foreman_openscap 13.1.2 → 13.2.0

data/test/unit/compliance_status_test.rb

@@ -74,12 +74,48 @@ class ComplianceStatusTest < ActiveSupport::TestCase
     status = ForemanOpenscap::ComplianceStatus.new
     host = FactoryBot.create(:compliance_host, :policies => [@policy_a])
 
+    host.expects(:combined_policies).never
     status.host = host
 
     assert status.relevant?
   end
 
-  test 'relevant? should be true for hostgroup policies and to_status should use them' do
+  test 'relevant? should be false for host without policies' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    host = FactoryBot.create(:host)
+
+    status.host = host
+
+    refute status.relevant?
+  end
+
+  test 'relevant? should be false for host with hostgroup but no policies' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    host = FactoryBot.create(:host, :with_hostgroup)
+
+    status.host = host
+
+    refute status.relevant?
+  end
+
+  test 'relevant? should be true for hostgroup policies without loading combined_policies' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    host = FactoryBot.create(:host, :with_hostgroup)
+
+    assert_empty host.policies
+    @policy_a.hostgroup_ids = [host.hostgroup.id]
+    assert @policy_a.save
+
+    host.reload
+    assert_includes host.combined_policies, @policy_a
+
+    status.host = host
+    host.expects(:combined_policies).never
+
+    assert status.relevant?
+  end
+
+  test 'to_status should use hostgroup policies' do
     status = ForemanOpenscap::ComplianceStatus.new
     host = FactoryBot.create(:host, :with_hostgroup)
     othered_status = { :passed => 0, :failed => 0, :othered => 1 }.with_indifferent_access
@@ -95,12 +131,10 @@ class ComplianceStatusTest < ActiveSupport::TestCase
     FactoryBot.create(:policy_arf_report, :policy_id => @policy_a.id, :arf_report_id => report.id)
 
     status.host = host
-
-    assert status.relevant?
     assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, status.to_status
   end
 
-  test 'relevant? should be true for inherited parent hostgroup policies' do
+  test 'relevant? should be true for inherited parent hostgroup policies without loading combined_policies' do
     status = ForemanOpenscap::ComplianceStatus.new
     host = FactoryBot.create(:host, :with_hostgroup)
     hostgroup = host.hostgroup
@@ -116,7 +150,22 @@ class ComplianceStatusTest < ActiveSupport::TestCase
     assert_includes host.combined_policies, @policy_a
 
     status.host = host
+    host.expects(:combined_policies).never
 
     assert status.relevant?
   end
+
+  test 'to_label returns label based on stored status' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    status.status = ForemanOpenscap::ComplianceStatus::COMPLIANT
+    status.expects(:to_status).never
+    assert_equal 'Compliant', status.to_label
+  end
+
+  test 'to_global returns global status based on stored status' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    status.status = ForemanOpenscap::ComplianceStatus::COMPLIANT
+    status.expects(:to_status).never
+    assert_equal ::HostStatus::Global::OK, status.to_global
+  end
 end

data/test/unit/concerns/host_extensions_test.rb

@@ -162,6 +162,61 @@ class HostExtensionsTest < ActiveSupport::TestCase
     assert_empty ForemanOpenscap::Asset.where(:assetable_id => host.id, :assetable_type => 'Host::Base')
   end
 
