puppet 6.16.0 → 7.0.0

data/spec/unit/network/http/api/master/v3/environments_spec.rb

@@ -7,13 +7,14 @@ require 'matchers/json'
 describe Puppet::Network::HTTP::API::Master::V3::Environments do
   include JSONMatchers
 
-  it "responds with all of the available environments" do
-    environment = Puppet::Node::Environment.create(:production, ["/first", "/second"], '/manifests')
-    loader = Puppet::Environments::Static.new(environment)
-    handler = Puppet::Network::HTTP::API::Master::V3::Environments.new(loader)
-    response = Puppet::Network::HTTP::MemoryResponse.new
+  let(:environment) { Puppet::Node::Environment.create(:production, ["/first", "/second"], '/manifests') }
+  let(:loader) { Puppet::Environments::Static.new(environment) }
+  let(:handler) { Puppet::Network::HTTP::API::Master::V3::Environments.new(loader) }
+  let(:request) { Puppet::Network::HTTP::Request.from_hash(:headers => { 'accept' => 'application/json' }) }
+  let(:response) { Puppet::Network::HTTP::MemoryResponse.new }
 
-    handler.call(Puppet::Network::HTTP::Request.from_hash(:headers => { 'accept' => 'application/json' }), response)
+  it "responds with all of the available environments" do
+    handler.call(request, response)
 
     expect(response.code).to eq(200)
     expect(response.type).to eq("application/json")
@@ -33,29 +34,17 @@ describe Puppet::Network::HTTP::API::Master::V3::Environments do
   end
 
   it "the response conforms to the environments schema for unlimited timeout" do
-    conf_stub = double('conf_stub')
-    expect(conf_stub).to receive(:environment_timeout).and_return(Float::INFINITY)
-    environment = Puppet::Node::Environment.create(:production, [])
-    env_loader = Puppet::Environments::Static.new(environment)
-    expect(env_loader).to receive(:get_conf).with(:production).and_return(conf_stub)
-    handler = Puppet::Network::HTTP::API::Master::V3::Environments.new(env_loader)
-    response = Puppet::Network::HTTP::MemoryResponse.new
+    Puppet[:environment_timeout] = 'unlimited'
 
-    handler.call(Puppet::Network::HTTP::Request.from_hash(:headers => { 'accept' => 'application/json' }), response)
+    handler.call(request, response)
 
     expect(response.body).to validate_against('api/schemas/environments.json')
   end
 
   it "the response conforms to the environments schema for integer timeout" do
-    conf_stub = double('conf_stub')
-    expect(conf_stub).to receive(:environment_timeout).and_return(1)
-    environment = Puppet::Node::Environment.create(:production, [])
-    env_loader = Puppet::Environments::Static.new(environment)
-    expect(env_loader).to receive(:get_conf).with(:production).and_return(conf_stub)
-    handler = Puppet::Network::HTTP::API::Master::V3::Environments.new(env_loader)
-    response = Puppet::Network::HTTP::MemoryResponse.new
-
-    handler.call(Puppet::Network::HTTP::Request.from_hash(:headers => { 'accept' => 'application/json' }), response)
+    Puppet[:environment_timeout] = 1
+
+    handler.call(request, response)
 
     expect(response.body).to validate_against('api/schemas/environments.json')
   end

data/spec/unit/network/http/api/master/v3_spec.rb

@@ -15,15 +15,18 @@ describe Puppet::Network::HTTP::API::Master::V3 do
         chain(Puppet::Network::HTTP::API::Master::V3.routes)
   }
 
-  it "mounts the environments endpoint" do
-    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/environments")
-    master_routes.process(request, response)
-
-    expect(response.code).to eq(200)
+  # simulate puppetserver registering its authconfigloader class
+  around :each do |example|
+    Puppet::Network::Authorization.authconfigloader_class = Object
+    begin
+      example.run
+    ensure
+      Puppet::Network::Authorization.authconfigloader_class = nil
+    end
   end
 
