puppet 6.12.0-universal-darwin → 6.17.0-universal-darwin

data/spec/unit/http/external_client_spec.rb

@@ -0,0 +1,201 @@
+require 'spec_helper'
+require 'puppet/http'
+
+# Simple "external" client to make get & post requests. This is used
+# to test the old HTTP API, such as requiring use_ssl and basic_auth
+# to be passed as options.
+class Puppet::HTTP::TestExternal
+  def initialize(host, port, options = {})
+    @host = host
+    @port = port
+    @options = options
+    @factory = Puppet::Network::HTTP::Factory.new
+  end
+
+  def get(path, headers = {}, options = {})
+    request = Net::HTTP::Get.new(path, headers)
+    do_request(request, options)
+  end
+
+  def post(path, data, headers = nil, options = {})
+    request = Net::HTTP::Post.new(path, headers)
+    do_request(request, options)
+  end
+
+  def do_request(request, options)
+    if options[:basic_auth]
+      request.basic_auth(options[:basic_auth][:user], options[:basic_auth][:password])
+    end
+
+    site = Puppet::Network::HTTP::Site.new(@options[:use_ssl] ? 'https' : 'http', @host, @port)
+    http = @factory.create_connection(site)
+    http.start
+    begin
+      http.request(request)
+    ensure
+      http.finish
+    end
+  end
+end
+
+describe Puppet::HTTP::ExternalClient do
+  let(:uri) { URI.parse('https://www.example.com') }
+  let(:http_client_class) { Puppet::HTTP::TestExternal }
+  let(:client) { described_class.new(http_client_class) }
+  let(:credentials) { ['user', 'pass'] }
+
+  context "for GET requests" do
+    it "stringifies keys and encodes values in the query" do
+      stub_request(:get, uri).with(query: "foo=bar%3Dbaz")
+
+      client.get(uri, params: {:foo => "bar=baz"})
+    end
+
+    it "fails if a user passes in an invalid param type" do
+      environment = Puppet::Node::Environment.create(:testing, [])
+
+      expect{client.get(uri, params: {environment: environment})}.to raise_error(Puppet::HTTP::SerializationError, /HTTP REST queries cannot handle values of type/)
+    end
+
+    it "returns the response" do
+      stub_request(:get, uri)
+
+      response = client.get(uri)
+      expect(response).to be_an_instance_of(Puppet::HTTP::Response)
+      expect(response).to be_success
+      expect(response.code).to eq(200)
+    end
+
+    it "returns the entire response body" do
+      stub_request(:get, uri).to_return(body: "abc")
+
+      expect(client.get(uri).body).to eq("abc")
+    end
+
+    it "streams the response body when a block is given" do
+      stub_request(:get, uri).to_return(body: "abc")
+
+      io = StringIO.new
+      client.get(uri) do |response|
+        response.read_body do |data|
+          io.write(data)
+        end
+      end
+
+      expect(io.string).to eq("abc")
+    end
+
+    context 'when connecting' do
+      it 'accepts an ssl context' do
+        stub_request(:get, uri).to_return(body: "abc")
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.get(uri, options: {ssl_context: other_context})
+      end
+
+      it 'accepts include_system_store' do
+        stub_request(:get, uri).to_return(body: "abc")
+
+        client.get(uri, options: {include_system_store: true})
+      end
+    end
+  end
+
+  context "for POST requests" do
+    it "stringifies keys and encodes values in the query" do
+      stub_request(:post, "https://www.example.com").with(query: "foo=bar%3Dbaz")
+
+      client.post(uri, "", params: {:foo => "bar=baz"}, headers: {'Content-Type' => 'text/plain'})
+    end
+
+    it "returns the response" do
+      stub_request(:post, uri)
+
+      response = client.post(uri, "", headers: {'Content-Type' => 'text/plain'})
+      expect(response).to be_an_instance_of(Puppet::HTTP::Response)
+      expect(response).to be_success
+      expect(response.code).to eq(200)
+    end
+
+    it "sets content-type for the body" do
+      stub_request(:post, uri).with(headers: {"Content-Type" => "text/plain"})
+
+      client.post(uri, "hello", headers: {'Content-Type' => 'text/plain'})
+    end
+
+    it "streams the response body when a block is given" do
+      stub_request(:post, uri).to_return(body: "abc")
+
+      io = StringIO.new
+      client.post(uri, "", headers: {'Content-Type' => 'text/plain'}) do |response|
+        response.read_body do |data|
+          io.write(data)
+        end
+      end
+
+      expect(io.string).to eq("abc")
+    end
+
+    it 'raises an ArgumentError if `body` is missing' do
+      expect {
+        client.post(uri, nil, headers: {'Content-Type' => 'text/plain'})
+      }.to raise_error(ArgumentError, /'post' requires a string 'body' argument/)
+    end
+
+    context 'when connecting' do
+      it 'accepts an ssl context' do
+        stub_request(:post, uri)
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.post(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: other_context})
+      end
+
+      it 'accepts include_system_store' do
+        stub_request(:post, uri)
+
+        client.post(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {include_system_store: true})
+      end
+    end
+  end
+
+  context "Basic Auth" do
+    it "submits credentials for GET requests" do
+      stub_request(:get, uri).with(basic_auth: credentials)
+
+      client.get(uri, options: {basic_auth: {user: 'user', password: 'pass'}})
+    end
+
+    it "submits credentials for POST requests" do
+      stub_request(:post, uri).with(basic_auth: credentials)
+
+      client.post(uri, "", options: {content_type: 'text/plain', basic_auth: {user: 'user', password: 'pass'}})
+    end
+
+    it "returns response containing access denied" do
+      stub_request(:get, uri).with(basic_auth: credentials).to_return(status: [403, "Ye Shall Not Pass"])
+
+      response = client.get(uri, options: { basic_auth: {user: 'user', password: 'pass'}})
+      expect(response.code).to eq(403)
+      expect(response.reason).to eq("Ye Shall Not Pass")
+      expect(response).to_not be_success
+    end
+
+    it 'includes basic auth if user is nil' do
+      stub_request(:get, uri).with do |req|
+        expect(req.headers).to include('Authorization')
+      end
+
+      client.get(uri, options: {basic_auth: {user: nil, password: 'pass'}})
+    end
+
+    it 'includes basic auth if password is nil' do
+      stub_request(:get, uri).with do |req|
+        expect(req.headers).to include('Authorization')
+      end
+
+      client.get(uri, options: {basic_auth: {user: 'user', password: nil}})
+    end
+  end
+end