+  test 'should reset compliance status when assigning policy through host policies' do
+    host = FactoryBot.create(:compliance_host)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    host.policies = [@policy]
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, host.reload.compliance_status
+  end
+
+  test 'should reset compliance status when removing policy through host policies' do
+    host = FactoryBot.create(:compliance_host, :policies => [@policy])
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    host.policies = []
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, host.reload.compliance_status
+  end
+
+  test 'should reset compliance status when host is moved to a different hostgroup' do
+    old_hostgroup = FactoryBot.create(:hostgroup)
+    new_hostgroup = FactoryBot.create(:hostgroup)
+    host = FactoryBot.create(:compliance_host, :hostgroup_id => old_hostgroup.id)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    host.update!(:hostgroup_id => new_hostgroup.id)
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, host.reload.compliance_status
+  end
+
+  test 'should not reset compliance status when host is saved without hostgroup change' do
+    hostgroup = FactoryBot.create(:hostgroup)
+    host = FactoryBot.create(:compliance_host, :hostgroup_id => hostgroup.id)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    host.update!(:comment => 'unrelated change')
+
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, host.reload.compliance_status
+  end
+
+  test 'compliance_status returns stored persisted status without recalculation' do
+    set_compliance_status(@host, ForemanOpenscap::ComplianceStatus::INCONCLUSIVE)
+    status = @host.reload.get_status(ForemanOpenscap::ComplianceStatus)
+    status.expects(:to_status).never
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, @host.compliance_status
+  end
+
+  test 'compliance_status_label returns label from stored persisted status without recalculation' do
+    set_compliance_status(@host, ForemanOpenscap::ComplianceStatus::INCOMPLIANT)
+    status = @host.reload.get_status(ForemanOpenscap::ComplianceStatus)
+    status.expects(:to_status).never
+
+    assert_equal 'Incompliant', @host.compliance_status_label
+  end
+
   private
 
   def setup_hosts_with_policy

data/test/unit/concerns/hostgroup_extensions_test.rb

@@ -7,4 +7,68 @@ class HostgroupExtensionsTest < ActiveSupport::TestCase
     asset_scope = ::ForemanOpenscap::Asset.where(:assetable_id => hostgroup.id, :assetable_type => 'Hostgroup')
     assert_difference("asset_scope.count", -3) { hostgroup.destroy }
   end
+
+  test "should reset compliance status for subtree when assigning policy through hostgroup asset policies" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    policy = FactoryBot.create(:policy)
+    asset = FactoryBot.create(:asset, :assetable_id => parent.id, :assetable_type => 'Hostgroup')
+
+    set_compliance_status(parent_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    set_compliance_status(child_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    asset.policies = [policy]
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, parent_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, child_host.reload.compliance_status
+  end
+
+  test "should reset compliance status for subtree when removing policy through hostgroup asset policies" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    policy = FactoryBot.create(:policy)
+    asset = FactoryBot.create(:asset, :assetable_id => parent.id, :assetable_type => 'Hostgroup')
+    asset.policies = [policy]
+
+    set_compliance_status(parent_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    set_compliance_status(child_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    asset.policies = []
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, parent_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, child_host.reload.compliance_status
+  end
+
+  test "should reset compliance status for subtree when hostgroup is reparented" do
+    old_parent = FactoryBot.create(:hostgroup)
+    new_parent = FactoryBot.create(:hostgroup)
+    moved = FactoryBot.create(:hostgroup, :ancestry => old_parent.id.to_s)
+    child = FactoryBot.create(:hostgroup, :ancestry => "#{old_parent.id}/#{moved.id}")
+    moved_host = FactoryBot.create(:compliance_host, :hostgroup_id => moved.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    unrelated_host = FactoryBot.create(:compliance_host, :hostgroup_id => old_parent.id)
+    [moved_host, child_host, unrelated_host].each do |host|
+      set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    end
+
+    moved.update!(:parent_id => new_parent.id)
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, moved_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, child_host.reload.compliance_status
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, unrelated_host.reload.compliance_status
+  end
+
+  test "should not reset compliance status for hostgroup save without ancestry change" do
+    hostgroup = FactoryBot.create(:hostgroup)
+    host = FactoryBot.create(:compliance_host, :hostgroup_id => hostgroup.id)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    hostgroup.update!(:name => 'renamed')
+
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, host.reload.compliance_status
+  end
 end

data/test/unit/policy_test.rb

@@ -46,6 +46,90 @@ class PolicyTest < ActiveSupport::TestCase
     assert_equal 1, policy.hosts.count
   end
 
