foreman_openscap 13.1.1 → 13.1.3

data/locale/zh_TW/foreman_openscap.po

@@ -6,7 +6,7 @@
 # FIRST AUTHOR <EMAIL@ADDRESS>, 2016
 msgid ""
 msgstr ""
-"Project-Id-Version: foreman_openscap 12.0.1\n"
+"Project-Id-Version: foreman_openscap 13.1.1\n"
 "Report-Msgid-Bugs-To: \n"
 "PO-Revision-Date: 2016-04-14 07:48+0000\n"
 "Last-Translator: FIRST AUTHOR <EMAIL@ADDRESS>, 2016\n"
@@ -47,6 +47,9 @@ msgstr "%s 最新報告"
 msgid "%s reports over time"
 msgstr "%s 一直以來的報告"
 
+msgid "%s selected hosts."
+msgstr ""
+
 msgid "%s spool errors detected, inspect the appropriate file directly on proxy"
 msgstr ""
 
@@ -65,6 +68,9 @@ msgstr ""
 msgid "A summary of reports for OpenSCAP policies"
 msgstr ""
 
+msgid "ALL selected hosts."
+msgstr ""
+
 msgid "Actions"
 msgstr "動作"
 
@@ -83,12 +89,21 @@ msgstr ""
 msgid "Apply policy to hosts"
 msgstr ""
 
-msgid "Are you sure you want to delete %s?"
+msgid "Assign"
 msgstr ""
 
 msgid "Assign Compliance Policy"
 msgstr "指定合規政策"
 
+msgid "Assign OpenSCAP Proxy"
+msgstr ""
+
+msgid "Assign OpenSCAP Proxy for "
+msgstr ""
+
+msgid "Assign OpenSCAP Proxy to multiple hosts"
+msgstr ""
+
 msgid "Back"
 msgstr "上一頁"
 
@@ -164,9 +179,6 @@ msgstr "合規主機"
 msgid "Compliant with the policy"
 msgstr "合於政策"
 
-msgid "Confirm"
-msgstr ""
-
 msgid "Content"
 msgstr ""
 
@@ -308,6 +320,11 @@ msgstr "只有失敗"
 msgid "Failed saving %s:"
 msgstr ""
 
+msgid "Failed to assign OpenSCAP Proxy to %{failed} of %{total} host."
+msgid_plural "Failed to assign OpenSCAP Proxy to %{failed} of %{total} hosts."
+msgstr[0] ""
+msgstr[1] ""
+
 msgid "Failed to delete %s compliance reports"
 msgstr "刪除 %s 合規報告失敗"
 
@@ -396,12 +413,21 @@ msgstr ""
 msgid "Hosts passing this rule"
 msgstr ""
 
+msgid "Hosts to explicitly exclude in the action. All other hosts will be included in the action, unless an included parameter is passed as well."
+msgstr ""
+
+msgid "Hosts to include in the action"
+msgstr ""
+
 msgid "How the policy should be deployed"
 msgstr ""
 
 msgid "ID of OpenSCAP Proxy"
 msgstr ""
 
+msgid "ID of the OpenSCAP Proxy to assign to the hosts"
+msgstr ""
+
 msgid "In Foreman, a compliance policy checklist is defined via %s."
 msgstr ""
 
@@ -439,6 +465,9 @@ msgstr ""
 msgid "Latest reports for policy: %s"
 msgstr "最新的政策報告：%s"
 
+msgid "Line chart"
+msgstr ""
+
 msgid "List ARF reports"
 msgstr ""
 
@@ -454,6 +483,15 @@ msgstr "列出 SCAP 內容"
 msgid "List Tailoring files"
 msgstr ""
 
+msgid "List of host ids to exclude and not perform the action on"
+msgstr ""
+
+msgid "List of host ids to perform the action on"
+msgstr ""
+
+msgid "Loading"
+msgstr "載入中"
+
 msgid "Loading..."
 msgstr "載入中…"
 
@@ -499,6 +537,9 @@ msgstr "否"
 msgid "No ARF reports for this policy"
 msgstr "此政策沒有 ARF 報告"
 
+msgid "No OpenSCAP Proxies available. Please configure a Smart Proxy with the OpenSCAP feature."
+msgstr ""
+
 msgid "No OpenSCAP Proxy selected."
 msgstr ""
 
@@ -520,6 +561,9 @@ msgstr ""
 msgid "No compliance reports were found."
 msgstr ""
 
