foreman_openscap 13.1.1 → 13.1.3

data/app/assets/javascripts/foreman_openscap/locale/zh_TW/foreman_openscap.js

@@ -3,7 +3,7 @@
   "locale_data": {
     "foreman_openscap": {
       "": {
-        "Project-Id-Version": "foreman_openscap 12.0.1",
+        "Project-Id-Version": "foreman_openscap 13.1.1",
         "Report-Msgid-Bugs-To": "",
         "PO-Revision-Date": "2016-04-14 07:48+0000",
         "Last-Translator": "FIRST AUTHOR <EMAIL@ADDRESS>, 2016",
@@ -45,6 +45,9 @@
       "%s reports over time": [
         "%s 一直以來的報告"
       ],
+      "%s selected hosts.": [
+        ""
+      ],
       "%s spool errors detected, inspect the appropriate file directly on proxy": [
         ""
       ],
@@ -63,6 +66,9 @@
       "A summary of reports for OpenSCAP policies": [
         ""
       ],
+      "ALL selected hosts.": [
+        ""
+      ],
       "Actions": [
         "動作"
       ],
@@ -81,12 +87,21 @@
       "Apply policy to hosts": [
         ""
       ],
-      "Are you sure you want to delete %s?": [
+      "Assign": [
         ""
       ],
       "Assign Compliance Policy": [
         "指定合規政策"
       ],
+      "Assign OpenSCAP Proxy": [
+        ""
+      ],
+      "Assign OpenSCAP Proxy for ": [
+        ""
+      ],
+      "Assign OpenSCAP Proxy to multiple hosts": [
+        ""
+      ],
       "Back": [
         "上一頁"
       ],
@@ -162,9 +177,6 @@
       "Compliant with the policy": [
         "合於政策"
       ],
-      "Confirm": [
-        ""
-      ],
       "Content": [
         ""
       ],
@@ -306,6 +318,10 @@
       "Failed saving %s:": [
         ""
       ],
+      "Failed to assign OpenSCAP Proxy to %{failed} of %{total} host.": [
+        "",
+        ""
+      ],
       "Failed to delete %s compliance reports": [
         "刪除 %s 合規報告失敗"
       ],
@@ -393,12 +409,21 @@
       "Hosts passing this rule": [
         ""
       ],
+      "Hosts to explicitly exclude in the action. All other hosts will be included in the action, unless an included parameter is passed as well.": [
+        ""
+      ],
+      "Hosts to include in the action": [
+        ""
+      ],
       "How the policy should be deployed": [
         ""
       ],
       "ID of OpenSCAP Proxy": [
         ""
       ],
+      "ID of the OpenSCAP Proxy to assign to the hosts": [
+        ""
+      ],
       "In Foreman, a compliance policy checklist is defined via %s.": [
         ""
       ],
@@ -432,6 +457,9 @@
       "Latest reports for policy: %s": [
         "最新的政策報告：%s"
       ],
+      "Line chart": [
+        ""
+      ],
       "List ARF reports": [
         ""
       ],
@@ -447,6 +475,15 @@
       "List Tailoring files": [
         ""
       ],
+      "List of host ids to exclude and not perform the action on": [
+        ""
+      ],
+      "List of host ids to perform the action on": [
+        ""
+      ],
+      "Loading": [
+        "載入中"
+      ],
       "Loading...": [
         "載入中…"
       ],
@@ -492,6 +529,9 @@
       "No ARF reports for this policy": [
         "此政策沒有 ARF 報告"
       ],
+      "No OpenSCAP Proxies available. Please configure a Smart Proxy with the OpenSCAP feature.": [
+        ""
+      ],
       "No OpenSCAP Proxy selected.": [
         ""
       ],
@@ -513,6 +553,9 @@
       "No compliance reports were found.": [
         ""
       ],
+      "No data available": [
+        ""
+      ],
       "No hosts selected": [
         "未選擇主機"
       ],
@@ -576,9 +619,15 @@
       "OpenSCAP Proxy": [
         ""
       ],
+      "OpenSCAP Proxy is set to %s": [
+        ""
+      ],
       "OpenSCAP Proxy to use for fetching SCAP content and uploading ARF reports. Leave blank and override appropriate parameters when using proxy load balancer.": [
         ""
       ],
+      "OpenSCAP Proxy with id %s not found": [
+        ""
+      ],
       "Openscap Proxy": [
         ""
       ],
@@ -606,9 +655,6 @@
       "Passed|P": [
         "Passed|P"
       ],
-      "Permission denied": [
-        "使用權限被拒"
-      ],
       "Please Confirm": [
         "請確認"
       ],
@@ -714,9 +760,6 @@
       "Reports": [
         "報告"
       ],
-      "Request the following permissions from administrator: %s.": [
-        ""
-      ],
       "Request timed out. Please try increasing Settings -> proxy_request_timeout": [
         ""
       ],
@@ -786,6 +829,9 @@
       "Schedule": [
         "排程"
       ],
+      "Search string describing which hosts to perform the action on": [
+        ""
+      ],
       "Select Action": [
         "選擇動作"
       ],
@@ -867,6 +913,10 @@
       "Successfully deleted ARF report.": [
         ""
       ],
+      "Successfully updated %{success} host.": [
+        "",
+        ""
+      ],
       "Summary from %{time} ago to now": [
         "%{time} 之前到現在的摘要"
       ],
@@ -909,13 +959,13 @@
       "The job has started on selected host(s), you can check the status on the job details page.": [
         ""
       ],
-      "There are significant differences in deployment options.": [
+      "The selected OpenSCAP Proxy does not have the OpenSCAP feature enabled.": [
         ""
       ],
-      "There is no job to remediate with. Please remediate manually.": [
+      "There are significant differences in deployment options.": [
         ""
       ],
-      "There was a following error when deleting %(name)s: %(error)s": [
+      "There is no job to remediate with. Please remediate manually.": [
         ""
       ],
       "There's no available report for this host": [
@@ -927,6 +977,9 @@
       "This profile will be used to override the one from scap content": [
         ""
       ],
+      "This will change previous proxy assignments on the selected hosts.": [
+        ""
+      ],
       "Title": [
         "標題"
       ],
@@ -1021,9 +1074,6 @@
       "Yes": [
         "是"
       ],
-      "You are not authorized to view the page. ": [
-        ""
-      ],
       "You can remediate by running a remote job or you can display a snippet for manual remediation.": [
         ""
       ],

