fix: restore TPM replacement flow for blacklisted boot flash

.limetech/ai-review-markers/ai-cld-1117-tpm-blacklisted-pr-66d786804bbd.json

@@ -0,0 +1,8 @@
+{
+  "disposition": "PATCH",
+  "forecast_commit": "4ea919b834a792e0fef28d00895c16e7d64ca9a3",
+  "reviewed_sha": "ca7795552495a8da91ec8969028d216992c83310",
+  "schema": "limetech.ai-review-marker.v2",
+  "stage": "final",
+  "unresolved_proportionality_findings": []
+}

plugin/source/dynamix.unraid.net/usr/local/emhttp/plugins/dynamix.my.servers/include/state.php

@@ -289,6 +289,7 @@ public function getServerState()
             "flashVendor" => $this->var['flashVendor'],
             "flashBackupActivated" => $this->flashBackupActivated,
             "guid" => $this->var['flashGUID'],
+            "tpmGuid" => $this->var['tpmGUID'] ?? '',
             "hasRemoteApikey" => $this->hasRemoteApikey,
             "internalPort" => _var($_SERVER, 'SERVER_PORT'),
             "keyfile" => $this->keyfileBase64UrlSafe,

web/__test__/components/Registration.test.ts

@@ -366,6 +366,88 @@ describe('Registration.standalone.vue', () => {
     expect(wrapper.find('[data-testid="move-license-to-tpm"]').exists()).toBe(true);
   });
 
+  it('shows the TPM mismatch and Replace Key action when the boot flash is blacklisted', async () => {
+    serverStore.state = 'EBLACKLISTED';
+    serverStore.guid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.flashGuid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.regGuid = '01-OLD-TPM-GUID-1234567890';
+    serverStore.tpmGuid = '01-V35H8S0L1QHK1SBG1XHXJNH7';
+    serverStore.keyfile = 'keyfile-present';
+
+    await wrapper.vm.$nextTick();
+
+    expect(wrapper.find('[data-testid="move-license-to-tpm"]').exists()).toBe(false);
+    expect(wrapper.text()).toContain('License / TPM mismatch');
+    expect(wrapper.text()).not.toContain('Blacklisted boot device GUID');
+    expect(wrapper.text()).not.toContain('copy the correct key file');
+    expect(wrapper.text()).not.toContain('Move License to TPM');
+    expect(wrapper.text()).toContain('Your license is registered to a different TPM');
+    expect(findItemByLabel(t('TPM GUID'))?.props('text')).toBe('01-V35H8S0L1QHK1SBG1XHXJNH7');
+    expect(findItemByLabel(t('registration.registeredGuid'))?.props('text')).toBe(
+      '01-OLD-TPM-GUID-1234567890'
+    );
+    expect(wrapper.find('[data-testid="key-actions"]').exists()).toBe(true);
+    expect(serverStore.keyActions?.some((action) => action.name === 'replace')).toBe(true);
+    expect(serverStore.keyActions?.find((action) => action.name === 'replace')?.text).toBe(
+      'Replace Key'
+    );
+
+    serverStore.keyActions?.find((action) => action.name === 'replace')?.click?.();
+
+    expect(accountStore.replace).toHaveBeenCalled();
+    expect(accountStore.replaceTpm).not.toHaveBeenCalled();
+  });
+
+  it('does not show Move License to TPM for invalid blacklisted states', async () => {
+    serverStore.state = 'EBLACKLISTED1';
+    serverStore.guid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.flashGuid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.tpmGuid = '01-V35H8S0L1QHK1SBG1XHXJNH7';
+    serverStore.keyfile = 'keyfile-present';
+
+    await wrapper.vm.$nextTick();
+
+    expect(wrapper.find('[data-testid="move-license-to-tpm"]').exists()).toBe(false);
+  });
+
+  it('does not show Move License to TPM for a blacklisted boot flash without a key file', async () => {
+    serverStore.state = 'EBLACKLISTED';
+    serverStore.guid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.flashGuid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.tpmGuid = '01-V35H8S0L1QHK1SBG1XHXJNH7';
+    serverStore.keyfile = '';
+
+    await wrapper.vm.$nextTick();
+
+    expect(wrapper.find('[data-testid="move-license-to-tpm"]').exists()).toBe(false);
+  });
+
+  it('does not show Move License to TPM when the blacklisted flash is still the registered license device', async () => {
+    serverStore.state = 'EBLACKLISTED';
+    serverStore.guid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.flashGuid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.regGuid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.tpmGuid = '01-V35H8S0L1QHK1SBG1XHXJNH7';
+    serverStore.keyfile = 'keyfile-present';
+
+    await wrapper.vm.$nextTick();
+
+    expect(wrapper.find('[data-testid="move-license-to-tpm"]').exists()).toBe(false);
+  });
+
+  it('does not show Move License to TPM when the key is already registered to the detected TPM', async () => {
+    serverStore.state = 'EBLACKLISTED';
+    serverStore.guid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.flashGuid = '058F-6387-0000-0000F1F1E1C6';
+    serverStore.regGuid = '01-V35H8S0L1QHK1SBG1XHXJNH7';
+    serverStore.tpmGuid = '01-V35H8S0L1QHK1SBG1XHXJNH7';
+    serverStore.keyfile = 'keyfile-present';
+
+    await wrapper.vm.$nextTick();
+
+    expect(wrapper.find('[data-testid="move-license-to-tpm"]').exists()).toBe(false);
+  });
+
   it('triggers the TPM replacement action when Move License to TPM is clicked', async () => {
     serverStore.state = 'PRO';
     serverStore.guid = '058F-6387-0000-0000F1F1E1C6';