+msgid "No data available"
+msgstr ""
+
 msgid "No hosts selected"
 msgstr "未選擇主機"
 
@@ -583,9 +627,15 @@ msgstr ""
 msgid "OpenSCAP Proxy"
 msgstr ""
 
+msgid "OpenSCAP Proxy is set to %s"
+msgstr ""
+
 msgid "OpenSCAP Proxy to use for fetching SCAP content and uploading ARF reports. Leave blank and override appropriate parameters when using proxy load balancer."
 msgstr ""
 
+msgid "OpenSCAP Proxy with id %s not found"
+msgstr ""
+
 msgid "Openscap Proxy"
 msgstr ""
 
@@ -615,9 +665,6 @@ msgstr "已通過"
 msgid "Passed|P"
 msgstr "Passed|P"
 
-msgid "Permission denied"
-msgstr "使用權限被拒"
-
 msgid "Please Confirm"
 msgstr "請確認"
 
@@ -723,9 +770,6 @@ msgstr ""
 msgid "Reports"
 msgstr "報告"
 
-msgid "Request the following permissions from administrator: %s."
-msgstr ""
-
 msgid "Request timed out. Please try increasing Settings -> proxy_request_timeout"
 msgstr ""
 
@@ -795,6 +839,9 @@ msgstr ""
 msgid "Schedule"
 msgstr "排程"
 
+msgid "Search string describing which hosts to perform the action on"
+msgstr ""
+
 msgid "Select Action"
 msgstr "選擇動作"
 
@@ -876,6 +923,11 @@ msgstr "刪除 %s 合規報告成功"
 msgid "Successfully deleted ARF report."
 msgstr ""
 
+msgid "Successfully updated %{success} host."
+msgid_plural "Successfully updated %{success} hosts."
+msgstr[0] ""
+msgstr[1] ""
+
 msgid "Summary from %{time} ago to now"
 msgstr "%{time} 之前到現在的摘要"
 
@@ -920,13 +972,13 @@ msgstr ""
 msgid "The job has started on selected host(s), you can check the status on the job details page."
 msgstr ""
 
-msgid "There are significant differences in deployment options."
+msgid "The selected OpenSCAP Proxy does not have the OpenSCAP feature enabled."
 msgstr ""
 
-msgid "There is no job to remediate with. Please remediate manually."
+msgid "There are significant differences in deployment options."
 msgstr ""
 
-msgid "There was a following error when deleting %(name)s: %(error)s"
+msgid "There is no job to remediate with. Please remediate manually."
 msgstr ""
 
 msgid "There's no available report for this host"
@@ -938,6 +990,9 @@ msgstr ""
 msgid "This profile will be used to override the one from scap content"
 msgstr ""
 
+msgid "This will change previous proxy assignments on the selected hosts."
+msgstr ""
+
 msgid "Title"
 msgstr "標題"
 
@@ -1033,9 +1088,6 @@ msgstr ""
 msgid "Yes"
 msgstr "是"
 
-msgid "You are not authorized to view the page. "
-msgstr ""
-
 msgid "You can remediate by running a remote job or you can display a snippet for manual remediation."
 msgstr ""
 

data/test/test_plugin_helper.rb

@@ -59,6 +59,13 @@ end
 module ScapTestCommon
   private
 
+  def set_compliance_status(host, status)
+    compliance_status = host.get_status(ForemanOpenscap::ComplianceStatus)
+    compliance_status.status = status
+    compliance_status.reported_at = Time.current
+    compliance_status.save!
+  end
+
   def create_report_with_rules(host, rule_names, rule_results)
     raise "rule_names and rule_results should have the same length!" if rule_names.size != rule_results.size
     metrics = {