data/spec/unit/http/resolver_spec.rb

@@ -22,10 +22,11 @@ describe Puppet::HTTP::Resolver do
   end
 
   context 'when resolving using server_list' do
+    let(:subject) { Puppet::HTTP::Resolver::ServerList.new(client, server_list_setting: Puppet.settings.setting(:server_list), default_port: 8142, services: Puppet::HTTP::Service::SERVICE_NAMES) }
+
     before :each do
       Puppet[:server_list] = 'ca.example.com:8141,apple.example.com'
     end
-    let(:subject) { Puppet::HTTP::Resolver::ServerList.new(client, server_list_setting: Puppet.settings.setting(:server_list), default_port: 8142, services: [:puppet, :ca]) }
 
     it 'returns a service based on the current server_list setting' do
       stub_request(:get, "https://ca.example.com:8141/status/v1/simple/master").to_return(status: 200)
@@ -43,7 +44,18 @@ describe Puppet::HTTP::Resolver do
       expect(service.url.to_s).to eq("https://ca.example.com:8141/puppet-ca/v1")
     end
 
-    it 'falls fails if no servers in server_list are accessible' do
+    it 'logs unsuccessful HTTP 500 responses' do
+      Puppet[:log_level] = "debug"
+
+      stub_request(:get, "https://ca.example.com:8141/status/v1/simple/master").to_return(status: [500, 'Internal Server Error'])
+      stub_request(:get, "https://apple.example.com:8142/status/v1/simple/master").to_return(status: 200)
+
+      subject.resolve(session, :ca)
+
+      expect(@logs.map(&:message)).to include(/Puppet server ca.example.com:8141 is unavailable: 500 Internal Server Error/)
+    end
+
+    it 'fails if no servers in server_list are accessible' do
       stub_request(:get, "https://ca.example.com:8141/status/v1/simple/master").to_return(status: 503)
       stub_request(:get, "https://apple.example.com:8142/status/v1/simple/master").to_return(status: 503)
 
@@ -58,6 +70,26 @@ describe Puppet::HTTP::Resolver do
       expect(service).to be_an_instance_of(Puppet::HTTP::Service::Ca)
       expect(service.url.to_s).to eq("https://apple.example.com:8142/puppet-ca/v1")
     end
+
+    it 'resolves once per session' do
+      failed = stub_request(:get, "https://ca.example.com:8141/status/v1/simple/master").to_return(status: 503)
+      passed = stub_request(:get, "https://apple.example.com:8142/status/v1/simple/master").to_return(status: 200)
+
+      service = subject.resolve(session, :puppet)
+      expect(service).to be_a(Puppet::HTTP::Service::Compiler)
+      expect(service.url.to_s).to eq("https://apple.example.com:8142/puppet/v3")
+
+      service = subject.resolve(session, :fileserver)
+      expect(service).to be_a(Puppet::HTTP::Service::FileServer)
+      expect(service.url.to_s).to eq("https://apple.example.com:8142/puppet/v3")
+
+      service = subject.resolve(session, :report)
+      expect(service).to be_a(Puppet::HTTP::Service::Report)
+      expect(service.url.to_s).to eq("https://apple.example.com:8142/puppet/v3")
+
+      expect(failed).to have_been_requested
+      expect(passed).to have_been_requested
+    end
   end
 
