I remember one of my concerns about this - this method is never actually applied on an existing resource:

```ruby
      it "should call :check_valid_shell on the provider when changing shell" do
        @provider = @shell_provider_class.new(:name => 'foo', :shell => '/bin/bash')
        @provider.expects(:check_valid_shell)
        resource = described_class.new(:name => 'foo', :shell => '/bin/zsh', :provider => @provider)

        Puppet::Util::Storage.stubs(:load)
        Puppet::Util::Storage.stubs(:store)

        catalog = Puppet::Resource::Catalog.new
        catalog.add_resource resource

        catalog.apply
      end
```

```
  1) Puppet::Type::User when setting shell with provider with manages_shell should call :check_valid_shell on the provider when changing shell
     Failure/Error: @provider.expects(:check_valid_shell)
     Mocha::ExpectationError:
       not all expectations were satisfied
       unsatisfied expectations:
       - expected exactly once, not yet invoked: User[foo](provider=manages_shell).check_valid_shell(any_parameters)
       satisfied expectations:
       - allowed any number of times, not yet invoked: Signal.trap(any_parameters)
       - allowed any number of times, invoked once: Puppet::Type::User.defaultprovider(any_parameters)
       - allowed any number of times, not yet invoked: Puppet::Type::User.defaultprovider(any_parameters)
       - allowed any number of times, invoked once: Puppet::Util::Storage.store(any_parameters)
       - allowed any number of times, invoked once: Puppet::Util::Storage.load(any_parameters)
     # ./spec/unit/type/user_spec.rb:386:in `block (4 levels) in <top (required)>'
```

The problem is that `check_valid_shell` is only called in `#create` and never when the `shell` property is checked. The current tests are masking this because they're directly calling the property and syncing it, which bypasses the resource_harness.