1 files changed, 75 insertions, 0 deletions
diff --git a/tests/unit/test_config.bats b/tests/unit/test_config.bats
index 554c0c7..26d9e0a 100644
--- a/tests/unit/test_config.bats
+++ b/tests/unit/test_config.bats
@@ -303,6 +303,51 @@ EOF
     ! [[ "$output" == *"ZFS_PASSPHRASE"* ]]
 }
 
+@test "validate_encryption_passphrase rejects a passphrase under the minimum length" {
+    NO_ENCRYPT=no
+    ZFS_PASSPHRASE="welcome"
+    run validate_encryption_passphrase ZFS_PASSPHRASE 8
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"at least 8"* ]]
+    [[ "$output" == *"ZFS_PASSPHRASE"* ]]
+}
+
+@test "validate_encryption_passphrase accepts a passphrase at exactly the minimum length" {
+    NO_ENCRYPT=no
+    ZFS_PASSPHRASE="welcome1"
+    run validate_encryption_passphrase ZFS_PASSPHRASE 8
+    [ "$status" -eq 0 ]
+}
+
+@test "validate_encryption_passphrase without a minimum keeps the empty-only check" {
+    NO_ENCRYPT=no
+    LUKS_PASSPHRASE="hunter2"
+    run validate_encryption_passphrase LUKS_PASSPHRASE
+    [ "$status" -eq 0 ]
+}
+
+@test "validate_encryption_passphrase skips the length check when NO_ENCRYPT=yes" {
+    NO_ENCRYPT=yes
+    ZFS_PASSPHRASE="short"
+    run validate_encryption_passphrase ZFS_PASSPHRASE 8
+    [ "$status" -eq 0 ]
+}
+
+@test "validate_encryption_passphrase rejects a passphrase over the maximum length" {
+    NO_ENCRYPT=no
+    ZFS_PASSPHRASE=$(printf 'a%.0s' {1..513})
+    run validate_encryption_passphrase ZFS_PASSPHRASE 8 512
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"at most 512"* ]]
+}
+
+@test "validate_encryption_passphrase accepts a passphrase at exactly the maximum length" {
+    NO_ENCRYPT=no
+    ZFS_PASSPHRASE=$(printf 'a%.0s' {1..512})
+    run validate_encryption_passphrase ZFS_PASSPHRASE 8 512
+    [ "$status" -eq 0 ]
+}
+
 #############################
 # SWAP_SIZE validation
 #############################
@@ -338,6 +383,36 @@ EOF
     [[ "$output" == *"Invalid SWAP_SIZE"* ]]
 }
 
+@test "validate_config rejects a zero SWAP_SIZE" {
+    HOSTNAME=h; TIMEZONE=UTC; ROOT_PASSWORD=x
+    SELECTED_DISKS=(/dev/sda); RAID_LEVEL=""; SWAP_SIZE=0G
+    run validate_config
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"Invalid SWAP_SIZE"* ]]
+}
+
+@test "validate_config rejects a leading-zero SWAP_SIZE" {
+    HOSTNAME=h; TIMEZONE=UTC; ROOT_PASSWORD=x
+    SELECTED_DISKS=(/dev/sda); RAID_LEVEL=""; SWAP_SIZE=00G
+    run validate_config
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"Invalid SWAP_SIZE"* ]]
+}
+
+@test "validate_config warns that swap is unencrypted when encryption is on" {
+    HOSTNAME=h; TIMEZONE=UTC; ROOT_PASSWORD=x
+    SELECTED_DISKS=(/dev/sda); RAID_LEVEL=""; SWAP_SIZE=100G; NO_ENCRYPT=no
+    run validate_config
+    [[ "$output" == *"unencrypted"* ]]
+}
+
+@test "validate_config does not warn about swap encryption when NO_ENCRYPT=yes" {
+    HOSTNAME=h; TIMEZONE=UTC; ROOT_PASSWORD=x
+    SELECTED_DISKS=(/dev/sda); RAID_LEVEL=""; SWAP_SIZE=100G; NO_ENCRYPT=yes
+    run validate_config
+    [[ "$output" != *"unencrypted"* ]]
+}
+
 @test "validate_config rejects SWAP_SIZE on a multi-disk layout" {
     HOSTNAME=h; TIMEZONE=UTC; ROOT_PASSWORD=x
     SELECTED_DISKS=(/dev/sda /dev/sdb); RAID_LEVEL=mirror; SWAP_SIZE=100G