   context 'when resolving using SRV' do

data/spec/unit/http/response_spec.rb

@@ -0,0 +1,75 @@
+require 'spec_helper'
+require 'puppet/http'
+
+describe Puppet::HTTP::Response do
+  let(:uri) { URI.parse('https://www.example.com') }
+  let(:client) { Puppet::HTTP::Client.new }
+
+  it "returns the request URL" do
+    stub_request(:get, uri)
+
+    response = client.get(uri)
+    expect(response.url).to eq(uri)
+  end
+
+  it "returns the HTTP code" do
+    stub_request(:get, uri)
+
+    response = client.get(uri)
+    expect(response.code).to eq(200)
+  end
+
+  it "returns the HTTP reason string" do
+    stub_request(:get, uri).to_return(status: [418, "I'm a teapot"])
+
+    response = client.get(uri)
+    expect(response.reason).to eq("I'm a teapot")
+  end
+
+  it "returns the response body" do
+    stub_request(:get, uri).to_return(status: 200, body: "I'm the body")
+
+    response = client.get(uri)
+    expect(response.body).to eq("I'm the body")
+  end
+
+  it "streams the response body" do
+    stub_request(:get, uri).to_return(status: 200, body: "I'm the streaming body")
+
+    content = StringIO.new
+    client.get(uri) do |response|
+      response.read_body do |data|
+        content << data
+      end
+    end
+    expect(content.string).to eq("I'm the streaming body")
+  end
+
+  it "raises if a block isn't given when streaming" do
+    stub_request(:get, uri).to_return(status: 200, body: "")
+
+    expect {
+      client.get(uri) do |response|
+        response.read_body
+      end
+    }.to raise_error(Puppet::HTTP::HTTPError, %r{Request to https://www.example.com failed after .* seconds: A block is required})
+  end
+
+  it "returns success for all 2xx codes" do
+    stub_request(:get, uri).to_return(status: 202)
+
+    expect(client.get(uri)).to be_success
+  end
+
+  it "returns a header value" do
+    stub_request(:get, uri).to_return(status: 200, headers: { 'Content-Encoding' => 'gzip' })
+
+    expect(client.get(uri)['Content-Encoding']).to eq('gzip')
+  end
+
+  it "enumerates headers" do
+    stub_request(:get, uri).to_return(status: 200, headers: { 'Content-Encoding' => 'gzip' })
+
+    expect(client.get(uri).each_header.to_a).to eq([['content-encoding', 'gzip']])
+  end
+end

data/spec/unit/http/service/ca_spec.rb

@@ -5,6 +5,7 @@ require 'puppet/http'
 describe Puppet::HTTP::Service::Ca do
   let(:ssl_context) { Puppet::SSL::SSLContext.new }
   let(:client) { Puppet::HTTP::Client.new(ssl_context: ssl_context) }
+  let(:session) { Puppet::HTTP::Session.new(client, []) }
   let(:subject) { client.create_session.route_to(:ca) }
 
   before :each do
@@ -23,15 +24,6 @@ describe Puppet::HTTP::Service::Ca do
 
       subject.get_certificate('ca')
     end
-
-
-    it 'includes the X-Puppet-Profiling header when Puppet[:profile] is true' do
-      stub_request(:get, uri).with(headers: {'X-Puppet-Version' => /./, 'User-Agent' => /./, 'X-Puppet-Profiling' => 'true'})
-
-      Puppet[:profile] = true
-
-      subject.get_certificate('ca')
-    end
   end
 
   context 'when routing to the CA service' do
@@ -64,10 +56,27 @@ describe Puppet::HTTP::Service::Ca do
     let(:pem) { cert.to_pem }
     let(:url) { "https://www.example.com/puppet-ca/v1/certificate/ca" }
 
+    it 'includes headers set via the :http_extra_headers and :profile settings' do
+      stub_request(:get, url).with(headers: {'Example-Header' => 'real-thing', 'another' => 'thing', 'X-Puppet-Profiling' => 'true'})
+
+      Puppet[:http_extra_headers] = 'Example-Header:real-thing,another:thing'
+      Puppet[:profile] = true
+
+      subject.get_certificate('ca')
+    end
+
     it 'gets a certificate from the "certificate" endpoint' do
       stub_request(:get, url).to_return(body: pem)
 
-      expect(subject.get_certificate('ca')).to eq(pem)
+      _, body = subject.get_certificate('ca')
+      expect(body).to eq(pem)
+    end
+
+    it 'returns the request response' do
+      stub_request(:get, url).to_return(body: pem)
+
+      resp, _ = subject.get_certificate('ca')
+      expect(resp).to be_a(Puppet::HTTP::Response)
     end
 
     it 'accepts text/plain responses' do
@@ -94,10 +103,27 @@ describe Puppet::HTTP::Service::Ca do
     let(:pem) { crl.to_pem }
     let(:url) { "https://www.example.com/puppet-ca/v1/certificate_revocation_list/ca" }
 
+    it 'includes headers set via the :http_extra_headers and :profile settings' do
+      stub_request(:get, url).with(headers: {'Example-Header' => 'real-thing', 'another' => 'thing', 'X-Puppet-Profiling' => 'true'})
+
+      Puppet[:http_extra_headers] = 'Example-Header:real-thing,another:thing'
+      Puppet[:profile] = true
+
+      subject.get_certificate_revocation_list
+    end
+
     it 'gets a CRL from "certificate_revocation_list" endpoint' do
       stub_request(:get, url).to_return(body: pem)
 
-      expect(subject.get_certificate_revocation_list).to eq(pem)
+      _, body = subject.get_certificate_revocation_list
+      expect(body).to eq(pem)
+    end
+
+    it 'returns the request response' do
+      stub_request(:get, url).to_return(body: pem)
+
+      resp, _ = subject.get_certificate_revocation_list
+      expect(resp).to be_a(Puppet::HTTP::Response)
     end
 
     it 'accepts text/plain responses' do
@@ -136,12 +162,28 @@ describe Puppet::HTTP::Service::Ca do
     let(:pem) { request.to_pem }
     let(:url) { "https://www.example.com/puppet-ca/v1/certificate_request/infinity" }
 
