1 files changed, 32 insertions, 0 deletions
diff --git a/internal/cli/kdbx_store_test.go b/internal/cli/kdbx_store_test.go
new file mode 100644
index 0000000..fc79ca6
--- /dev/null
+++ b/internal/cli/kdbx_store_test.go
@@ -0,0 +1,32 @@
+package cli
+
+import "testing"
+
+func TestSplitDescriptionPath(t *testing.T) {
+	group, title, err := splitDescriptionPath("foo/bar/baz")
+	if err != nil {
+		t.Fatalf("splitDescriptionPath: %v", err)
+	}
+	if title != "baz" {
+		t.Fatalf("title = %q; want baz", title)
+	}
+	if len(group) != 2 || group[0] != "foo" || group[1] != "bar" {
+		t.Fatalf("group path = %v; want [foo bar]", group)
+	}
+}
+
+func TestSanitizeRelativePathRejectsTraversal(t *testing.T) {
+	if _, err := sanitizeRelativePath("../secret"); err == nil {
+		t.Fatal("sanitizeRelativePath should reject traversal path")
+	}
+}
+
+func TestExtractPasswordFromContent(t *testing.T) {
+	password, notes := extractPasswordFromContent("user: alice\npassword: s3cr3t\nurl: example.com\n")
+	if password != "s3cr3t" {
+		t.Fatalf("password = %q; want s3cr3t", password)
+	}
+	if notes != "user: alice\nurl: example.com" {
+		t.Fatalf("notes = %q; want without password line", notes)
+	}
+}