From 1b322c4223304a46f615a31fadc73911bd65bffb Mon Sep 17 00:00:00 2001
From: Nick Hall <nick.hall@deshaw.com>
Date: Fri, 2 May 2025 12:26:41 +0100
Subject: [PATCH] Allow any sensitive type so that Sensitive(Deferred(...))
 values can be passed to concat::fragment

---
 manifests/fragment.pp                         |  8 +++----
 ...ontent_with_deferred_function_call_spec.rb | 22 ++++++++++++++++++-
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/manifests/fragment.pp b/manifests/fragment.pp
index c73ec0ce..17e3abef 100644
--- a/manifests/fragment.pp
+++ b/manifests/fragment.pp
@@ -17,10 +17,10 @@
 #   Specifies the destination file of the fragment. Valid options: a string containing the path or title of the parent concat resource.
 #
 define concat::fragment (
-  String                                                 $target,
-  Optional[Variant[Sensitive[String], String, Deferred]] $content = undef,
-  Optional[Variant[String, Array]]                       $source  = undef,
-  Variant[String, Integer]                               $order   = '10',
+  String                                         $target,
+  Optional[Variant[Sensitive, String, Deferred]] $content = undef,
+  Optional[Variant[String, Array]]               $source  = undef,
+  Variant[String, Integer]                       $order   = '10',
 ) {
   $resource = 'Concat::Fragment'
 
diff --git a/spec/acceptance/fragment_content_with_deferred_function_call_spec.rb b/spec/acceptance/fragment_content_with_deferred_function_call_spec.rb
index 71cf83bd..8d82504a 100644
--- a/spec/acceptance/fragment_content_with_deferred_function_call_spec.rb
+++ b/spec/acceptance/fragment_content_with_deferred_function_call_spec.rb
@@ -12,7 +12,7 @@
     @basedir = setup_test_directory
   end
 
-  describe 'file' do
+  describe 'deferred file' do
     let(:pp) do
       <<-MANIFEST
         concat { '#{basedir}/deferred_file': }
@@ -30,4 +30,24 @@
       expect(file("#{basedir}/deferred_file").content).to match Digest::MD5.hexdigest('test')
     end
   end
+
+  describe 'sensitive deferred file' do
+    let(:pp) do
+      <<-MANIFEST
+        concat { '#{basedir}/sensitive_deferred_file': }
+
+        concat::fragment { '1':
+          target  => '#{basedir}/sensitive_deferred_file',
+          content => Sensitive(Deferred('md5', ['test'])),
+        }
+      MANIFEST
+    end
+
+    it 'idempotent, file matches' do
+      idempotent_apply(pp)
+      expect(file("#{basedir}/sensitive_deferred_file")).to be_file
+      expect(file("#{basedir}/sensitive_deferred_file").content).to match Digest::MD5.hexdigest('test')
+    end
+  end
+
 end