patch2

Author: LukasAud

lib/puppet/provider/base_dsc_lite/powershell.rb

@@ -3,6 +3,9 @@
 require 'pathname'
 require 'json'
 require 'erb' # ensure ERB is available
+require 'puppet'
+require 'puppet/node'
+require 'puppet/parser/script_compiler'
 require 'puppet/pops/evaluator/deferred_resolver'
 require_relative '../../../puppet_x/puppetlabs/dsc_lite/powershell_hash_formatter'
 
@@ -84,22 +87,56 @@ def ps_manager
     Pwsh::Manager.instance(command(:powershell), Pwsh::Manager.powershell_args, debug: debug_output)
   end
 
-  # Minimal provider-side formatter for ERB (keeps patched templates working)
+  # Minimal provider-side formatter used by ERB
   def format_for_ps(value)
     self.class.format_dsc_lite(value)
   end
 
-  # ---- Option 1: force-resolve all Deferreds in the catalog before rendering ----
+  # --------- Two-stage resolver ---------
+
+  # Build an environment instance suitable for compilation on the agent
+  def current_environment_instance
+    # Prefer the catalog's environment_instance if present
+    env = resource&.catalog&.respond_to?(:environment_instance) ? resource.catalog.environment_instance : nil
+    return env if env
+
+    # Fallback to the current environment from the context
+    begin
+      Puppet.lookup(:current_environment) { nil }
+    rescue StandardError
+      nil
+    end
+  end
+
+  # Build Facts for the resolver. It accepts Puppet::Node::Facts or nil.
+  def build_facts_for_resolver(env)
+    # Best effort: use the looked-up facts if present
+    facts = begin
+              Puppet.lookup(:facts) { nil }
+            rescue
+              nil
+            end
+    return facts if facts
+
+    # Fallback: construct from Facter.to_hash for this node
+    begin
+      node_name = Puppet[:node_name_value]
+      fact_hash = Facter.to_hash
+      Puppet::Node::Facts.new(node_name, fact_hash, environment: env&.name)
+    rescue StandardError => e
+      Puppet.debug("DSC_lite: unable to construct facts for resolver: #{e.class}: #{e.message}")
+      nil
+    end
+  end
+
+  # Stage 1: Resolve all deferreds in the entire catalog (direct and nested)
+  # using Puppet's public API (used by Bolt/pxp-agent).  See docs.  [1](https://www.rubydoc.info/gems/puppet/8.4.0/Puppet/Pops/Evaluator/DeferredResolver)
   def force_resolve_catalog_deferred!
     cat = resource&.catalog
     return unless cat
 
-    facts = Puppet.lookup(:facts) { nil }
-    env   = if cat.respond_to?(:environment_instance)
-              cat.environment_instance
-            else
-              Puppet.lookup(:current_environment) { nil }
-            end
+    env   = current_environment_instance
+    facts = build_facts_for_resolver(env)
 
     begin
       Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(facts, cat, env, true)
@@ -109,6 +146,51 @@ def force_resolve_catalog_deferred!
     end
   end
 
+  # Stage 2: If :properties still contains a Deferred (nested), resolve that
+  # hash locally by spinning up a temporary ScriptCompiler and replace it back.
+  # Uses DeferredResolver.resolve(value, compiler).  [1](https://www.rubydoc.info/gems/puppet/8.4.0/Puppet/Pops/Evaluator/DeferredResolver)
+  def resolve_properties_locally_if_needed!
+    return unless resource.parameters.key?(:properties)
+
+    props = resource[:properties]
+    return unless contains_deferred?(props)
+
+    begin
+      env = current_environment_instance || Puppet::Node::Environment.create('production', [])
+      node_name = Puppet[:node_name_value]
+
+      node = Puppet::Node.new(node_name, environment: env)
+
+      # Attach facts if available (improves function behavior during resolution)
+      begin
+        facts = build_facts_for_resolver(env)
+        node.add_facts(facts) if facts
+      rescue StandardError => e
+        Puppet.debug("DSC_lite: failed to attach facts to node: #{e.class}: #{e.message}")
+      end
+
+      compiler = Puppet::Parser::ScriptCompiler.new(node)
+
+      resolved = Puppet::Pops::Evaluator::DeferredResolver.resolve(props, compiler)
+      resource[:properties] = resolved # write resolved value back into the resource
+      Puppet.debug('DSC_lite: locally resolved :properties via ScriptCompiler')
+    rescue StandardError => e
+      Puppet.debug("DSC_lite: local properties resolution failed: #{e.class}: #{e.message}")
+    end
+  end
+
+  # Lightweight check for nested Deferred presence
+  def contains_deferred?(obj)
+    case obj
+    when Hash
+      obj.any? { |k, v| contains_deferred?(k) || contains_deferred?(v) }
+    when Array
+      obj.any? { |v| contains_deferred?(v) }
+    else
+      obj && obj.class && obj.class.name.to_s.include?('Deferred')
+    end
+  end
+
   # ---------- provider operations ----------
 
   def exists?
@@ -117,8 +199,9 @@ def exists?
     version = Facter.value(:powershell_version)
     Puppet.debug "PowerShell Version: #{version}"
 
-    # Ensure all Deferreds (including nested) are resolved prior to ERB rendering
+    # Two-stage resolution before building the PowerShell script
     force_resolve_catalog_deferred!
+    resolve_properties_locally_if_needed!
 
     script_content = ps_script_content('test')
     Puppet.debug "\n" + self.class.redact_content(script_content)
@@ -148,8 +231,9 @@ def create
     timeout = set_timeout
     Puppet.debug "Dsc Timeout: #{timeout} milliseconds"
 
-    # Ensure all Deferreds (including nested) are resolved prior to ERB rendering
+    # Two-stage resolution before building the PowerShell script
     force_resolve_catalog_deferred!
+    resolve_properties_locally_if_needed!
 
     script_content = ps_script_content('set')
     Puppet.debug "\n" + self.class.redact_content(script_content)