data/test/unit/compliance_status_resetter_test.rb

@@ -0,0 +1,48 @@
+require 'test_plugin_helper'
+
+class ComplianceStatusResetterTest < ActiveSupport::TestCase
+  setup do
+    ForemanOpenscap::Policy.any_instance.stubs(:ensure_needed_puppetclasses).returns(true)
+    @policy = FactoryBot.create(:policy)
+  end
+
+  test 'creates inconclusive status for host without existing status' do
+    host = FactoryBot.create(:compliance_host, :policies => [@policy])
+
+    ForemanOpenscap::ComplianceStatusResetter.to_inconclusive([host.id])
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, host.reload.compliance_status
+  end
+
+  test 'resets existing compliant status to inconclusive' do
+    host = FactoryBot.create(:compliance_host, :policies => [@policy])
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    ForemanOpenscap::ComplianceStatusResetter.to_inconclusive([host.id])
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, host.reload.compliance_status
+  end
+
+  test 'ignores blank and duplicate host ids without error' do
+    host = FactoryBot.create(:compliance_host, :policies => [@policy])
+
+    ForemanOpenscap::ComplianceStatusResetter.to_inconclusive([host.id, host.id, nil])
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, host.reload.compliance_status
+  end
+
+  test 'does nothing for an empty list of host ids' do
+    assert_nil ForemanOpenscap::ComplianceStatusResetter.to_inconclusive([])
+  end
+
+  test 'refreshes host global_status so it reflects the new inconclusive compliance status' do
+    host = FactoryBot.create(:compliance_host, :policies => [@policy])
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    host.refresh_global_status!
+    assert_equal ::HostStatus::Global::OK, host.reload.global_status
+
+    ForemanOpenscap::ComplianceStatusResetter.to_inconclusive([host.id])
+
+    assert_equal ::HostStatus::Global::WARN, host.reload.global_status
+  end
+end

data/test/unit/compliance_status_test.rb

@@ -74,12 +74,48 @@ class ComplianceStatusTest < ActiveSupport::TestCase
     status = ForemanOpenscap::ComplianceStatus.new
     host = FactoryBot.create(:compliance_host, :policies => [@policy_a])
 
+    host.expects(:combined_policies).never
     status.host = host
 
     assert status.relevant?
   end
 
-  test 'relevant? should be true for hostgroup policies and to_status should use them' do
+  test 'relevant? should be false for host without policies' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    host = FactoryBot.create(:host)
+
+    status.host = host
+
+    refute status.relevant?
+  end
+
+  test 'relevant? should be false for host with hostgroup but no policies' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    host = FactoryBot.create(:host, :with_hostgroup)
+
+    status.host = host
+
+    refute status.relevant?
+  end
+
+  test 'relevant? should be true for hostgroup policies without loading combined_policies' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    host = FactoryBot.create(:host, :with_hostgroup)
+
+    assert_empty host.policies
+    @policy_a.hostgroup_ids = [host.hostgroup.id]
+    assert @policy_a.save
+
+    host.reload
+    assert_includes host.combined_policies, @policy_a
+
+    status.host = host
+    host.expects(:combined_policies).never
+
+    assert status.relevant?
+  end
+
+  test 'to_status should use hostgroup policies' do
     status = ForemanOpenscap::ComplianceStatus.new
     host = FactoryBot.create(:host, :with_hostgroup)
     othered_status = { :passed => 0, :failed => 0, :othered => 1 }.with_indifferent_access
@@ -95,12 +131,10 @@ class ComplianceStatusTest < ActiveSupport::TestCase
     FactoryBot.create(:policy_arf_report, :policy_id => @policy_a.id, :arf_report_id => report.id)
 
     status.host = host
-
-    assert status.relevant?
     assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, status.to_status
   end
 
-  test 'relevant? should be true for inherited parent hostgroup policies' do
+  test 'relevant? should be true for inherited parent hostgroup policies without loading combined_policies' do
     status = ForemanOpenscap::ComplianceStatus.new
     host = FactoryBot.create(:host, :with_hostgroup)
     hostgroup = host.hostgroup
@@ -116,7 +150,22 @@ class ComplianceStatusTest < ActiveSupport::TestCase
     assert_includes host.combined_policies, @policy_a
 
     status.host = host
+    host.expects(:combined_policies).never
 
     assert status.relevant?
   end
+
+  test 'to_label returns label based on stored status' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    status.status = ForemanOpenscap::ComplianceStatus::COMPLIANT
+    status.expects(:to_status).never
+    assert_equal 'Compliant', status.to_label
+  end
+
+  test 'to_global returns global status based on stored status' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    status.status = ForemanOpenscap::ComplianceStatus::COMPLIANT
+    status.expects(:to_status).never
+    assert_equal ::HostStatus::Global::OK, status.to_global
+  end
 end

data/test/unit/concerns/host_extensions_test.rb

@@ -162,6 +162,61 @@ class HostExtensionsTest < ActiveSupport::TestCase
     assert_empty ForemanOpenscap::Asset.where(:assetable_id => host.id, :assetable_type => 'Host::Base')
   end
 