+    it 'includes headers set via the :http_extra_headers and :profile settings' do
+      stub_request(:put, url).with(headers: {'Example-Header' => 'real-thing', 'another' => 'thing', 'X-Puppet-Profiling' => 'true'})
+
+      Puppet[:http_extra_headers] = 'Example-Header:real-thing,another:thing'
+      Puppet[:profile] = true
+
+      subject.put_certificate_request('infinity', request)
+    end
+
     it 'submits a CSR to the "certificate_request" endpoint' do
       stub_request(:put, url).with(body: pem, headers: { 'Content-Type' => 'text/plain' })
 
       subject.put_certificate_request('infinity', request)
     end
 
+    it 'returns the request response' do
+      stub_request(:put, url).with(body: pem, headers: { 'Content-Type' => 'text/plain' })
+
+      resp = subject.put_certificate_request('infinity', request)
+      expect(resp).to be_a(Puppet::HTTP::Response)
+    end
+
     it 'raises response error if unsuccessful' do
       stub_request(:put, url).to_return(status: [400, 'Bad Request'])
 

data/spec/unit/http/service/compiler_spec.rb

@@ -0,0 +1,627 @@
+# coding: utf-8
+require 'spec_helper'
+require 'webmock/rspec'
+require 'puppet/http'
+
+describe Puppet::HTTP::Service::Compiler do
+  let(:ssl_context) { Puppet::SSL::SSLContext.new }
+  let(:client) { Puppet::HTTP::Client.new(ssl_context: ssl_context) }
+  let(:subject) { client.create_session.route_to(:puppet) }
+  let(:environment) { 'testing' }
+  let(:certname) { 'ziggy' }
+  let(:node) { Puppet::Node.new(certname) }
+  let(:facts) { Puppet::Node::Facts.new(certname) }
+  let(:catalog) { Puppet::Resource::Catalog.new(certname) }
+  let(:status) { Puppet::Status.new }
+  let(:formatter) { Puppet::Network::FormatHandler.format(:json) }
+
+  before :each do
+    Puppet[:server] = 'compiler.example.com'
+    Puppet[:masterport] = 8140
+
+    Puppet::Node::Facts.indirection.terminus_class = :memory
+  end
+
+  context 'when making requests' do
+    let(:uri) {"https://compiler.example.com:8140/puppet/v3/catalog/ziggy?environment=testing"}
+
+    it 'includes default HTTP headers' do
+      stub_request(:post, uri).with do |request|
+        expect(request.headers).to include({'X-Puppet-Version' => /./, 'User-Agent' => /./})
+        expect(request.headers).to_not include('X-Puppet-Profiling')
+      end.to_return(body: formatter.render(catalog), headers: {'Content-Type' => formatter.mime })
+
+      subject.post_catalog(certname, environment: environment, facts: facts)
+    end
+  end
+
+  context 'when routing to the compiler service' do
+    it 'defaults the server and port based on settings' do
+      Puppet[:server] = 'compiler2.example.com'
+      Puppet[:masterport] = 8141
+
+      stub_request(:post, "https://compiler2.example.com:8141/puppet/v3/catalog/ziggy?environment=testing")
+        .to_return(body: formatter.render(catalog), headers: {'Content-Type' => formatter.mime })
+
+      subject.post_catalog(certname, environment: environment, facts: facts)
+    end
+  end
+
+  context 'when posting for a catalog' do
+    let(:uri) { %r{/puppet/v3/catalog/ziggy} }
+    let(:catalog_response) { { body: formatter.render(catalog), headers: {'Content-Type' => formatter.mime } } }
+
+    it 'includes puppet headers set via the :http_extra_headers and :profile settings' do
+      stub_request(:post, uri).with(headers: {'Example-Header' => 'real-thing', 'another' => 'thing', 'X-Puppet-Profiling' => 'true'}).
+        to_return(body: formatter.render(catalog), headers: {'Content-Type' => formatter.mime })
+
+      Puppet[:http_extra_headers] = 'Example-Header:real-thing,another:thing'
+      Puppet[:profile] = true
+
+      subject.post_catalog(certname, environment: environment, facts: facts)
+    end
+
+    it 'submits facts as application/json by default' do
+      stub_request(:post, uri)
+        .with(body: hash_including("facts_format" => /application\/json/))
+        .to_return(**catalog_response)
+
+      subject.post_catalog(certname, environment: environment, facts: facts)
+    end
+
+    it 'submits facts as pson if set as the preferred format' do
+      Puppet[:preferred_serialization_format] = "pson"
+
+      stub_request(:post, uri)
+        .with(body: hash_including("facts_format" => /pson/))
+        .to_return(**catalog_response)
+
+      subject.post_catalog(certname, environment: environment, facts: facts)
+    end
+
+    it 'includes environment as a query parameter AND in the POST body' do
+      stub_request(:post, uri)
+        .with(query: {"environment" => "outerspace"},
+              body: hash_including("environment" => 'outerspace'))
+        .to_return(**catalog_response)
+
+      subject.post_catalog(certname, environment: 'outerspace', facts: facts)
+    end
+
+    it 'includes configured_environment' do
+      stub_request(:post, uri)
+        .with(body: hash_including("configured_environment" => 'agent_specified'))
+        .to_return(**catalog_response)
+
+      subject.post_catalog(certname, environment: 'production', facts: facts, configured_environment: 'agent_specified')
+    end
