do
-    Puppet::Indirector::Indirection.expects(:instance).with(:my_indirection).returns(nil)
+    it "should use the last term in the constant for the terminus class name" do
+      subclass.expects(:name=).with(:one_two)
+      subclass.stubs(:indirection=)
+      Puppet::Indirector::Terminus.inherited(subclass)
+    end
 
-    @abstract_terminus = Class.new(Puppet::Indirector::Terminus) do
-      def self.to_s
-        "Abstract"
-      end
+    it "should convert the terminus name to a downcased symbol" do
+      subclass.expects(:name=).with(:one_two)
+      subclass.stubs(:indirection=)
+      Puppet::Indirector::Terminus.inherited(subclass)
     end
-    proc {
-      @terminus = Class.new(@abstract_terminus) do
-        def self.to_s
-          "MyIndirection::TestType"
-        end
-      end
-    }.should raise_error(ArgumentError)
-  end
 
-  it "should register the terminus class with the terminus base class", :'fails_on_ruby_1.9.2' => true do
-    Puppet::Indirector::Terminus.expects(:register_terminus_class).with do |type|
-      type.indirection_name == :my_indirection and type.name == :test_terminus
+    it "should use the second to last term in the constant for the indirection name" do
+      subclass.expects(:indirection=).with(:test_ind)
+      subclass.stubs(:name=)
+      subclass.stubs(:terminus_type=)
+      Puppet::Indirector::Memory.inherited(subclass)
     end
-    @indirection = stub 'indirection', :name => :my_indirection, :register_terminus_type => nil
-    Puppet::Indirector::Indirection.expects(:instance).with(:my_indirection).returns(@indirection)
 
-    @abstract_terminus = Class.new(Puppet::Indirector::Terminus) do
-      def self.to_s
-        "Abstract"
-      end
+    it "should convert the indirection name to a downcased symbol" do
+      subclass.expects(:indirection=).with(:test_ind)
+      subclass.stubs(:name=)
+      subclass.stubs(:terminus_type=)
+      Puppet::Indirector::Memory.inherited(subclass)
     end
 
-    @terminus = Class.new(@abstract_terminus) do
-      def self.to_s
-        "MyIndirection::TestTerminus"
-      end
+    it "should convert camel case to lower case with underscores as word separators" do
+      subclass.expects(:name=).with(:one_two)
+      subclass.stubs(:indirection=)
+
+      Puppet::Indirector::Terminus.inherited(subclass)
     end
   end
-end
 
-describe Puppet::Indirector::Terminus, " when parsing class constants for indirection and terminus names" do
-  before do
-    @subclass = mock 'subclass'
-    @subclass.stubs(:to_s).returns("TestInd::OneTwo")
-    @subclass.stubs(:mark_as_abstract_terminus)
-    Puppet::Indirector::Terminus.stubs(:register_terminus_class)
-  end
+  describe "when creating terminus class types" do
+    before :all do
+      Puppet::Indirector::Terminus.stubs(:register_terminus_class)
 
-  it "should fail when anonymous classes are used" do
-    proc { Puppet::Indirector::Terminus.inherited(Class.new) }.should raise_error(Puppet::DevError)
-  end
+      class Puppet::Indirector::Terminus::TestTerminusType < Puppet::Indirector::Terminus
+      end
+    end
 
-  it "should use the last term in the constant for the terminus class name" do
-    @subclass.expects(:name=).with(:one_two)
-    @subclass.stubs(:indirection=)
-    Puppet::Indirector::Terminus.inherited(@subclass)
-  end
+    after :all do
+      Puppet::Indirector::Terminus.send(:remove_const, :TestTerminusType)
+    end
 
-  it "should convert the terminus name to a downcased symbol" do
-    @subclass.expects(:name=).with(:one_two)
-    @subclass.stubs(:indirection=)
-    Puppet::Indirector::Terminus.inherited(@subclass)
-  end
+    let :subclass do
+      Puppet::Indirector::Terminus::TestTerminusType
+    end
+
+    it "should set the name of the abstract subclass to be its class constant" do
+      subclass.name.should == :test_terminus_type
+    end
+
+    it "should mark abstract terminus types as such" do
+      subclass.should be_abstract_terminus
+    end
 
-  it "should use the second to last term in the constant for the indirection name" do
-    @subclass.expects(:indirection=).with(:test_ind)
-    @subclass.stubs(:name=)
-    @subclass.stubs(:terminus_type=)
-    Puppet::Indirector::Memory.inherited(@subclass)
+    it "should not allow instances of abstract subclasses to be created" do
+      expect { subclass.new }.to raise_error(Puppet::DevError)
+    end
   end
 
-  it "should convert the indirection name to a downcased symbol" do
-    @subclass.expects(:indirection=).with(:test_ind)
-    @subclass.stubs(:name=)
-    @subclass.stubs(:terminus_type=)
-    Puppet::Indirector::Memory.inherited(@subclass)
+  describe "when listing terminus classes" do
+    it "should list the terminus files available to load" do
+      Puppet::Util::Autoload.any_instance.stubs(:files_to_load).returns ["/foo/bar/baz", "/max/runs/marathon"]
+      Puppet::Indirector::Terminus.terminus_classes('my_stuff').should == [:baz, :marathon]
+    end
   end
 
-  it "should convert camel case to lower case with underscores as word separators" do
-    @subclass.expects(:name=).with(:one_two)
-    @subclass.stubs(:indirection=)
+  describe "when validating a request" do
+    let :request do
+      Puppet::Indirector::Request.new(indirection.name, :find, "the_key", instance)
+    end
 
-    Puppet::Indirector::Terminus.inherited(@subclass)
-  end
-end
+    describe "`instance.name` does not match the key in the request" do
+      let(:instance) { model.new("wrong_key") }
 
-describe Puppet::Indirector::Terminus, " when creating terminus class types", :'fails_on_ruby_1.9.2' => true do
-  before do
-    Puppet::Indirector::Terminus.stubs(:register_terminus_class)
-    @subclass = Class.new(Puppet::Indirector::Terminus) do
-      def self.to_s
-        "Puppet::Indirector::Terminus::MyTermType"
+      it "raises an error " do
+        expect {
+          terminus.validate(request)
+        }.to raise_error(
+          Puppet::Indirector::ValidationError,
+          /Instance name .* does not match requested key/
+        )
       end
     end
-  end
 
-  it "should set the name of the abstract subclass to be its class constant" do
-    @subclass.name.should equal(:my_term_type)
-  end
+    describe "`instance` is not an instance of the model class" do
+      let(:instance) { mock "instance" }
 
-  it "should mark abstract terminus types as such" do
-    @subclass.should be_abstract_terminus
-  end
+      it "raises an error" do
+        expect {
+          terminus.validate(request)
+        }.to raise_error(
+          Puppet::Indirector::ValidationError,
+          /Invalid instance type/
+        )
+      end
+    end
 
-  it "should not allow instances of abstract subclasses to be created" do
-    proc { @subclass.new }.should raise_error(Puppet::DevError)
-  end
-end
+    describe "the instance key and class match the request key and model class" do
+      let(:instance) { model.new("the_key") }
 
-describe Puppet::Indirector::Terminus, " when listing terminus classes" do
-  it "should list the terminus files available to load" do
-    Puppet::Util::Autoload.any_instance.stubs(:files_to_load).returns ["/foo/bar/baz", "/max/runs/marathon"]
-    Puppet::Indirector::Terminus.terminus_classes('my_stuff').should == [:baz, :marathon]
+      it "passes" do
+        terminus.validate(request)
+      end
+    end
   end
 end