From fda14821ec0443f336b421b73e1d674a9ef2ec3e Mon Sep 17 00:00:00 2001
From: tvpartytonight <vu.tony@gmail.com>
Date: Mon, 15 Jun 2026 14:53:20 -0700
Subject: [PATCH] (PA-7812) Only check_schema on resources actually consumed

The v2.0.0 caching change moved check_schema into the cache-population
loop in rsapi_provider_get. Combined with the get() optimization (a
single get(context) fetches all resources of a type), this caused every
resource on the system to be schema-checked during an apply, including
resources not managed by the catalog. Modules that previously ran fine
would then error on unrelated resources with schema violations.

Restore the pre-2.0.0 semantics: only schema-check the resources that
are actually consumed.
- rsapi_provider_get only populates the cache
- instances checks each resource (backs `puppet resource`)
- refresh_current_state checks only the single matched resource

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 lib/puppet/resource_api.rb       |  3 ++-
 spec/puppet/resource_api_spec.rb | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/lib/puppet/resource_api.rb b/lib/puppet/resource_api.rb
index 60f2afeb..3f2c2f46 100644
--- a/lib/puppet/resource_api.rb
+++ b/lib/puppet/resource_api.rb
@@ -282,7 +282,6 @@ def self.rsapi_provider_get(names = nil)
                   end
 
         fetched.each do |resource_hash|
-          type_definition.check_schema(resource_hash)
           rsapi_provider_get_cache.add(build_title(type_definition, resource_hash), resource_hash)
         end
 
@@ -300,6 +299,7 @@ def self.instances
         provider(type_definition.name)
 
         rsapi_provider_get.map do |resource_hash|
+          type_definition.check_schema(resource_hash)
           # allow a :title from the provider to override the default
           result = if resource_hash.key? :title
                      new(title: resource_hash[:title])
@@ -317,6 +317,7 @@ def refresh_current_state
         current_state = self.class.rsapi_provider_get([rsapi_title]).find { |h| namevar_match?(h) }
 
         if current_state
+          type_definition.check_schema(current_state)
           strict_check(current_state)
         else
           current_state = if rsapi_title.is_a? Hash
diff --git a/spec/puppet/resource_api_spec.rb b/spec/puppet/resource_api_spec.rb
index fd3e4129..08d623bb 100644
--- a/spec/puppet/resource_api_spec.rb
+++ b/spec/puppet/resource_api_spec.rb
@@ -367,6 +367,38 @@ def set(_context, _changes); end
           end
         end
       end
+
+      context 'with a provider that returns other, unmanaged resources with schema violations', :agent_test do
+        before do
+          stub_const('Puppet::Provider::TypeCheck', Module.new)
+          stub_const('Puppet::Provider::TypeCheck::TypeCheck', provider_class)
+          Puppet::Type.type(type_name.to_sym).rsapi_provider_get_cache.clear
+        end
+
+        # `get` returns the managed resource (`test`, schema-valid) alongside another
+        # resource (`other`) that the catalog does not manage but which violates the
+        # schema. Only the managed resource should be schema-checked on retrieve.
+        let(:provider_class) do
+          Class.new do
+            def get(_context)
+              [
+                { name: 'test' },
+                { name: 'other', test_string: 15, wibble: 'foo' }
+              ]
+            end
+
+            def set(_context, _changes); end
+          end
+        end
+
+        context 'when strict is :error' do
+          let(:strict_level) { :error }
+
+          it 'does not raise for schema violations in the unmanaged resource' do
+            expect { instance.retrieve }.not_to raise_error
+          end
+        end
+      end
     end
   end