From 595e152de442d7af247924ea5e45177a21307671 Mon Sep 17 00:00:00 2001
From: Levi Durfee <levi.durfee@gmail.com>
Date: Thu, 8 Jan 2026 10:58:05 -0500
Subject: Start writing tests

---
 .github/workflows/gotest.yml | 27 ++++++++++++++
 internal/goaes_test.go       | 83 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 110 insertions(+)
 create mode 100644 .github/workflows/gotest.yml
 create mode 100644 internal/goaes_test.go

diff --git a/.github/workflows/gotest.yml b/.github/workflows/gotest.yml
new file mode 100644
index 0000000..40ca57d
--- /dev/null
+++ b/.github/workflows/gotest.yml
@@ -0,0 +1,27 @@
+name: gotest
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install dependencies
+        run: go mod tidy
+
+      - name: Run tests
+        run: go test -v ./...
diff --git a/internal/goaes_test.go b/internal/goaes_test.go
new file mode 100644
index 0000000..c965e54
--- /dev/null
+++ b/internal/goaes_test.go
@@ -0,0 +1,83 @@
+package internal_test
+
+import (
+	"os"
+	"testing"
+
+	"github.com/nerdsec/goaes/internal"
+)
+
+const totalIterationTests = 100
+
+func TestNewDEK(t *testing.T) {
+	for range totalIterationTests {
+		dek, err := internal.NewDEK()
+		if err != nil {
+			t.Errorf("failed to create dek. error: %v", err)
+		}
+
+		if len(dek) < 32 {
+			t.Errorf("dek too small")
+		}
+	}
+}
+
+func TestNewSalt(t *testing.T) {
+	for range totalIterationTests {
+		salt, err := internal.NewSalt()
+		if err != nil {
+			t.Errorf("failed to create salt. error: %v", err)
+		}
+
+		if len(salt) < 32 {
+			t.Errorf("salt too small")
+		}
+	}
+}
+
+func TestNewKEKFromEnvB64(t *testing.T) {
+	tests := []struct {
+		name             string
+		passphraseEnvVar string
+		passphrase       string
+		salt             internal.Salt
+		wantErr          bool
+	}{
+		{
+			name:             "Valid base64",
+			passphraseEnvVar: "GOAES_PASSPHRASE",
+			passphrase:       "dJyHOdMbG94EMvQGQrs6YZiXGiAGQgDYtx6+eqLufQg=",
+			salt:             []byte("kD+tNSxjss1XchcyyrKJyZBGg2mdmhh/IO3I87WW2Ds="),
+			wantErr:          false,
+		},
+		{
+			name:             "Invalid passphrase base64",
+			passphraseEnvVar: "GOAES_PASSPHRASE",
+			passphrase:       "dJyHOdMbG94EMvQGQrs6YZiXGiAGQgDYtx6eqLufQg=",
+			salt:             []byte("kD+tNSxjss1XchcyyrKJyZBGg2mdmhh/IO3I87WW2Ds="),
+			wantErr:          true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := os.Setenv(tt.passphraseEnvVar, tt.passphrase)
+			if err != nil {
+				t.Fatal("failed to set env var")
+			}
+
+			_, gotErr := internal.NewKEKFromEnvB64(tt.passphraseEnvVar, tt.salt)
+			if gotErr != nil {
+				if !tt.wantErr {
+					t.Errorf("NewKEKFromEnvB64() failed: %v", gotErr)
+				}
+
+				return
+			}
+
+			if tt.wantErr {
+				t.Fatal("NewKEKFromEnvB64() succeeded unexpectedly")
+			}
+		})
+	}
+}
-- 
cgit v1.2.3