validate flags before reading stdin and reject bare -C with -j/-1/-2

main_test.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 	"sync/atomic"
 	"testing"
+	"time"
 
 	"gopkg.in/yaml.v3"
 )
@@ -944,3 +945,80 @@ func TestRun_CountWithoutStdinRequiresRoleOrFact(t *testing.T) {
 		t.Fatalf("expected -R/-F requirement error, got: %v", err)
 	}
 }
+
+func TestRun_CountPipedWithFactQueriesEachNode(t *testing.T) {
+	withStdin(t, pipedLookup)
+	var queried atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !strings.Contains(r.URL.Query().Get("query"), "osfamily") {
+			t.Errorf("expected osfamily query, got %q", r.URL.Query().Get("query"))
+		}
+		queried.Add(1)
+		_ = json.NewEncoder(w).Encode([]fact{{Certname: "h", Name: "osfamily", Value: rawJSON("RedHat")}})
+	}))
+	t.Cleanup(srv.Close)
+	cfg := config{PuppetDBURL: srv.URL, RoleFact: "enc_role"}
+
+	out := strings.TrimSpace(captureStdout(t, func() {
+		if err := run(cfg, "", "osfamily", "", false, false, false, false, false, true, false, false, false); err != nil {
+			t.Fatalf("run returned error: %v", err)
+		}
+	}))
+	if out != "2: RedHat" {
+		t.Fatalf("expected fact counts of piped nodes, got: %q", out)
+	}
+	if n := queried.Load(); n != 2 {
+		t.Fatalf("expected one query per piped node, got %d", n)
+	}
+}
+
+func TestRun_CountPipedWithOtherOutputFlagsRequiresRoleOrFact(t *testing.T) {
+	for name, mutate := range map[string]func(*runArgs){
+		"json":      func(a *runArgs) { a.jsonMode = true },
+		"nodeOnly":  func(a *runArgs) { a.nodeOnly = true },
+		"valueOnly": func(a *runArgs) { a.valueOnly = true },
+	} {
+		t.Run(name, func(t *testing.T) {
+			withStdin(t, pipedLookup)
+			a := runArgs{cfg: config{PuppetDBURL: "http://unused"}, count: true}
+			mutate(&a)
+			var err error
+			out := captureStdout(t, func() {
+				err = run(a.cfg, "", "", "", false, false, false, a.nodeOnly, a.valueOnly, true, false, a.jsonMode, false)
+			})
+			if err == nil || !strings.Contains(err.Error(), "-R or -F") {
+				t.Fatalf("expected -R/-F requirement error, got: %v (output %q)", err, out)
+			}
+		})
+	}
+}
+
+func TestRun_InvalidFlagsErrorWithoutReadingOpenPipe(t *testing.T) {
+	for name, a := range map[string]runArgs{
+		"match":     {match: "foo"},
+		"countJSON": {count: true, jsonMode: true},
+	} {
+		t.Run(name, func(t *testing.T) {
+			r, w, err := os.Pipe()
+			if err != nil {
+				t.Fatal(err)
+			}
+			old := os.Stdin
+			os.Stdin = r
+			t.Cleanup(func() { os.Stdin = old; _ = w.Close(); _ = r.Close() })
+
+			done := make(chan error, 1)
+			go func() {
+				done <- run(config{PuppetDBURL: "http://unused"}, "", "", a.match, false, false, false, false, false, a.count, false, a.jsonMode, false)
+			}()
+			select {
+			case err := <-done:
+				if err == nil || !strings.Contains(err.Error(), "-R or -F") {
+					t.Fatalf("expected -R/-F requirement error, got: %v", err)
+				}
+			case <-time.After(2 * time.Second):
+				t.Fatal("run blocked on an open, empty stdin pipe before validating flags")
+			}
+		})
+	}
+}