puppet 6.16.0 → 7.0.0

data/spec/unit/type/filebucket_spec.rb

@@ -21,7 +21,7 @@ describe Puppet::Type.type(:filebucket) do
   end
 
   it "should not have a default port" do
-    Puppet.settings[:masterport] = 50
+    Puppet.settings[:serverport] = 50
     expect(Puppet::Type.type(:filebucket).new(:name => "main")[:port]).to eq(nil)
   end
 

data/spec/unit/type/package_spec.rb

@@ -349,7 +349,7 @@ describe Puppet::Type.type(:package) do
         end
       end
 
-      [:purged, :absent, :held].each do |state|
+      [:purged, :absent].each do |state|
         it "should not reinstall if it should be #{state.to_s} and reinstall_on_refresh is true" do
           @package[:ensure] = state
           allow(@provider).to receive(:reinstallable?).and_return(true)

data/spec/unit/type/service_spec.rb

@@ -145,6 +145,199 @@ describe test_title, "when validating attribute values" do
     end
   end
 
+  describe "the service logon credentials" do 
+    before do
+      provider_class_with_logon_credentials = Puppet::Type.type(:service).provide(:simple) do
+        has_features :manages_logon_credentials
+        def logonpassword=(value) end
+      end
+      allow(Puppet::Type.type(:service)).to receive(:defaultprovider).and_return(provider_class_with_logon_credentials)
+    end
+
+    describe "the 'logonaccount' property" do
+      it "should not be munged nor checked when not on Windows" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'NonWindowsUser')
+
+        expect { service }.not_to raise_error
+        expect(service[:logonaccount]).to eq('NonWindowsUser')
+      end
+
+      context "when on Windows", :if => Puppet::Util::Platform.windows? do
+        before do
+          allow(Puppet::Util::Windows::User).to receive(:password_is?).and_return(true)
+          allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
+        end
+
+        it "should fail when the `Log On As A Service` right is missing from given user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.to raise_error(Puppet::Error, /"myPC\\myUser" is missing the 'Log On As A Service' right./)
+        end
+
+        it "should fail when the `Log On As A Service` right is set to denied for given user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("SeDenyServiceLogonRight")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.to raise_error(Puppet::Error, /"myPC\\myUser" has the 'Log On As A Service' right set to denied./)
+        end
+
+        it "should not fail when given user has the `Log On As A Service` right" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("SeServiceLogonRight")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.not_to raise_error
+        end
+
+        it "should not fail when given user is a default system account even if the `Log On As A Service` right is missing" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).and_return(true)
+
+          expect(Puppet::Util::Windows::User).not_to receive(:get_rights)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.not_to raise_error
+        end
+
+        ['LocalSystem', '.\LocalSystem', 'myPC\LocalSystem', 'lOcALsysTem'].each do |user_input|
+          it "should succesfully munge #{user_input} to 'LocalSystem'" do
+            service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => user_input)
+
+            expect { service }.not_to raise_error
+            expect(service[:logonaccount]).to eq('LocalSystem')
+          end
+        end
+
+        it "should succesfully munge local account" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('.\myUser')
+        end
+
+        it "should succesfully munge domain account" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("DomainUser", nil, nil, "myDomain", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'DomainUser')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('myDomain\DomainUser')
+        end
+
+        it "should succesfully munge well known user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeWellKnownGroup))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'LocalService')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('NT AUTHORITY\LOCAL SERVICE')
+        end
+
+        it "should succesfully munge a SID" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("NETWORK SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'S-1-5-20')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('NT AUTHORITY\NETWORK SERVICE')
+        end
+
+        it "should fail when account is invalid" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(nil)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'InvalidUser') }.to raise_error(Puppet::Error, /"InvalidUser" is not a valid account/)
+        end
+
+        it "should fail when sid type is not user or well known user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("Administrators", nil, nil, "BUILTIN", :SidTypeAlias))
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'Administrators') }.to raise_error(Puppet::Error, /"Administrators" is not a valid account/)
+        end
+      end
+    end
+
+    describe "the logonpassword parameter" do
+      it "should fail when logonaccount is not being managed as well" do
+        expect { Puppet::Type.type(:service).new(:name => "yay", :logonpassword => 'myPass') }.to raise_error(Puppet::Error, /The 'logonaccount' parameter is mandatory when setting 'logonpassword'./)
+      end
+
