Describe the Bug

From the Datatype definition password_hash is allowed to be Sensitive but when setting it as one the password is set wrongly and ALTER password runs always.

Problem is https://github.com/puppetlabs/puppetlabs-postgresql/blob/v8.2.1/manifests/server/role.pp#L165 because is merged with string here https://github.com/puppetlabs/puppetlabs-postgresql/blob/main/manifests/server/role.pp#L182-L183

Resulting that $pwd_hash_sql will always replaced with Sensitive [value redacted] because it has not been unwrapped before.

Expected Behavior

postgresql::server::role should be allowed to be used with a Sensitive password_hash and with update_password enabled.

Steps to Reproduce

• Manifest with

postgresql::server::role { 'marmot':
  password_hash => postgresql::postgresql_password('marmot', 'mypasswd',true),
}

• run puppet
• run puppet again
  • shows that the password has been changed again
• try to login

psql --host=localhost --username=marmot --password

• does not work because the password is not accepted

Environment

• puppetlabs-postgresql v8.2.1
• postgresql 12.14
• CentOS 8 Stream

Additional Context

POC of the problem:

$password = Sensitive('Password')
$command = "/usr/bin/echo \"The password is: '${password}'\" > /tmp/data.txt"

exec { 'test':
  command => $command,
}