test: Add bats-core test framework

- Create test_helper/common.bash with shared utilities
- Add unit tests for firewall configuration functions
- Add unit tests for build script functions
- Establish testing patterns for TDD approach

This provides the foundation for 100% test coverage.

💘 Generated with Crush

Assisted-by: GLM-4.6 via Crush <crush@charm.land>

tests/test_helper/common.bash

@@ -0,0 +1,38 @@
+#!/usr/bin/env bats
+# Test helper setup for bats-core
+
+# Load bats support libraries if available
+if [[ -f "/usr/lib/bats-core/bats-support/load.bash" ]]; then
+    load '/usr/lib/bats-core/bats-support/load'
+    load '/usr/lib/bats-core/bats-assert/load'
+    load '/usr/lib/bats-core/bats-file/load'
+fi
+
+# Common test variables
+readonly TEST_TEMP_DIR=$(mktemp -d)
+readonly PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# Cleanup function
+cleanup() {
+    rm -rf "$TEST_TEMP_DIR"
+}
+
+# Set up trap for cleanup
+trap cleanup EXIT
+
+# Common helper functions
+create_test_wg_config() {
+    local config_file="$1"
+    cat > "$config_file" << EOF
+[Interface]
+PrivateKey = testPrivateKey1234567890abcdefghijklmnopqrstuvwxyz
+Address = 10.0.0.2/24
+DNS = 1.1.1.1
+
+[Peer]
+PublicKey = testPublicKey1234567890abcdefghijklmnopqrstuvwxyz
+Endpoint = 192.168.1.100:51820
+AllowedIPs = 0.0.0.0/0
+PersistentKeepalive = 25
+EOF
+}

tests/unit/build_test.bats

@@ -0,0 +1,51 @@
+#!/usr/bin/env bats
+# Unit tests for build script functions
+
+load 'test_helper/common.bash'
+
+@test "validate_environment checks for required tools" {
+    source "${PROJECT_ROOT}/src/build-iso.sh"
+    
+    # Create mock directory structure
+    mkdir -p "${TEST_TEMP_DIR}/config"
+    mkdir -p "${TEST_TEMP_DIR}/output"
+    
+    # Override variables for testing
+    PROJECT_ROOT="$TEST_TEMP_DIR"
+    CONFIG_DIR="$TEST_TEMP_DIR/config"
+    OUTPUT_DIR="$TEST_TEMP_DIR/output"
+    
+    # Test with missing tools (should fail)
+    run validate_environment
+    assert_failure
+}
+
+@test "prepare_build creates output directory" {
+    source "${PROJECT_ROOT}/src/build-iso.sh"
+    
+    # Override variables for testing
+    PROJECT_ROOT="$TEST_TEMP_DIR"
+    OUTPUT_DIR="$TEST_TEMP_DIR/output"
+    
+    # Remove directory if it exists
+    rm -rf "$OUTPUT_DIR"
+    
+    # Run function
+    run prepare_build
+    assert_success
+    
+    # Check directory was created
+    assert [ -d "$OUTPUT_DIR" ]
+}
+
+@test "build_iso fails without live-build setup" {
+    source "${PROJECT_ROOT}/src/build-iso.sh"
+    
+    # Override variables for testing
+    PROJECT_ROOT="$TEST_TEMP_DIR"
+    OUTPUT_DIR="$TEST_TEMP_DIR/output"
+    
+    # Run function
+    run build_iso
+    assert_failure
+}

tests/unit/firewall_test.bats

@@ -0,0 +1,51 @@
+#!/usr/bin/env bats
+# Unit tests for firewall configuration functions
+
+load 'test_helper/common.bash'
+
+@test "parse wireguard endpoint from config" {
+    # Create test configuration
+    local test_config="$TEST_TEMP_DIR/wg0.conf"
+    create_test_wg_config "$test_config"
+    
+    # Source the firewall setup script functions
+    source "${PROJECT_ROOT}/src/firewall-setup.sh"
+    
+    # Test parsing function
+    result=$(parse_wg_endpoint "$test_config")
+    assert_equal "$result" "192.168.1.100:51820"
+}
+
+@test "generate nftables rules for wireguard" {
+    source "${PROJECT_ROOT}/src/firewall-setup.sh"
+    
+    rules=$(generate_nftables_rules "192.168.1.100:51820")
+    assert_regex "$rules" "udp.*192.168.1.100.*51820"
+    assert_regex "$rules" "policy drop"
+}
+
+@test "error handling for missing config file" {
+    source "${PROJECT_ROOT}/src/firewall-setup.sh"
+    
+    run parse_wg_endpoint "/nonexistent/file.conf"
+    assert_failure
+    assert_output --partial "Error: WireGuard config not found"
+}
+
+@test "error handling for malformed config" {
+    # Create malformed config without endpoint
+    local malformed_config="$TEST_TEMP_DIR/malformed.conf"
+    cat > "$malformed_config" << EOF
+[Interface]
+PrivateKey = testkey
+Address = 10.0.0.2/24
+
+[Peer]
+PublicKey = testpubkey
+# No endpoint line
+EOF
+    
+    source "${PROJECT_ROOT}/src/firewall-setup.sh"
+    run parse_wg_endpoint "$malformed_config"
+    assert_failure
+}