puppet 6.16.0-universal-darwin → 6.20.0-universal-darwin

data/spec/unit/type/filebucket_spec.rb

@@ -21,7 +21,7 @@ describe Puppet::Type.type(:filebucket) do
   end
 
   it "should not have a default port" do
-    Puppet.settings[:masterport] = 50
+    Puppet.settings[:serverport] = 50
     expect(Puppet::Type.type(:filebucket).new(:name => "main")[:port]).to eq(nil)
   end
 

data/spec/unit/type/group_spec.rb

@@ -60,9 +60,12 @@ describe Puppet::Type.type(:group) do
   end
 
   it "delegates the existence check to its provider" do
-    provider = @class.provide(:testing) {}
+    provider = @class.provide(:testing) do
+      def exists?
+        true
+      end
+    end
     provider_instance = provider.new
-    expect(provider_instance).to receive(:exists?).and_return(true)
 
     type = @class.new(:name => "group", :provider => provider_instance)
 
@@ -77,20 +80,24 @@ describe Puppet::Type.type(:group) do
         def members
           []
         end
+
+        def members_insync?(current, should)
+          current == should
+        end
+
+        def members_to_s(values)
+          values.map { |v| "#{v} ()" }.join(', ')
+        end
       end
     end
     let (:provider_instance) { provider.new }
     let (:type) { @class.new(:name => "group", :provider => provider_instance, :members => ['user1']) }
 
     it "insync? calls members_insync?" do
-      expect(provider_instance).to receive(:members_insync?).with(['user1'], ['user1']).and_return(true)
       expect(type.property(:members).insync?(['user1'])).to be_truthy
     end
 
     it "is_to_s and should_to_s call members_to_s" do
-      expect(provider_instance).to receive(:members_to_s).with(['user1', 'user2']).and_return("user1 (), user2 ()")
-      expect(provider_instance).to receive(:members_to_s).with(['user1']).and_return("user1 ()")
-
       expect(type.property(:members).is_to_s('user1')).to eq('user1 ()')
       expect(type.property(:members).should_to_s('user1,user2')).to eq('user1 (), user2 ()')
     end

data/spec/unit/type/resources_spec.rb

@@ -6,6 +6,9 @@ Puppet::Type.newtype(:purgeable_test) do
   newparam(:name) {}
 end
 Puppet::Type.type(:purgeable_test).provide(:purgeable_test) do
+  def self.instances
+    []
+  end
 end
 
 resources = Puppet::Type.type(:resources)
@@ -46,19 +49,16 @@ describe resources do
     end
 
     it "cannot be set to true for a resource type that does not accept ensure" do
-      allow(instance.resource_type).to receive(:respond_to?).and_return(true)
-      allow(instance.resource_type).to receive(:validproperty?).and_return(false)
-      expect { instance[:purge] = 'yes' }.to raise_error Puppet::Error
+      allow(instance.resource_type).to receive(:validproperty?).with(:ensure).and_return(false)
+      expect { instance[:purge] = 'yes' }.to raise_error Puppet::Error, /Purging is only supported on types that accept 'ensure'/
     end
 
     it "cannot be set to true for a resource type that does not have instances" do
-      allow(instance.resource_type).to receive(:respond_to?).and_return(false)
-      allow(instance.resource_type).to receive(:validproperty?).and_return(true)
-      expect { instance[:purge] = 'yes' }.to raise_error Puppet::Error
+      allow(instance.resource_type).to receive(:respond_to?).with(:instances).and_return(false)
+      expect { instance[:purge] = 'yes' }.to raise_error Puppet::Error, /Purging resources of type file is not supported/
     end
 
     it "can be set to true for a resource type that has instances and can accept ensure" do
-      allow(instance.resource_type).to receive(:respond_to?).and_return(true)
       allow(instance.resource_type).to receive(:validproperty?).and_return(true)
       expect { instance[:purge] = 'yes' }.to_not raise_error
     end

data/spec/unit/type/service_spec.rb

@@ -145,6 +145,199 @@ describe test_title, "when validating attribute values" do
     end
   end
 
