puppet 6.24.0-x64-mingw32 → 7.0.0-x64-mingw32

data/spec/unit/type/service_spec.rb

@@ -72,65 +72,50 @@ describe test_title, "when validating attribute values" do
       allow(@provider.class).to receive(:supports_parameter?).and_return(true)
     end
 
-    describe "for value without required features" do
-      before :each do
-        allow(@provider).to receive(:satisfies?)
-      end
-
-      it "should not support :mask as a value" do
-        expect { Puppet::Type.type(:service).new(:name => "yay", :enable => :mask) }.to raise_error(
-          Puppet::ResourceError,
-          /Provider .+ must have features 'maskable' to set 'enable' to 'mask'/
-        )
-      end
+    it "should support :true as a value" do
+      srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :true)
+      expect(srv.should(:enable)).to eq(:true)
+    end
 
-      it "should not support :manual as a value" do
-        expect { Puppet::Type.type(:service).new(:name => "yay", :enable => :manual) }.to raise_error(
-          Puppet::ResourceError,
-          /Provider .+ must have features 'manual_startable' to set 'enable' to 'manual'/
-        )
-      end
+    it "should support :false as a value" do
+      srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :false)
+      expect(srv.should(:enable)).to eq(:false)
+    end
 
-      it "should not support :mask as a value" do
-        expect { Puppet::Type.type(:service).new(:name => "yay", :enable => :delayed) }.to raise_error(
-          Puppet::ResourceError,
-          /Provider .+ must have features 'delayed_startable' to set 'enable' to 'delayed'/
-        )
-      end
+    it "should support :mask as a value" do
+      srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :mask)
+      expect(srv.should(:enable)).to eq(:mask)
     end
 
-    describe "for value with required features" do
-      before :each do
-        allow(@provider).to receive(:satisfies?).and_return(:true)
-      end
+    it "should support :manual as a value on Windows" do
+      allow(Puppet::Util::Platform).to receive(:windows?).and_return(true)
+      srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :manual)
+      expect(srv.should(:enable)).to eq(:manual)
+    end
 
-      it "should support :true as a value" do
-        srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :true)
-        expect(srv.should(:enable)).to eq(:true)
-      end
+    it "should support :delayed as a value on Windows" do
+      allow(Puppet::Util::Platform).to receive(:windows?).and_return(true)
 
-      it "should support :false as a value" do
-        srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :false)
-        expect(srv.should(:enable)).to eq(:false)
-      end
+      srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :delayed)
+      expect(srv.should(:enable)).to eq(:delayed)
+    end
 
-      it "should support :mask as a value" do
-        srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :mask)
-        expect(srv.should(:enable)).to eq(:mask)
-      end
+    it "should not support :manual as a value when not on Windows" do
+      allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
 
-      it "should support :manual as a value on Windows" do
-        allow(Puppet::Util::Platform).to receive(:windows?).and_return(true)
-        srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :manual)
-        expect(srv.should(:enable)).to eq(:manual)
-      end
+      expect { Puppet::Type.type(:service).new(:name => "yay", :enable => :manual) }.to raise_error(
+        Puppet::Error,
+        /Setting enable to manual is only supported on Microsoft Windows\./
+      )
+    end
 
-      it "should support :delayed as a value on Windows" do
-        allow(Puppet::Util::Platform).to receive(:windows?).and_return(true)
+    it "should not support :delayed as a value when not on Windows" do
+      allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
 
-        srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :delayed)
-        expect(srv.should(:enable)).to eq(:delayed)
-      end
+      expect { Puppet::Type.type(:service).new(:name => "yay", :enable => :delayed) }.to raise_error(
+        Puppet::Error,
+        /Setting enable to delayed is only supported on Microsoft Windows\./
+      )
     end
   end
 
@@ -165,24 +150,105 @@ describe test_title, "when validating attribute values" do
       provider_class_with_logon_credentials = Puppet::Type.type(:service).provide(:simple) do
         has_features :manages_logon_credentials
         def logonpassword=(value) end
-        def logonaccount_insync?(current) end
       end
       allow(Puppet::Type.type(:service)).to receive(:defaultprovider).and_return(provider_class_with_logon_credentials)
     end
 
     describe "the 'logonaccount' property" do
-      let(:service) {Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser')}
+      it "should not be munged nor checked when not on Windows" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'NonWindowsUser')
 
