puppet 6.17.0-x64-mingw32 → 6.18.0-x64-mingw32

data/spec/unit/provider/service/systemd_spec.rb

@@ -1,12 +1,7 @@
 require 'spec_helper'
 
-describe 'Puppet::Type::Service::Provider::Systemd', unless: Puppet::Util::Platform.jruby? do
+describe 'Puppet::Type::Service::Provider::Systemd', unless: Puppet::Util::Platform.jruby? || Puppet::Util::Platform.windows? do
   let(:provider_class) { Puppet::Type.type(:service).provider(:systemd) }
-  if Puppet::Util::Platform.windows?
-    # Get a pid for $CHILD_STATUS to latch on to
-    command = "cmd.exe /c \"exit 0\""
-    Puppet::Util::Execution.execute(command, {:failonfail => false})
-  end
 
   before :each do
     allow(Puppet::Type.type(:service)).to receive(:defaultprovider).and_return(provider_class)

data/spec/unit/provider/service/windows_spec.rb

@@ -127,6 +127,34 @@ describe 'Puppet::Type::Service::Provider::Windows',
         expect(provider.status).to eq(:running)
       end
     end
+
+    context 'when querying lmhosts', if: Puppet::Util::Platform.windows? do
+      # This service should be ubiquitous across all supported Windows platforms
+      let(:service) { Puppet::Type.type(:service).new(:name => 'lmhosts') }
+
+      before :each do
+        allow(service_util).to receive(:exists?).with(service.name).and_call_original
+      end
+
+      it "reports if the service is enabled" do
+        expect([:true, :false, :manual]).to include(service.provider.enabled?)
+      end
+
+      it "reports on the service status" do
+        expect(
+          [
+            :running,
+            :'continue pending',
+            :'pause pending',
+            :paused,
+            :running,
+            :'start pending',
+            :'stop pending',
+            :stopped
+          ]
+        ).to include(service.provider.status)
+      end
+    end
   end
 
   describe "#restart" do

data/spec/unit/provider/user/windows_adsi_spec.rb

@@ -72,6 +72,88 @@ describe Puppet::Type.type(:user).provider(:windows_adsi), :if => Puppet::Util::
     end
   end
 
+  describe "when setting roles" do
+    context "when role_membership => minimum" do
+      before :each do
+        resource[:role_membership] = :minimum
+      end
+
+      it "should set the given role when user has no roles" do
+        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('')
+
+        expect(Puppet::Util::Windows::User).to receive(:set_rights).with('testuser', ['givenRole1']).and_return(nil)
+        provider.roles = 'givenRole1'
+      end
+
+      it "should set only the misssing role when user already has other roles" do
+        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('givenRole1')
+
+        expect(Puppet::Util::Windows::User).to receive(:set_rights).with('testuser', ['givenRole2']).and_return(nil)
+        provider.roles = 'givenRole1,givenRole2'
+      end
+
+      it "should never remove any roles" do
+        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('givenRole1')
+        allow(Puppet::Util::Windows::User).to receive(:set_rights).and_return(nil)
+
+        expect(Puppet::Util::Windows::User).not_to receive(:remove_rights)
+        provider.roles = 'givenRole1,givenRole2'
+      end
+    end
+
+    context "when role_membership => inclusive" do
+      before :each do
+        resource[:role_membership] = :inclusive
+      end
+
+      it "should remove the unwanted role" do
+        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('givenRole1,givenRole2')
+
+        expect(Puppet::Util::Windows::User).to receive(:remove_rights).with('testuser', ['givenRole2']).and_return(nil)
+        provider.roles = 'givenRole1'
+      end
+
+      it "should add the missing role and remove the unwanted one" do
+        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('givenRole1,givenRole2')
+
+        expect(Puppet::Util::Windows::User).to receive(:set_rights).with('testuser', ['givenRole3']).and_return(nil)
+        expect(Puppet::Util::Windows::User).to receive(:remove_rights).with('testuser', ['givenRole2']).and_return(nil)
+        provider.roles = 'givenRole1,givenRole3'
+      end
+
+      it "should not set any roles when the user already has given role" do
+        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('givenRole1,givenRole2')
+        allow(Puppet::Util::Windows::User).to receive(:remove_rights).with('testuser', ['givenRole2']).and_return(nil)
+
+        expect(Puppet::Util::Windows::User).not_to receive(:set_rights)
+        provider.roles = 'givenRole1'
+      end
+
+      it "should set the given role when user has no roles" do
+        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('')
+
+        expect(Puppet::Util::Windows::User).to receive(:set_rights).with('testuser', ['givenRole1']).and_return(nil)
+        provider.roles = 'givenRole1'
+      end
+
+      it "should not remove any roles when user has no roles" do
+        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('')
+        allow(Puppet::Util::Windows::User).to receive(:set_rights).with('testuser', ['givenRole1']).and_return(nil)
+
+        expect(Puppet::Util::Windows::User).not_to receive(:remove_rights)
+        provider.roles = 'givenRole1'
+      end
+
+      it "should remove all roles when none given" do
+        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('givenRole1,givenRole2')
+
+        expect(Puppet::Util::Windows::User).not_to receive(:set_rights)
+        expect(Puppet::Util::Windows::User).to receive(:remove_rights).with('testuser', ['givenRole1', 'givenRole2']).and_return(nil)
+        provider.roles = ''
+      end
+    end
+  end
+
   describe "#groups_insync?" do
     let(:group1) { double(:account => 'group1', :domain => '.', :sid => 'group1sid') }
     let(:group2) { double(:account => 'group2', :domain => '.', :sid => 'group2sid') }

