From 351db42564f78976ffd979f81c8e13a03c45093b Mon Sep 17 00:00:00 2001
From: Josh Cooper <joshcooper@users.noreply.github.com>
Date: Wed, 31 Jul 2024 12:02:01 -0700
Subject: [PATCH] Support arrays of deferred parameter values

If an `exec` resource's `environment` parameter was specified as an
array of values, where at least one of the values was deferred, then
validation failed with:

    undefined method `=~' for #<Puppet::Pops::Evaluator::DeferredValue:0x00007ff6913f7908

This occurred because the transaction's `resolved_resolve` assumed the
parameter's value was single-valued. As a result, the deferred value
was never resolved before calling the type's `validate` method.

This updates the transaction to support multi-valued parameters. All
deferred values will be resolved before the type's `validate` method is
called.

Fixes #9438
---
 lib/puppet/parameter.rb                    |  6 +++---
 lib/puppet/transaction.rb                  | 17 +++++++++++++----
 spec/integration/application/apply_spec.rb | 17 +++++++++++++++++
 3 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/lib/puppet/parameter.rb b/lib/puppet/parameter.rb
index be72e8024af..d4fbce9d185 100644
--- a/lib/puppet/parameter.rb
+++ b/lib/puppet/parameter.rb
@@ -416,7 +416,7 @@ def unsafe_munge(value)
   # @return [Object] the unmunged value
   #
   def unmunge(value)
-    return value if value.is_a?(Puppet::Pops::Evaluator::DeferredValue)
+    return value if value.is_a?(Puppet::Pops::Evaluator::DeferredValue) || (value.is_a?(Array) && value.any? { |v| v.is_a?(Puppet::Pops::Evaluator::DeferredValue) })
 
     unsafe_unmunge(value)
   end
@@ -438,7 +438,7 @@ def unsafe_unmunge(value)
   # @return [Object] the munged (internal) value
   #
   def munge(value)
-    return value if value.is_a?(Puppet::Pops::Evaluator::DeferredValue)
+    return value if value.is_a?(Puppet::Pops::Evaluator::DeferredValue) || (value.is_a?(Array) && value.any? { |v| v.is_a?(Puppet::Pops::Evaluator::DeferredValue) })
 
     begin
       ret = unsafe_munge(value)
@@ -473,7 +473,7 @@ def unsafe_validate(value)
   # @api public
   #
   def validate(value)
-    return if value.is_a?(Puppet::Pops::Evaluator::DeferredValue)
+    return value if value.is_a?(Puppet::Pops::Evaluator::DeferredValue) || (value.is_a?(Array) && value.any? { |v| v.is_a?(Puppet::Pops::Evaluator::DeferredValue) })
 
     begin
       unsafe_validate(value)
diff --git a/lib/puppet/transaction.rb b/lib/puppet/transaction.rb
index 27d5152997f..8aa5b00424a 100644
--- a/lib/puppet/transaction.rb
+++ b/lib/puppet/transaction.rb
@@ -473,12 +473,21 @@ def resolve_resource(resource)
     deferred_validate = false
 
     resource.eachparameter do |param|
+      # Puppet::Parameter#value= triggers validation and munging. Puppet::Property#value=
+      # overrides the method, but also triggers validation and munging, since we're
+      # setting the desired/should value.
       if param.value.instance_of?(Puppet::Pops::Evaluator::DeferredValue)
-        # Puppet::Parameter#value= triggers validation and munging. Puppet::Property#value=
-        # overrides the method, but also triggers validation and munging, since we're
-        # setting the desired/should value.
         resolved = param.value.resolve
-        # resource.notice("Resolved deferred value to #{resolved}")
+        param.value = resolved
+        deferred_validate = true
+      elsif param.value.is_a?(Array) && param.value.any? { |v| v.instance_of?(Puppet::Pops::Evaluator::DeferredValue) }
+        resolved = param.value.map do |v|
+          if v.instance_of?(Puppet::Pops::Evaluator::DeferredValue)
+            v.resolve
+          else
+            v
+          end
+        end
         param.value = resolved
         deferred_validate = true
       end
diff --git a/spec/integration/application/apply_spec.rb b/spec/integration/application/apply_spec.rb
index dde9c3931d6..41d8e10d9d1 100644
--- a/spec/integration/application/apply_spec.rb
+++ b/spec/integration/application/apply_spec.rb
@@ -770,6 +770,23 @@ def bogus()
         .and output(/Validation of File.* failed: You cannot specify more than one of content, source, target/).to_stderr
     end
 
+    it "validates multi-valued parameters" do
+      manifest = <<~END
+      $password = Deferred('new', [Sensitive, 'opensesame'])
+      exec { '/usr/bin/echo \$ADMIN_PASSWORD':
+        logoutput => true,
+        environment => [
+          Deferred('inline_epp', ['ADMIN_PASSWORD=<%= $password %>', { 'password' => $password }]),
+        ],
+      }
+      END
+      apply.command_line.args = ['-e', manifest]
+      expect {
+        apply.run
+      }.to exit_with(0)
+        .and output(%r{Exec\[/usr/bin/echo \$ADMIN_PASSWORD\]/returns: opensesame}).to_stdout
+    end
+
     it "applies deferred sensitive file content" do
       manifest = <<~END
       file { '#{deferred_file}':