-  it "mounts the environment endpoint" do
-    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/environment/production")
+  it "mounts the environments endpoint" do
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/environments")
     master_routes.process(request, response)
 
     expect(response.code).to eq(200)
@@ -54,4 +57,22 @@ describe Puppet::Network::HTTP::API::Master::V3 do
       master_routes.process(request, response)
     }.to raise_error(not_found_error)
   end
+
+  it "checks authorization for indirected routes" do
+    Puppet::Network::Authorization.authconfigloader_class = nil
+
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/catalog/foo")
+    expect {
+      master_routes.process(request, response)
+    }.to raise_error(Puppet::Network::HTTP::Error::HTTPNotAuthorizedError, %r{Not Authorized: Forbidden request: /puppet/v3/catalog/foo \(method GET\)})
+  end
+
+  it "checks authorization for environments" do
+    Puppet::Network::Authorization.authconfigloader_class = nil
+
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/environments")
+    expect {
+      master_routes.process(request, response)
+    }.to raise_error(Puppet::Network::HTTP::Error::HTTPNotAuthorizedError, %r{Not Authorized: Forbidden request: /puppet/v3/environments \(method GET\)})
+  end
 end

data/spec/unit/network/http/api_spec.rb

@@ -70,6 +70,16 @@ describe Puppet::Network::HTTP::API do
     end
 
     describe "when processing master routes" do
+      # simulate puppetserver registering its authconfigloader class
+      around :each do |example|
+        Puppet::Network::Authorization.authconfigloader_class = Object
+        begin
+          example.run
+        ensure
+          Puppet::Network::Authorization.authconfigloader_class = nil
+        end
+      end
+
       it "responds to v3 indirector requests" do
         req = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_prefix}/v3/node/foo",
                                                        :params => {:environment => "production"},

data/spec/unit/network/http/connection_spec.rb

@@ -1,6 +1,5 @@
 require 'spec_helper'
 require 'puppet/network/http/connection'
-require 'puppet/network/http/connection_adapter'
 require 'puppet/test_ca'
 
 describe Puppet::Network::HTTP::Connection do
@@ -8,21 +7,25 @@ describe Puppet::Network::HTTP::Connection do
   let(:port) { 8140 }
   let(:path) { '/foo' }
   let(:url) { "https://#{host}:#{port}#{path}" }
+  let(:params) { { 'key' => 'a value' } }
+  let(:encoded_url_with_params) { "#{url}?%7B%22key%22:%22a%20value%22%7D" }
+  let(:ssl_context) { Puppet::SSL::SSLProvider.new.create_system_context(cacerts: []) }
+  let(:verifier) { Puppet::SSL::Verifier.new(host, ssl_context) }
 
-  shared_examples_for "an HTTP connection" do |klass, legacy_api|
-    subject { klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator) }
+  shared_examples_for "an HTTP connection" do |klass|
+    subject { klass.new(host, port, :verifier => verifier) }
 
     context "when providing HTTP connections" do
       context "when initializing http instances" do
         it "should return an http instance created with the passed host and port" do
-          conn = klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :verifier => verifier)
 
           expect(conn.address).to eq(host)
           expect(conn.port).to eq(port)
         end
 
         it "should enable ssl on the http instance by default" do
-          conn = klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :verifier => verifier)
 
           expect(conn).to be_use_ssl
         end
@@ -34,21 +37,21 @@ describe Puppet::Network::HTTP::Connection do
         end
 
         it "can enable ssl using an option" do
-          conn = klass.new(host, port, :use_ssl => true, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :use_ssl => true, :verifier => verifier)
 
           expect(conn).to be_use_ssl
         end
 
         it "ignores the ':verify' option when ssl is disabled" do
-          conn = klass.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :use_ssl => false, :verifier => verifier)
 
           expect(conn.verifier).to be_nil
         end
 
         it "wraps the validator in an adapter" do
-          conn = klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :verifier => verifier)
 
-          expect(conn.verifier).to be_a_kind_of(Puppet::SSL::VerifierAdapter)
+          expect(conn.verifier).to be_a(Puppet::SSL::Verifier)
         end
 
         it "should raise Puppet::Error when invalid options are specified" do
@@ -64,9 +67,9 @@ describe Puppet::Network::HTTP::Connection do
 
         it "raises if the wrong verifier class is specified" do
           expect {
-            klass.new(host, port, :verifier => Puppet::SSL::Validator.default_validator)
+            klass.new(host, port, :verifier => Object.new)
           }.to raise_error(ArgumentError,
-                           "Expected an instance of Puppet::SSL::Verifier but was passed a Puppet::SSL::Validator::DefaultValidator")
+                           "Expected an instance of Puppet::SSL::Verifier but was passed a Object")
         end
       end
     end
@@ -81,9 +84,9 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "stringifies keys and encodes values in the query" do
-        stub_request(:get, url).with(query: "foo=bar%3Dbaz")
+        stub_request(:get, encoded_url_with_params)
 
