Fix passing deferred password

[deric]

Summary

I'm getting a strange error when passing Deferred object to password_hash or password:

parameter 'password_hash' expects a value of type Boolean, String, or Sensitive[String], got Sensitive

Changes done in #1611 weren't enough.

Additional Context

Tested on Puppet 8.10.0, I'm unable to compile catalog with Deferred secret returned from a function.

I have a function that returns Deferred object

function vault::kv(String $key, Hash $opts = {}) >> Deferred {
  Deferred(
    'vault_lookup::lookup',
    ["kv/data/${key}", $_opts]
  )
}

Since it's not possible to specify type for Deferred object, like Deferred[String] or Deferred[Sensitive[String]] to only workaround remains relaxing Sensitive[String] to Sensitive

    postgresql::server::db { 'mydb':
      user     => 'dbuser',
      password => vault::kv('db/password'),
    }

Related Issues (if any)

• Allow any sensitive type so that Sensitive(Deferred(...)) values can be passed to concat::fragment puppetlabs-concat#824
• [Feature request]: Handling of Sensitive data when Deferred is hard to do correctly OpenVoxProject/openvox#189
• Deferred values are not resolved before eval_generate puppet#9174

Checklist

• 🟢 Spec tests.
• 🟢 Acceptance tests.
• Manually verified. (For example puppet apply)

[deric]

Test failures seems to be unrelated. Upstream fixtures modules doesn't seem to support Puppet 7 anymore.

[jiayuchen888]

Maybe you can define your password type Sensitive[String] ?

[deric]

@jiayuchen888 Password is defined as Sensitive[String], yet it doesn't work. As you can see currently there is no test for passing Sensitive[String].

[Copilot]

Pull request overview

Updates password parameter types to support deferred secrets resolving to Sensitive.

Changes:

• Broadens database and role password types.
• Updates deferred-password acceptance coverage.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
manifests/server/db.pp	Accepts generic sensitive passwords.
manifests/server/role.pp	Broadens role password-hash input type.
spec/acceptance/db_deferred_spec.rb	Tests a deferred sensitive password.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[deric]

@jst-cyr could you have a look at this, please?

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

lib/puppet/functions/postgresql/prepend_sql_password.rb:13

• Doubling apostrophes is not sufficient when PostgreSQL runs with standard_conforming_strings = off: a password such as \'; SUPERUSER; -- can use the backslash to escape the first doubled quote and terminate the literal at the second. Build the literal with the existing dollar-quoting postgresql::postgresql_escape function (handling the currently supported empty string explicitly), or use an E'' literal and escape both backslashes and apostrophes; add a backslash-plus-quote regression case.

    "ENCRYPTED PASSWORD '#{password.gsub("'", "''")}'"

[jst-cyr]

Running CI tests for this PR here: #1699

[jst-cyr]

@deric : Engineering will need to review when it comes up in the priority queue, but I'm happy to kick off some acceptance tests so that we can get some feedback and see how it runs on the different platforms.

[jst-cyr]

**Acceptance test results: ** https://github.com/puppetlabs/puppetlabs-postgresql/actions/runs/32730002205?pr=1699

All failures (Debian-13, CentOS-7, Scientific-7, OracleLinux-7, SLES-12) match pre-existing failures already on main. Mostly a systemd/D-Bus environment issue unrelated to this change. No new regressions introduced. All other platforms passed.

So this PR doesn't seem to be introducing new issues, but this still requires an engineering review.