puppet 3.8.7 → 4.0.0

data/spec/unit/network/http/webrick_spec.rb

@@ -5,7 +5,7 @@ require 'puppet/network/http/webrick'
 
 describe Puppet::Network::HTTP::WEBrick, "after initializing" do
   it "should not be listening" do
-    Puppet::Network::HTTP::WEBrick.new.should_not be_listening
+    expect(Puppet::Network::HTTP::WEBrick.new).not_to be_listening
   end
 end
 
@@ -85,7 +85,7 @@ describe Puppet::Network::HTTP::WEBrick do
 
     it "should be listening" do
       server.listen(address, port)
-      server.should be_listening
+      expect(server).to be_listening
     end
 
     describe "when the REST protocol is requested" do
@@ -112,7 +112,7 @@ describe Puppet::Network::HTTP::WEBrick do
     it "should no longer be listening" do
       server.listen(address, port)
       server.unlisten
-      server.should_not be_listening
+      expect(server).not_to be_listening
     end
   end
 
@@ -132,8 +132,7 @@ describe Puppet::Network::HTTP::WEBrick do
       server.setup_logger
     end
 
-    it "should use the masterhttplog if the run_mode is master" do
-      Puppet.run_mode.stubs(:master?).returns(true)
+    it "should use the masterhttplog" do
       log = make_absolute("/master/log")
       Puppet[:masterhttplog] = log
 
@@ -142,16 +141,6 @@ describe Puppet::Network::HTTP::WEBrick do
       server.setup_logger
     end
 
-    it "should use the httplog if the run_mode is not master" do
-      Puppet.run_mode.stubs(:master?).returns(false)
-      log = make_absolute("/other/log")
-      Puppet[:httplog] = log
-
-      File.expects(:open).with(log, "a+").returns @filehandle
-
-      server.setup_logger
-    end
-
     describe "and creating the logging filehandle" do
       it "should set the close-on-exec flag if supported" do
         if defined? Fcntl::FD_CLOEXEC
@@ -188,17 +177,17 @@ describe Puppet::Network::HTTP::WEBrick do
       logger = mock 'logger'
       WEBrick::Log.expects(:new).returns logger
 
-      server.setup_logger[:Logger].should == logger
+      expect(server.setup_logger[:Logger]).to eq(logger)
     end
 
     it "should return the logger as the access log using both the Common and Referer log format" do
       logger = mock 'logger'
       WEBrick::Log.expects(:new).returns logger
 
-      server.setup_logger[:AccessLog].should == [
+      expect(server.setup_logger[:AccessLog]).to eq([
         [logger, WEBrick::AccessLog::COMMON_LOG_FORMAT],
         [logger, WEBrick::AccessLog::REFERER_LOG_FORMAT]
-      ]
+      ])
     end
   end
 
@@ -219,11 +208,11 @@ describe Puppet::Network::HTTP::WEBrick do
       Puppet::SSL::Host.expects(:localhost).returns host
       host.expects(:key).returns key
 
-      server.setup_ssl[:SSLPrivateKey].should == "mykey"
+      expect(server.setup_ssl[:SSLPrivateKey]).to eq("mykey")
     end
 
     it "should configure the certificate" do
-      server.setup_ssl[:SSLCertificate].should == "mycert"
+      expect(server.setup_ssl[:SSLCertificate]).to eq("mycert")
     end
 
     it "should fail if no CA certificate can be found" do
@@ -236,7 +225,7 @@ describe Puppet::Network::HTTP::WEBrick do
       Puppet.settings[:hostcrl] = 'false'
       Puppet.settings[:localcacert] = localcacert
 
-      server.setup_ssl[:SSLCACertificateFile].should == localcacert
+      expect(server.setup_ssl[:SSLCACertificateFile]).to eq(localcacert)
     end
 
     it "should specify the path to the CA certificate" do
@@ -244,15 +233,15 @@ describe Puppet::Network::HTTP::WEBrick do
       Puppet.settings[:localcacert] = localcacert
       Puppet.settings[:ssl_server_ca_auth] = ssl_server_ca_auth
 