+      it "should default to empty string when only logonaccount is being managed" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser')
+
+        expect { service }.not_to raise_error
+        expect(service[:logonpassword]).to eq("")
+      end
+
+      it "should default to nil when not even logonaccount is being managed" do
+        service = Puppet::Type.type(:service).new(:name => "yay")
+        expect(service[:logonpassword]).to eq(nil)
+      end
+
+      it "should fail when logonpassword includes the ':' character" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'my:Pass') }.to raise_error(Puppet::Error, /Passwords cannot include ':'/)
+      end
+
+      it "should not further check the password against given account when not on Windows" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myPass') }.not_to raise_error
+      end
+
+      context "when on Windows", :if => Puppet::Util::Platform.windows? do
+        before do
+          allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(name_to_principal_result)
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
+        end
+
+        it "should pass validation when given account is 'LocalSystem'" do
+          allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('LocalSystem').and_return(true)
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('LocalSystem').and_return(false)
+
+          expect(Puppet::Util::Windows::SID).not_to receive(:name_to_principal)
+          expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'LocalSystem') }.not_to raise_error
+        end
+
+        ['LOCAL SERVICE', 'NETWORK SERVICE', 'SYSTEM'].each do |predefined_local_account|
+          describe "when given account is #{predefined_local_account}" do
+            let(:name_to_principal_result) do
+              Puppet::Util::Windows::SID::Principal.new(predefined_local_account, nil, nil, "NT AUTHORITY", :SidTypeUser)
+            end
+
+            it "should pass validation" do
+              allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(predefined_local_account).and_return(false)
+              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with(predefined_local_account).and_return(true)
+              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with("NT AUTHORITY\\#{predefined_local_account}").and_return(true)
+
+              expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
+              expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => predefined_local_account) }.not_to raise_error
+            end
+          end
+        end
+
+        let(:name_to_principal_result) do
+          Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser)
+        end
+
+        describe "when given logonaccount is not a predefined local account" do
+          before do
+            allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('myUser').and_return(false)
+            allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('myUser').and_return(false)
+            allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('.\\myUser').and_return(false)
+          end
+
+          it "should pass validation if password is proven correct" do
+            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myPass', '.').and_return(true)
+            expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myPass') }.not_to raise_error
+          end
+
+          it "should not pass validation if password check fails" do
+            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myWrongPass', '.').and_return(false)
+            expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myWrongPass') }.to raise_error(Puppet::Error, /The given password is invalid for user '.\\myUser'/)
+          end
+        end
+      end
+    end
+  end
+
   it "should support :true as a value to :hasstatus" do
     srv = Puppet::Type.type(:service).new(:name => "yay", :hasstatus => :true)
     expect(srv[:hasstatus]).to eq(:true)
@@ -314,6 +507,22 @@ describe test_title, "when changing the host" do
 
     @service.property(:ensure).sync
   end
+
+  it "should sync the service's logonaccount state when changing the state of :ensure if :logonaccount is being managed" do
+    allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
+    allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+
+    @service[:ensure] = :stopped
+    @service[:logonaccount] = 'LocalSystem'
+
+    expect(@service.property(:logonaccount)).to receive(:retrieve).and_return("MyUser")
+    expect(@service.property(:logonaccount)).to receive(:insync?).and_return(false)
+    expect(@service.property(:logonaccount)).to receive(:sync)
+
+    allow(@service.provider).to receive(:stop)
+
+    @service.property(:ensure).sync
+  end
 end
 
 describe test_title, "when refreshing the service" do

data/spec/unit/type/user_spec.rb

@@ -4,7 +4,7 @@ require 'spec_helper'
 describe Puppet::Type.type(:user) do
   before :each do
     @provider_class = described_class.provide(:simple) do
-      has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac, :manages_shell
+      has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac, :manages_roles, :manages_shell
       mk_resource_methods
       def create; end
       def delete; end
@@ -35,6 +35,10 @@ describe Puppet::Type.type(:user) do
     expect(described_class.provider_feature(:manages_solaris_rbac)).not_to be_nil
   end
 
