puppet 6.19.0 → 7.3.0

data/spec/unit/network/http/api/master/v3_spec.rb

@@ -15,15 +15,18 @@ describe Puppet::Network::HTTP::API::Master::V3 do
         chain(Puppet::Network::HTTP::API::Master::V3.routes)
   }
 
-  it "mounts the environments endpoint" do
-    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/environments")
-    master_routes.process(request, response)
-
-    expect(response.code).to eq(200)
+  # simulate puppetserver registering its authconfigloader class
+  around :each do |example|
+    Puppet::Network::Authorization.authconfigloader_class = Object
+    begin
+      example.run
+    ensure
+      Puppet::Network::Authorization.authconfigloader_class = nil
+    end
   end
 
-  it "mounts the environment endpoint" do
-    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/environment/production")
+  it "mounts the environments endpoint" do
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/environments")
     master_routes.process(request, response)
 
     expect(response.code).to eq(200)
@@ -54,4 +57,22 @@ describe Puppet::Network::HTTP::API::Master::V3 do
       master_routes.process(request, response)
     }.to raise_error(not_found_error)
   end
+
+  it "checks authorization for indirected routes" do
+    Puppet::Network::Authorization.authconfigloader_class = nil
+
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/catalog/foo")
+    expect {
+      master_routes.process(request, response)
+    }.to raise_error(Puppet::Network::HTTP::Error::HTTPNotAuthorizedError, %r{Not Authorized: Forbidden request: /puppet/v3/catalog/foo \(method GET\)})
+  end
+
+  it "checks authorization for environments" do
+    Puppet::Network::Authorization.authconfigloader_class = nil
+
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/environments")
+    expect {
+      master_routes.process(request, response)
+    }.to raise_error(Puppet::Network::HTTP::Error::HTTPNotAuthorizedError, %r{Not Authorized: Forbidden request: /puppet/v3/environments \(method GET\)})
+  end
 end

data/spec/unit/network/http/api_spec.rb

@@ -70,6 +70,16 @@ describe Puppet::Network::HTTP::API do
     end
 
     describe "when processing master routes" do
+      # simulate puppetserver registering its authconfigloader class
+      around :each do |example|
+        Puppet::Network::Authorization.authconfigloader_class = Object
+        begin
+          example.run
+        ensure
+          Puppet::Network::Authorization.authconfigloader_class = nil
+        end
+      end
+
       it "responds to v3 indirector requests" do
         req = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_prefix}/v3/node/foo",
                                                        :params => {:environment => "production"},

data/spec/unit/network/http/connection_spec.rb

@@ -1,6 +1,5 @@
 require 'spec_helper'
 require 'puppet/network/http/connection'
-require 'puppet/network/http/connection_adapter'
 require 'puppet/test_ca'
 
 describe Puppet::Network::HTTP::Connection do
@@ -10,21 +9,23 @@ describe Puppet::Network::HTTP::Connection do
   let(:url) { "https://#{host}:#{port}#{path}" }
   let(:params) { { 'key' => 'a value' } }
   let(:encoded_url_with_params) { "#{url}?%7B%22key%22:%22a%20value%22%7D" }
+  let(:ssl_context) { Puppet::SSL::SSLProvider.new.create_system_context(cacerts: []) }
+  let(:verifier) { Puppet::SSL::Verifier.new(host, ssl_context) }
 
-  shared_examples_for "an HTTP connection" do |klass, legacy_api|
-    subject { klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator) }
+  shared_examples_for "an HTTP connection" do |klass|
+    subject { klass.new(host, port, :verifier => verifier) }
 
     context "when providing HTTP connections" do
       context "when initializing http instances" do
         it "should return an http instance created with the passed host and port" do
-          conn = klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :verifier => verifier)
 
           expect(conn.address).to eq(host)
           expect(conn.port).to eq(port)
         end
 
         it "should enable ssl on the http instance by default" do
-          conn = klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :verifier => verifier)
 
           expect(conn).to be_use_ssl
         end
@@ -36,21 +37,21 @@ describe Puppet::Network::HTTP::Connection do
         end
 
         it "can enable ssl using an option" do
-          conn = klass.new(host, port, :use_ssl => true, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :use_ssl => true, :verifier => verifier)
 
           expect(conn).to be_use_ssl
         end
 
         it "ignores the ':verify' option when ssl is disabled" do
-          conn = klass.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :use_ssl => false, :verifier => verifier)
 
           expect(conn.verifier).to be_nil
         end
 
         it "wraps the validator in an adapter" do
-          conn = klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :verifier => verifier)
 