+  test "should reset compliance status when assigning policy to host" do
+    host = FactoryBot.create(:compliance_host)
+    unrelated_host = FactoryBot.create(:compliance_host)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    set_compliance_status(unrelated_host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    policy = FactoryBot.create(:policy, :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+
+    policy.host_ids = [host.id]
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, compliance_status_for(unrelated_host)
+  end
+
+  test "should create inconclusive compliance status when assigning policy to host without status" do
+    host = FactoryBot.create(:compliance_host)
+    policy = FactoryBot.create(:policy, :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+
+    policy.host_ids = [host.id]
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+  end
+
+  test "should reset compliance status when removing policy from host assignment" do
+    host = FactoryBot.create(:compliance_host)
+    asset = FactoryBot.create(:asset, :assetable_id => host.id, :assetable_type => 'Host::Base')
+    policy = FactoryBot.create(:policy, :assets => [asset], :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    policy.host_ids = []
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+  end
+
+  test "should reset compliance status when unassigning host from policy" do
+    host = FactoryBot.create(:compliance_host)
+    asset = FactoryBot.create(:asset, :assetable_id => host.id, :assetable_type => 'Host::Base')
+    policy = FactoryBot.create(:policy, :assets => [asset], :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+    set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+
+    policy.unassign_hosts([host])
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(host)
+  end
+
+  test "should reset compliance status for hostgroup subtree when assigning policy to hostgroup" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    unrelated_host = FactoryBot.create(:compliance_host)
+    [parent_host, child_host, unrelated_host].each do |host|
+      set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    end
+    policy = FactoryBot.create(:policy, :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+
+    policy.hostgroup_ids = [parent.id]
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(parent_host)
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(child_host)
+    assert_equal ForemanOpenscap::ComplianceStatus::COMPLIANT, compliance_status_for(unrelated_host)
+  end
+
+  test "should reset compliance status for hostgroup subtree when removing policy from hostgroup" do
+    parent = FactoryBot.create(:hostgroup)
+    child = FactoryBot.create(:hostgroup, :ancestry => parent.id.to_s)
+    parent_host = FactoryBot.create(:compliance_host, :hostgroup_id => parent.id)
+    child_host = FactoryBot.create(:compliance_host, :hostgroup_id => child.id)
+    asset = FactoryBot.create(:asset, :assetable_id => parent.id, :assetable_type => 'Hostgroup')
+    policy = FactoryBot.create(:policy, :assets => [asset], :scap_content => @scap_content, :scap_content_profile => @scap_profile)
+    [parent_host, child_host].each do |host|
+      set_compliance_status(host, ForemanOpenscap::ComplianceStatus::COMPLIANT)
+    end
+
+    policy.hostgroup_ids = []
+    policy.save!
+
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(parent_host)
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, compliance_status_for(child_host)
+  end
+
   test "should delete assets when unassigning hosts" do
     host1 = FactoryBot.create(:compliance_host)
     host2 = FactoryBot.create(:compliance_host)
@@ -331,4 +415,10 @@ class PolicyTest < ActiveSupport::TestCase
     assert_equal policy.deploy_by, 'manual'
     assert_equal policy.name, name
   end
+
+  private
+
+  def compliance_status_for(host)
+    ForemanOpenscap::ComplianceStatus.find_by(:host_id => host.id).try(:status)
+  end
 end

data/webpack/components/BulkActions/compliancePolicy/BulkCompliancePolicyMenuItems.js

