fix(global_defaults): validate system.users as the documented dict on both paths

2026-10-05 16:54:28 +02:00
parent 9aad42a4c2
commit 74caca915e
5 changed files with 213 additions and 22 deletions
@@ -0,0 +1,123 @@
+---
+users_fixture_system:
+  type: virtual
+  os: debian
+  version: "13"
+  cpus: 2
+  memory: 2048
+  disks:
+    - size: 30
+  network:
+    interfaces:
+      - bridge: br0
+        ip: 192.0.2.10
+        prefix: 24
+        gateway: 192.0.2.1
+  root:
+    password: rootpw
+
+# precomputed: hand system_cfg over the way deploy_iac does, skipping the raw input checks.
+users_fixtures:
+  - name: dict-first-password-wins
+    system:
+      users:
+        keyonly:
+          keys:
+            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFixture keyonly
+        blank:
+          password: ""
+        ops:
+          password: pw
+          sudo: true
+        later:
+          password: pw2
+    expect:
+      primary: ops
+
+  - name: dict-first-password-wins-precomputed
+    precomputed: true
+    system:
+      users:
+        keyonly:
+          keys:
+            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFixture keyonly
+        ops:
+          password: pw
+    expect:
+      primary: ops
+
+  - name: list-rejected
+    system:
+      users:
+        - name: ops
+          password: pw
+    expect:
+      fail: system.users must be a dict keyed by username
+
+  - name: list-rejected-precomputed
+    precomputed: true
+    system:
+      users:
+        - name: ops
+          password: pw
+    expect:
+      fail: system.users must be a dict keyed by username
+
+  - name: scalar-entry-rejected
+    system:
+      users:
+        ops: pw
+    expect:
+      fail: system.users.ops must be a dict
+
+  - name: scalar-entry-rejected-precomputed
+    precomputed: true
+    system:
+      users:
+        ops: pw
+    expect:
+      fail: system.users.ops must be a dict
+
+  - name: keys-string-rejected
+    system:
+      users:
+        ops:
+          password: pw
+          keys: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFixture ops
+    expect:
+      fail: its keys a list of SSH public keys
+
+  - name: no-password-rejected
+    system:
+      users:
+        ops:
+          keys:
+            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFixture ops
+    expect:
+      fail: needs a non-empty password
+
+  - name: autologin-user-accepted
+    system:
+      users:
+        ops:
+          password: pw
+      features:
+        desktop:
+          enabled: true
+          environment: gnome
+          autologin: ops
+    expect:
+      primary: ops
+
+  - name: autologin-unknown-user-rejected
+    system:
+      users:
+        ops:
+          password: pw
+      features:
+        desktop:
+          enabled: true
+          environment: gnome
+          autologin: ghost
+    expect:
+      fail: desktop.autologin must be false or a username