web/src/components/Registration.standalone.vue

@@ -51,6 +51,7 @@ const {
   guid,
   keyActions,
   computedRegDevs,
+  hasBlacklistedTpmLicenseMismatch,
   regGuid,
   regTm,
   regTo,
@@ -129,9 +130,12 @@ const showPartnerActivationCode = computed(() => {
   );
 });
 const showTpmTransferButton = computed((): boolean =>
-  Boolean((keyInstalled.value || showTrialExpiration.value) && hasDistinctTpmGuid.value)
+  Boolean(hasDistinctTpmGuid.value && (keyInstalled.value || showTrialExpiration.value))
 );
 const disableTpmTransferButton = computed((): boolean => showTrialExpiration.value);
+const showTpmGuid = computed((): boolean =>
+  Boolean(showTpmTransferButton.value || hasBlacklistedTpmLicenseMismatch.value)
+);
 
 // Organize items into three sections
 const bootDeviceItems = computed((): RegistrationItemProps[] => {
@@ -144,7 +148,7 @@ const bootDeviceItems = computed((): RegistrationItemProps[] => {
           },
         ]
       : []),
-    ...(showTpmTransferButton.value && tpmGuid.value
+    ...(showTpmGuid.value && tpmGuid.value
       ? [
           {
             label: t('registration.tpmGuid'),
@@ -176,7 +180,7 @@ const bootDeviceItems = computed((): RegistrationItemProps[] => {
           },
         ]
       : []),
-    ...(state.value === 'EGUID'
+    ...(state.value === 'EGUID' || hasBlacklistedTpmLicenseMismatch.value
       ? [
           {
             label: t('registration.registeredGuid'),
@@ -369,7 +373,7 @@ const actionItems = computed((): RegistrationItemProps[] => {
 
           <!-- Actions Section -->
           <div
-            v-if="actionItems.length > 0"
+            v-if="actionItems.length > 0 || showTpmTransferButton"
             class="rounded-lg border border-gray-200 p-4 dark:border-gray-700"
           >
             <h4 class="mb-3 text-lg font-semibold">{{ t('registration.actions') }}</h4>

web/src/locales/en.json

@@ -767,6 +767,9 @@
   "server.state.eblacklisted.heading": "Blacklisted boot device GUID",
   "server.state.eblacklisted.humanReadable": "BLACKLISTED",
   "server.state.eblacklisted.message": "<p>This boot device has been blacklisted. This can occur as a result of transferring your license key to a replacement device, and you are currently booted from your old device.</p><p>A device may also be blacklisted if we discover the serial number is not unique – this is common with USB card readers.</p>",
+  "server.state.eblacklisted.tpmMismatch.heading": "License / TPM mismatch",
+  "server.state.eblacklisted.tpmMismatch.humanReadable": "LICENSE / TPM MISMATCH",
+  "server.state.eblacklisted.tpmMismatch.message": "<p>Your license is registered to a different TPM than the one currently detected. This can occur after a hardware swap.</p><p>Choose Replace Key to start the license replacement flow. The blacklisted boot flash will not be changed.</p>",
   "server.state.eblacklisted1.heading": "Boot device error",
   "server.state.eblacklisted1.message": "<p>This boot device has an invalid GUID. Please try a different boot device</p>",
   "server.state.eblacklisted2.heading": "Boot device has no serial number",

web/src/store/server.ts

@@ -145,6 +145,17 @@ export const useServerStore = defineStore('server', () => {
     }
     return guid.value || undefined;
   });
+  const hasBlacklistedTpmLicenseMismatch = computed(
+    (): boolean =>
+      state.value === 'EBLACKLISTED' &&
+      Boolean(
+        keyfile.value &&
+          hasDistinctTpmGuid.value &&
+          regGuid.value.startsWith('01-') &&
+          tpmGuid.value.startsWith('01-') &&
+          regGuid.value !== tpmGuid.value
+      )
+  );
   const site = ref<string>('');
   const ssoEnabled = ref<boolean>(false);
   const state = ref<ServerState>();
@@ -718,6 +729,15 @@ export const useServerStore = defineStore('server', () => {
           message: t('server.state.enoflash.message'),
         };
       case 'EBLACKLISTED':
+        if (hasBlacklistedTpmLicenseMismatch.value) {
+          return {
+            actions: [replaceAction.value],
+            error: true,
+            humanReadable: t('server.state.eblacklisted.tpmMismatch.humanReadable'),
+            heading: t('server.state.eblacklisted.tpmMismatch.heading'),
+            message: t('server.state.eblacklisted.tpmMismatch.message'),
+          };
+        }
         return {
           error: true,
           humanReadable: t('server.state.eblacklisted.humanReadable'),
@@ -1436,6 +1456,7 @@ export const useServerStore = defineStore('server', () => {
     guid,
     bootDeviceType,
     hasDistinctTpmGuid,
+    hasBlacklistedTpmLicenseMismatch,
     bootedFromFlashWithInternalBootSetup,
     keyfile,
     inIframe,