+
+    it 'includes transaction_uuid' do
+      uuid = "ec3d2844-b236-4287-b0ad-632fbb4d1ff0"
+
+      stub_request(:post, uri)
+        .with(body: hash_including("transaction_uuid" => uuid))
+        .to_return(**catalog_response)
+
+      subject.post_catalog(certname, environment: 'production', facts: facts, transaction_uuid: uuid)
+    end
+
+    it 'includes job_uuid' do
+      uuid = "3dd13eec-1b6b-4b5d-867b-148193e0593e"
+
+      stub_request(:post, uri)
+        .with(body: hash_including("job_uuid" => uuid))
+        .to_return(**catalog_response)
+
+      subject.post_catalog(certname, environment: 'production', facts: facts, job_uuid: uuid)
+    end
+
+    it 'includes static_catalog' do
+      stub_request(:post, uri)
+        .with(body: hash_including("static_catalog" => "false"))
+        .to_return(**catalog_response)
+
+      subject.post_catalog(certname, environment: 'production', facts: facts, static_catalog: false)
+    end
+
+    it 'includes dot-separated list of checksum_types' do
+      stub_request(:post, uri)
+        .with(body: hash_including("checksum_type" => "sha256.sha384"))
+        .to_return(**catalog_response)
+
+      subject.post_catalog(certname, environment: 'production', facts: facts, checksum_type: %w[sha256 sha384])
+    end
+
+    it 'returns a deserialized catalog' do
+      stub_request(:post, uri)
+        .to_return(**catalog_response)
+
+      _, cat = subject.post_catalog(certname, environment: 'production', facts: facts)
+      expect(cat).to be_a(Puppet::Resource::Catalog)
+      expect(cat.name).to eq(certname)
+    end
+
+    it 'returns the request response' do
+      stub_request(:post, uri)
+        .to_return(**catalog_response)
+
+      resp, _ = subject.post_catalog(certname, environment: 'production', facts: facts)
+      expect(resp).to be_a(Puppet::HTTP::Response)
+    end
+
+    it 'raises a response error if unsuccessful' do
+      stub_request(:post, uri)
+        .to_return(status: [500, "Server Error"])
+
+      expect {
+        subject.post_catalog(certname, environment: 'production', facts: facts)
+      }.to raise_error do |err|
+        expect(err).to be_an_instance_of(Puppet::HTTP::ResponseError)
+        expect(err.message).to eq('Server Error')
+        expect(err.response.code).to eq(500)
+      end
+    end
+
+    it 'raises a protocol error if the content-type header is missing' do
+      stub_request(:post, uri)
+        .to_return(body: "content-type is missing")
+
+      expect {
+        subject.post_catalog(certname, environment: 'production', facts: facts)
+      }.to raise_error(Puppet::HTTP::ProtocolError, /No content type in http response; cannot parse/)
+    end
+
+    it 'raises a serialization error if the content is invalid' do
+      stub_request(:post, uri)
+        .to_return(body: "this isn't valid JSON", headers: {'Content-Type' => 'application/json'})
+
+      expect {
+        subject.post_catalog(certname, environment: 'production', facts: facts)
+      }.to raise_error(Puppet::HTTP::SerializationError, /Failed to deserialize Puppet::Resource::Catalog from json/)
+    end
+
+    context 'serializing facts' do
+      facts_with_special_characters = [
+        { :hash => { 'afact' => 'a+b' }, :encoded => 'a%2Bb' },
+        { :hash => { 'afact' => 'a b' }, :encoded => 'a%20b' },
+        { :hash => { 'afact' => 'a&b' }, :encoded => 'a%26b' },
+        { :hash => { 'afact' => 'a*b' }, :encoded => 'a%2Ab' },
+        { :hash => { 'afact' => 'a=b' }, :encoded => 'a%3Db' },
+        # different UTF-8 widths
+        # 1-byte A
+        # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
+        # 3-byte ᚠ - http://www.fileformat.info/info/unicode/char/16A0/index.htm - 0xE1 0x9A 0xA0 / 225 154 160
+        # 4-byte 𠜎 - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
+        { :hash => { 'afact' => "A\u06FF\u16A0\u{2070E}" }, :encoded => 'A%DB%BF%E1%9A%A0%F0%A0%9C%8E' },
+      ]
+
+      facts_with_special_characters.each do |test_fact|
+        it "escapes special characters #{test_fact[:hash]}" do
+          facts = Puppet::Node::Facts.new(certname, test_fact[:hash])
+          Puppet::Node::Facts.indirection.save(facts)
+
+          stub_request(:post, uri)
+            .with(body: hash_including("facts" => /#{test_fact[:encoded]}/))
+            .to_return(**catalog_response)
+
+          subject.post_catalog(certname, environment: environment, facts: facts)
+        end
+      end
+    end
+  end
+
+  context 'when getting a node' do
+    let(:uri) { %r{/puppet/v3/node/ziggy} }
+    let(:node_response) { { body: formatter.render(node), headers: {'Content-Type' => formatter.mime } } }
+
+    it 'includes custom headers set via the :http_extra_headers and :profile settings' do
+      stub_request(:get, uri).with(headers: {'Example-Header' => 'real-thing', 'another' => 'thing', 'X-Puppet-Profiling' => 'true'}).
+        to_return(**node_response)
+
+      Puppet[:http_extra_headers] = 'Example-Header:real-thing,another:thing'
+      Puppet[:profile] = true
+
