(PUP-9323) Defer per-resource validation

If any parameters/properties for a resource are deferred, then also defer the
per-resource validate method[1]. The latter is often used in cases when
parameters are mutually exclusive or certain combinations are not allowed.

Once all parameters for a resource are evaluated, then the resource's `validate`
method will be called, if one is defined using the puppet DSL.

[1] https://github.com/puppetlabs/puppet-specifications/blob/master/language/resource_types.md#validate

Author: joshcooper

lib/puppet/transaction.rb

@@ -468,6 +468,8 @@ def split_qualified_tags?
   def resolve_resource(resource)
     return unless catalog.host_config?
 
+    deferred_validate = false
+
     resource.eachparameter do |param|
       if param.value.instance_of?(Puppet::Pops::Evaluator::DeferredValue)
         # Puppet::Parameter#value= triggers validation and munging. Puppet::Property#value=
@@ -476,8 +478,13 @@ def resolve_resource(resource)
         resolved = param.value.resolve
         # resource.notice("Resolved deferred value to #{resolved}")
         param.value = resolved
+        deferred_validate = true
       end
     end
+
+    if deferred_validate
+      resource.validate_resource
+    end
   end
 end
 

lib/puppet/type.rb

@@ -2282,7 +2282,13 @@ def self.to_s
   # @api public
   #
   def self.validate(&block)
-    define_method(:validate, &block)
+    define_method(:unsafe_validate, &block)
+
+    define_method(:validate) do
+      return if enum_for(:eachparameter).any? { |p| p.value.instance_of?(Puppet::Pops::Evaluator::DeferredValue) }
+
+      unsafe_validate
+    end
   end
 
   # @return [String] The file from which this type originates from
@@ -2372,15 +2378,26 @@ def initialize(resource)
 
     set_parameters(@original_parameters)
 
+    validate_resource
+
+    set_sensitive_parameters(resource.sensitive_parameters)
+  end
+
+  # Optionally validate the resource. This method is a noop if the type has not defined
+  # a `validate` method using the puppet DSL. If validation fails, then an exception will
+  # be raised with this resources as the context.
+  #
+  # @api public
+  #
+  # @return [void]
+  def validate_resource
     begin
       self.validate if self.respond_to?(:validate)
     rescue Puppet::Error, ArgumentError => detail
       error = Puppet::ResourceError.new("Validation of #{ref} failed: #{detail}")
       adderrorcontext(error, detail)
       raise error
     end
-
-    set_sensitive_parameters(resource.sensitive_parameters)
   end
 
   protected

spec/integration/application/apply_spec.rb

@@ -713,5 +713,47 @@ def bogus()
         .and output(%r{defined 'message' as Binary\("MTIz"\)}).to_stdout
     end
 
+    it "validates the deferred resource before applying any resources" do
+      undeferred_file = tmpfile('undeferred')
+
+      manifest = <<~END
+      file { '#{undeferred_file}':
+        ensure => file,
+      }
+      file { '#{deferred_file}':
+          ensure => file,
+          content => Deferred('inline_epp', ['<%= 42 %>']),
+          source => 'http://example.com/content',
+      }
+      END
+      apply.command_line.args = ['-e', manifest]
+      expect {
+        apply.run
+      }.to exit_with(1)
+        .and output(/Compiled catalog/).to_stdout
+        .and output(/Validation of File.* failed: You cannot specify more than one of content, source, target/).to_stderr
+
+      # validation happens before all resources are applied, so this shouldn't exist
+      expect(File).to_not be_exist(undeferred_file)
+    end
+
+    it "evaluates resources before validating the deferred resource" do
+      Puppet[:preprocess_deferred] = false
+
+      manifest = <<~END
+        notify { 'runs before file': } ->
+        file { '#{deferred_file}':
+          ensure => file,
+          content => Deferred('inline_epp', ['<%= 42 %>']),
+          source => 'http://example.com/content',
+      }
+      END
+      apply.command_line.args = ['-e', manifest]
+      expect {
+        apply.run
+      }.to exit_with(1)
+        .and output(/Notify\[runs before file\]/).to_stdout
+        .and output(/Validation of File.* failed: You cannot specify more than one of content, source, target/).to_stderr
+    end
   end
 end