+  describe "the service logon credentials" do 
+    before do
+      provider_class_with_logon_credentials = Puppet::Type.type(:service).provide(:simple) do
+        has_features :manages_logon_credentials
+        def logonpassword=(value) end
+      end
+      allow(Puppet::Type.type(:service)).to receive(:defaultprovider).and_return(provider_class_with_logon_credentials)
+    end
+
+    describe "the 'logonaccount' property" do
+      it "should not be munged nor checked when not on Windows" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'NonWindowsUser')
+
+        expect { service }.not_to raise_error
+        expect(service[:logonaccount]).to eq('NonWindowsUser')
+      end
+
+      context "when on Windows", :if => Puppet::Util::Platform.windows? do
+        before do
+          allow(Puppet::Util::Windows::User).to receive(:password_is?).and_return(true)
+          allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
+        end
+
+        it "should fail when the `Log On As A Service` right is missing from given user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.to raise_error(Puppet::Error, /"myPC\\myUser" is missing the 'Log On As A Service' right./)
+        end
+
+        it "should fail when the `Log On As A Service` right is set to denied for given user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("SeDenyServiceLogonRight")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.to raise_error(Puppet::Error, /"myPC\\myUser" has the 'Log On As A Service' right set to denied./)
+        end
+
+        it "should not fail when given user has the `Log On As A Service` right" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("SeServiceLogonRight")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.not_to raise_error
+        end
+
+        it "should not fail when given user is a default system account even if the `Log On As A Service` right is missing" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).and_return(true)
+
+          expect(Puppet::Util::Windows::User).not_to receive(:get_rights)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.not_to raise_error
+        end
+
+        ['LocalSystem', '.\LocalSystem', 'myPC\LocalSystem', 'lOcALsysTem'].each do |user_input|
+          it "should succesfully munge #{user_input} to 'LocalSystem'" do
+            service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => user_input)
+
+            expect { service }.not_to raise_error
+            expect(service[:logonaccount]).to eq('LocalSystem')
+          end
+        end
+
+        it "should succesfully munge local account" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('.\myUser')
+        end
+
+        it "should succesfully munge domain account" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("DomainUser", nil, nil, "myDomain", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'DomainUser')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('myDomain\DomainUser')
+        end
+
+        it "should succesfully munge well known user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeWellKnownGroup))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'LocalService')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('NT AUTHORITY\LOCAL SERVICE')
+        end
+
+        it "should succesfully munge a SID" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("NETWORK SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'S-1-5-20')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('NT AUTHORITY\NETWORK SERVICE')
+        end
+
+        it "should fail when account is invalid" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(nil)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'InvalidUser') }.to raise_error(Puppet::Error, /"InvalidUser" is not a valid account/)
+        end
+
+        it "should fail when sid type is not user or well known user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("Administrators", nil, nil, "BUILTIN", :SidTypeAlias))
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'Administrators') }.to raise_error(Puppet::Error, /"Administrators" is not a valid account/)
+        end
+      end
+    end
+
+    describe "the logonpassword parameter" do
+      it "should fail when logonaccount is not being managed as well" do
+        expect { Puppet::Type.type(:service).new(:name => "yay", :logonpassword => 'myPass') }.to raise_error(Puppet::Error, /The 'logonaccount' parameter is mandatory when setting 'logonpassword'./)
+      end
+
+      it "should default to empty string when only logonaccount is being managed" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser')
+
+        expect { service }.not_to raise_error
+        expect(service[:logonpassword]).to eq("")
+      end
+
+      it "should default to nil when not even logonaccount is being managed" do
+        service = Puppet::Type.type(:service).new(:name => "yay")
+        expect(service[:logonpassword]).to eq(nil)
+      end
+
+      it "should fail when logonpassword includes the ':' character" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'my:Pass') }.to raise_error(Puppet::Error, /Passwords cannot include ':'/)
+      end
+
+      it "should not further check the password against given account when not on Windows" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myPass') }.not_to raise_error
+      end
+
+      context "when on Windows", :if => Puppet::Util::Platform.windows? do
+        before do
+          allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(name_to_principal_result)
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
+        end
+
+        it "should pass validation when given account is 'LocalSystem'" do
+          allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('LocalSystem').and_return(true)
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('LocalSystem').and_return(false)
+
+          expect(Puppet::Util::Windows::SID).not_to receive(:name_to_principal)
+          expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'LocalSystem') }.not_to raise_error
+        end
+
+        ['LOCAL SERVICE', 'NETWORK SERVICE', 'SYSTEM'].each do |predefined_local_account|
+          describe "when given account is #{predefined_local_account}" do
+            let(:name_to_principal_result) do
+              Puppet::Util::Windows::SID::Principal.new(predefined_local_account, nil, nil, "NT AUTHORITY", :SidTypeUser)
+            end
+
+            it "should pass validation" do
+              allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(predefined_local_account).and_return(false)
+              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with(predefined_local_account).and_return(true)
+              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with("NT AUTHORITY\\#{predefined_local_account}").and_return(true)
+
+              expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
+              expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => predefined_local_account) }.not_to raise_error
+            end
+          end
+        end
+
+        let(:name_to_principal_result) do
+          Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser)
+        end
+
+        describe "when given logonaccount is not a predefined local account" do
+          before do
+            allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('myUser').and_return(false)
+            allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('myUser').and_return(false)
+            allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('.\\myUser').and_return(false)
+          end
+
+          it "should pass validation if password is proven correct" do
+            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myPass', '.').and_return(true)
+            expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myPass') }.not_to raise_error
+          end
+
+          it "should not pass validation if password check fails" do
+            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myWrongPass', '.').and_return(false)
+            expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myWrongPass') }.to raise_error(Puppet::Error, /The given password is invalid for user '.\\myUser'/)
+          end
+        end
+      end
+    end
+  end
+
   it "should support :true as a value to :hasstatus" do
     srv = Puppet::Type.type(:service).new(:name => "yay", :hasstatus => :true)
     expect(srv[:hasstatus]).to eq(:true)
@@ -295,7 +488,7 @@ describe test_title, "when changing the host" do
   it "insyncness should be resolved by provider instead of superclass implementation when provider responds to the 'enabled_insync?' method" do
     allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
     @service[:enable] = true
-    allow(@service.provider).to receive(:respond_to?).with(:enabled_insync?).and_return(true)
+    allow(@service.provider).to receive(:respond_to?).with(:enabled_insync?, any_args).and_return(true)
     allow(@service.provider).to receive(:enabled_insync?).and_return(false)
 