-          expect(conn.verifier).to be_a_kind_of(Puppet::SSL::VerifierAdapter)
+          expect(conn.verifier).to be_a(Puppet::SSL::Verifier)
         end
 
         it "should raise Puppet::Error when invalid options are specified" do
@@ -66,9 +67,9 @@ describe Puppet::Network::HTTP::Connection do
 
         it "raises if the wrong verifier class is specified" do
           expect {
-            klass.new(host, port, :verifier => Puppet::SSL::Validator.default_validator)
+            klass.new(host, port, :verifier => Object.new)
           }.to raise_error(ArgumentError,
-                           "Expected an instance of Puppet::SSL::Verifier but was passed a Puppet::SSL::Validator::DefaultValidator")
+                           "Expected an instance of Puppet::SSL::Verifier but was passed a Object")
         end
       end
     end
@@ -306,8 +307,6 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it 'defaults content-type to application/x-www-form-urlencoded' do
-        skip("Net::HTTP sends a default content-type header, but it's not visible to webmock") if legacy_api
-
         stub_request(:put, url).with(headers: {'Content-Type' => 'application/x-www-form-urlencoded'})
 
         subject.put(path, '')
@@ -362,8 +361,6 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it 'defaults content-type to application/x-www-form-urlencoded' do
-        skip("Net::HTTP sends a default content-type header, but it's not visible to webmock") if legacy_api
-
         stub_request(:post, url).with(headers: {'Content-Type' => 'application/x-www-form-urlencoded'})
 
         subject.post(path, "")
@@ -425,7 +422,7 @@ describe Puppet::Network::HTTP::Connection do
 
       def create_connection(options = {})
         options[:use_ssl] = false
-        options[:verify] = Puppet::SSL::Validator.no_validator
+        options[:verifier] = verifier
         subject.new(host, port, options)
       end
 
@@ -474,15 +471,9 @@ describe Puppet::Network::HTTP::Connection do
       it 'raises an exception when the location header is missing' do
         stub_request(:get, "http://me.example.com:8140/").to_return(status: 302)
 
-        if legacy_api
-          expect {
-            create_connection.get('/')
-          }.to raise_error(URI::InvalidURIError, /bad URI/)
-        else
-          expect {
+        expect {
             create_connection.get('/')
           }.to raise_error(Puppet::HTTP::ProtocolError, /Location response header is missing/)
-        end
       end
     end
 
@@ -503,14 +494,9 @@ describe Puppet::Network::HTTP::Connection do
       it "should return a 503 response if Retry-After is not convertible to an Integer or RFC 2822 Date" do
         retry_after('foo')
 
-        if legacy_api
-          result = subject.get('/foo')
-          expect(result.code).to eq("503")
-        else
-          expect {
-            subject.get('/foo')
-          }.to raise_error(Puppet::HTTP::ProtocolError, /Failed to parse Retry-After header 'foo'/)
-        end
+        expect {
+          subject.get('/foo')
+        }.to raise_error(Puppet::HTTP::ProtocolError, /Failed to parse Retry-After header 'foo'/)
       end
 
       it "should close the connection before sleeping" do
@@ -525,11 +511,7 @@ describe Puppet::Network::HTTP::Connection do
         allow(http1).to receive(:started?).and_return(true)
 
         # The "with_connection" method is required to yield started connections
-        pool = if legacy_api
-                 Puppet.lookup(:http_pool)
-               else
-                 Puppet.runtime[:http].pool
-               end
+        pool = Puppet.runtime[:http].pool
 
         allow(pool).to receive(:with_connection).and_yield(http1).and_yield(http2)
 
@@ -649,10 +631,6 @@ describe Puppet::Network::HTTP::Connection do
   end
 
   describe Puppet::Network::HTTP::Connection do
-    it_behaves_like "an HTTP connection", described_class, true
-  end
-
-  describe Puppet::Network::HTTP::ConnectionAdapter do
-    it_behaves_like "an HTTP connection", described_class, false
+    it_behaves_like "an HTTP connection", described_class
   end
 end

data/spec/unit/network/http/handler_spec.rb

@@ -2,7 +2,6 @@ require 'spec_helper'
 
 require 'puppet_spec/handler'
 require 'puppet/indirector_testing'
-require 'puppet/network/authorization'
 require 'puppet/network/http'
 
 describe Puppet::Network::HTTP::Handler do
@@ -102,11 +101,6 @@ describe Puppet::Network::HTTP::Handler do
       { :status => 200 }
     end
 