data/app/models/concerns/foreman_openscap/host_extensions.rb

@@ -11,6 +11,8 @@ module ForemanOpenscap
 
       base.validate :openscap_proxy_in_taxonomy, :if => Proc.new { |host| host.openscap_proxy_id.present? }
 
+      base.after_update :reset_compliance_status_on_hostgroup_change, :if => :saved_change_to_hostgroup_id?
+
       base.scoped_search :relation => :policies, :on => :name, :complete_value => true, :rename => :compliance_policy,
                     :only_explicit => true, :operators => ['= '], :ext_method => :search_by_policy_name
 
@@ -129,18 +131,22 @@ module ForemanOpenscap
       report_scope
     end
 
-    def compliance_status(options = {})
-      @compliance_status ||= get_status(ForemanOpenscap::ComplianceStatus).to_status(options)
+    def compliance_status(_options = {})
+      @compliance_status ||= get_status(ForemanOpenscap::ComplianceStatus).status
     end
 
-    def compliance_status_label(options = {})
-      @compliance_status_label ||= get_status(ForemanOpenscap::ComplianceStatus).to_label(options)
+    def compliance_status_label(_options = {})
+      @compliance_status_label ||= get_status(ForemanOpenscap::ComplianceStatus).to_label
     end
 
     def openscap_proxy_in_taxonomy
       validate_association_taxonomy(:openscap_proxy)
     end
 
+    def reset_compliance_status_on_hostgroup_change
+      ForemanOpenscap::ComplianceStatusResetter.to_inconclusive([id])
+    end
+
     module ClassMethods
       def search_by_removed_from_policy(key, operator, policy_name)
         policy = ForemanOpenscap::Policy.find_by :name => policy_name

data/app/models/concerns/foreman_openscap/hostgroup_extensions.rb

@@ -8,12 +8,19 @@ module ForemanOpenscap
       has_many :assets, :as => :assetable, :class_name => "::ForemanOpenscap::Asset", dependent: :destroy
       has_many :asset_policies, :through => :assets, :class_name => "::ForemanOpenscap::AssetPolicy"
       has_many :policies, :through => :asset_policies, :class_name => "::ForemanOpenscap::Policy"
+
+      after_update :reset_compliance_status_on_ancestry_change, :if => :saved_change_to_ancestry?
     end
 