-      server.setup_ssl[:SSLCACertificateFile].should == ssl_server_ca_auth
+      expect(server.setup_ssl[:SSLCACertificateFile]).to eq(ssl_server_ca_auth)
     end
 
     it "should start ssl immediately" do
-      server.setup_ssl[:SSLStartImmediately].should be_true
+      expect(server.setup_ssl[:SSLStartImmediately]).to be_truthy
     end
 
     it "should enable ssl" do
-      server.setup_ssl[:SSLEnable].should be_true
+      expect(server.setup_ssl[:SSLEnable]).to be_truthy
     end
 
     it "should reject SSLv2" do
@@ -268,17 +257,17 @@ describe Puppet::Network::HTTP::WEBrick do
     end
 
     it "should configure the verification method as 'OpenSSL::SSL::VERIFY_PEER'" do
-      server.setup_ssl[:SSLVerifyClient].should == OpenSSL::SSL::VERIFY_PEER
+      expect(server.setup_ssl[:SSLVerifyClient]).to eq(OpenSSL::SSL::VERIFY_PEER)
     end
 
     it "should add an x509 store" do
       host.expects(:ssl_store).returns "mystore"
 
-      server.setup_ssl[:SSLCertificateStore].should == "mystore"
+      expect(server.setup_ssl[:SSLCertificateStore]).to eq("mystore")
     end
 
     it "should set the certificate name to 'nil'" do
-      server.setup_ssl[:SSLCertName].should be_nil
+      expect(server.setup_ssl[:SSLCertName]).to be_nil
     end
 
     it "specifies the allowable ciphers" do

data/spec/unit/network/http_pool_spec.rb

@@ -11,9 +11,9 @@ describe Puppet::Network::HttpPool do
   describe "when managing http instances" do
     it "should return an http instance created with the passed host and port" do
       http = Puppet::Network::HttpPool.http_instance("me", 54321)
-      http.should be_an_instance_of Puppet::Network::HTTP::Connection
-      http.address.should == 'me'
-      http.port.should    == 54321
+      expect(http).to be_an_instance_of Puppet::Network::HTTP::Connection
+      expect(http.address).to eq('me')
+      expect(http.port).to    eq(54321)
     end
 
     it "should support using an alternate http client implementation" do
@@ -29,21 +29,21 @@ describe Puppet::Network::HttpPool do
         orig_class = Puppet::Network::HttpPool.http_client_class
         Puppet::Network::HttpPool.http_client_class = FooClient
         http = Puppet::Network::HttpPool.http_instance("me", 54321)
-        http.should be_an_instance_of FooClient
-        http.host.should == 'me'
-        http.port.should == 54321
+        expect(http).to be_an_instance_of FooClient
+        expect(http.host).to eq('me')
+        expect(http.port).to eq(54321)
       ensure
         Puppet::Network::HttpPool.http_client_class = orig_class
       end
     end
 
     it "should enable ssl on the http instance by default" do
-      Puppet::Network::HttpPool.http_instance("me", 54321).should be_use_ssl
+      expect(Puppet::Network::HttpPool.http_instance("me", 54321)).to be_use_ssl
     end
 
     it "can set ssl using an option" do
-      Puppet::Network::HttpPool.http_instance("me", 54321, false).should_not be_use_ssl
-      Puppet::Network::HttpPool.http_instance("me", 54321, true).should be_use_ssl
+      expect(Puppet::Network::HttpPool.http_instance("me", 54321, false)).not_to be_use_ssl
+      expect(Puppet::Network::HttpPool.http_instance("me", 54321, true)).to be_use_ssl
     end
 
     describe 'peer verification' do
@@ -91,8 +91,8 @@ describe Puppet::Network::HttpPool do
     end
 
