wip ci

.fixtures.yml

@@ -4,7 +4,6 @@ fixtures:
     inifile: 'https://github.com/puppetlabs/puppetlabs-inifile.git'
     stdlib: 'https://github.com/puppetlabs/puppetlabs-stdlib.git'
     postgresql: 'https://github.com/puppetlabs/puppet-postgresql.git'
-    firewall: 'https://github.com/puppetlabs/puppetlabs-firewall.git'
     apt: 'https://github.com/puppetlabs/puppetlabs-apt.git'
     concat: 'https://github.com/puppetlabs/puppetlabs-concat.git'
     file_concat: 'https://github.com/electrical/puppet-lib-file_concat.git'
@@ -22,5 +21,9 @@ fixtures:
     augeas_core:
       repo: https://github.com/puppetlabs/puppetlabs-augeas_core.git
       puppet_version: ">= 6.0.0"
+  forge_modules:
+    firewall:
+      repo: 'puppetlabs/firewall'
+      ref: "6.0.0"
   symlinks:
     puppetdb: '#{source_dir}'

spec/defines/database/default_read_grant_spec.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'puppetdb::database::default_read_grant' do
+  valid = {
+    'standard': {
+      database_name:               'puppetdb',
+      schema:                      'public',
+      database_username:           'puppetdb',
+      database_read_only_username: 'puppetdb-read',
+    }
+  }
+
+  invalid = {
+    'no params': {},
+    'without database_name': {
+      schema:                      'public',
+      database_username:           'puppetdb',
+      database_read_only_username: 'puppetdb-read',
+    }
+  }
+
+  let(:facts) { on_supported_os.take(1).first[1] }
+  let(:pre_condition) { 'include postgresql::server' }
+  let(:name) { title }
+  let(:args) { params }
+
+  context 'with valid parameters' do
+    valid.each do |name, params|
+      context name do
+        include_examples 'puppetdb::database::default_read_grant' do
+          let(:title) { name.to_s }
+          let(:params) { params }
+        end
+      end
+    end
+  end
+
+  context 'with invalid parameters' do
+    invalid.each do |name, params|
+      context name do
+        include_examples 'puppetdb::database::default_read_grant', Puppet::Error do
+          let(:title) { name.to_s }
+          let(:params) { params }
+        end
+      end
+    end
+  end
+end

spec/defines/database/postgresql_ssl_rules_spec.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+valid = {
+  'puppetdb-read': {
+    database_name:     'puppetdb',
+    database_username: 'monitor',
+    puppetdb_server:   'localhost',
+  },
+  'monitor': {
+    database_name:     'opensesame',
+    database_username: 'grover',
+    puppetdb_server:   'rainbow',
+  },
+}
+
+invalid = {
+  'no params': {},
+}
+
+describe 'puppetdb::database::postgresql_ssl_rules' do
+  let(:facts) { on_supported_os.take(1).first[1] }
+  let(:pre_condition) { 'include postgresql::server' }
+  let(:name) { title }
+  let(:args) { params }
+
+  valid.each do |name, params|
+    context "for valid #{name}" do
+      include_examples 'puppetdb::database::postgresql_ssl_rules' do
+        let(:title) { name.to_s }
+        let(:params) { params }
+      end
+    end
+  end
+
+  invalid.each do |name, params|
+    context "for invalid #{name}" do
+      include_examples 'puppetdb::database::postgresql_ssl_rules', Puppet::Error do
+        let(:title) { name.to_s }
+        let(:params) { params }
+      end
+    end
+  end
+end

spec/defines/database/read_grant_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+valid = {
+  'grant read on new objects from blah to blah': {
+    database_read_only_username: 'puppetdb-read',
+    database_name:               'puppetdb',
+    schema:                      'public',
+  },
+}
+
+invalid = {
+  'no params': {},
+}
+
+describe 'puppetdb::database::read_grant' do
+  let(:facts) { on_supported_os.take(1).first[1] }
+  let(:pre_condition) { 'include postgresql::server' }
+  let(:name) { title }
+  let(:args) { params }
+
+  valid.each do |name, params|
+    context "for valid #{name}" do
+      include_examples 'puppetdb::database::read_grant' do
+        let(:title) { name.to_s }
+        let(:params) { params }
+      end
+    end
+  end
+
+  invalid.each do |name, params|
+    context "for invalid #{name}" do
+      include_examples 'puppetdb::database::read_grant', Puppet::Error do
+        let(:title) { name.to_s }
+        let(:params) { params }
+      end
+    end
+  end
+end

spec/defines/database/read_only_user_spec.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+valid = {
+  'puppetdb-read': {
+    read_database_username: 'puppetdb-read',
+    database_name:          'puppetdb',
+    password_hash:          'blah',
+    database_owner:         'puppetdb',
+  },
+  'spectest': {
+    read_database_username: 'spectest-read',
+    database_name:          'spectest',
+    database_owner:         'spectest',
+  },
+}
+
+invalid = {
+  'no params': {},
+}
+
+describe 'puppetdb::database::read_only_user', type: :define do
+  let(:facts) { on_supported_os.take(1).first[1] }
+  let(:pre_condition) { 'include postgresql::server' }
+  let(:name) { title }
+  let(:args) { params }
+
+  valid.each do |name, params|
+    context "for valid #{name}" do
+      include_examples 'puppetdb::database::read_only_user' do
+        let(:title) { name.to_s }
+        let(:params) { params }
+      end
+    end
+  end
+
+  invalid.each do |name, params|
+    context "for invalid #{name}" do
+      include_examples 'puppetdb::database::read_only_user', Puppet::Error do
+        let(:title) { name.to_s }
+        let(:params) { params }
+      end
+    end
+  end
+end

spec/spec_helper_local.rb

@@ -1,8 +1,17 @@
 # frozen_string_literal: true
 
+Dir['./spec/support/unit/**/*.rb'].sort.each { |f| require f }
+
 RSpec.configure do |c|
   if ENV['GITHUB_ACTIONS']
     c.formatter = 'RSpec::Github::Formatter'
     c.color_mode = :on
   end
+
+  c.fail_if_no_examples = true
+  c.silence_filter_announcements = true
+
+  c.expect_with :rspec do |expectations|
+    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
+  end
 end