     def inherited_policies
       find_inherited_policies :policies
     end
 
+    def reset_compliance_status_on_ancestry_change
+      host_ids = ::Host.where(:hostgroup_id => subtree_ids).pluck(:id)
+      ForemanOpenscap::ComplianceStatusResetter.to_inconclusive(host_ids)
+    end
+
     def openscap_proxy
       return super if ancestry.nil? || self.openscap_proxy_id.present?
       ::SmartProxy.find_by(:id => inherited_openscap_proxy_id)

data/app/models/foreman_openscap/asset.rb

@@ -1,7 +1,9 @@
 module ForemanOpenscap
   class Asset < ApplicationRecord
     has_many :asset_policies, :dependent => :delete_all
-    has_many :policies, :through => :asset_policies
+    has_many :policies, :through => :asset_policies,
+                        :after_add => :reset_compliance_status,
+                        :after_remove => :reset_compliance_status
     belongs_to :assetable, :polymorphic => true
 
     scope :hosts, lambda { where(:assetable_type => 'Host::Base') }
@@ -20,6 +22,24 @@ module ForemanOpenscap
 
     private
 
+    def reset_compliance_status(_policy)
+      ForemanOpenscap::ComplianceStatusResetter.to_inconclusive(host_ids_reached_by_asset)
+    end
+
+    def host_ids_reached_by_asset
+      case assetable_type
+      when 'Host::Base'
+        [assetable_id]
+      when 'Hostgroup'
+        hostgroup = Hostgroup.find_by(:id => assetable_id)
+        return [] unless hostgroup
+
+        Host.where(:hostgroup_id => hostgroup.subtree_ids).pluck(:id)
+      else
+        []
+      end
+    end
+
     def fetch_asset(type)
       assetable if assetable_type == type
     end

data/app/models/foreman_openscap/compliance_status.rb

@@ -16,8 +16,8 @@ module ForemanOpenscap
       "#{ArfReport::BIT_NUM * ArfReport::METRIC.index(status)} & #{ArfReport::MAX}"
     end
 
-    def to_label(options = {})
-      case to_status
+    def to_label(_options = {})
+      case status
       when COMPLIANT
         N_('Compliant')
       when INCONCLUSIVE
@@ -29,8 +29,8 @@ module ForemanOpenscap
       end
     end
 
-    def to_global(options = {})
-      case to_status
+    def to_global(_options = {})
+      case status
       when COMPLIANT
         ::HostStatus::Global::OK
       when INCONCLUSIVE
@@ -40,17 +40,29 @@ module ForemanOpenscap
       end
     end
 
-    def relevant?(options = {})
+    def relevant?(_options = {})
       # May fail host status during migration
       return false unless ForemanOpenscap::Asset.table_exists?
-      host.combined_policies.present?
+      host.policies.any? || host_has_hostgroup_policies?
     end
 
-    def to_status(options = {})
+    def to_status(_options = {})
       latest_reports = host.combined_policies.flat_map { |p| host.last_report_for_policy p }
       return INCOMPLIANT if latest_reports.any?(&:failed?)
       return INCONCLUSIVE if latest_reports.any?(&:othered?)
       COMPLIANT
     end
+
+    private
+
+    def host_has_hostgroup_policies?
+      return false if host.hostgroup_id.blank?
+
+      ids = [host.hostgroup_id] + host.hostgroup.ancestor_ids
+      ForemanOpenscap::Policy.joins(:assets)
+                             .where('foreman_openscap_assets.assetable_type' => 'Hostgroup',
+                                    'foreman_openscap_assets.assetable_id' => ids)
+                             .exists?
+    end
   end
 end

data/app/models/foreman_openscap/policy.rb

@@ -42,6 +42,7 @@ module ForemanOpenscap
     validate :valid_tailoring, :valid_tailoring_profile, :no_mixed_deployments
     validate :valid_cron_line, :valid_weekday, :valid_day_of_month, :if => Proc.new { |policy| policy.should_validate?('Schedule') }
     after_save :assign_policy_to_hostgroups
+    after_save :reset_changed_assignment_hosts_to_inconclusive
     # before_destroy - ensure that the policy has no hostgroups, or classes
 
     default_scope do
@@ -179,10 +180,14 @@ module ForemanOpenscap
         :assetable_type => 'Host::Base',
         :assetable_id => hosts.map(&:id),
         :foreman_openscap_asset_policies => { :policy_id => id }
-      ).pluck(:id)
+      ).pluck(:id, :assetable_id)
 
