package platform

import (
	"os"
	"path/filepath"
	"reflect"
	"strings"
	"testing"
)

func TestRunTPMValidationPackSkipsWhenNoTPMDevice(t *testing.T) {
	old := tpmDeviceGlob
	tpmDeviceGlob = func() []string { return nil }
	t.Cleanup(func() { tpmDeviceGlob = old })

	dir := t.TempDir()
	runDir, err := (&System{}).RunTPMValidationPack(nil, dir, nil)
	if err != nil {
		t.Fatalf("RunTPMValidationPack: %v", err)
	}
	for _, name := range []string{"01-properties-fixed.log", "02-pcr-banks.log", "03-pcr-values.log", "04-test-result.log"} {
		if _, err := os.Stat(filepath.Join(runDir, name)); err == nil {
			t.Fatalf("tpm2 job %q ran despite no TPM device", name)
		}
	}
	summary, err := os.ReadFile(filepath.Join(runDir, "summary.txt"))
	if err != nil {
		t.Fatalf("read summary: %v", err)
	}
	if !strings.Contains(string(summary), "overall_status=UNSUPPORTED") ||
		!strings.Contains(string(summary), "tpm_present=false") {
		t.Fatalf("summary missing UNSUPPORTED/tpm_present markers:\n%s", summary)
	}
}

func TestTPMPresentRequiresVersion2(t *testing.T) {
	oldGlob, oldRead := tpmDeviceGlob, tpmReadFile
	t.Cleanup(func() {
		tpmDeviceGlob = oldGlob
		tpmReadFile = oldRead
	})

	tests := []struct {
		name    string
		version string
		readErr error
		want    bool
	}{
		{name: "TPM 2", version: "2\n", want: true},
		{name: "TPM 1.2", version: "1\n", want: false},
		{name: "missing version attribute", readErr: os.ErrNotExist, want: false},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			tpmDeviceGlob = func() []string { return []string{"/sys/class/tpm/tpm0"} }
			tpmReadFile = func(string) ([]byte, error) { return []byte(test.version), test.readErr }
			if got := (&System{}).TPMPresent(); got != test.want {
				t.Fatalf("TPMPresent()=%v want %v", got, test.want)
			}
		})
	}
}

func TestTPMValidationJobsAreReadOnly(t *testing.T) {
	t.Parallel()

	jobs := tpmValidationJobs()
	want := [][]string{
		{"tpm2_getcap", "properties-fixed"},
		{"tpm2_getcap", "pcrs"},
		{"tpm2_pcrread"},
		{"tpm2_gettestresult"},
	}
	if len(jobs) != len(want) {
		t.Fatalf("jobs=%d want %d", len(jobs), len(want))
	}
	for index, job := range jobs {
		if !reflect.DeepEqual(job.cmd, want[index]) {
			t.Fatalf("jobs[%d].cmd=%v want %v", index, job.cmd, want[index])
		}
		joined := strings.ToLower(strings.Join(job.cmd, " "))
		for _, forbidden := range []string{"selftest", "clear", "changeauth", "nvwrite", "pcrextend", "create"} {
			if strings.Contains(joined, forbidden) {
				t.Fatalf("job %q contains state-changing command %q", joined, forbidden)
			}
		}
	}
}