enhance diagnostics

Author: LukasAud

lib/puppet/provider/base_dsc_lite/powershell.rb

@@ -2,7 +2,7 @@
 
 require 'pathname'
 require 'json'
-require 'erb' # ensure ERB is available
+require 'erb' # ensure ERB is available for template rendering
 require_relative '../../../puppet_x/puppetlabs/dsc_lite/powershell_hash_formatter'
 
 Puppet::Type.type(:base_dsc_lite).provide(:powershell) do
@@ -96,8 +96,7 @@ def ps_manager
     Pwsh::Manager.instance(command(:powershell), Pwsh::Manager.powershell_args, debug: debug_output)
   end
 
-  # --- NEW: deep scan for Deferred ---
-  # Recursively detect any object whose class name suggests it's a Puppet Deferred
+  # --- Helper: recursively detect any Puppet Deferred ---
   def deep_contains_deferred?(obj)
     case obj
     when Hash
@@ -109,12 +108,30 @@ def deep_contains_deferred?(obj)
     end
   end
 
-  # --- NEW: best-effort resolution hook ---
-  # Attempt to resolve any remaining Deferreds before rendering ERB.
-  # This is intentionally defensive: it tries available agent-side options
-  # and degrades to no-op if none are present.
+  # --- Helper: enumerate nested paths to Deferreds (e.g., "properties.Content", "properties.Credential.password") ---
+  def deferred_paths(obj, prefix = '')
+    paths = []
+    if obj.is_a?(Hash)
+      obj.each do |k, v|
+        key = k.is_a?(Symbol) ? k.to_s : k.to_s
+        child_prefix = prefix.empty? ? key : "#{prefix}.#{key}"
+        paths.concat(deferred_paths(v, child_prefix))
+      end
+    elsif obj.is_a?(Array)
+      obj.each_with_index do |v, i|
+        paths.concat(deferred_paths(v, "#{prefix}[#{i}]"))
+      end
+    else
+      if obj && obj.class && obj.class.name.to_s.include?('Deferred')
+        paths << (prefix.empty? ? '(root)' : prefix)
+      end
+    end
+    paths
+  end
+
+  # --- Best-effort, agent-safe "last chance" resolution ---
   def ensure_deferreds_resolved!
-    # 1) Catalog-wide resolve (if the catalog supports it)
+    # 1) Catalog-wide resolve if supported
     begin
       cat = resource&.catalog
       if cat && cat.respond_to?(:resolve_and_replace)
@@ -125,37 +142,32 @@ def ensure_deferreds_resolved!
       Puppet.debug("DSC_lite: resolve_and_replace raised #{e.class}: #{e.message}")
     end
 
-    # 2) Compiler lookup (often nil in agent/provider context)
+    # 2) Try compiler lookup (often nil in agent/provider context)
     begin
       compiler = Puppet.respond_to?(:lookup) ? Puppet.lookup(:compiler) { nil } : nil
       Puppet.debug('DSC_lite: compiler available for resolution') if compiler
     rescue StandardError => e
       Puppet.debug("DSC_lite: compiler lookup failed: #{e.class}: #{e.message}")
     end
 
-    # 3) Nothing else to do safely here—actual evaluation requires scope,
-    # which agent providers typically don't have. We rely on (1), and if
-    # it still leaks we'll detect/log just before formatting.
+    # Nothing else safe to do here—actual evaluation requires scope (not available here).
     nil
   end
 