data/spec/unit/puppet_pal_2pec.rb

@@ -708,6 +708,46 @@ describe 'Puppet Pal' do
         end
       end
 
+      context 'facts are supported such that' do
+        it 'they are obtained if they are not given' do
+          facts = Puppet::Node::Facts.new(Puppet[:certname], 'puppetversion' => Puppet.version)
+          Puppet::Node::Facts.indirection.save(facts)
+
+          testing_env_dir # creates the structure
+          result = Puppet::Pal.in_tmp_environment('pal_env', modulepath: modulepath ) do |ctx|
+            ctx.with_script_compiler {|c| c.evaluate_string("$facts =~ Hash and $facts[puppetversion] == '#{Puppet.version}'") }
+          end
+          expect(result).to eq(true)
+        end
+
+        it 'can be given as a hash when creating the environment' do
+          testing_env_dir # creates the structure
+          result = Puppet::Pal.in_tmp_environment('pal_env', modulepath: modulepath, facts: { 'myfact' => 42 }) do |ctx|
+            ctx.with_script_compiler {|c| c.evaluate_string("$facts =~ Hash and $facts[myfact] == 42") }
+          end
+          expect(result).to eq(true)
+        end
+
+        it 'can be overridden with a hash when creating a script compiler' do
+          testing_env_dir # creates the structure
+          result = Puppet::Pal.in_tmp_environment('pal_env', modulepath: modulepath, facts: { 'myfact' => 42 }) do |ctx|
+            ctx.with_script_compiler(facts: { 'myfact' => 43 }) {|c| c.evaluate_string("$facts =~ Hash and $facts[myfact] == 43") }
+          end
+          expect(result).to eq(true)
+        end
+
+        it 'can be disabled with the :set_local_facts option' do
+          Puppet::Pal.in_tmp_environment('pal_env', modulepath: modulepath, facts: { 'myfact' => 42}) do |ctx|
+            ctx.with_script_compiler(facts: { 'myfact' => 42 }, set_local_facts: false) do |compiler|
+              expect { compiler.evaluate_string('$facts') }.to raise_error(
+                Puppet::PreformattedError,
+                /Unknown variable: 'facts'/
+              )
+            end
+          end
+        end
+      end
+
       context 'supports tasks such that' do
         it '"task_signature" returns the signatures of a generic task' do
           result = Puppet::Pal.in_tmp_environment('pal_env', modulepath: modulepath, facts: node_facts) do |ctx|

data/spec/unit/reports/store_spec.rb

@@ -6,53 +6,57 @@ require 'pathname'
 require 'tempfile'
 require 'fileutils'
 
-processor = Puppet::Reports.report(:store)
-
-describe processor do
+describe Puppet::Reports.report(:store) do
   describe "#process" do
     include PuppetSpec::Files
+
     before :each do
       Puppet[:reportdir] = File.join(tmpdir('reports'), 'reports')
-      @report = YAML.load_file(File.join(PuppetSpec::FIXTURE_DIR, 'yaml/report2.6.x.yaml')).extend processor
+    end
+
+    let(:report) do
+      report = YAML.load_file(File.join(PuppetSpec::FIXTURE_DIR, 'yaml/report2.6.x.yaml'))
+      report.extend(described_class)
+      report
     end
 
     it "should create a report directory for the client if one doesn't exist" do
-      @report.process
+      report.process
 
-      expect(File).to be_directory(File.join(Puppet[:reportdir], @report.host))
+      expect(File).to be_directory(File.join(Puppet[:reportdir], report.host))
     end
 
     it "should write the report to the file in YAML" do
       allow(Time).to receive(:now).and_return(Time.utc(2011,01,06,12,00,00))
-      @report.process
+      report.process
 