@@ -0,0 +1,49 @@
+import React, { useContext } from 'react';
+import { MenuItem } from '@patternfly/react-core';
+import { translate as __ } from 'foremanReact/common/I18n';
+import { openBulkModal } from 'foremanReact/common/BulkModalStateHelper';
+import { usePermissions } from 'foremanReact/common/hooks/Permissions/permissionHooks';
+import { EDIT_HOSTS } from 'foremanReact/permissions';
+import { ForemanHostsIndexActionsBarContext } from 'foremanReact/components/HostsIndex';
+import {
+  ASSIGN_POLICY_MODAL_ID,
+  UNASSIGN_POLICY_MODAL_ID,
+  ASSIGN_POLICIES,
+} from './constants';
+
+const BulkCompliancePolicyMenuItems = () => {
+  const { selectedCount } = useContext(ForemanHostsIndexActionsBarContext);
+
+  const hasPermission = usePermissions([ASSIGN_POLICIES, EDIT_HOSTS]);
+
+  const handleAssignClick = () => openBulkModal(ASSIGN_POLICY_MODAL_ID, true);
+  const handleUnassignClick = () =>
+    openBulkModal(UNASSIGN_POLICY_MODAL_ID, true);
+
+  if (!hasPermission) {
+    return null;
+  }
+
+  return (
+    <>
+      <MenuItem
+        itemId="assign-compliance-policy-dropdown-item"
+        key="assign-compliance-policy-dropdown-item"
+        onClick={handleAssignClick}
+        isDisabled={selectedCount === 0}
+      >
+        {__('Assign compliance policy')}
+      </MenuItem>
+      <MenuItem
+        itemId="unassign-compliance-policy-dropdown-item"
+        key="unassign-compliance-policy-dropdown-item"
+        onClick={handleUnassignClick}
+        isDisabled={selectedCount === 0}
+      >
+        {__('Unassign compliance policy')}
+      </MenuItem>
+    </>
+  );
+};
+
+export default BulkCompliancePolicyMenuItems;

data/webpack/components/BulkActions/compliancePolicy/BulkCompliancePolicyModal.js

