1 files changed, 45 insertions, 0 deletions
diff --git a/internal/profile/vault_test.go b/internal/profile/vault_test.go
new file mode 100644
index 0000000..a726c5f
--- /dev/null
+++ b/internal/profile/vault_test.go
@@ -0,0 +1,45 @@
+package profile
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestVaultRoundTrip(t *testing.T) {
+	value, err := Generate("pseudonym", "reader@example.org")
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(t.TempDir(), "profile.json.age")
+	if err := Save(path, value, "correct horse battery staple"); err != nil {
+		t.Fatal(err)
+	}
+	loaded, err := Load(path, "correct horse battery staple")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.Username != value.Username || loaded.PublicKey != value.PublicKey || loaded.PrivateKey != value.PrivateKey {
+		t.Fatal("profile vault round-trip changed identity")
+	}
+	if _, err := Load(path, "wrong password"); err == nil {
+		t.Fatal("wrong password unlocked profile vault")
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(data) == 0 || string(data) == "" {
+		t.Fatal("empty profile vault")
+	}
+}
+
+func TestPasswordMinimum(t *testing.T) {
+	value, err := Generate("pseudonym", "reader@example.org")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := Save(filepath.Join(t.TempDir(), "profile.json.age"), value, "short"); err == nil {
+		t.Fatal("short profile password accepted")
+	}
+}