+  test 'should reset compliance status when assigning policy through host policies' do
+    host = FactoryBot.create(:compliance_host)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    host.policies = [@policy]
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, host.reload.compliance_status
+  end
+
+  test 'should reset compliance status when removing policy through host policies' do
+    host = FactoryBot.create(:compliance_host, :policies => [@policy])
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    host.policies = []
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, host.reload.compliance_status
+  end
+
+  test 'should reset compliance status when host is moved to a different hostgroup' do
+    old_hostgroup = FactoryBot.create(:hostgroup)
+    new_hostgroup = FactoryBot.create(:hostgroup)
+    host = FactoryBot.create(:compliance_host, :hostgroup_id => old_hostgroup.id)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    host.update!(:hostgroup_id => new_hostgroup.id)
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, host.reload.compliance_status
+  end
+
+  test 'should not reset compliance status when host is saved without hostgroup change' do
+    hostgroup = FactoryBot.create(:hostgroup)
+    host = FactoryBot.create(:compliance_host, :hostgroup_id => hostgroup.id)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    host.update!(:comment => 'unrelated change')
+
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, host.reload.compliance_status
+  end
+
+  test 'compliance_status returns stored persisted status without recalculation' do
+    set_compliance_status(@host, ForemanOpenscap::ComplianceStatus::INCONCLUSIVE)
+    status = @host.reload.get_status(ForemanOpenscap::ComplianceStatus)
+    status.expects(:to_status).never
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, @host.compliance_status
+  end
+
+  test 'compliance_status_label returns label from stored persisted status without recalculation' do
+    set_compliance_status(@host, ForemanOpenscap::ComplianceStatus::INCOMPLIANT)
+    status = @host.reload.get_status(ForemanOpenscap::ComplianceStatus)
+    status.expects(:to_status).never
+
+    assert_equal 'Incompliant', @host.compliance_status_label
+  end
+
   private
 
   def setup_hosts_with_policy

data/test/unit/concerns/hostgroup_extensions_test.rb

@@ -7,4 +7,68 @@ class HostgroupExtensionsTest < ActiveSupport::TestCase
     asset_scope = ::ForemanOpenscap::Asset.where(:assetable_id => hostgroup.id, :assetable_type => 'Hostgroup')
     assert_difference("asset_scope.count", -3) { hostgroup.destroy }
   end
+
+  test "should reset compliance status for subtree when assigning policy through hostgroup asset policies" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    policy = FactoryBot.create(:policy)
+    asset = FactoryBot.create(:asset, :assetable_id => parent.id, :assetable_type => 'Hostgroup')
+
+    set_compliance_status(parent_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    set_compliance_status(child_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    asset.policies = [policy]
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, parent_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, child_host.reload.compliance_status
+  end
+
+  test "should reset compliance status for subtree when removing policy through hostgroup asset policies" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    policy = FactoryBot.create(:policy)
+    asset = FactoryBot.create(:asset, :assetable_id => parent.id, :assetable_type => 'Hostgroup')
+    asset.policies = [policy]
+
+    set_compliance_status(parent_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    set_compliance_status(child_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    asset.policies = []
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, parent_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, child_host.reload.compliance_status
+  end
+
+  test "should reset compliance status for subtree when hostgroup is reparented" do
+    old_parent = FactoryBot.create(:hostgroup)
+    new_parent = FactoryBot.create(:hostgroup)
+    moved = FactoryBot.create(:hostgroup, :ancestry => old_parent.id.to_s)
+    child = FactoryBot.create(:hostgroup, :ancestry => "#{old_parent.id}/#{moved.id}")
+    moved_host = FactoryBot.create(:compliance_host, :hostgroup_id => moved.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    unrelated_host = FactoryBot.create(:compliance_host, :hostgroup_id => old_parent.id)
+    [moved_host, child_host, unrelated_host].each do |host|
+      set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    end
+
+    moved.update!(:parent_id => new_parent.id)
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, moved_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, child_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, unrelated_host.reload.compliance_status
+  end
+
+  test "should not reset compliance status for hostgroup save without ancestry change" do
+    hostgroup = FactoryBot.create(:hostgroup)
+    host = FactoryBot.create(:compliance_host, :hostgroup_id => hostgroup.id)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    hostgroup.update!(:name => 'renamed')
+
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, host.reload.compliance_status
+  end
 end

data/test/unit/policy_test.rb

@@ -46,6 +46,90 @@ class PolicyTest < ActiveSupport::TestCase
     assert_equal 1, policy.hosts.count
   end
 
