fix lint and tests for clientcert value

Author: jhunt-steds

manifests/database/postgresql.pp

@@ -117,7 +117,7 @@
         postgresql_ssl_cert_path    => $postgresql_ssl_cert_path,
         postgresql_ssl_ca_cert_path => $postgresql_ssl_ca_cert_path,
         postgres_version            => $postgres_version,
-        create_read_user_rule       => $create_read_user_rule
+        create_read_user_rule       => $create_read_user_rule,
       }
     }
 

spec/defines/database/postgresql_ssl_rules_spec.rb

@@ -6,11 +6,28 @@
   'puppetdb-read': {
     database_name:     'puppetdb',
     database_username: 'monitor',
+    postgres_version: '11',
     puppetdb_server:   'localhost',
   },
   'monitor': {
     database_name:     'opensesame',
     database_username: 'grover',
+    postgres_version: '11',
+    puppetdb_server:   'rainbow',
+  },
+}
+
+valid_12plus = {
+  'puppetdb-read': {
+    database_name:     'puppetdb',
+    database_username: 'monitor',
+    postgres_version: '12',
+    puppetdb_server:   'localhost',
+  },
+  'monitor': {
+    database_name:     'opensesame',
+    database_username: 'grover',
+    postgres_version: '12',
     puppetdb_server:   'rainbow',
   },
 }
@@ -34,6 +51,15 @@
     end
   end
 
+  valid_12plus.each do |name, params|
+    context "for valid_12plus #{name}" do
+      include_examples 'puppetdb::database::postgresql_ssl_rules' do
+        let(:title) { name.to_s }
+        let(:params) { params }
+      end
+    end
+  end
+
   invalid.each do |name, params|
     context "for invalid #{name}" do
       include_examples 'puppetdb::database::postgresql_ssl_rules', Puppet::Error do

spec/support/unit/shared/database.rb

@@ -227,6 +227,7 @@
     it { is_expected.to raise_error(error) }
   else
     let(:identity_map_key) { "#{with[:database_name]}-#{with[:database_username]}-map" }
+    let(:client_cert) { (with[:postgres_version].to_f >= 12.0) ? 'verify-full' : '1' }
 
     it { is_expected.to contain_puppetdb__database__postgresql_ssl_rules(name).with(with) }
 
@@ -239,7 +240,7 @@
           address:     '0.0.0.0/0',
           auth_method: 'cert',
           order:       0,
-          auth_option: "map=#{identity_map_key} clientcert=1",
+          auth_option: "map=#{identity_map_key} clientcert=#{client_cert}",
         )
     }
 
@@ -252,7 +253,7 @@
           address:     '::0/0',
           auth_method: 'cert',
           order:       0,
-          auth_option: "map=#{identity_map_key} clientcert=1",
+          auth_option: "map=#{identity_map_key} clientcert=#{client_cert}",
         )
     }
 

spec/unit/classes/database/ssl_configuration_spec.rb

@@ -110,37 +110,5 @@
         end
       end
     end
-
-    context 'when the specified Postgresql version is 12 or later' do
-      let(:params) do
-        {
-          database_name: 'puppetdb',
-          database_username: 'puppetdb',
-          postgres_version: '12'
-        }
-      end
-
-      it 'has hba rule for puppetdb user ipv4' do
-        is_expected.to contain_postgresql__server__pg_hba_rule("Allow certificate mapped connections to #{params[:database_name]} as #{params[:database_username]} (ipv4)")
-          .with_type('hostssl')
-          .with_database(params[:database_name])
-          .with_user(params[:database_username])
-          .with_address('0.0.0.0/0')
-          .with_auth_method('cert')
-          .with_order(0)
-          .with_auth_option("map=#{identity_map} clientcert=verify-full")
-      end
-
-      it 'has hba rule for puppetdb user ipv6' do
-        is_expected.to contain_postgresql__server__pg_hba_rule("Allow certificate mapped connections to #{params[:database_name]} as #{params[:database_username]} (ipv6)")
-          .with_type('hostssl')
-          .with_database(params[:database_name])
-          .with_user(params[:database_username])
-          .with_address('::0/0')
-          .with_auth_method('cert')
-          .with_order(0)
-          .with_auth_option("map=#{identity_map} clientcert=verify-full")
-      end
-    end
   end
 end