Fix passing deferred password

[deric]

Summary

I'm getting a strange error when passing Deferred object to password_hash or password:

parameter 'password_hash' expects a value of type Boolean, String, or Sensitive[String], got Sensitive

Changes done in #1611 weren't enough.

Additional Context

Tested on Puppet 8.10.0, I'm unable to compile catalog with Deferred secret returned from a function.

I have a function that returns Deferred object

function vault::kv(String $key, Hash $opts = {}) >> Deferred {
  Deferred(
    'vault_lookup::lookup',
    ["kv/data/${key}", $_opts]
  )
}

Since it's not possible to specify type for Deferred object, like Deferred[String] or Deferred[Sensitive[String]] to only workaround remains relaxing Sensitive[String] to Sensitive

    postgresql::server::db { 'mydb':
      user     => 'dbuser',
      password => vault::kv('db/password'),
    }

Related Issues (if any)

• Allow any sensitive type so that Sensitive(Deferred(...)) values can be passed to concat::fragment puppetlabs-concat#824
• [Feature request]: Handling of Sensitive data when Deferred is hard to do correctly OpenVoxProject/openvox#189
• Deferred values are not resolved before eval_generate puppet#9174

Checklist

• 🟢 Spec tests.
• 🟢 Acceptance tests.
• Manually verified. (For example puppet apply)

[deric]

Test failures seems to be unrelated. Upstream fixtures modules doesn't seem to support Puppet 7 anymore.

[jiayuchen888]

Maybe you can define your password type Sensitive[String] ?

[deric]

@jiayuchen888 Password is defined as Sensitive[String], yet it doesn't work. As you can see currently there is no test for passing Sensitive[String].