Sanitize hosts param and add edge case tests

Filter empty/malformed host values from the query string so that
an empty or whitespace-only hosts param falls back to GET instead
of sending an invalid POST with blank entries.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: chris1984

app/services/foreman_rh_cloud/url_remediations_retriever.rb

@@ -10,7 +10,8 @@ def initialize(url:, organization_id:, payload: '', headers: {}, logger: Logger.
       hosts_param = query_params.delete('hosts')
 
       if hosts_param.present?
-        @host_uuids = hosts_param.flat_map { |v| v.split(',') }
+        @host_uuids = hosts_param.flat_map { |v| v.split(',') }.map(&:strip).reject(&:blank?)
+        @host_uuids = nil if @host_uuids.empty?
         parsed_url.query = query_params.any? ? URI.encode_www_form(query_params) : nil
         @url = parsed_url.to_s
       else

test/unit/services/foreman_rh_cloud/url_remediations_retriever_test.rb

@@ -67,4 +67,40 @@ class URLRemediationsRetrieverTest < ActiveSupport::TestCase
 
     retriever.create_playbook
   end
+
+  test 'Merges multiple hosts query params into a single array' do
+    retriever = ForemanRhCloud::URLRemediationsRetriever.new(
+      organization_id: FactoryBot.create(:organization).id,
+      url: 'http://test.example.com/api/remediations/1234/playbook?hosts=uuid-1&hosts=uuid-2'
+    )
+
+    retriever.stubs(:cert_auth_available?).returns(true)
+
+    response = mock('response')
+    response.stubs(:body).returns('TEST_PLAYBOOK')
+    retriever.expects(:execute_cloud_request).with do |params|
+      params[:method] == :post &&
+      params[:url] == 'http://test.example.com/api/remediations/1234/playbook' &&
+      JSON.parse(params[:payload]) == ['uuid-1', 'uuid-2']
+    end.returns(response)
+
+    retriever.create_playbook
+  end
+
+  test 'Falls back to GET when hosts query param is empty' do
+    retriever = ForemanRhCloud::URLRemediationsRetriever.new(
+      organization_id: FactoryBot.create(:organization).id,
+      url: 'http://test.example.com/api/remediations/1234/playbook?hosts='
+    )
+
+    retriever.stubs(:cert_auth_available?).returns(true)
+
+    response = mock('response')
+    response.stubs(:body).returns('TEST_PLAYBOOK')
+    retriever.expects(:execute_cloud_request).with do |params|
+      params[:method] == :get
+    end.returns(response)
+
+    retriever.create_playbook
+  end
 end