patch 2

Author: LukasAud

lib/puppet/provider/base_dsc_lite/powershell.rb

@@ -1,10 +1,11 @@
+
 # frozen_string_literal: true
 
 require 'pathname'
 require 'json'
-require_relative '../../../puppet_x/puppetlabs/dsc_lite/powershell_hash_formatter'
 require 'puppet/pops/evaluator/deferred_resolver'
 require 'puppet/node/facts'
+require_relative '../../../puppet_x/puppetlabs/dsc_lite/powershell_hash_formatter'
 
 Puppet::Type.type(:base_dsc_lite).provide(:powershell) do
   confine feature: :pwshlib
@@ -67,7 +68,9 @@ def ps_manager
     Pwsh::Manager.instance(command(:powershell), Pwsh::Manager.powershell_args, debug: debug_output)
   end
 
-  # Returns true if obj (or any nested value) is a DeferredValue
+  # ===== NEW: Deferred helpers (instance methods) =====
+
+  # Detects if a value (or nested) contains a DeferredValue
   def deep_contains_deferred?(obj)
     case obj
     when Puppet::Pops::Evaluator::DeferredValue
@@ -87,47 +90,57 @@ def deep_contains_deferred?(obj)
     end
   end
 
-  # Resolve any lingering Deferred values in the `properties` parameter
-  def resolve_properties_deferreds!
+  # Force resolution of Deferreds across the catalog before script generation.
+  # This mirrors Puppet's own preprocessing when preprocess_deferred=true.
+  def ensure_deferreds_resolved!
+    # (A) Prefer compiler-based resolution for properties when available
     props_param = resource.parameters[:properties]
-    return unless props_param
-
-    props_val = props_param.value
-    return unless deep_contains_deferred?(props_val)
-
-    # Prefer compiler-based resolution when available
-    compiler = Puppet.lookup(:compiler) { nil }
-    if compiler
-      resolved = Puppet::Pops::Evaluator::DeferredResolver.resolve(props_val, compiler)
-      resource[:properties] = resolved
-      return
+    compiler    = Puppet.lookup(:compiler) { nil }
+
+    if props_param
+      pv = props_param.value
+      if deep_contains_deferred?(pv)
+        Puppet.debug('DSC_lite: Deferred detected in properties; resolving via compiler') if compiler
+        if compiler
+          resolved = Puppet::Pops::Evaluator::DeferredResolver.resolve(pv, compiler)
+          resource[:properties] = resolved
+        end
+      end
     end
 
-    # Fallback: resolve across the whole catalog in place (official API)
+    # (B) Always run a full catalog resolution pass as a safety net.
     facts = Puppet::Node::Facts.new(
       (resource.catalog.respond_to?(:host) && resource.catalog.host) ||
         Facter.value(:fqdn) || Facter.value(:hostname) || 'localhost',
       Facter.to_hash,
     )
     env = resource.catalog.respond_to?(:environment_instance) ? resource.catalog.environment_instance : nil
 
+    Puppet.debug('DSC_lite: invoking DeferredResolver.resolve_and_replace on catalog')
     Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(facts, resource.catalog, env, true)
 
-    # Refresh our local value after in-place resolution
-    updated = resource.parameters[:properties]
-    resource[:properties] = updated.value if updated
+    # Post-check for diagnostics
+    pp = resource.parameters[:properties]
+    if pp && deep_contains_deferred?(pp.value)
+      Puppet.debug('DSC_lite: WARNING — Deferred still present in properties after resolution pass')
+    else
+      Puppet.debug('DSC_lite: no Deferred values remain in properties after resolution')
+    end
   rescue => e
-    raise Puppet::Error, "DSC_lite: failed to resolve Deferred values in `properties`: #{e.class}: #{e.message}"
+    # Raise a targeted error; this is better than failing later with "unsupported type DeferredValue"
+    raise Puppet::Error, "DSC_lite: failed while resolving Deferred values: #{e.class}: #{e.message}"
   end
 
+  # ===== END NEW helpers =====
+
   def exists?
     timeout = set_timeout
     Puppet.debug "Dsc Timeout: #{timeout} milliseconds"
     version = Facter.value(:powershell_version)
     Puppet.debug "PowerShell Version: #{version}"
 
-    # NEW: resolve any lingering DeferredValue in properties
-    resolve_properties_deferreds!
+    # NEW: ensure any lingering Deferreds are resolved before building the script
+    ensure_deferreds_resolved!
 
     script_content = ps_script_content('test')
     Puppet.debug "\n" + self.class.redact_content(script_content)
@@ -157,8 +170,8 @@ def create
     timeout = set_timeout
     Puppet.debug "Dsc Timeout: #{timeout} milliseconds"
 
-    # NEW: resolve any lingering DeferredValue in properties
-    resolve_properties_deferreds!
+    # NEW: ensure any lingering Deferreds are resolved before building the script
+    ensure_deferreds_resolved!
 
     script_content = ps_script_content('set')
     Puppet.debug "\n" + self.class.redact_content(script_content)
@@ -179,7 +192,6 @@ def create
     raise(data['errormessage']) unless data['errormessage'].empty?
 
     notify_reboot_pending if data['rebootrequired'] == true
-
     data
   end
 
@@ -216,7 +228,7 @@ def self.redact_content(content)
     # always inside a hash table to be passed along. This means we can (currently) expect the value to
     # always come after an equals sign.
     # Note that the line may include a semi-colon and/or a newline character after the sensitive unwrap.
-    content.gsub(%r{= '.+' # PuppetSensitive;?(\\n)?$}, "= '[REDACTED]'")
+    content.gsub(%r{= '.+' # PuppetSensitive;?(\n)?$}, "= '[REDACTED]'")
   end
 
   def ps_script_content(mode)