+  test "should reset compliance status when assigning policy to host" do
+    host = FactoryBot.create(:compliance_host)
+    unrelated_host = FactoryBot.create(:compliance_host)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    set_compliance_status(unrelated_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    policy = FactoryBot.create(:policy, :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+
+    policy.host_ids = [host.id]
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, compliance_status_for(unrelated_host)
+  end
+
+  test "should create inconclusive compliance status when assigning policy to host without status" do
+    host = FactoryBot.create(:compliance_host)
+    policy = FactoryBot.create(:policy, :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+
+    policy.host_ids = [host.id]
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+  end
+
+  test "should reset compliance status when removing policy from host assignment" do
+    host = FactoryBot.create(:compliance_host)
+    asset = FactoryBot.create(:asset, :assetable_id => host.id, :assetable_type => 'Host::Base')
+    policy = FactoryBot.create(:policy, :assets => [asset], :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    policy.host_ids = []
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+  end
+
+  test "should reset compliance status when unassigning host from policy" do
+    host = FactoryBot.create(:compliance_host)
+    asset = FactoryBot.create(:asset, :assetable_id => host.id, :assetable_type => 'Host::Base')
+    policy = FactoryBot.create(:policy, :assets => [asset], :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    policy.unassign_hosts([host])
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+  end
+
+  test "should reset compliance status for hostgroup subtree when assigning policy to hostgroup" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    unrelated_host = FactoryBot.create(:compliance_host)
+    [parent_host, child_host, unrelated_host].each do |host|
+      set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    end
+    policy = FactoryBot.create(:policy, :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+
+    policy.hostgroup_ids = [parent.id]
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(parent_host)
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(child_host)
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, compliance_status_for(unrelated_host)
+  end
+
+  test "should reset compliance status for hostgroup subtree when removing policy from hostgroup" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    asset = FactoryBot.create(:asset, :assetable_id => parent.id, :assetable_type => 'Hostgroup')
+    policy = FactoryBot.create(:policy, :assets => [asset], :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+    [parent_host, child_host].each do |host|
+      set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    end
+
+    policy.hostgroup_ids = []
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(parent_host)
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(child_host)
+  end
+
   test "should delete assets when unassigning hosts" do
     host1 = FactoryBot.create(:compliance_host)
     host2 = FactoryBot.create(:compliance_host)
@@ -331,4 +415,10 @@ class PolicyTest < ActiveSupport::TestCase
     assert_equal policy.deploy_by, 'manual'
     assert_equal policy.name, name
   end
+
+  private
+
+  def compliance_status_for(host)
+    ForemanOpenscap::ComplianceStatus.find_by(:host_id => host.id).try(:status)
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: foreman_openscap
 version: !ruby/object:Gem::Version
-  version: 13.1.1
+  version: 13.1.3
 platform: ruby
 authors:
 - slukasik@redhat.com
@@ -106,6 +106,7 @@ files:
 - app/services/foreman_openscap/client_config/base.rb
 - app/services/foreman_openscap/client_config/manual.rb
 - app/services/foreman_openscap/client_config/puppet.rb
+- app/services/foreman_openscap/compliance_status_resetter.rb
 - app/services/foreman_openscap/config_name_service.rb
 - app/services/foreman_openscap/host_report_dashboard/data.rb
 - app/services/foreman_openscap/hostgroup_overrider.rb
@@ -349,6 +350,7 @@ files:
 - test/test_plugin_helper.rb
 - test/unit/arf_report_status_calculator_test.rb
 - test/unit/arf_report_test.rb
+- test/unit/compliance_status_resetter_test.rb
 - test/unit/compliance_status_test.rb
 - test/unit/concerns/bookmark_controller_validator_extensions_test.rb
 - test/unit/concerns/host_extensions_test.rb
@@ -457,6 +459,7 @@ test_files:
 - test/test_plugin_helper.rb
 - test/unit/arf_report_status_calculator_test.rb
 - test/unit/arf_report_test.rb
+- test/unit/compliance_status_resetter_test.rb
 - test/unit/compliance_status_test.rb
 - test/unit/concerns/bookmark_controller_validator_extensions_test.rb
 - test/unit/concerns/host_extensions_test.rb