feat(tpm): add read-only TPM validation

audit/internal/webui/page_validate_test.go

@@ -0,0 +1,49 @@
+package webui
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestFormatValidateTPMSummary(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		raw  string
+		want string
+	}{
+		{name: "absent", raw: `{"TpmPresent":false}`, want: "No TPM detected."},
+		{name: "present", raw: `{"TpmPresent":true,"TpmVersion":"2.0","TpmManufacturer":"IFX","TpmFirmwareVersion":"7.63","TpmInterface":"/dev/tpmrm0"}`, want: "TPM detected / 2.0 / IFX / 7.63 / /dev/tpmrm0"},
+		{name: "legacy snapshot", raw: `{}`, want: "TPM presence was not collected."},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			raw := json.RawMessage(tt.raw)
+			if got := formatValidateTPMSummary(&raw); got != tt.want {
+				t.Fatalf("summary=%q want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRenderCheckIncludesReadOnlyTPMValidation(t *testing.T) {
+	t.Parallel()
+
+	page := renderCheck(HandlerOptions{})
+	for _, want := range []string{
+		`id="sat-btn-tpm"`,
+		`tpm2_getcap properties-fixed`,
+		`tpm2_pcrread`,
+		`tpm2_gettestresult`,
+		`'storage', 'tpm', 'nvidia-config'`,
+	} {
+		if !strings.Contains(page, want) {
+			t.Fatalf("check page does not contain %q", want)
+		}
+	}
+	if strings.Contains(page, "tpm2_selftest") {
+		t.Fatal("check page must not offer tpm2_selftest")
+	}
+}