+  it "should have a manages_roles feature" do
+    expect(described_class.provider_feature(:manages_roles)).not_to be_nil
+  end
+
   it "should have a manages_expiry feature" do
     expect(described_class.provider_feature(:manages_expiry)).not_to be_nil
   end
@@ -401,7 +405,7 @@ describe Puppet::Type.type(:user) do
   end
 
   describe "when user has roles" do
-    it "should autorequire roles" do
+    it "should autorequire roles on non-Windows", :unless => Puppet::Util::Platform.windows? do
       testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
       testrole = described_class.new(:name => "testrole")
 
@@ -413,6 +417,31 @@ describe Puppet::Type.type(:user) do
       expect(rel.source.ref).to eq(testrole.ref)
       expect(rel.target.ref).to eq(testuser.ref)
     end
+
+    it "should not autorequire roles on Windows", :if => Puppet::Util::Platform.windows? do
+      testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
+      testrole = described_class.new(:name => "testrole")
+
+      Puppet::Resource::Catalog.new :testing do |conf|
+        [testuser, testrole].each { |resource| conf.add_resource resource }
+      end
+
+      expect(testuser.autorequire).to be_empty
+    end
+
+    it "should sync the user roles when changing the state of :ensure if :roles is being managed" do
+      user = Puppet::Type.type(:user).new(:name => "myUser", :ensure => :present)
+      user[:roles] = 'testRole'
+
+      allow(user.provider.class).to receive(:supports_parameter?).and_return(true)
+      expect(user.property(:roles)).to receive(:retrieve).and_return("other")
+      expect(user.property(:roles)).to receive(:insync?).and_return(false)
+      expect(user.property(:roles)).to receive(:sync)
+
+      allow(user.provider).to receive(:create)
+
+      user.property(:ensure).sync
+    end
   end
 
   describe "when setting shell" do

data/spec/unit/type_spec.rb

@@ -195,6 +195,26 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
     end
   end
 
+  context 'aliased resource' do
+    it 'fails if a resource is defined and then redefined using name that results in the same alias' do
+      drive = Puppet::Util::Platform.windows? ? 'C:' : ''
+      code = <<~PUPPET
+        $dir='#{drive}/tmp/test'
+        $same_dir='#{drive}/tmp/test/'
+
+        file {$dir:
+          ensure => directory
+        }
+
+        file { $same_dir:
+          ensure => directory
+        }
+      PUPPET
+
+      expect { compile_to_ral(code) }.to raise_error(/resource \["File", "#{drive}\/tmp\/test"\] already declared/)
+    end
+  end
+
   context "resource attributes" do
     let(:resource) {
       resource = klass.new(:name => "foo")
@@ -1099,6 +1119,56 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
       expect { expect(type.instances).to eq([]) }.to_not raise_error
     end
 
+    context "with a composite namevar type" do
+      let :type do
+        Puppet::Type.newtype(:type_spec_fake_type) do
+          newparam(:name) do
+            isnamevar
+          end
+
+          newparam(:path) do
+            isnamevar
+          end
+
+          def self.title_patterns
+            [[%r{^(.*)@(.*)$}, [:name, :path]], [%r{^([^@]+)$}, [:name]]]
+          end
+
+          newproperty(:prop1) {}
+        end
+
+        Puppet::Type.type(:type_spec_fake_type)
+      end
+
+      before :each do
+        type.provide(:default) do
+          defaultfor :operatingsystem => Facter.value(:operatingsystem)
+          mk_resource_methods
+          class << self
+            attr_accessor :params
+          end
+
+          def title
+            "#{@property_hash[:name]}@#{@property_hash[:path]}"
+          end
+
+          def self.instance(name, path)
+            new(:name => name, :path => path, :ensure => :present)
+          end
+
+          def self.instances
+            @instances ||= params.collect { |param| instance(param.first.to_s, param.last.to_s) }
+          end
+
+          @params = [[:name_one, :path_one], [:name_two, :path_two]]
+        end
+      end
+
+      it "should return composite titles for the instances" do
+        expect(type.instances.map(&:title)).to eq(["name_one@path_one", "name_two@path_two"])
+      end
+    end
+
     context "with a default provider" do
       before :each do
         type.provide(:default) do