-      it "should let superclass implementation resolve insyncness when provider does not respond to the 'logonaccount_insync?' method" do
-        allow(service.provider).to receive(:respond_to?).with(:logonaccount_insync?).and_return(false)
-        expect(service.property(:logonaccount).insync?('myUser')).to eq(true)
+        expect { service }.not_to raise_error
+        expect(service[:logonaccount]).to eq('NonWindowsUser')
       end
 
-      it "should let provider resolve insyncness when provider responds to the 'logonaccount_insync?' method" do
-        allow(service.provider).to receive(:respond_to?).with(:logonaccount_insync?, any_args).and_return(true)
-        allow(service.provider).to receive(:logonaccount_insync?).and_return(false)
-        
-        expect(service.property(:logonaccount).insync?('myUser')).to eq(false)
+      context "when on Windows", :if => Puppet::Util::Platform.windows? do
+        before do
+          allow(Puppet::Util::Windows::User).to receive(:password_is?).and_return(true)
+          allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
+        end
+
+        it "should fail when the `Log On As A Service` right is missing from given user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.to raise_error(Puppet::Error, /"myPC\\myUser" is missing the 'Log On As A Service' right./)
+        end
+
+        it "should fail when the `Log On As A Service` right is set to denied for given user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("SeDenyServiceLogonRight")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.to raise_error(Puppet::Error, /"myPC\\myUser" has the 'Log On As A Service' right set to denied./)
+        end
+
+        it "should not fail when given user has the `Log On As A Service` right" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("SeServiceLogonRight")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.not_to raise_error
+        end
+
+        it "should not fail when given user is a default system account even if the `Log On As A Service` right is missing" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).and_return(true)
+
+          expect(Puppet::Util::Windows::User).not_to receive(:get_rights)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.not_to raise_error
+        end
+
+        ['LocalSystem', '.\LocalSystem', 'myPC\LocalSystem', 'lOcALsysTem'].each do |user_input|
+          it "should succesfully munge #{user_input} to 'LocalSystem'" do
+            service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => user_input)
+
+            expect { service }.not_to raise_error
+            expect(service[:logonaccount]).to eq('LocalSystem')
+          end
+        end
+
+        it "should succesfully munge local account" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('.\myUser')
+        end
+
+        it "should succesfully munge domain account" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("DomainUser", nil, nil, "myDomain", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'DomainUser')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('myDomain\DomainUser')
+        end
+
+        it "should succesfully munge well known user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeWellKnownGroup))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'LocalService')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('NT AUTHORITY\LOCAL SERVICE')
+        end
+
+        it "should succesfully munge a SID" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("NETWORK SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'S-1-5-20')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('NT AUTHORITY\NETWORK SERVICE')
+        end
+
+        it "should fail when account is invalid" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(nil)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'InvalidUser') }.to raise_error(Puppet::Error, /"InvalidUser" is not a valid account/)
+        end
+
+        it "should fail when sid type is not user or well known user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("Administrators", nil, nil, "BUILTIN", :SidTypeAlias))
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'Administrators') }.to raise_error(Puppet::Error, /"Administrators" is not a valid account/)
+        end
       end
     end
 
@@ -192,6 +258,7 @@ describe test_title, "when validating attribute values" do
       end
 
       it "should default to empty string when only logonaccount is being managed" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
         service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser')
 
         expect { service }.not_to raise_error
@@ -204,8 +271,70 @@ describe test_title, "when validating attribute values" do
       end
 