-      self.asset_ids = self.asset_ids - policy_host_assets
-      ForemanOpenscap::Asset.where(:id => policy_host_assets).destroy_all
+      asset_ids = policy_host_assets.map(&:first)
+      host_ids_to_reset = policy_host_assets.map(&:second)
+
+      self.asset_ids = self.asset_ids - asset_ids
+      ForemanOpenscap::Asset.where(:id => asset_ids).destroy_all
+      ForemanOpenscap::ComplianceStatusResetter.to_inconclusive(host_ids_to_reset)
     end
 
     def to_enc
@@ -251,12 +256,47 @@ module ForemanOpenscap
     end
 
     def assign_ids(ids, class_name)
+      before_host_ids = host_ids_reached_by_assignments(class_name)
       new_assets = ids.uniq.reject { |id| id.respond_to?(:empty?) && id.empty? }.reduce([]) do |memo, id|
         memo << assets.where(:assetable_type => class_name, :assetable_id => id).first_or_initialize
       end
       complimentary_class_name = class_name == 'Host::Base' ? 'Hostgroup' : 'Host::Base'
       existing_assets = self.assets.select { |assigned_asset| assigned_asset.assetable_type == complimentary_class_name }
       self.assets = existing_assets + new_assets
+      after_host_ids = host_ids_reached_by_assignments(class_name, self.assets)
+
+      return unless host_assignment_changed?(before_host_ids, after_host_ids)
+
+      remember_hosts_for_compliance_status_reset(before_host_ids + after_host_ids)
+    end
+
+    def host_ids_reached_by_assignments(class_name, assigned_assets = assets)
+      assetable_ids = assigned_assets.select { |asset| asset.assetable_type == class_name }.map { |asset| asset.assetable_id.to_i }
+
+      if class_name == 'Host::Base'
+        assetable_ids
+      else
+        hostgroup_ids = ::Hostgroup.where(:id => assetable_ids).flat_map(&:subtree_ids).uniq
+        ::Host.where(:hostgroup_id => hostgroup_ids).pluck(:id)
+      end
+    end
+
+    def remember_hosts_for_compliance_status_reset(host_ids)
+      @compliance_status_reset_host_ids ||= []
+      @compliance_status_reset_host_ids.concat(host_ids)
+    end
+
+    def host_assignment_changed?(before_host_ids, after_host_ids)
+      before_host_ids.to_set != after_host_ids.to_set
+    end
+
+    def reset_changed_assignment_hosts_to_inconclusive
+      host_ids = Array(@compliance_status_reset_host_ids).compact.uniq
+      return if host_ids.empty?
+
+      ForemanOpenscap::ComplianceStatusResetter.to_inconclusive(host_ids)
+    ensure
+      @compliance_status_reset_host_ids = nil
     end
 
     def no_mixed_deployments

data/app/services/foreman_openscap/compliance_status_resetter.rb

@@ -0,0 +1,26 @@
+module ForemanOpenscap
+  class ComplianceStatusResetter
+    def self.to_inconclusive(host_ids)
+      host_ids = Array(host_ids).compact.uniq
+      return if host_ids.empty?
+
+      now = Time.current
+      rows = host_ids.map do |host_id|
+        {
+          :host_id => host_id,
+          :type => ComplianceStatus.to_s,
+          :status => ComplianceStatus::INCONCLUSIVE,
+          :reported_at => now
+        }
+      end
+
+      ComplianceStatus.upsert_all(rows, :unique_by => %i[type host_id], :update_only => %i[status reported_at])
+
+      refresh_global_statuses(host_ids)
+    end
+
+    def self.refresh_global_statuses(host_ids)
+      ::Host::Managed.where(:id => host_ids).find_each(&:refresh_global_status!)
+    end
+  end
+end

data/lib/foreman_openscap/version.rb

@@ -1,3 +1,3 @@
 module ForemanOpenscap
-  VERSION = '13.1.1'.freeze
+  VERSION = '13.1.3'.freeze
 end