-    before do
-      allow(handler).to receive(:check_authorization)
-      allow(handler).to receive(:warn_if_near_expiration)
-    end
-
     it "should setup a profiler when the puppet-profiling header exists" do
       request = a_request
       request[:headers][Puppet::Network::HTTP::HEADER_ENABLE_PROFILING.downcase] = "true"

data/spec/unit/network/http_pool_spec.rb

@@ -69,10 +69,6 @@ describe Puppet::Network::HttpPool do
       expect(Puppet::Network::HttpPool.http_instance("me", 54321, true)).to be_use_ssl
     end
 
-    it 'has an http_ssl_instance method' do
-      expect(Puppet::Network::HttpPool.http_ssl_instance("me", 54321)).to be_use_ssl
-    end
-
     context "when calling 'connection'" do
       it 'requires an ssl_context' do
         expect {

data/spec/unit/node/environment_spec.rb

@@ -526,34 +526,46 @@ describe Puppet::Node::Environment do
   end
 
   describe "managing module translations" do
-    it "creates a new text domain the first time we try to use the text domain" do
-      expect(Puppet::GettextConfig).to receive(:reset_text_domain).with(env.name)
-      expect(Puppet::ModuleTranslations).to receive(:load_from_modulepath)
-      expect(Puppet::GettextConfig).to receive(:clear_text_domain)
+    context "when i18n is enabled" do
+      before(:each) do
+        Puppet[:disable_i18n] = false
+      end
 
-      env.with_text_domain do; end
-    end
+      it "yields block results" do
+        ran = false
+        expect(env.with_text_domain { ran = true; :result }).to eq(:result)
+        expect(ran).to eq(true)
+      end
 
-    it "uses the existing text domain once it has been created" do
-      env.with_text_domain do; end
+      it "creates a new text domain the first time we try to use the text domain" do
+        expect(Puppet::GettextConfig).to receive(:reset_text_domain).with(env.name)
+        expect(Puppet::ModuleTranslations).to receive(:load_from_modulepath)
+        expect(Puppet::GettextConfig).to receive(:clear_text_domain)
 
-      expect(Puppet::GettextConfig).to receive(:use_text_domain).with(env.name)
-      env.with_text_domain do; end
-    end
+        env.with_text_domain do; end
+      end
 
-    it "yields block results" do
-      ran = false
-      expect(env.with_text_domain { ran = true; :result }).to eq(:result)
-      expect(ran).to eq(true)
+      it "uses the existing text domain once it has been created" do
+        env.with_text_domain do; end
+
+        expect(Puppet::GettextConfig).to receive(:use_text_domain).with(env.name)
+        env.with_text_domain do; end
+      end
     end
 
-    it "yields block results when i18n is disabled" do
-      Puppet[:disable_i18n] = true
+    context "when i18n is disabled" do
+      it "yields block results" do
+        ran = false
+        expect(env.with_text_domain { ran = true; :result }).to eq(:result)
+        expect(ran).to eq(true)
+      end
+
+      it "does not create a new text domain the first time we try to use the text domain" do
+        expect(Puppet::GettextConfig).not_to receive(:reset_text_domain)
+        expect(Puppet::ModuleTranslations).not_to receive(:load_from_modulepath)
 
-      ran = false
-      expect(env.with_text_domain { ran = true; :result }).to eq(:result)
-      expect(ran).to eq(true)
+        env.with_text_domain do; end
+      end
     end
   end
-
 end

data/spec/unit/node_spec.rb

@@ -417,64 +417,12 @@ end
 
 describe Puppet::Node, "when generating the list of names to search through" do
   before do
-    Puppet[:strict_hostname_checking] = false
     @node = Puppet::Node.new("foo.domain.com",
                              :parameters => {"hostname" => "yay", "domain" => "domain.com"})
   end
 