       it "should fail when logonpassword includes the ':' character" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
         expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'my:Pass') }.to raise_error(Puppet::Error, /Passwords cannot include ':'/)
       end
+
+      it "should not further check the password against given account when not on Windows" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myPass') }.not_to raise_error
+      end
+
+      context "when on Windows", :if => Puppet::Util::Platform.windows? do
+        before do
+          allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(name_to_principal_result)
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
+        end
+
+        it "should pass validation when given account is 'LocalSystem'" do
+          allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('LocalSystem').and_return(true)
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('LocalSystem').and_return(false)
+
+          expect(Puppet::Util::Windows::SID).not_to receive(:name_to_principal)
+          expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'LocalSystem') }.not_to raise_error
+        end
+
+        ['LOCAL SERVICE', 'NETWORK SERVICE', 'SYSTEM'].each do |predefined_local_account|
+          describe "when given account is #{predefined_local_account}" do
+            let(:name_to_principal_result) do
+              Puppet::Util::Windows::SID::Principal.new(predefined_local_account, nil, nil, "NT AUTHORITY", :SidTypeUser)
+            end
+
+            it "should pass validation" do
+              allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(predefined_local_account).and_return(false)
+              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with(predefined_local_account).and_return(true)
+              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with("NT AUTHORITY\\#{predefined_local_account}").and_return(true)
+
+              expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
+              expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => predefined_local_account) }.not_to raise_error
+            end
+          end
+        end
+
+        let(:name_to_principal_result) do
+          Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser)
+        end
+
+        describe "when given logonaccount is not a predefined local account" do
+          before do
+            allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('myUser').and_return(false)
+            allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('myUser').and_return(false)
+            allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('.\\myUser').and_return(false)
+          end
+
+          it "should pass validation if password is proven correct" do
+            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myPass', '.').and_return(true)
+            expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myPass') }.not_to raise_error
+          end
+
+          it "should not pass validation if password check fails" do
+            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myWrongPass', '.').and_return(false)
+            expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myWrongPass') }.to raise_error(Puppet::Error, /The given password is invalid for user '.\\myUser'/)
+          end
+        end
+      end
     end
   end
 
@@ -359,7 +488,7 @@ describe test_title, "when changing the host" do
   it "insyncness should be resolved by provider instead of superclass implementation when provider responds to the 'enabled_insync?' method" do
     allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
     @service[:enable] = true
-    allow(@service.provider).to receive(:respond_to?).with(:enabled_insync?, any_args).and_return(true)
+    allow(@service.provider).to receive(:respond_to?).with(:enabled_insync?).and_return(true)
     allow(@service.provider).to receive(:enabled_insync?).and_return(false)
 
     expect(@service.property(:enable).insync?(:true)).to eq(false)

data/spec/unit/type/tidy_spec.rb

@@ -191,31 +191,22 @@ describe tidy do
     describe "and recursion is used" do
       before do
         @tidy[:recurse] = true
+        allow_any_instance_of(Puppet::FileServing::Fileset).to receive(:stat).and_return(double("stat"))
         @fileset = Puppet::FileServing::Fileset.new(@basepath)
         allow(Puppet::FileServing::Fileset).to receive(:new).and_return(@fileset)
       end
 
-      it "should use a Fileset with default max_files for infinite recursion" do
-        expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true, :max_files=>0).and_return(@fileset)
+      it "should use a Fileset for infinite recursion" do
+        expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true).and_return(@fileset)
         expect(@fileset).to receive(:files).and_return(%w{. one two})
         allow(@tidy).to receive(:tidy?).and_return(false)
 
         @tidy.generate
       end
 
-      it "should use a Fileset with default max_files for limited recursion" do
+      it "should use a Fileset for limited recursion" do
         @tidy[:recurse] = 42
-        expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true, :recurselimit => 42, :max_files=>0).and_return(@fileset)
-        expect(@fileset).to receive(:files).and_return(%w{. one two})
-        allow(@tidy).to receive(:tidy?).and_return(false)
-
-        @tidy.generate
-      end
-
-      it "should use a Fileset with max_files for limited recursion" do
-        @tidy[:recurse] = 42
-        @tidy[:max_files] = 9876
-        expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true, :recurselimit => 42, :max_files=>9876).and_return(@fileset)
+        expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true, :recurselimit => 42).and_return(@fileset)
         expect(@fileset).to receive(:files).and_return(%w{. one two})
         allow(@tidy).to receive(:tidy?).and_return(false)
 
@@ -280,13 +271,6 @@ describe tidy do
         @ager.tidy?(@basepath, @stat)
       end
 
-      it "should return true if the specified age is 0" do
-        @tidy[:age] = "0"
-        expect(@stat).to receive(:mtime).and_return(Time.now)
-
-        expect(@ager).to be_tidy(@basepath, @stat)
-      end
-
       it "should return false if the file is more recent than the specified age" do
         expect(@stat).to receive(:mtime).and_return(Time.now)
 
@@ -428,7 +412,7 @@ describe tidy do
       @tidy[:recurse] = true
       @tidy[:rmdirs] = true
       fileset = double('fileset')
-      expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true, :max_files=>0).and_return(fileset)
+      expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true).and_return(fileset)
       expect(fileset).to receive(:files).and_return(%w{. one two one/subone two/subtwo one/subone/ssone})
       allow(@tidy).to receive(:tidy?).and_return(true)
 
