Manage compliance status if policy only assigned to hostgroup

app/models/foreman_openscap/compliance_status.rb

@@ -43,11 +43,11 @@ def to_global(options = {})
     def relevant?(options = {})
       # May fail host status during migration
       return false unless ForemanOpenscap::Asset.table_exists?
-      host.policies.present?
+      host.combined_policies.present?
     end
 
     def to_status(options = {})
-      latest_reports = host.policies.map { |p| host.last_report_for_policy p }.flatten
+      latest_reports = host.combined_policies.flat_map { |p| host.last_report_for_policy p }
       return INCOMPLIANT if latest_reports.any?(&:failed?)
       return INCONCLUSIVE if latest_reports.any?(&:othered?)
       COMPLIANT

test/unit/compliance_status_test.rb

@@ -69,4 +69,54 @@ def setup
     status.host = host
     assert_equal 0, status.to_status
   end
+
+  test 'relevant? should be true for host policies' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    host = FactoryBot.create(:compliance_host, :policies => [@policy_a])
+
+    status.host = host
+
+    assert status.relevant?
+  end
+
+  test 'relevant? should be true for hostgroup policies and to_status should use them' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    host = FactoryBot.create(:host, :with_hostgroup)
+    othered_status = { :passed => 0, :failed => 0, :othered => 1 }.with_indifferent_access
+
+    assert_empty host.policies
+    @policy_a.hostgroup_ids = [host.hostgroup.id]
+    assert @policy_a.save
+
+    host.reload
+    assert_includes host.combined_policies, @policy_a
+
+    report = FactoryBot.create(:arf_report, :host_id => host.id, :status => othered_status)
+    FactoryBot.create(:policy_arf_report, :policy_id => @policy_a.id, :arf_report_id => report.id)
+
+    status.host = host
+
+    assert status.relevant?
+    assert_equal ForemanOpenscap::ComplianceStatus::INCONCLUSIVE, status.to_status
+  end
+
+  test 'relevant? should be true for inherited parent hostgroup policies' do
+    status = ForemanOpenscap::ComplianceStatus.new
+    host = FactoryBot.create(:host, :with_hostgroup)
+    hostgroup = host.hostgroup
+
+    hostgroup.parent = FactoryBot.create(:hostgroup)
+    hostgroup.save!
+
+    assert_empty host.policies
+    @policy_a.hostgroup_ids = [hostgroup.parent.id]
+    assert @policy_a.save
+
+    host.reload
+    assert_includes host.combined_policies, @policy_a
+
+    status.host = host
+
+    assert status.relevant?
+  end
 end