-        subject.request_get("#{path}?foo=bar=baz") { |_| }
+        subject.request_get("#{path}?#{params.to_json}") { |_| }
       end
 
       it "merges custom headers with default ones" do
@@ -101,9 +104,10 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "accepts a URL string as the path" do
-        stub_request(:get, url)
+        url_with_query = "#{url}?foo=bar"
+        stub_request(:get, url_with_query)
 
-        response = subject.request_get(url) { |_| }
+        response = subject.request_get(url_with_query) { |_| }
         expect(response).to be_an_instance_of(Net::HTTPOK)
       end
     end
@@ -118,9 +122,9 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "stringifies keys and encodes values in the query" do
-        stub_request(:head, url).with(query: "foo=bar%3Dbaz")
+        stub_request(:head, encoded_url_with_params)
 
-        subject.request_head("#{path}?foo=bar=baz") { |_| }
+        subject.request_head("#{path}?#{params.to_json}") { |_| }
       end
 
       it "merges custom headers with default ones" do
@@ -138,9 +142,10 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "accepts a URL string as the path" do
-        stub_request(:head, url)
+        url_with_query = "#{url}?foo=bar"
+        stub_request(:head, url_with_query)
 
-        response = subject.request_head(url) { |_| }
+        response = subject.request_head(url_with_query) { |_| }
         expect(response).to be_an_instance_of(Net::HTTPOK)
       end
     end
@@ -155,9 +160,9 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "stringifies keys and encodes values in the query" do
-        stub_request(:post, url).with(query: "foo=bar%3Dbaz")
+        stub_request(:post, encoded_url_with_params)
 
-        subject.request_post("#{path}?foo=bar=baz", "") { |_| }
+        subject.request_post("#{path}?#{params.to_json}", "") { |_| }
       end
 
       it "merges custom headers with default ones" do
@@ -175,9 +180,10 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "accepts a URL string as the path" do
-        stub_request(:post, url)
+        url_with_query = "#{url}?foo=bar"
+        stub_request(:post, url_with_query)
 
-        response = subject.request_post(url, "") { |_| }
+        response = subject.request_post(url_with_query, "") { |_| }
         expect(response).to be_an_instance_of(Net::HTTPOK)
       end
     end
@@ -190,9 +196,9 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "stringifies keys and encodes values in the query" do
-        stub_request(:get, url).with(query: "foo=bar%3Dbaz")
+        stub_request(:get, encoded_url_with_params)
 
-        subject.get("#{path}?foo=bar=baz")
+        subject.get("#{path}?#{params.to_json}")
       end
 
       it "merges custom headers with default ones" do
@@ -217,9 +223,10 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "accepts a URL string as the path" do
-        stub_request(:get, url)
+        url_with_query = "#{url}?foo=bar"
+        stub_request(:get, url_with_query)
 
-        response = subject.get(url)
+        response = subject.get(url_with_query)
         expect(response).to be_an_instance_of(Net::HTTPOK)
       end
     end
@@ -232,9 +239,9 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "stringifies keys and encodes values in the query" do
-        stub_request(:head, url).with(query: "foo=bar%3Dbaz")
+        stub_request(:head, encoded_url_with_params)
 
-        subject.head("#{path}?foo=bar=baz")
+        subject.head("#{path}?#{params.to_json}")
       end
 
       it "merges custom headers with default ones" do
@@ -252,9 +259,10 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "accepts a URL string as the path" do
-        stub_request(:head, url)
+        url_with_query = "#{url}?foo=bar"
+        stub_request(:head, url_with_query)
 
-        response = subject.head(url)
+        response = subject.head(url_with_query)
         expect(response).to be_an_instance_of(Net::HTTPOK)
       end
     end
@@ -267,9 +275,9 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "stringifies keys and encodes values in the query" do
-        stub_request(:put, url).with(query: "foo=bar%3Dbaz")
+        stub_request(:put, encoded_url_with_params)
 
-        subject.put("#{path}?foo=bar=baz", "")
+        subject.put("#{path}?#{params.to_json}", "")
       end
 
       it "includes custom headers" do
@@ -299,17 +307,16 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it 'defaults content-type to application/x-www-form-urlencoded' do
-        skip("Net::HTTP sends a default content-type header, but it's not visible to webmock") if legacy_api
-
         stub_request(:put, url).with(headers: {'Content-Type' => 'application/x-www-form-urlencoded'})
 
         subject.put(path, '')
       end
 
       it "accepts a URL string as the path" do
-        stub_request(:put, url)
+        url_with_query = "#{url}?foo=bar"
+        stub_request(:put, url_with_query)
 