@@ -450,7 +434,7 @@ describe tidy do
       @tidy[:recurse] = true
       @tidy[:rmdirs] = true
       fileset = double('fileset')
-      expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true, :max_files=>0).and_return(fileset)
+      expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true).and_return(fileset)
       expect(fileset).to receive(:files).and_return(%w{. a a/2 a/1 a/3})
       allow(@tidy).to receive(:tidy?).and_return(true)
 
@@ -463,7 +447,7 @@ describe tidy do
       @tidy[:noop] = true
 
       fileset = double('fileset')
-      expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true, :max_files=>0).and_return(fileset)
+      expect(Puppet::FileServing::Fileset).to receive(:new).with(@basepath, :recurse => true).and_return(fileset)
       expect(fileset).to receive(:files).and_return(%w{. a a/2 a/1 a/3})
       allow(@tidy).to receive(:tidy?).and_return(true)
 

data/spec/unit/type/user_spec.rb

@@ -174,51 +174,6 @@ describe Puppet::Type.type(:user) do
     end
   end
 
-  describe "when managing the purge_ssh_keys property" do
-    context "with valid input" do
-      it "should support a :true value" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => :true) }.to_not raise_error
-      end
-
-      it "should support a :false value" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => :false) }.to_not raise_error
-      end
-
-      it "should support a String value" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => File.expand_path('home/foo/.ssh/authorized_keys')) }.to_not raise_error
-      end
-
-      it "should support an Array value" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => [File.expand_path('home/foo/.ssh/authorized_keys'),
-          File.expand_path('custom/authorized_keys')]) }.to_not raise_error
-      end
-    end
-
-    context "with faulty input" do
-      it "should raise error for relative path" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => 'home/foo/.ssh/authorized_keys') }.to raise_error(Puppet::ResourceError,
-          /Paths to keyfiles must be absolute/ )
-      end
-
-      it "should raise error for invalid type" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => :invalid) }.to raise_error(Puppet::ResourceError,
-          /purge_ssh_keys must be true, false, or an array of file names/ )
-      end
-
-      it "should raise error for array with relative path" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => ['home/foo/.ssh/authorized_keys',
-          File.expand_path('custom/authorized_keys')]) }.to raise_error(Puppet::ResourceError,
-          /Paths to keyfiles must be absolute/ )
-      end
-
-      it "should raise error for array with invalid type" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => [:invalid,
-          File.expand_path('custom/authorized_keys')]) }.to raise_error(Puppet::ResourceError,
-          /Each entry for purge_ssh_keys must be a string/ )
-      end
-    end
-  end
-
   describe "when managing the uid property" do
     it "should convert number-looking strings into actual numbers" do
       expect(described_class.new(:name => 'foo', :uid => '50')[:uid]).to eq(50)

data/spec/unit/type_spec.rb

@@ -195,6 +195,26 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
     end
   end
 
+  context 'aliased resource' do
+    it 'fails if a resource is defined and then redefined using name that results in the same alias' do
+      drive = Puppet::Util::Platform.windows? ? 'C:' : ''
+      code = <<~PUPPET
+        $dir='#{drive}/tmp/test'
+        $same_dir='#{drive}/tmp/test/'
+
+        file {$dir:
+          ensure => directory
+        }
+
+        file { $same_dir:
+          ensure => directory
+        }
+      PUPPET
+
+      expect { compile_to_ral(code) }.to raise_error(/resource \["File", "#{drive}\/tmp\/test"\] already declared/)
+    end
+  end
+
   context "resource attributes" do
     let(:resource) {
       resource = klass.new(:name => "foo")
@@ -912,8 +932,8 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
 
     it "should always retrieve the ensure value by default" do
       @ensurable_resource = Puppet::Type.type(:file).new(:name => "/not/existent", :mode => "0644")
-      # the ensure property is lazily metaprogrammed...
-      allow_any_instance_of(Puppet::Type::File::Ensure).to receive(:retrieve).and_return(:absent)
+      allow(Puppet::Type::File::Ensure).to receive(:ensure).and_return(:absent)
+      expect_any_instance_of(Puppet::Type::File::Ensure).to receive(:retrieve).once
       @ensurable_resource.retrieve_resource
     end