     expect(@service.property(:enable).insync?(:true)).to eq(false)
@@ -314,6 +507,22 @@ describe test_title, "when changing the host" do
 
     @service.property(:ensure).sync
   end
+
+  it "should sync the service's logonaccount state when changing the state of :ensure if :logonaccount is being managed" do
+    allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
+    allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+
+    @service[:ensure] = :stopped
+    @service[:logonaccount] = 'LocalSystem'
+
+    expect(@service.property(:logonaccount)).to receive(:retrieve).and_return("MyUser")
+    expect(@service.property(:logonaccount)).to receive(:insync?).and_return(false)
+    expect(@service.property(:logonaccount)).to receive(:sync)
+
+    allow(@service.provider).to receive(:stop)
+
+    @service.property(:ensure).sync
+  end
 end
 
 describe test_title, "when refreshing the service" do

data/spec/unit/type/tidy_spec.rb

@@ -191,7 +191,6 @@ describe tidy do
     describe "and recursion is used" do
       before do
         @tidy[:recurse] = true
-        allow_any_instance_of(Puppet::FileServing::Fileset).to receive(:stat).and_return(double("stat"))
         @fileset = Puppet::FileServing::Fileset.new(@basepath)
         allow(Puppet::FileServing::Fileset).to receive(:new).and_return(@fileset)
       end

data/spec/unit/type/user_spec.rb

@@ -4,7 +4,7 @@ require 'spec_helper'
 describe Puppet::Type.type(:user) do
   before :each do
     @provider_class = described_class.provide(:simple) do
-      has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac, :manages_shell
+      has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac, :manages_roles, :manages_shell
       mk_resource_methods
       def create; end
       def delete; end
@@ -35,6 +35,10 @@ describe Puppet::Type.type(:user) do
     expect(described_class.provider_feature(:manages_solaris_rbac)).not_to be_nil
   end
 