data/spec/unit/util/backups_spec.rb

@@ -16,8 +16,6 @@ describe Puppet::Util::Backups do
     let(:path) { make_absolute('/no/such/file') }
 
     it "should noop if the file does not exist" do
-      file = Puppet::Type.type(:file).new(:name => path)
-
       expect(file).not_to receive(:bucket)
       expect(Puppet::FileSystem).to receive(:exist?).with(path).and_return(false)
 

data/spec/unit/util/character_encoding_spec.rb

@@ -21,7 +21,7 @@ describe Puppet::Util::CharacterEncoding do
         let(:invalid_utf8_string) { "\xfd\xf1".force_encoding(Encoding::UTF_8) }
 
         it "should issue a debug message" do
-          expect(Puppet).to receive(:debug).with(/encoding is invalid/)
+          expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/encoding is invalid/) }
           Puppet::Util::CharacterEncoding.convert_to_utf_8(invalid_utf8_string)
         end
 
@@ -80,7 +80,7 @@ describe Puppet::Util::CharacterEncoding do
         end
 
         it "should issue a debug message that the string was not transcodable" do
-          expect(Puppet).to receive(:debug).with(/cannot be transcoded/)
+          expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/cannot be transcoded/) }
           PuppetSpec::CharacterEncoding.with_external_encoding(Encoding::Windows_31J) do
             Puppet::Util::CharacterEncoding.convert_to_utf_8(invalid_win_31j)
           end
@@ -124,7 +124,7 @@ describe Puppet::Util::CharacterEncoding do
           let(:euc_kr) { [253, 241].pack('C*').force_encoding(Encoding::ASCII) }
 
           it "should issue a debug message" do
-            expect(Puppet).to receive(:debug).with(/cannot be transcoded/)
+            expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/cannot be transcoded/) }
             Puppet::Util::CharacterEncoding.convert_to_utf_8(euc_kr)
           end
 
@@ -168,7 +168,7 @@ describe Puppet::Util::CharacterEncoding do
       let(:foo) { 'foo' }
 
       it "should issue a debug message" do
-        expect(Puppet).to receive(:debug).with(/not valid UTF-8/)
+        expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/not valid UTF-8/) }
         Puppet::Util::CharacterEncoding.override_encoding_to_utf_8(oslash)
       end
 

data/spec/unit/util/checksums_spec.rb

@@ -65,6 +65,22 @@ describe Puppet::Util::Checksums do
     expect(@summer.sumtype("asdfasdfa")).to be_nil
   end
 
+  it "has a list of known checksum types" do
+    expect(@summer.known_checksum_types).to match_array(content_sums + file_only)
+  end
+
+  it "returns true if the checksum is valid" do
+    expect(@summer).to be_valid_checksum('sha1', 'fcc1715b22278a9dae322b0a34935f10d1608b9f')
+  end
+
+  it "returns false if the checksum is known but invalid" do
+    expect(@summer).to_not be_valid_checksum('sha1', 'wronglength')
+  end
+
+  it "returns false if the checksum type is unknown" do
+    expect(@summer).to_not be_valid_checksum('rot13', 'doesntmatter')
+  end
+
   {:md5 => Digest::MD5, :sha1 => Digest::SHA1, :sha256 => Digest::SHA256, :sha512 => Digest::SHA512, :sha384 => Digest::SHA384}.each do |sum, klass|
     describe("when using #{sum}") do
       it "should use #{klass} to calculate string checksums" do