+      subject.get_node(certname, environment: 'production')
+    end
+
+    it 'includes environment' do
+      stub_request(:get, uri)
+          .with(query: hash_including("environment" => "outerspace"))
+          .to_return(**node_response)
+
+      subject.get_node(certname, environment: 'outerspace')
+    end
+
+    it 'includes configured_environment' do
+      stub_request(:get, uri)
+        .with(query: hash_including("configured_environment" => 'agent_specified'))
+        .to_return(**node_response)
+
+      subject.get_node(certname, environment: 'production', configured_environment: 'agent_specified')
+    end
+
+    it 'includes transaction_uuid' do
+      uuid = "ec3d2844-b236-4287-b0ad-632fbb4d1ff0"
+
+      stub_request(:get, uri)
+        .with(query: hash_including("transaction_uuid" => uuid))
+        .to_return(**node_response)
+
+      subject.get_node(certname, environment: 'production', transaction_uuid: uuid)
+    end
+
+    it 'returns a deserialized node' do
+      stub_request(:get, uri)
+        .to_return(**node_response)
+
+      _, n = subject.get_node(certname, environment: 'production')
+      expect(n).to be_a(Puppet::Node)
+      expect(n.name).to eq(certname)
+    end
+
+    it 'returns the request response' do
+      stub_request(:get, uri)
+        .to_return(**node_response)
+
+      resp, _ = subject.get_node(certname, environment: 'production')
+      expect(resp).to be_a(Puppet::HTTP::Response)
+    end
+
+    it 'raises a response error if unsuccessful' do
+      stub_request(:get, uri)
+        .to_return(status: [500, "Server Error"])
+
+      expect {
+        subject.get_node(certname, environment: 'production')
+      }.to raise_error do |err|
+        expect(err).to be_an_instance_of(Puppet::HTTP::ResponseError)
+        expect(err.message).to eq('Server Error')
+        expect(err.response.code).to eq(500)
+      end
+    end
+
+    it 'raises a protocol error if the content-type header is missing' do
+      stub_request(:get, uri)
+        .to_return(body: "content-type is missing")
+
+      expect {
+        subject.get_node(certname, environment: 'production')
+      }.to raise_error(Puppet::HTTP::ProtocolError, /No content type in http response; cannot parse/)
+    end
+
+    it 'raises a serialization error if the content is invalid' do
+      stub_request(:get, uri)
+        .to_return(body: "this isn't valid JSON", headers: {'Content-Type' => 'application/json'})
+
+      expect {
+        subject.get_node(certname, environment: 'production')
+      }.to raise_error(Puppet::HTTP::SerializationError, /Failed to deserialize Puppet::Node from json/)
+    end
+  end
+
+  context 'when getting facts' do
+    let(:uri) { %r{/puppet/v3/facts/ziggy} }
+    let(:facts_response) { { body: formatter.render(facts), headers: {'Content-Type' => formatter.mime } } }
+
+    it 'includes environment' do
+      stub_request(:get, uri)
+          .with(query: hash_including("environment" => "outerspace"))
+          .to_return(**facts_response)
+
+      subject.get_facts(certname, environment: 'outerspace')
+    end
+
+    it 'returns a deserialized facts object' do
+      stub_request(:get, uri)
+        .to_return(**facts_response)
+
+      _, n = subject.get_facts(certname, environment: 'production')
+      expect(n).to be_a(Puppet::Node::Facts)
+      expect(n.name).to eq(certname)
+    end
+
+    it 'returns the request response' do
+      stub_request(:get, uri)
+        .to_return(**facts_response)
+
+      resp, _ = subject.get_facts(certname, environment: 'production')
+      expect(resp).to be_a(Puppet::HTTP::Response)
+    end
+
+    it 'raises a response error if unsuccessful' do
+      stub_request(:get, uri)
+        .to_return(status: [500, "Server Error"])
+
+      expect {
+        subject.get_facts(certname, environment: 'production')
+      }.to raise_error do |err|
+        expect(err).to be_an_instance_of(Puppet::HTTP::ResponseError)
+        expect(err.message).to eq('Server Error')
+        expect(err.response.code).to eq(500)
+      end
+    end
+
+    it 'raises a protocol error if the content-type header is missing' do
+      stub_request(:get, uri)
+        .to_return(body: "content-type is missing")
+
+      expect {
+        subject.get_facts(certname, environment: 'production')
+      }.to raise_error(Puppet::HTTP::ProtocolError, /No content type in http response; cannot parse/)
+    end
+
+    it 'raises a serialization error if the content is invalid' do
+      stub_request(:get, uri)
+        .to_return(body: "this isn't valid JSON", headers: {'Content-Type' => 'application/json'})
+
+      expect {
+        subject.get_facts(certname, environment: 'production')
+      }.to raise_error(Puppet::HTTP::SerializationError, /Failed to deserialize Puppet::Node::Facts from json/)
+    end
+  end
+
+  context 'when putting facts' do
+    let(:uri) { %r{/puppet/v3/facts/ziggy} }
+
+    it 'includes custom headers set the :http_extra_headers and :profile settings' do
+      stub_request(:put, uri).with(headers: {'Example-Header' => 'real-thing', 'another' => 'thing', 'X-Puppet-Profiling' => 'true'})