@@ -0,0 +1,304 @@
+import React, { useState, useEffect } from 'react';
+import PropTypes from 'prop-types';
+import { FormattedMessage } from 'react-intl';
+import { useDispatch, useSelector } from 'react-redux';
+import {
+  Modal,
+  Button,
+  TextContent,
+  Text,
+  Select,
+  SelectOption,
+  SelectList,
+  MenuToggle,
+  Spinner,
+  EmptyState,
+  EmptyStateHeader,
+  EmptyStateIcon,
+  EmptyStateBody,
+  Flex,
+  FlexItem,
+} from '@patternfly/react-core';
+import { ExclamationCircleIcon, SearchIcon } from '@patternfly/react-icons';
+import { STATUS } from 'foremanReact/constants';
+import { addToast } from 'foremanReact/components/ToastsList/slice';
+import { translate as __ } from 'foremanReact/common/I18n';
+import {
+  selectAPIStatus,
+  selectAPIResponse,
+} from 'foremanReact/redux/API/APISelectors';
+import {
+  buildBulkRequestBody,
+  bulkErrorToastParams,
+} from 'foremanReact/components/HostsIndex/BulkActions/helpers';
+import { fetchPolicies, bulkAssignPolicy, bulkUnassignPolicy } from './actions';
+import {
+  POLICIES_KEY,
+  BULK_ASSIGN_POLICY_KEY,
+  BULK_UNASSIGN_POLICY_KEY,
+} from './constants';
+
+const BulkCompliancePolicyModal = ({
+  isOpen,
+  closeModal,
+  mode,
+  selectAllHostsMode,
+  selectedCount,
+  fetchBulkParams,
+  organizationId,
+  locationId,
+  onSuccess: onSuccessCallback,
+}) => {
+  const dispatch = useDispatch();
+  const [policyId, setPolicyId] = useState('');
+  const [policySelectOpen, setPolicySelectOpen] = useState(false);
+
+  useEffect(() => {
+    if (isOpen) {
+      dispatch(fetchPolicies());
+    }
+  }, [dispatch, isOpen]);
+
+  const isAssignMode = mode === 'assign';
+  const actionKey = isAssignMode
+    ? BULK_ASSIGN_POLICY_KEY
+    : BULK_UNASSIGN_POLICY_KEY;
+
+  const policies = useSelector(state => selectAPIResponse(state, POLICIES_KEY));
+  const policiesStatus = useSelector(state =>
+    selectAPIStatus(state, POLICIES_KEY)
+  );
+  const policiesError = useSelector(
+    state => state.API?.[POLICIES_KEY]?.error?.message
+  );
+  const hostUpdateStatus = useSelector(state =>
+    selectAPIStatus(state, actionKey)
+  );
+
+  const onToggleClick = () => {
+    setPolicySelectOpen(!policySelectOpen);
+  };
+
+  const handlePolicySelect = (event, selection) => {
+    setPolicyId(selection);
+    setPolicySelectOpen(false);
+  };
+
+  const getPolicyLabel = id =>
+    policies?.results?.find(p => p.id.toString() === id)?.name ||
+    __('Select a policy');
+
+  const toggle = toggleRef => (
+    <MenuToggle
+      ref={toggleRef}
+      ouiaId="bulk-compliance-policy-toggle"
+      onClick={onToggleClick}
+      isExpanded={policySelectOpen}
+      style={{ width: '100%' }}
+    >
+      {policyId ? getPolicyLabel(policyId) : __('Select a policy')}
+    </MenuToggle>
+  );
+
+  const handleModalClose = () => {
+    setPolicyId('');
+    setPolicySelectOpen(false);
+    closeModal();
+  };
+
+  const handleError = error => {
+    handleModalClose();
+    dispatch(addToast(bulkErrorToastParams(error, actionKey)));
+  };
+
+  const handleSuccess = response => {
+    dispatch(
+      addToast({
+        type: 'success',
+        message: response.data.message,
+      })
+    );
+    if (onSuccessCallback) onSuccessCallback();
+    handleModalClose();
+  };
+
+  const handleConfirm = () => {
+    const requestBody = buildBulkRequestBody({
+      fetchBulkParams,
+      organizationId,
+      locationId,
+      policy_id: policyId,
+    });
+
+    if (mode === 'assign') {
+      dispatch(bulkAssignPolicy(requestBody, handleSuccess, handleError));
+    } else {
+      dispatch(bulkUnassignPolicy(requestBody, handleSuccess, handleError));
+    }
+  };
+
+  const title = isAssignMode
+    ? __('Assign Compliance Policy')
+    : __('Unassign Compliance Policy');
+  const confirmButtonText = isAssignMode
+    ? __('Assign policy')
+    : __('Unassign policy');
+
+  const modalActions = [
+    <Button
+      key="confirm"
+      ouiaId="bulk-compliance-policy-modal-confirm-button"
+      variant="primary"
+      onClick={handleConfirm}
+      isDisabled={hostUpdateStatus === STATUS.PENDING || policyId === ''}
+      isLoading={hostUpdateStatus === STATUS.PENDING}
+    >
+      {confirmButtonText}
+    </Button>,
+    <Button
+      key="cancel"
+      ouiaId="bulk-compliance-policy-modal-cancel-button"
+      variant="link"
+      onClick={handleModalClose}
+    >
+      {__('Cancel')}
+    </Button>,
+  ];
+
+  const warningMessage = isAssignMode
+    ? __(
