foreman_openscap 13.1.2 → 13.1.3

data/test/unit/concerns/hostgroup_extensions_test.rb

@@ -7,4 +7,68 @@ class HostgroupExtensionsTest < ActiveSupport::TestCase
     asset_scope = ::ForemanOpenscap::Asset.where(:assetable_id => hostgroup.id, :assetable_type => 'Hostgroup')
     assert_difference("asset_scope.count", -3) { hostgroup.destroy }
   end
+
+  test "should reset compliance status for subtree when assigning policy through hostgroup asset policies" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    policy = FactoryBot.create(:policy)
+    asset = FactoryBot.create(:asset, :assetable_id => parent.id, :assetable_type => 'Hostgroup')
+
+    set_compliance_status(parent_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    set_compliance_status(child_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    asset.policies = [policy]
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, parent_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, child_host.reload.compliance_status
+  end
+
+  test "should reset compliance status for subtree when removing policy through hostgroup asset policies" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    policy = FactoryBot.create(:policy)
+    asset = FactoryBot.create(:asset, :assetable_id => parent.id, :assetable_type => 'Hostgroup')
+    asset.policies = [policy]
+
+    set_compliance_status(parent_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    set_compliance_status(child_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    asset.policies = []
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, parent_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, child_host.reload.compliance_status
+  end
+
+  test "should reset compliance status for subtree when hostgroup is reparented" do
+    old_parent = FactoryBot.create(:hostgroup)
+    new_parent = FactoryBot.create(:hostgroup)
+    moved = FactoryBot.create(:hostgroup, :ancestry => old_parent.id.to_s)
+    child = FactoryBot.create(:hostgroup, :ancestry => "#{old_parent.id}/#{moved.id}")
+    moved_host = FactoryBot.create(:compliance_host, :hostgroup_id => moved.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    unrelated_host = FactoryBot.create(:compliance_host, :hostgroup_id => old_parent.id)
+    [moved_host, child_host, unrelated_host].each do |host|
+      set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    end
+
+    moved.update!(:parent_id => new_parent.id)
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, moved_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, child_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, unrelated_host.reload.compliance_status
+  end
+
+  test "should not reset compliance status for hostgroup save without ancestry change" do
+    hostgroup = FactoryBot.create(:hostgroup)
+    host = FactoryBot.create(:compliance_host, :hostgroup_id => hostgroup.id)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    hostgroup.update!(:name => 'renamed')
+
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, host.reload.compliance_status
+  end
 end

data/test/unit/policy_test.rb

@@ -46,6 +46,90 @@ class PolicyTest < ActiveSupport::TestCase
     assert_equal 1, policy.hosts.count
   end
 
+  test "should reset compliance status when assigning policy to host" do
+    host = FactoryBot.create(:compliance_host)
+    unrelated_host = FactoryBot.create(:compliance_host)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    set_compliance_status(unrelated_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    policy = FactoryBot.create(:policy, :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+
+    policy.host_ids = [host.id]
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, compliance_status_for(unrelated_host)
+  end
+
+  test "should create inconclusive compliance status when assigning policy to host without status" do
+    host = FactoryBot.create(:compliance_host)
+    policy = FactoryBot.create(:policy, :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+
+    policy.host_ids = [host.id]
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+  end
+
+  test "should reset compliance status when removing policy from host assignment" do
+    host = FactoryBot.create(:compliance_host)
+    asset = FactoryBot.create(:asset, :assetable_id => host.id, :assetable_type => 'Host::Base')
+    policy = FactoryBot.create(:policy, :assets => [asset], :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    policy.host_ids = []
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+  end
+
+  test "should reset compliance status when unassigning host from policy" do
+    host = FactoryBot.create(:compliance_host)
+    asset = FactoryBot.create(:asset, :assetable_id => host.id, :assetable_type => 'Host::Base')
+    policy = FactoryBot.create(:policy, :assets => [asset], :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    policy.unassign_hosts([host])
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+  end
+
+  test "should reset compliance status for hostgroup subtree when assigning policy to hostgroup" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    unrelated_host = FactoryBot.create(:compliance_host)
+    [parent_host, child_host, unrelated_host].each do |host|
+      set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    end
+    policy = FactoryBot.create(:policy, :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+
+    policy.hostgroup_ids = [parent.id]
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(parent_host)
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(child_host)
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, compliance_status_for(unrelated_host)
+  end
+
+  test "should reset compliance status for hostgroup subtree when removing policy from hostgroup" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    asset = FactoryBot.create(:asset, :assetable_id => parent.id, :assetable_type => 'Hostgroup')
+    policy = FactoryBot.create(:policy, :assets => [asset], :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+    [parent_host, child_host].each do |host|
+      set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    end
+
+    policy.hostgroup_ids = []
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(parent_host)
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(child_host)
+  end
+
   test "should delete assets when unassigning hosts" do
     host1 = FactoryBot.create(:compliance_host)
     host2 = FactoryBot.create(:compliance_host)
@@ -331,4 +415,10 @@ class PolicyTest < ActiveSupport::TestCase
     assert_equal policy.deploy_by, 'manual'
     assert_equal policy.name, name
   end
+
+  private
+
+  def compliance_status_for(host)
+    ForemanOpenscap::ComplianceStatus.find_by(:host_id => host.id).try(:status)
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: foreman_openscap
 version: !ruby/object:Gem::Version
-  version: 13.1.2
+  version: 13.1.3
 platform: ruby
 authors:
 - slukasik@redhat.com
@@ -106,6 +106,7 @@ files:
 - app/services/foreman_openscap/client_config/base.rb
 - app/services/foreman_openscap/client_config/manual.rb
 - app/services/foreman_openscap/client_config/puppet.rb
+- app/services/foreman_openscap/compliance_status_resetter.rb
 - app/services/foreman_openscap/config_name_service.rb
 - app/services/foreman_openscap/host_report_dashboard/data.rb
 - app/services/foreman_openscap/hostgroup_overrider.rb
@@ -349,6 +350,7 @@ files:
 - test/test_plugin_helper.rb
 - test/unit/arf_report_status_calculator_test.rb
 - test/unit/arf_report_test.rb
+- test/unit/compliance_status_resetter_test.rb
 - test/unit/compliance_status_test.rb
 - test/unit/concerns/bookmark_controller_validator_extensions_test.rb
 - test/unit/concerns/host_extensions_test.rb
@@ -457,6 +459,7 @@ test_files:
 - test/test_plugin_helper.rb
 - test/unit/arf_report_status_calculator_test.rb
 - test/unit/arf_report_test.rb
+- test/unit/compliance_status_resetter_test.rb
 - test/unit/compliance_status_test.rb
 - test/unit/concerns/bookmark_controller_validator_extensions_test.rb
 - test/unit/concerns/host_extensions_test.rb