+
+      Puppet[:http_extra_headers] = 'Example-Header:real-thing,another:thing'
+      Puppet[:profile] = true
+
+      subject.put_facts(certname, environment: environment, facts: facts)
+    end
+
+    it 'serializes facts in the body' do
+      facts = Puppet::Node::Facts.new(certname, { 'domain' => 'zork'})
+      Puppet::Node::Facts.indirection.save(facts)
+
+      stub_request(:put, uri)
+        .with(body: hash_including("name" => "ziggy", "values" => {"domain" => "zork"}))
+
+      subject.put_facts(certname, environment: environment, facts: facts)
+    end
+
+    it 'includes environment' do
+      stub_request(:put, uri)
+        .with(query: {"environment" => "outerspace"})
+
+      subject.put_facts(certname, environment: 'outerspace', facts: facts)
+    end
+
+    it 'returns the request response' do
+      # the REST API returns the filename, good grief
+      stub_request(:put, uri)
+        .to_return(status: 200, body: "/opt/puppetlabs/server/data/puppetserver/yaml/facts/#{certname}.yaml")
+
+      expect(subject.put_facts(certname, environment: environment, facts: facts)).to be_a(Puppet::HTTP::Response)
+    end
+
+    it 'raises a response error if unsuccessful' do
+      stub_request(:put, uri)
+        .to_return(status: [500, "Server Error"])
+
+      expect {
+        subject.put_facts(certname, environment: environment, facts: facts)
+      }.to raise_error do |err|
+        expect(err).to be_an_instance_of(Puppet::HTTP::ResponseError)
+        expect(err.message).to eq('Server Error')
+        expect(err.response.code).to eq(500)
+      end
+    end
+
+    it 'raises a serialization error if the report cannot be serialized' do
+      invalid_facts = Puppet::Node::Facts.new(certname, {'invalid_utf8_sequence' => "\xE2\x82".force_encoding('binary')})
+      expect {
+        subject.put_facts(certname, environment: 'production', facts: invalid_facts)
+      }.to raise_error(Puppet::HTTP::SerializationError, /Failed to serialize Puppet::Node::Facts to json: "\\xE2" from ASCII-8BIT to UTF-8/)
+    end
+  end
+
+  context 'when getting status' do
+    let(:uri) { %r{/puppet/v3/status/ziggy} }
+    let(:status_response) { { body: formatter.render(status), headers: {'Content-Type' => formatter.mime } } }
+
+    it 'always sends production' do
+      stub_request(:get, uri)
+          .with(query: hash_including("environment" => "production"))
+          .to_return(**status_response)
+
+      subject.get_status(certname)
+    end
+
+    it 'returns a deserialized status' do
+      stub_request(:get, uri)
+        .to_return(**status_response)
+
+      _, s = subject.get_status(certname)
+      expect(s).to be_a(Puppet::Status)
+      expect(s.status).to eq("is_alive" => true)
+    end
+
+    it 'returns the request response' do
+      stub_request(:get, uri)
+        .to_return(**status_response)
+
+      resp, _ = subject.get_status(certname)
+      expect(resp).to be_a(Puppet::HTTP::Response)
+    end
+
+    it 'raises a response error if unsuccessful' do
+      stub_request(:get, uri)
+        .to_return(status: [500, "Server Error"])
+
+      expect {
+        subject.get_status(certname)
+      }.to raise_error do |err|
+        expect(err).to be_an_instance_of(Puppet::HTTP::ResponseError)
+        expect(err.message).to eq('Server Error')
+        expect(err.response.code).to eq(500)
+      end
+    end
+
+    it 'raises a protocol error if the content-type header is missing' do
+      stub_request(:get, uri)
+        .to_return(body: "content-type is missing")
+
+      expect {
+        subject.get_status(certname)
+      }.to raise_error(Puppet::HTTP::ProtocolError, /No content type in http response; cannot parse/)
+    end
+
+    it 'raises a serialization error if the content is invalid' do
+      stub_request(:get, uri)
+        .to_return(body: "this isn't valid JSON", headers: {'Content-Type' => 'application/json'})
+
+      expect {
+        subject.get_status(certname)
+      }.to raise_error(Puppet::HTTP::SerializationError, /Failed to deserialize Puppet::Status from json/)
+    end
+  end
+
+  context 'filebucket' do
+    let(:filebucket_file) { Puppet::FileBucket::File.new('file to store') }
+    let(:formatter) { Puppet::Network::FormatHandler.format(:binary) }
+    let(:path) { "md5/4aabe1257043bd03ce4c3319c155bc55" }
+    let(:uri) { %r{/puppet/v3/file_bucket_file/#{path}} }
+
+    context 'when getting a file' do
+      let(:status_response) { { body: formatter.render(filebucket_file), headers: {'Content-Type' => 'application/octet-stream' }}}
+
+      it 'includes default HTTP headers' do
+        stub_request(:get, uri).with do |request|
+          expect(request.headers).to include({
+            'X-Puppet-Version' => /./,
+            'User-Agent' => /./,
+            'Accept' => 'application/octet-stream'
+            })
+          expect(request.headers).to_not include('X-Puppet-Profiling')
+        end.to_return(**status_response)
+
+        subject.get_filebucket_file(path, environment: 'production')