-        response = subject.put(url, '')
+        response = subject.put(url_with_query, '')
         expect(response).to be_an_instance_of(Net::HTTPOK)
       end
     end
@@ -322,9 +329,9 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "stringifies keys and encodes values in the query" do
-        stub_request(:post, url).with(query: "foo=bar%3Dbaz")
+        stub_request(:post, encoded_url_with_params)
 
-        subject.post("#{path}?foo=bar=baz", "", {'Content-Type' => 'text/plain'})
+        subject.post("#{path}?#{params.to_json}", "", {'Content-Type' => 'text/plain'})
       end
 
       it "includes custom headers" do
@@ -354,17 +361,16 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it 'defaults content-type to application/x-www-form-urlencoded' do
-        skip("Net::HTTP sends a default content-type header, but it's not visible to webmock") if legacy_api
-
         stub_request(:post, url).with(headers: {'Content-Type' => 'application/x-www-form-urlencoded'})
 
         subject.post(path, "")
       end
 
       it "accepts a URL string as the path" do
-        stub_request(:post, url)
+        url_with_query = "#{url}?foo=bar"
+        stub_request(:post, url_with_query)
 
-        response = subject.post(url, '')
+        response = subject.post(url_with_query, '')
         expect(response).to be_an_instance_of(Net::HTTPOK)
       end
     end
@@ -383,9 +389,9 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "stringifies keys and encodes values in the query" do
-        stub_request(:delete, url).with(query: "foo=bar%3Dbaz")
+        stub_request(:delete, encoded_url_with_params)
 
-        subject.delete("#{path}?foo=bar=baz")
+        subject.delete("#{path}?#{params.to_json}")
       end
 
       it "returns the response" do
@@ -403,9 +409,10 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it "accepts a URL string as the path" do
-        stub_request(:delete, url)
+        url_with_query = "#{url}?foo=bar"
+        stub_request(:delete, url_with_query)
 
-        response = subject.delete(url)
+        response = subject.delete(url_with_query)
         expect(response).to be_an_instance_of(Net::HTTPOK)
       end
     end
@@ -415,7 +422,7 @@ describe Puppet::Network::HTTP::Connection do
 
       def create_connection(options = {})
         options[:use_ssl] = false
-        options[:verify] = Puppet::SSL::Validator.no_validator
+        options[:verifier] = verifier
         subject.new(host, port, options)
       end
 
@@ -464,15 +471,9 @@ describe Puppet::Network::HTTP::Connection do
       it 'raises an exception when the location header is missing' do
         stub_request(:get, "http://me.example.com:8140/").to_return(status: 302)
 
-        if legacy_api
-          expect {
-            create_connection.get('/')
-          }.to raise_error(URI::InvalidURIError, /bad URI/)
-        else
-          expect {
+        expect {
             create_connection.get('/')
           }.to raise_error(Puppet::HTTP::ProtocolError, /Location response header is missing/)
-        end
       end
     end
 
@@ -493,14 +494,9 @@ describe Puppet::Network::HTTP::Connection do
       it "should return a 503 response if Retry-After is not convertible to an Integer or RFC 2822 Date" do
         retry_after('foo')
 
-        if legacy_api
-          result = subject.get('/foo')
-          expect(result.code).to eq("503")
-        else
-          expect {
-            subject.get('/foo')
-          }.to raise_error(Puppet::HTTP::ProtocolError, /Failed to parse Retry-After header 'foo'/)
-        end
+        expect {
+          subject.get('/foo')
+        }.to raise_error(Puppet::HTTP::ProtocolError, /Failed to parse Retry-After header 'foo'/)
       end
 
       it "should close the connection before sleeping" do
@@ -515,11 +511,7 @@ describe Puppet::Network::HTTP::Connection do
         allow(http1).to receive(:started?).and_return(true)
 
         # The "with_connection" method is required to yield started connections
-        pool = if legacy_api
-                 Puppet.lookup(:http_pool)
-               else
-                 Puppet.runtime[:http].pool
-               end
+        pool = Puppet.runtime[:http].pool
 
         allow(pool).to receive(:with_connection).and_yield(http1).and_yield(http2)
 
@@ -639,10 +631,6 @@ describe Puppet::Network::HTTP::Connection do
   end
 
   describe Puppet::Network::HTTP::Connection do
-    it_behaves_like "an HTTP connection", described_class, true
-  end
-
-  describe Puppet::Network::HTTP::ConnectionAdapter do
-    it_behaves_like "an HTTP connection", described_class, false
+    it_behaves_like "an HTTP connection", described_class
   end
 end