     it "should not cache http instances" do
-      Puppet::Network::HttpPool.http_instance("me", 54321).
-        should_not equal(Puppet::Network::HttpPool.http_instance("me", 54321))
+      expect(Puppet::Network::HttpPool.http_instance("me", 54321)).
+        not_to equal(Puppet::Network::HttpPool.http_instance("me", 54321))
     end
   end
 end

data/spec/unit/network/resolver_spec.rb

@@ -76,8 +76,8 @@ describe Puppet::Network::Resolver do
       Puppet::Network::Resolver.each_srv_record(@test_srv_domain) do |hostname, port|
         expected_priority = order.keys.min
 
-        order[expected_priority].should include(hostname)
-        port.should_not be(@test_port)
+        expect(order[expected_priority]).to include(hostname)
+        expect(port).not_to be(@test_port)
 
         # Remove the host from our expected hosts
         order[expected_priority].delete hostname
@@ -109,8 +109,8 @@ describe Puppet::Network::Resolver do
       Puppet::Network::Resolver.each_srv_record(@test_srv_domain, :report) do |hostname, port|
         expected_priority = order.keys.min
 
-        order[expected_priority].should include(hostname)
-        port.should_not be(@test_port)
+        expect(order[expected_priority]).to include(hostname)
+        expect(port).not_to be(@test_port)
 
         # Remove the host from our expected hosts
         order[expected_priority].delete hostname
@@ -150,8 +150,8 @@ describe Puppet::Network::Resolver do
       Puppet::Network::Resolver.each_srv_record(@test_srv_domain, :report) do |hostname, port|
         expected_priority = order.keys.min
 
-        order[expected_priority].should include(hostname)
-        port.should_not be(@test_port)
+        expect(order[expected_priority]).to include(hostname)
+        expect(port).not_to be(@test_port)
 
         # Remove the host from our expected hosts
         order[expected_priority].delete hostname
@@ -164,12 +164,12 @@ describe Puppet::Network::Resolver do
 
   describe "when finding weighted servers" do
     it "should return nil when no records were found" do
-      Puppet::Network::Resolver.find_weighted_server([]).should == nil
+      expect(Puppet::Network::Resolver.find_weighted_server([])).to eq(nil)
     end
 
     it "should return the first record when one record is passed" do
       result = Puppet::Network::Resolver.find_weighted_server([@test_records.first])
-      result.should == @test_records.first
+      expect(result).to eq(@test_records.first)
     end
 
     {
@@ -197,9 +197,9 @@ describe Puppet::Network::Resolver do
           seen[server] += 1
         end
 
-        seen.length.should == records.length
+        expect(seen.length).to eq(records.length)
         records.each do |record|
-          seen[record].should == Puppet::Network::Resolver.weight(record)
+          expect(seen[record]).to eq(Puppet::Network::Resolver.weight(record))
         end
       end
     end

data/spec/unit/network/rights_spec.rb

@@ -16,43 +16,43 @@ describe Puppet::Network::Rights do
         right.allow("*")
         right.restrict_method(allowed_method)
         right.restrict_authenticated(:any)
-        rights.is_request_forbidden_and_why?(:head, "/indirection_name/key", {}).should == nil
+        expect(rights.is_request_forbidden_and_why?(:head, "/indirection_name/key", {})).to eq(nil)
       end
     end
 
     it "should disallow the request if neither :find nor :save is allowed" do
       rights = Puppet::Network::Rights.new
       why_forbidden = rights.is_request_forbidden_and_why?(:head, "/indirection_name/key", {})
-      why_forbidden.should be_instance_of(Puppet::Network::AuthorizationError)
-      why_forbidden.to_s.should == "Forbidden request:  access to /indirection_name/key [find]"
+      expect(why_forbidden).to be_instance_of(Puppet::Network::AuthorizationError)
+      expect(why_forbidden.to_s).to eq("Forbidden request:  access to /indirection_name/key [find]")
     end
   end
 
   it "should throw an error if type can't be determined" do
-    lambda { @right.newright("name") }.should raise_error
+    expect { @right.newright("name") }.to raise_error
   end
 
   describe "when creating new path ACLs" do
     it "should not throw an error if the ACL already exists" do
       @right.newright("/name")
 