+  it "should have a manages_roles feature" do
+    expect(described_class.provider_feature(:manages_roles)).not_to be_nil
+  end
+
   it "should have a manages_expiry feature" do
     expect(described_class.provider_feature(:manages_expiry)).not_to be_nil
   end
@@ -401,7 +405,7 @@ describe Puppet::Type.type(:user) do
   end
 
   describe "when user has roles" do
-    it "should autorequire roles" do
+    it "should autorequire roles on non-Windows", :unless => Puppet::Util::Platform.windows? do
       testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
       testrole = described_class.new(:name => "testrole")
 
@@ -413,6 +417,31 @@ describe Puppet::Type.type(:user) do
       expect(rel.source.ref).to eq(testrole.ref)
       expect(rel.target.ref).to eq(testuser.ref)
     end
+
+    it "should not autorequire roles on Windows", :if => Puppet::Util::Platform.windows? do
+      testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
+      testrole = described_class.new(:name => "testrole")
+
+      Puppet::Resource::Catalog.new :testing do |conf|
+        [testuser, testrole].each { |resource| conf.add_resource resource }
+      end
+
+      expect(testuser.autorequire).to be_empty
+    end
+
+    it "should sync the user roles when changing the state of :ensure if :roles is being managed" do
+      user = Puppet::Type.type(:user).new(:name => "myUser", :ensure => :present)
+      user[:roles] = 'testRole'
+
+      allow(user.provider.class).to receive(:supports_parameter?).and_return(true)
+      expect(user.property(:roles)).to receive(:retrieve).and_return("other")
+      expect(user.property(:roles)).to receive(:insync?).and_return(false)
+      expect(user.property(:roles)).to receive(:sync)
+
+      allow(user.provider).to receive(:create)
+
+      user.property(:ensure).sync
+    end
   end
 
   describe "when setting shell" do

data/spec/unit/type_spec.rb

@@ -912,8 +912,8 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
 
     it "should always retrieve the ensure value by default" do
       @ensurable_resource = Puppet::Type.type(:file).new(:name => "/not/existent", :mode => "0644")
-      allow(Puppet::Type::File::Ensure).to receive(:ensure).and_return(:absent)
-      expect_any_instance_of(Puppet::Type::File::Ensure).to receive(:retrieve).once
+      # the ensure property is lazily metaprogrammed...
+      allow_any_instance_of(Puppet::Type::File::Ensure).to receive(:retrieve).and_return(:absent)
       @ensurable_resource.retrieve_resource
     end
 
@@ -1099,6 +1099,56 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
       expect { expect(type.instances).to eq([]) }.to_not raise_error
     end
 
+    context "with a composite namevar type" do
+      let :type do
+        Puppet::Type.newtype(:type_spec_fake_type) do
+          newparam(:name) do
+            isnamevar
+          end
+
+          newparam(:path) do
+            isnamevar
+          end
+
+          def self.title_patterns
+            [[%r{^(.*)@(.*)$}, [:name, :path]], [%r{^([^@]+)$}, [:name]]]
+          end
+
+          newproperty(:prop1) {}
+        end
+
+        Puppet::Type.type(:type_spec_fake_type)
+      end
+
+      before :each do
+        type.provide(:default) do
+          defaultfor :operatingsystem => Facter.value(:operatingsystem)
+          mk_resource_methods
+          class << self
+            attr_accessor :params
+          end
+
+          def title
+            "#{@property_hash[:name]}@#{@property_hash[:path]}"
+          end
+
+          def self.instance(name, path)
+            new(:name => name, :path => path, :ensure => :present)
+          end
+
+          def self.instances
+            @instances ||= params.collect { |param| instance(param.first.to_s, param.last.to_s) }
+          end
+
+          @params = [[:name_one, :path_one], [:name_two, :path_two]]
+        end
+      end
+
+      it "should return composite titles for the instances" do
+        expect(type.instances.map(&:title)).to eq(["name_one@path_one", "name_two@path_two"])
+      end
+    end
+
     context "with a default provider" do
       before :each do
         type.provide(:default) do