-      expect(File.read(File.join(Puppet[:reportdir], @report.host, "201101061200.yaml"))).to eq(@report.to_yaml)
+      expect(File.read(File.join(Puppet[:reportdir], report.host, "201101061200.yaml"))).to eq(report.to_yaml)
     end
 
     it "rejects invalid hostnames" do
-      @report.host = ".."
+      report.host = ".."
       expect(Puppet::FileSystem).not_to receive(:exist?)
-      expect { @report.process }.to raise_error(ArgumentError, /Invalid node/)
+      expect { report.process }.to raise_error(ArgumentError, /Invalid node/)
     end
   end
 
   describe "::destroy" do
     it "rejects invalid hostnames" do
       expect(Puppet::FileSystem).not_to receive(:unlink)
-      expect { processor.destroy("..") }.to raise_error(ArgumentError, /Invalid node/)
+      expect { described_class.destroy("..") }.to raise_error(ArgumentError, /Invalid node/)
     end
   end
 
   describe "::validate_host" do
     ['..', 'hello/', '/hello', 'he/llo', 'hello/..', '.'].each do |node|
       it "rejects #{node.inspect}" do
-        expect { processor.validate_host(node) }.to raise_error(ArgumentError, /Invalid node/)
+        expect { described_class.validate_host(node) }.to raise_error(ArgumentError, /Invalid node/)
       end
     end
 
     ['.hello', 'hello.', '..hi', 'hi..'].each do |node|
       it "accepts #{node.inspect}" do
-        processor.validate_host(node)
+        described_class.validate_host(node)
       end
     end
   end

data/spec/unit/transaction/persistence_spec.rb

@@ -123,6 +123,21 @@ describe Puppet::Transaction::Persistence do
         persistence = Puppet::Transaction::Persistence.new
         persistence.load
       end
+
+      it 'should load Time and Symbols' do
+        write_state_file(<<~END)
+          File[/tmp/audit]:
+            parameters:
+              mtime:
+                system_value:
+                  - 2020-07-15 05:38:12.427678398 +00:00
+              ensure:
+                system_value:
+        END
+
+        persistence = Puppet::Transaction::Persistence.new
+        expect(persistence.load.dig("File[/tmp/audit]", "parameters", "mtime", "system_value")).to contain_exactly(be_a(Time))
+      end
     end
   end
 

data/spec/unit/type/service_spec.rb

@@ -165,8 +165,38 @@ describe test_title, "when validating attribute values" do
 
       context "when on Windows", :if => Puppet::Util::Platform.windows? do
         before do
+          allow(Puppet::Util::Windows::User).to receive(:password_is?).and_return(true)
           allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
+        end
+
+        it "should fail when the `Log On As A Service` right is missing from given user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.to raise_error(Puppet::Error, /"myPC\\myUser" is missing the 'Log On As A Service' right./)
+        end
+
+        it "should fail when the `Log On As A Service` right is set to denied for given user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("SeDenyServiceLogonRight")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.to raise_error(Puppet::Error, /"myPC\\myUser" has the 'Log On As A Service' right set to denied./)
+        end
+
+        it "should not fail when given user has the `Log On As A Service` right" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("SeServiceLogonRight")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.not_to raise_error
+        end
+
+        it "should not fail when given user is a default system account even if the `Log On As A Service` right is missing" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser))
           allow(Puppet::Util::Windows::User).to receive(:default_system_account?).and_return(true)
+
+          expect(Puppet::Util::Windows::User).not_to receive(:get_rights)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.not_to raise_error
         end
 
         ['LocalSystem', '.\LocalSystem', 'myPC\LocalSystem', 'lOcALsysTem'].each do |user_input|
@@ -212,12 +242,12 @@ describe test_title, "when validating attribute values" do
 
         it "should fail when account is invalid" do
           allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(nil)
-          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'InvalidUser') }.to raise_error(Puppet::Error, /\"InvalidUser\" is not a valid account/)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'InvalidUser') }.to raise_error(Puppet::Error, /"InvalidUser" is not a valid account/)
         end
 
         it "should fail when sid type is not user or well known user" do
           allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("Administrators", nil, nil, "BUILTIN", :SidTypeAlias))
-          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'Administrators') }.to raise_error(Puppet::Error, /\"Administrators\" is not a valid account/)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'Administrators') }.to raise_error(Puppet::Error, /"Administrators" is not a valid account/)
         end
       end
     end
@@ -254,6 +284,7 @@ describe test_title, "when validating attribute values" do
         before do
           allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
           allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(name_to_principal_result)
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
         end
 
         it "should pass validation when given account is 'LocalSystem'" do
@@ -273,6 +304,7 @@ describe test_title, "when validating attribute values" do
 