-  it "returns an array of names" do
+  it "returns an array of one name" do
     expect(@node.names).to be_instance_of(Array)
-  end
-
-  describe "and the node name is fully qualified" do
-    it "contains an entry for each part of the node name" do
-      expect(@node.names).to include("foo.domain.com")
-      expect(@node.names).to include("foo.domain")
-      expect(@node.names).to include("foo")
-    end
-  end
-
-  it "includes the node's fqdn" do
-    expect(@node.names).to include("yay.domain.com")
-  end
-
-  it "combines and include the node's hostname and domain if no fqdn is available" do
-    expect(@node.names).to include("yay.domain.com")
-  end
-
-  it "contains an entry for each name available by stripping a segment of the fqdn" do
-    @node.parameters["fqdn"] = "foo.deep.sub.domain.com"
-    expect(@node.names).to include("foo.deep.sub.domain")
-    expect(@node.names).to include("foo.deep.sub")
-  end
-
-  describe "and :node_name is set to 'cert'" do
-    before do
-      Puppet[:node_name] = "cert"
-    end
-
-    it "uses the passed-in key as the first value" do
-      expect(@node.names[0]).to eq("foo.domain.com")
-    end
-
-    describe "and strict hostname checking is enabled" do
-      before do
-        Puppet[:strict_hostname_checking] = true
-      end
-
-      it "only uses the passed-in key" do
-        expect(@node.names).to eq(["foo.domain.com"])
-      end
-    end
-  end
-
-  describe "and :node_name is set to 'facter'" do
-    before do
-      Puppet[:node_name] = "facter"
-    end
-
-    it "uses the node's 'hostname' fact as the first value" do
-      expect(@node.names[0]).to eq("yay")
-    end
+    expect(@node.names).to eq ["foo.domain.com"]
   end
 end

data/spec/unit/parser/compiler_spec.rb

@@ -240,20 +240,9 @@ describe Puppet::Parser::Compiler do
   end
 
   describe "when compiling" do
-    def compile_methods
-      [:set_node_parameters, :evaluate_main, :evaluate_ast_node, :evaluate_node_classes, :evaluate_generators, :fail_on_unevaluated,
-        :finish, :store, :extract, :evaluate_relationships]
-    end
-
-    # Stub all of the main compile methods except the ones we're specifically interested in.
-    def compile_stub(*except)
-      (compile_methods - except).each { |m| allow(@compiler).to receive(m) }
-    end
-
     it "should set node parameters as variables in the top scope" do
       params = {"a" => "b", "c" => "d"}
       allow(@node).to receive(:parameters).and_return(params)
-      compile_stub(:set_node_parameters)
       @compiler.compile
       expect(@compiler.topscope['a']).to eq("b")
       expect(@compiler.topscope['c']).to eq("d")
@@ -262,13 +251,11 @@ describe Puppet::Parser::Compiler do
     it "should set node parameters that are of Symbol type as String variables in the top scope" do
       params = {"a" => :b}
       allow(@node).to receive(:parameters).and_return(params)
-      compile_stub(:set_node_parameters)
       @compiler.compile
       expect(@compiler.topscope['a']).to eq("b")
     end
 
     it "should set the node's environment as a string variable in top scope" do
-      compile_stub(:set_node_parameters)
       @node.merge({'wat' => 'this is how the sausage is made'})
       @compiler.compile
       expect(@compiler.topscope['environment']).to eq("testing")
@@ -276,7 +263,6 @@ describe Puppet::Parser::Compiler do
     end
 
     it "sets the environment based on node.environment instead of the parameters" do
-      compile_stub(:set_node_parameters)
       @node.parameters['environment'] = "Not actually #{@node.environment.name}"
 
       @compiler.compile
@@ -286,23 +272,21 @@ describe Puppet::Parser::Compiler do
     it "should set the client and server versions on the catalog" do
       params = {"clientversion" => "2", "serverversion" => "3"}
       allow(@node).to receive(:parameters).and_return(params)
-      compile_stub(:set_node_parameters)
       @compiler.compile
       expect(@compiler.catalog.client_version).to eq("2")
       expect(@compiler.catalog.server_version).to eq("3")
     end
 
     it "should evaluate the main class if it exists" do
-      compile_stub(:evaluate_main)
       main_class = @known_resource_types.add Puppet::Resource::Type.new(:hostclass, "")
+      @compiler.topscope.source = main_class
+
       expect(main_class).to receive(:evaluate_code).with(be_a(Puppet::Parser::Resource))
-      expect(@compiler.topscope).to receive(:source=).with(main_class)
 
       @compiler.compile
     end
 
     it "should create a new, empty 'main' if no main class exists" do
-      compile_stub(:evaluate_main)
       @compiler.compile
       expect(@known_resource_types.find_hostclass("")).to be_instance_of(Puppet::Resource::Type)
     end
@@ -325,7 +309,7 @@ describe Puppet::Parser::Compiler do
       @compiler.add_collection(colls[0])
       @compiler.add_collection(colls[1])
 
-      compile_stub(:evaluate_generators)
+      allow(@compiler).to receive(:fail_on_unevaluated)
       @compiler.compile
     end