-      lambda { @right.newright("/name")}.should_not raise_error
+      expect { @right.newright("/name")}.not_to raise_error
     end
 
     it "should throw an error if the acl uri path is not absolute" do
-      lambda { @right.newright("name")}.should raise_error
+      expect { @right.newright("name")}.to raise_error
     end
 
     it "should create a new ACL with the correct path" do
       @right.newright("/name")
 
-      @right["/name"].should_not be_nil
+      expect(@right["/name"]).not_to be_nil
     end
 
     it "should create an ACL of type Puppet::Network::AuthStore" do
       @right.newright("/name")
 
-      @right["/name"].should be_a_kind_of(Puppet::Network::AuthStore)
+      expect(@right["/name"]).to be_a_kind_of(Puppet::Network::AuthStore)
     end
   end
 
@@ -60,59 +60,59 @@ describe Puppet::Network::Rights do
     it "should not throw an error if the ACL already exists" do
       @right.newright("~ .rb$")
 
-      lambda { @right.newright("~ .rb$")}.should_not raise_error
+      expect { @right.newright("~ .rb$")}.not_to raise_error
     end
 
     it "should create a new ACL with the correct regex" do
       @right.newright("~ .rb$")
 
-      @right.include?(".rb$").should_not be_nil
+      expect(@right.include?(".rb$")).not_to be_nil
     end
 
     it "should be able to lookup the regex" do
       @right.newright("~ .rb$")
 
-      @right[".rb$"].should_not be_nil
+      expect(@right[".rb$"]).not_to be_nil
     end
 
     it "should be able to lookup the regex by its full name" do
       @right.newright("~ .rb$")
 
-      @right["~ .rb$"].should_not be_nil
+      expect(@right["~ .rb$"]).not_to be_nil
     end
 
     it "should create an ACL of type Puppet::Network::AuthStore" do
-      @right.newright("~ .rb$").should be_a_kind_of(Puppet::Network::AuthStore)
+      expect(@right.newright("~ .rb$")).to be_a_kind_of(Puppet::Network::AuthStore)
     end
   end
 
   describe "when checking ACLs existence" do
     it "should return false if there are no matching rights" do
-      @right.include?("name").should be_false
+      expect(@right.include?("name")).to be_falsey
     end
 
     it "should return true if a path right exists" do
       @right.newright("/name")
 
-      @right.include?("/name").should be_true
+      expect(@right.include?("/name")).to be_truthy
     end
 
     it "should return false if no matching path rights exist" do
       @right.newright("/name")
 
-      @right.include?("/differentname").should be_false
+      expect(@right.include?("/differentname")).to be_falsey
     end
 
     it "should return true if a regex right exists" do
       @right.newright("~ .rb$")
 
-      @right.include?(".rb$").should be_true
+      expect(@right.include?(".rb$")).to be_truthy
     end
 
     it "should return false if no matching path rights exist" do
       @right.newright("~ .rb$")
 
-      @right.include?(".pp$").should be_false
+      expect(@right.include?(".pp$")).to be_falsey
     end
   end
 