+      end
+
+      it 'always the environment as a parameter' do
+        stub_request(:get, uri).with(query: hash_including('environment' => 'production')).to_return(**status_response)
+
+        subject.get_filebucket_file(path, environment: 'production')
+      end
+
+      {bucket_path: 'path', diff_with: '4aabe1257043bd0', list_all: 'true', fromdate: '20200404', todate: '20200404'}.each do |param, val|
+        it "includes #{param} as a parameter in the request if #{param} is set" do
+          stub_request(:get, uri).with(query: hash_including(param => val)).to_return(**status_response)
+
+          options = { param => val }
+          subject.get_filebucket_file(path, environment: 'production', **options)
+        end
+      end
+
+      it "doesn't include :diff_with as a query param if :bucket_path is nil" do
+        stub_request(:get, uri).with do |request|
+          expect(request.uri.query).not_to match(/diff_with/)
+        end.to_return(**status_response)
+
+        subject.get_filebucket_file(path, environment: 'production', diff_with: nil)
+      end
+
+      it 'returns a deserialized response' do
+        stub_request(:get, uri)
+        .to_return(**status_response)
+
+        _, s = subject.get_filebucket_file(path, environment: 'production')
+        expect(s).to be_a(Puppet::FileBucket::File)
+        expect(s.contents).to eq('file to store')
+      end
+
+      it 'returns the request response' do
+        stub_request(:get, uri)
+        .to_return(**status_response)
+
+        resp, _ = subject.get_filebucket_file(path, environment: 'production')
+        expect(resp).to be_a(Puppet::HTTP::Response)
+      end
+    end
+
+    context 'when putting a file' do
+      let(:status_response) { { status: 200, body: '' } }
+
+      it 'includes default HTTP headers' do
+        stub_request(:put, uri).with do |request|
+          expect(request.headers).to include({
+            'X-Puppet-Version' => /./,
+            'User-Agent' => /./,
+            'Accept' => 'application/octet-stream',
+            'Content-Type' => 'application/octet-stream'
+            })
+          expect(request.headers).to_not include('X-Puppet-Profiling')
+        end.to_return(**status_response)
+
+        subject.put_filebucket_file(path, body: filebucket_file.contents, environment: 'production')
+      end
+
+      it 'always the environment as a parameter' do
+        stub_request(:put, uri).with(query: hash_including('environment' => 'production')).to_return(**status_response)
+
+        subject.put_filebucket_file(path, body: filebucket_file.contents, environment: 'production')
+      end
+
+      it 'sends the file contents as the request body' do
+        stub_request(:put, uri).with(body: filebucket_file.contents).to_return(**status_response)
+
+        subject.put_filebucket_file(path, body: filebucket_file.contents, environment: 'production')
+      end
+
+      it 'returns the request response' do
+        stub_request(:put, uri)
+        .to_return(**status_response)
+
+        s = subject.put_filebucket_file(path, body: filebucket_file.contents, environment: 'production')
+        expect(s).to be_a(Puppet::HTTP::Response)
+      end
+    end
+
+    context 'when heading a file' do
+      let(:status_response) {{ status: 200 }}
+
+      it 'includes default HTTP headers' do
+        stub_request(:head, uri).with do |request|
+          expect(request.headers).to include({
+            'X-Puppet-Version' => /./,
+            'User-Agent' => /./,
+            'Accept' => 'application/octet-stream',
+            })
+          expect(request.headers).to_not include('X-Puppet-Profiling')
+        end.to_return(**status_response)
+
+        subject.head_filebucket_file(path, environment: 'production')
+      end
+
+      it 'always the environment as a parameter' do
+        stub_request(:head, uri).with(query: hash_including('environment' => 'production')).to_return(**status_response)
+
+        subject.head_filebucket_file(path, environment: 'production')
+      end
+
+      it "includes :bucket_path as a parameter in the request if :bucket_path is set" do
+        stub_request(:head, uri).with(query: hash_including(:bucket_path => 'some/path')).to_return(**status_response)
+
+        subject.head_filebucket_file(path, environment: 'production', bucket_path: 'some/path')
+      end
+
+      it "doesn't include :bucket_path as a query param if :bucket_path is nil" do
+        stub_request(:head, uri).with do |request|
+          expect(request.uri.query).not_to match(/bucket_path/)
+        end.to_return(**status_response)
+
+        subject.head_filebucket_file(path, environment: 'production', bucket_path: nil)
+      end
+
+      it "returns the request response" do
+        stub_request(:head, uri).with(query: hash_including(:bucket_path => 'some/path')).to_return(**status_response)
+
+        resp = subject.head_filebucket_file(path, environment: 'production', bucket_path: 'some/path')
+        expect(resp).to be_a(Puppet::HTTP::Response)
+      end
+    end
+  end
+end