refactor: extract validate_encryption_passphrase from gather_input

gather_input's unattended branch had two parallel if-blocks, one for ZFS and one for Btrfs, each doing the same encryption-passphrase empty check against a filesystem-specific variable (ZFS_PASSPHRASE or LUKS_PASSPHRASE). The two blocks shared the condition surface and error template. Only the variable name differed.

I lifted the check into validate_encryption_passphrase in lib/config.sh next to validate_filesystem. The helper takes the variable name and uses indirect expansion (${!var_name}) so one function covers both filesystems. gather_input now dispatches via if/elif on FILESYSTEM and calls the helper with the right variable, collapsing 14 lines to 6.

The original tests in test_archangel.bats (gather_input errors when ZFS without ZFS_PASSPHRASE / when Btrfs without LUKS_PASSPHRASE / accepts ZFS with NO_ENCRYPT=yes) still pass, exercising the helper through the dispatch. Added 4 direct unit tests in test_config.bats covering the four cases: NO_ENCRYPT=yes passes regardless, NO_ENCRYPT=no with empty fails, NO_ENCRYPT=no with value passes, and the error message names the offending variable. Bats: 177 → 181.

No behavior change. The helper preserves the original error message format and exit conditions.

1 files changed, 39 insertions, 0 deletions

diff --git a/tests/unit/test_config.bats b/tests/unit/test_config.bats
index 46f0236..af23e4a 100644
--- a/tests/unit/test_config.bats
+++ b/tests/unit/test_config.bats
@@ -205,3 +205,42 @@ EOF
     [ "$status" -eq 1 ]
     [[ "$output" == *"Invalid FILESYSTEM"* ]]
 }
+
+#############################
+# validate_encryption_passphrase
+#############################
+# Called from gather_input's unattended branch. Errors when encryption
+# is enabled (NO_ENCRYPT != "yes") but the named passphrase variable
+# is empty. Indirect expansion lets one helper cover both ZFS and Btrfs.
+
+@test "validate_encryption_passphrase passes when NO_ENCRYPT=yes regardless of passphrase" {
+    NO_ENCRYPT=yes
+    ZFS_PASSPHRASE=""
+    run validate_encryption_passphrase ZFS_PASSPHRASE
+    [ "$status" -eq 0 ]
+}
+
+@test "validate_encryption_passphrase errors when NO_ENCRYPT=no and passphrase empty" {
+    NO_ENCRYPT=no
+    ZFS_PASSPHRASE=""
+    run validate_encryption_passphrase ZFS_PASSPHRASE
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"ZFS_PASSPHRASE"* ]]
+    [[ "$output" == *"NO_ENCRYPT=yes"* ]]
+}
+
+@test "validate_encryption_passphrase passes when NO_ENCRYPT=no and passphrase set" {
+    NO_ENCRYPT=no
+    LUKS_PASSPHRASE="hunter2hunter2"
+    run validate_encryption_passphrase LUKS_PASSPHRASE
+    [ "$status" -eq 0 ]
+}
+
+@test "validate_encryption_passphrase names the offending variable in the error" {
+    NO_ENCRYPT=no
+    LUKS_PASSPHRASE=""
+    run validate_encryption_passphrase LUKS_PASSPHRASE
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"LUKS_PASSPHRASE"* ]]
+    ! [[ "$output" == *"ZFS_PASSPHRASE"* ]]
+}