bundle common test_meta
{
  vars:
      "description" string => "Test that cached password hashes do not cause problems";
      "story_id" string => "5525";
      "covers" string => "operational_kept";
}

#######################################################

# If the platform is using /etc/passwd to store hashes, then the hash will be
# cached in the passwd_info structure in the C code. This may cause problems
# if one part of the code (password update) tries to modify the hash, and
# another one (locking) also does it. The latter may use the cached value from
# before it was modified, but should use the updated value.

#######################################################

body common control
{
      inputs => { "../../default.sub.cf", "user_queries.cf.sub" };
      bundlesequence  => { default("$(this.promise_filename)") };
}

#######################################################

bundle common hpux_trusted
{
  classes:
      "hpux_trusted_mode_test"
        expression => regcmp(".*hpux_trusted.*", $(this.promise_filename));
}

bundle agent init
{
  meta:
      # Password hashes are not supported on Windows.
      "test_skip_unsupported" string => "(hpux_trusted_mode_test.!hpux)|windows";

  vars:
      # "j0hnd0e"
      "hash" string => "dTloMVpjYt1w2";

  methods:
      "any" usebundle => init_firstpass;
      "any" usebundle => init_secondpass;
}

bundle agent init_firstpass
{
  users:
      "user1"
        policy => "absent";
      "user2"
        policy => "absent";
}

bundle agent init_secondpass
{
  users:
      "user1"
        policy => "present",
        password => init_password;
      "user2"
        policy => "present",
        password => init_password;
}

body password init_password
{
    format => "hash";
    data => "$(init.hash)";
}

#######################################################

bundle agent test
{
  vars:
      # "N4wP4ssw"
      "hash" string => "aapgPBZAGeZf6";

  methods:
      "any" usebundle => test_firstpass;
      "any" usebundle => test_secondpass;
}

bundle agent test_firstpass
{
  users:
      "user1"
        policy => "locked";
      "user2"
        policy => "locked";
}

bundle agent test_secondpass
{
  users:
      "user1"
        policy => "present",
        password => test_hash;
      "user2"
        policy => "present",
        password => test_passwd;
}

body password test_hash
{
  format => "hash";
  data => "$(test.hash)";
}

body password test_passwd
{
  format => "plaintext";
  data => "N4wP4ssw";
}

#######################################################

bundle agent check
{
  methods:
      "any" usebundle => user_has_password_hash("user1", "$(test.hash)", "user1_success", "user1_failure"),
        classes => always("user1_methods_run");
      "any" usebundle => user_has_password_hash("user2", "$(init.hash)", "user2_failure", "user2_success"),
        classes => always("user2_methods_run");

  classes:
      "ready" and => { "user1_methods_run", "user2_methods_run" };
      "ok" and => { "user1_success", "!user1_failure",
                    "user2_success", "!user2_failure"
                  };

  reports:
    ok.ready::
      "$(this.promise_filename) Pass";
    !ok.ready::
      "$(this.promise_filename) FAIL";
}