+        'The selected policy will be assigned to the selected hosts. Some hosts may already be assigned to this policy.'
+      )
+    : __(
+        'The selected policy will be unassigned from the selected hosts. Some hosts may not be assigned to this policy.'
+      );
+
+  return (
+    <Modal
+      isOpen={isOpen}
+      onClose={handleModalClose}
+      onEscapePress={handleModalClose}
+      title={title}
+      variant="medium"
+      position="top"
+      actions={modalActions}
+      id="bulk-compliance-policy-modal"
+      key="bulk-compliance-policy-modal"
+      ouiaId="bulk-compliance-policy-modal"
+    >
+      <TextContent>
+        <Text ouiaId="bulk-compliance-policy-count">
+          {selectAllHostsMode ? (
+            <FormattedMessage
+              id="bulk-compliance-policy-all-hosts"
+              defaultMessage="{action} will affect {boldCount} selected hosts."
+              values={{
+                action: isAssignMode ? __('Assigning') : __('Unassigning'),
+                boldCount: <strong>{__('All')}</strong>,
+              }}
+            />
+          ) : (
+            <FormattedMessage
+              id="bulk-compliance-policy-selected-hosts"
+              defaultMessage="{action} will affect {boldCount} selected {count, plural, one {host} other {hosts}}."
+              values={{
+                action: isAssignMode ? __('Assigning') : __('Unassigning'),
+                count: selectedCount,
+                boldCount: <strong>{selectedCount}</strong>,
+              }}
+            />
+          )}
+        </Text>
+        <Text ouiaId="bulk-compliance-policy-warning">{warningMessage}</Text>
+      </TextContent>
+
+      {policiesStatus === STATUS.PENDING && (
+        <Flex
+          direction={{ default: 'column' }}
+          alignItems={{ default: 'alignItemsCenter' }}
+          spaceItems={{ default: 'spaceItemsSm' }}
+        >
+          <FlexItem>
+            <Spinner size="lg" aria-label={__('Loading policies')} />
+          </FlexItem>
+          <FlexItem>
+            <Text ouiaId="loading-policies-text">
+              {__('Loading policies...')}
+            </Text>
+          </FlexItem>
+        </Flex>
+      )}
+
+      {policiesStatus === STATUS.ERROR && (
+        <EmptyState>
+          <EmptyStateHeader
+            titleText={__('Failed to load policies')}
+            icon={<EmptyStateIcon icon={ExclamationCircleIcon} />}
+            headingLevel="h4"
+          />
+          <EmptyStateBody>
+            {policiesError || __('An error occurred while fetching policies.')}
+          </EmptyStateBody>
+        </EmptyState>
+      )}
+
+      {policiesStatus === STATUS.RESOLVED && policies?.results?.length === 0 && (
+        <EmptyState>
+          <EmptyStateHeader
+            titleText={__('No policies available')}
+            icon={<EmptyStateIcon icon={SearchIcon} />}
+            headingLevel="h4"
+          />
+          <EmptyStateBody>
+            {__(
+              'There are no compliance policies available in your current organization and location.'
+            )}
+          </EmptyStateBody>
+        </EmptyState>
+      )}
+
+      {policiesStatus === STATUS.RESOLVED && policies?.results?.length > 0 && (
+        <Select
+          id="compliance-policy-select"
+          isOpen={policySelectOpen}
+          selected={policyId}
+          onSelect={handlePolicySelect}
+          onOpenChange={isSelectOpen => setPolicySelectOpen(isSelectOpen)}
+          toggle={toggle}
+          shouldFocusToggleOnSelect
+          ouiaId="bulk-compliance-policy-select"
+        >
+          <SelectList>
+            {policies.results.map(policy => (
+              <SelectOption key={policy.id} value={policy.id.toString()}>
+                {policy.name}
+              </SelectOption>
+            ))}
+          </SelectList>
+        </Select>
+      )}
+    </Modal>
+  );
+};
+
+BulkCompliancePolicyModal.propTypes = {
+  isOpen: PropTypes.bool,
+  closeModal: PropTypes.func,
+  mode: PropTypes.oneOf(['assign', 'unassign']).isRequired,
+  fetchBulkParams: PropTypes.func.isRequired,
+  selectedCount: PropTypes.number.isRequired,
+  selectAllHostsMode: PropTypes.bool.isRequired,
+  organizationId: PropTypes.number,
+  locationId: PropTypes.number,
+  onSuccess: PropTypes.func,
+};
+
+BulkCompliancePolicyModal.defaultProps = {
+  isOpen: false,
+  closeModal: () => {},
+  organizationId: undefined,
+  locationId: undefined,
+  onSuccess: undefined,
+};
+
+export default BulkCompliancePolicyModal;