-  # --- NEW: provider helper used by ERB ---
-  # Route every formatted value through here so we can:
-  #  - perform a last-chance Deferred resolution
-  #  - then delegate to the pure formatter
+  # --- ERB-facing formatter (deferred-safe) ---
+  # Route EVERY formatted value through this method from ERB.
   def format_for_ps(value)
     if deep_contains_deferred?(value)
       Puppet.debug('DSC_lite: Deferred detected in ERB-bound value; attempting last-chance resolution')
       ensure_deferreds_resolved!
-      if deep_contains_deferred?(value)
-        Puppet.debug('DSC_lite: value still contains Deferred after last-chance resolution')
-        # Optional: uncomment to fail fast with a clearer message instead of formatter type error
-        # raise Puppet::Error, 'DSC_lite: Deferred value reached ERB formatting; '\
-        #                      'agent invoked provider before deferrals completed (Puppet 8 timing).'
-      end
+      Puppet.debug('DSC_lite: value still contains Deferred after last-chance resolution') if deep_contains_deferred?(value)
+      # Optional fail-fast (clear message) instead of later formatter error:
+      # raise Puppet::Error, 'DSC_lite: Deferred value reached ERB formatting; '\
+      #                      'agent invoked provider before deferrals completed (Puppet 8 timing).'
     end
     self.class.format_dsc_lite(value)
   end
+
   # ---------------------------
   # Provider operations
   # ---------------------------
@@ -166,13 +178,23 @@ def exists?
     version = Facter.value(:powershell_version)
     Puppet.debug "PowerShell Version: #{version}"
 
-    # Last-chance resolve + pinpoint diagnostic BEFORE rendering
+    # Last-chance resolve + enhanced diagnostics BEFORE rendering
     ensure_deferreds_resolved!
     leaks = resource.parameters_with_value
                     .select { |p| deep_contains_deferred?(p.value) }
                     .map { |p| "#{p.name}=#{p.value.class}" }
     Puppet.debug("DSC_lite: still deferred after resolution? #{leaks.join(', ')}")
 
+    props_param = resource.parameters_with_value.find { |p| p.name == :properties }
+    if props_param
+      nested = deferred_paths(props_param.value)
+      Puppet.debug("DSC_lite: nested Deferred paths inside properties: #{nested.join(', ')}") unless nested.empty?
+      # Optional clear fail-fast (uncomment if you want CI to stop with a crisp message)
+      # unless nested.empty?
+      #   raise Puppet::Error, "DSC_lite: Deferred values remain under properties at: #{nested.join(', ')}. "\
+      #                        "Agent invoked provider before all deferrals resolved (Puppet 8 timing)."
+      # end
+    end
     script_content = ps_script_content('test')
     Puppet.debug "\n" + self.class.redact_content(script_content)
 
@@ -201,13 +223,24 @@ def create
     timeout = set_timeout
     Puppet.debug "Dsc Timeout: #{timeout} milliseconds"
 
-    # Last-chance resolve + pinpoint diagnostic BEFORE rendering
+    # Last-chance resolve + enhanced diagnostics BEFORE rendering
     ensure_deferreds_resolved!
     leaks = resource.parameters_with_value
                     .select { |p| deep_contains_deferred?(p.value) }
                     .map { |p| "#{p.name}=#{p.value.class}" }
     Puppet.debug("DSC_lite: still deferred after resolution? #{leaks.join(', ')}")
 
+    props_param = resource.parameters_with_value.find { |p| p.name == :properties }
+    if props_param
+      nested = deferred_paths(props_param.value)
+      Puppet.debug("DSC_lite: nested Deferred paths inside properties: #{nested.join(', ')}") unless nested.empty?
+      # Optional clear fail-fast (uncomment if you want CI to stop with a crisp message)
+      # unless nested.empty?
+      #   raise Puppet::Error, "DSC_lite: Deferred values remain under properties at: #{nested.join(', ')}. "\
+      #                        "Agent invoked provider before all deferrals resolved (Puppet 8 timing)."
+      # end
+    end
+
     script_content = ps_script_content('set')
     Puppet.debug "\n" + self.class.redact_content(script_content)
 
@@ -227,6 +260,7 @@ def create
     raise(data['errormessage']) unless data['errormessage'].empty?
 
     notify_reboot_pending if data['rebootrequired'] == true
+
     data
   end