@@ -132,12 +132,12 @@ describe Puppet::Network::Rights do
 
     it "should return true if is_forbidden_and_why? returns nil" do
       @right.stubs(:is_forbidden_and_why?).returns(nil)
-      @right.allowed?("namespace", :args).should be_true
+      expect(@right.allowed?("namespace", :args)).to be_truthy
     end
 
     it "should return false if is_forbidden_and_why? returns an AuthorizationError" do
       @right.stubs(:is_forbidden_and_why?).returns(Puppet::Network::AuthorizationError.new("forbidden"))
-      @right.allowed?("namespace", :args1, :args2).should be_false
+      expect(@right.allowed?("namespace", :args1, :args2)).to be_falsey
     end
 
     it "should pass the match? return to allowed?" do
@@ -146,7 +146,7 @@ describe Puppet::Network::Rights do
       @pathacl.expects(:match?).returns(:match)
       @pathacl.expects(:allowed?).with { |node,ip,h| h[:match] == :match }.returns(true)
 
-      @right.is_forbidden_and_why?("/path/to/there", {}).should == nil
+      expect(@right.is_forbidden_and_why?("/path/to/there", {})).to eq(nil)
     end
 
     describe "with path acls" do
@@ -171,7 +171,7 @@ describe Puppet::Network::Rights do
         @short_acl.expects(:allowed?).returns(true)
         @long_acl.expects(:allowed?).never
 
-        @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
+        expect(@right.is_forbidden_and_why?("/path/to/there/and/there", {})).to eq(nil)
       end
 
       it "should select the first match that doesn't return :dunno" do
@@ -184,7 +184,7 @@ describe Puppet::Network::Rights do
         @long_acl.expects(:allowed?).returns(:dunno)
         @short_acl.expects(:allowed?).returns(true)
 
-        @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
+        expect(@right.is_forbidden_and_why?("/path/to/there/and/there", {})).to eq(nil)
       end
 
       it "should not select an ACL that doesn't match" do
@@ -197,7 +197,7 @@ describe Puppet::Network::Rights do
         @long_acl.expects(:allowed?).never
         @short_acl.expects(:allowed?).returns(true)
 
-        @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
+        expect(@right.is_forbidden_and_why?("/path/to/there/and/there", {})).to eq(nil)
       end
 
       it "should not raise an AuthorizationError if allowed" do
@@ -206,7 +206,7 @@ describe Puppet::Network::Rights do
         @long_acl.stubs(:match?).returns(true)
         @long_acl.stubs(:allowed?).returns(true)
 
-        @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
+        expect(@right.is_forbidden_and_why?("/path/to/there/and/there", {})).to eq(nil)
       end
 
       it "should raise an AuthorizationError if the match is denied" do
@@ -215,11 +215,11 @@ describe Puppet::Network::Rights do
         @long_acl.stubs(:match?).returns(true)
         @long_acl.stubs(:allowed?).returns(false)
 
-        @right.is_forbidden_and_why?("/path/to/there", {}).should be_instance_of(Puppet::Network::AuthorizationError)
+        expect(@right.is_forbidden_and_why?("/path/to/there", {})).to be_instance_of(Puppet::Network::AuthorizationError)
       end
 
       it "should raise an AuthorizationError if no path match" do
-        @right.is_forbidden_and_why?("/nomatch", {}).should be_instance_of(Puppet::Network::AuthorizationError)
+        expect(@right.is_forbidden_and_why?("/nomatch", {})).to be_instance_of(Puppet::Network::AuthorizationError)
       end
     end
 
@@ -245,7 +245,7 @@ describe Puppet::Network::Rights do
         @regex_acl1.expects(:allowed?).returns(true)
         @regex_acl2.expects(:allowed?).never
 
-        @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
+        expect(@right.is_forbidden_and_why?("/files/repository/myfile/other", {})).to eq(nil)
       end
 
       it "should select the first match that doesn't return :dunno" do
@@ -258,7 +258,7 @@ describe Puppet::Network::Rights do
         @regex_acl1.expects(:allowed?).returns(:dunno)
         @regex_acl2.expects(:allowed?).returns(true)
 
-        @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
+        expect(@right.is_forbidden_and_why?("/files/repository/myfile/other", {})).to eq(nil)
       end
 
       it "should not select an ACL that doesn't match" do
@@ -271,7 +271,7 @@ describe Puppet::Network::Rights do
         @regex_acl1.expects(:allowed?).never
         @regex_acl2.expects(:allowed?).returns(true)
 
