package platform

import (
	"reflect"
	"strings"
	"testing"
)

func TestTPMValidationJobsAreReadOnly(t *testing.T) {
	t.Parallel()

	jobs := tpmValidationJobs()
	want := [][]string{
		{"tpm2_getcap", "properties-fixed"},
		{"tpm2_getcap", "pcrs"},
		{"tpm2_pcrread"},
		{"tpm2_gettestresult"},
	}
	if len(jobs) != len(want) {
		t.Fatalf("jobs=%d want %d", len(jobs), len(want))
	}
	for index, job := range jobs {
		if !reflect.DeepEqual(job.cmd, want[index]) {
			t.Fatalf("jobs[%d].cmd=%v want %v", index, job.cmd, want[index])
		}
		joined := strings.ToLower(strings.Join(job.cmd, " "))
		for _, forbidden := range []string{"selftest", "clear", "changeauth", "nvwrite", "pcrextend", "create"} {
			if strings.Contains(joined, forbidden) {
				t.Fatalf("job %q contains state-changing command %q", joined, forbidden)
			}
		}
	}
}