             it "should pass validation" do
               allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(predefined_local_account).and_return(false)
+              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with(predefined_local_account).and_return(true)
               expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with("NT AUTHORITY\\#{predefined_local_account}").and_return(true)
 
               expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
@@ -288,6 +320,7 @@ describe test_title, "when validating attribute values" do
         describe "when given logonaccount is not a predefined local account" do
           before do
             allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('myUser').and_return(false)
+            allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('myUser').and_return(false)
             allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('.\\myUser').and_return(false)
           end
 

data/spec/unit/type/user_spec.rb

@@ -4,7 +4,7 @@ require 'spec_helper'
 describe Puppet::Type.type(:user) do
   before :each do
     @provider_class = described_class.provide(:simple) do
-      has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac, :manages_shell
+      has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac, :manages_roles, :manages_shell
       mk_resource_methods
       def create; end
       def delete; end
@@ -35,6 +35,10 @@ describe Puppet::Type.type(:user) do
     expect(described_class.provider_feature(:manages_solaris_rbac)).not_to be_nil
   end
 
+  it "should have a manages_roles feature" do
+    expect(described_class.provider_feature(:manages_roles)).not_to be_nil
+  end
+
   it "should have a manages_expiry feature" do
     expect(described_class.provider_feature(:manages_expiry)).not_to be_nil
   end
@@ -401,7 +405,7 @@ describe Puppet::Type.type(:user) do
   end
 
   describe "when user has roles" do
-    it "should autorequire roles" do
+    it "should autorequire roles on non-Windows", :unless => Puppet::Util::Platform.windows? do
       testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
       testrole = described_class.new(:name => "testrole")
 
@@ -413,6 +417,31 @@ describe Puppet::Type.type(:user) do
       expect(rel.source.ref).to eq(testrole.ref)
       expect(rel.target.ref).to eq(testuser.ref)
     end
+
+    it "should not autorequire roles on Windows", :if => Puppet::Util::Platform.windows? do
+      testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
+      testrole = described_class.new(:name => "testrole")
+
+      Puppet::Resource::Catalog.new :testing do |conf|
+        [testuser, testrole].each { |resource| conf.add_resource resource }
+      end
+
+      expect(testuser.autorequire).to be_empty
+    end
+
+    it "should sync the user roles when changing the state of :ensure if :roles is being managed" do
+      user = Puppet::Type.type(:user).new(:name => "myUser", :ensure => :present)
+      user[:roles] = 'testRole'
+
+      allow(user.provider.class).to receive(:supports_parameter?).and_return(true)
+      expect(user.property(:roles)).to receive(:retrieve).and_return("other")
+      expect(user.property(:roles)).to receive(:insync?).and_return(false)
+      expect(user.property(:roles)).to receive(:sync)
+
+      allow(user.provider).to receive(:create)
+
+      user.property(:ensure).sync
+    end
   end
 
   describe "when setting shell" do

data/spec/unit/util/character_encoding_spec.rb

@@ -21,7 +21,7 @@ describe Puppet::Util::CharacterEncoding do
         let(:invalid_utf8_string) { "\xfd\xf1".force_encoding(Encoding::UTF_8) }
 
         it "should issue a debug message" do
-          expect(Puppet).to receive(:debug).with(/encoding is invalid/)
+          expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/encoding is invalid/) }
           Puppet::Util::CharacterEncoding.convert_to_utf_8(invalid_utf8_string)
         end
 
@@ -80,7 +80,7 @@ describe Puppet::Util::CharacterEncoding do
         end
 
         it "should issue a debug message that the string was not transcodable" do
-          expect(Puppet).to receive(:debug).with(/cannot be transcoded/)
+          expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/cannot be transcoded/) }
           PuppetSpec::CharacterEncoding.with_external_encoding(Encoding::Windows_31J) do
             Puppet::Util::CharacterEncoding.convert_to_utf_8(invalid_win_31j)
           end
@@ -124,7 +124,7 @@ describe Puppet::Util::CharacterEncoding do
           let(:euc_kr) { [253, 241].pack('C*').force_encoding(Encoding::ASCII) }
 
           it "should issue a debug message" do
-            expect(Puppet).to receive(:debug).with(/cannot be transcoded/)
+            expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/cannot be transcoded/) }
             Puppet::Util::CharacterEncoding.convert_to_utf_8(euc_kr)
           end
 
@@ -168,7 +168,7 @@ describe Puppet::Util::CharacterEncoding do
       let(:foo) { 'foo' }
 
       it "should issue a debug message" do
-        expect(Puppet).to receive(:debug).with(/not valid UTF-8/)
+        expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/not valid UTF-8/) }
         Puppet::Util::CharacterEncoding.override_encoding_to_utf_8(oslash)
       end