-        @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
+        expect(@right.is_forbidden_and_why?("/files/repository/myfile/other", {})).to eq(nil)
       end
 
       it "should not raise an AuthorizationError if allowed" do
@@ -280,15 +280,15 @@ describe Puppet::Network::Rights do
         @regex_acl1.stubs(:match?).returns(true)
         @regex_acl1.stubs(:allowed?).returns(true)
 
-        @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
+        expect(@right.is_forbidden_and_why?("/files/repository/myfile/other", {})).to eq(nil)
       end
 
       it "should raise an error if no regex acl match" do
-        @right.is_forbidden_and_why?("/path", {}).should be_instance_of(Puppet::Network::AuthorizationError)
+        expect(@right.is_forbidden_and_why?("/path", {})).to be_instance_of(Puppet::Network::AuthorizationError)
       end
 
       it "should raise an AuthorizedError on deny" do
-        @right.is_forbidden_and_why?("/path", {}).should be_instance_of(Puppet::Network::AuthorizationError)
+        expect(@right.is_forbidden_and_why?("/path", {})).to be_instance_of(Puppet::Network::AuthorizationError)
       end
 
     end
@@ -301,15 +301,15 @@ describe Puppet::Network::Rights do
 
     describe "with path" do
       it "should match up to its path length" do
-        @acl.match?("/path/that/works").should_not be_nil
+        expect(@acl.match?("/path/that/works")).not_to be_nil
       end
 
       it "should match up to its path length" do
-        @acl.match?("/paththatalsoworks").should_not be_nil
+        expect(@acl.match?("/paththatalsoworks")).not_to be_nil
       end
 
       it "should return nil if no match" do
-        @acl.match?("/notpath").should be_nil
+        expect(@acl.match?("/notpath")).to be_nil
       end
     end
 
@@ -319,39 +319,39 @@ describe Puppet::Network::Rights do
       end
 
       it "should match as a regex" do
-        @acl.match?("this should work.rb").should_not be_nil
+        expect(@acl.match?("this should work.rb")).not_to be_nil
       end
 
       it "should return nil if no match" do
-        @acl.match?("do not match").should be_nil
+        expect(@acl.match?("do not match")).to be_nil
       end
     end
 
     it "should allow all rest methods by default" do
-      @acl.methods.should == Puppet::Network::Rights::Right::ALL
+      expect(@acl.methods).to eq(Puppet::Network::Rights::Right::ALL)
     end
 
     it "should allow only authenticated request by default" do
-      @acl.authentication.should be_true
+      expect(@acl.authentication).to be_truthy
     end
 
     it "should allow modification of the methods filters" do
       @acl.restrict_method(:save)
 
-      @acl.methods.should == [:save]
+      expect(@acl.methods).to eq([:save])
     end
 
     it "should stack methods filters" do
       @acl.restrict_method(:save)
       @acl.restrict_method(:destroy)
 
-      @acl.methods.should == [:save, :destroy]
+      expect(@acl.methods).to eq([:save, :destroy])
     end
 
     it "should raise an error if the method is already filtered" do
       @acl.restrict_method(:save)
 
-      lambda { @acl.restrict_method(:save) }.should raise_error
+      expect { @acl.restrict_method(:save) }.to raise_error
     end
 
     it "should allow setting an environment filters" do
@@ -359,7 +359,7 @@ describe Puppet::Network::Rights do
       Puppet.override(:environments => Puppet::Environments::Static.new(env)) do
         @acl.restrict_environment(:acltest)
 
-        @acl.environment.should == [env]
+        expect(@acl.environment).to eq([env])
       end
     end
 
@@ -367,14 +367,14 @@ describe Puppet::Network::Rights do
       it "should allow filtering on authenticated requests with '#{auth}'" do
         @acl.restrict_authenticated(auth)
 
-        @acl.authentication.should be_true
+        expect(@acl.authentication).to be_truthy
       end
     end
 
     ["off", "no", "false", false, "all", "any", :all, :any].each do |auth|
       it "should allow filtering on authenticated or unauthenticated requests with '#{auth}'" do
         @acl.restrict_authenticated(auth)
-        @acl.authentication.should be_false
+        expect(@acl.authentication).to be_falsey
       end
     end
 
@@ -382,36 +382,46 @@ describe Puppet::Network::Rights do
       it "should return :dunno if this right is not restricted to the given method" do
         @acl.restrict_method(:destroy)
 
-        @acl.allowed?("me","127.0.0.1", { :method => :save } ).should == :dunno
+        expect(@acl.allowed?("me","127.0.0.1", { :method => :save } )).to eq(:dunno)
       end
 
-      it "should return allow/deny if this right is restricted to the given method" do
+      it "should return true if this right is restricted to the given method" do
         @acl.restrict_method(:save)
-        @acl.allow("127.0.0.1")
+        @acl.allow("me")
 
-        @acl.allowed?("me","127.0.0.1", { :method => :save }).should be_true
+        expect(@acl.allowed?("me","127.0.0.1", { :method => :save, :authenticated => true })).to eq true
       end
 
       it "should return :dunno if this right is not restricted to the given environment" do
-        prod = Puppet::Node::Environment.create(:prod, [])
-        Puppet.override(:environments => Puppet::Environments::Static.new(prod)) do
+        prod = Puppet::Node::Environment.create(:production, [])
+        dev = Puppet::Node::Environment.create(:development, [])
+        Puppet.override(:environments => Puppet::Environments::Static.new(prod, dev)) do
           @acl.restrict_environment(:production)
 
-          @acl.allowed?("me","127.0.0.1", { :method => :save, :environment => :development }).should == :dunno
+          expect(@acl.allowed?("me","127.0.0.1", { :method => :save, :environment => dev })).to eq(:dunno)
+        end
+      end
+
+      it "returns true if the request is permitted for this environment" do
+        @acl.allow("me")
+        prod = Puppet::Node::Environment.create(:production, [])
+        Puppet.override(:environments => Puppet::Environments::Static.new(prod)) do
+          @acl.restrict_environment(:production)
+          expect(@acl.allowed?("me", "127.0.0.1", { :method => :save, :authenticated => true, :environment => prod })).to eq true
         end
       end
 
       it "should return :dunno if this right is not restricted to the given request authentication state" do
         @acl.restrict_authenticated(true)
 
-        @acl.allowed?("me","127.0.0.1", { :method => :save, :authenticated => false }).should == :dunno
+        expect(@acl.allowed?("me","127.0.0.1", { :method => :save, :authenticated => false })).to eq(:dunno)
       end
 
-      it "should return allow/deny if this right is restricted to the given request authentication state" do
+      it "returns true if this right is restricted to the given request authentication state" do
         @acl.restrict_authenticated(false)
-        @acl.allow("127.0.0.1")
+        @acl.allow("me")
 
-        @acl.allowed?("me","127.0.0.1", { :authenticated => false }).should be_true
+        expect(@acl.allowed?("me","127.0.0.1", {:method => :save, :authenticated => false })).to eq true
       end
 
       it "should interpolate allow/deny patterns with the given match" do
@@ -425,16 +435,6 @@ describe Puppet::Network::Rights do
 
         @acl.allowed?("me","127.0.0.1", { :method => :save, :match => :match, :authenticated => true })
       end
-
-      # mocha doesn't allow testing super...
-      # it "should delegate to the AuthStore for the result" do
-      #     @acl.method(:save)
-      #
-      #     @acl.expects(:allowed?).with("me","127.0.0.1")
-      #
-      #     @acl.allowed?("me","127.0.0.1", :save)
-      # end
     end
   end
-
 end