From a1b9822f032747189a83688253043f563619d7ce Mon Sep 17 00:00:00 2001
From: Michael Hoang <enzime@users.noreply.github.com>
Date: Mon, 18 May 2026 14:13:51 +0200
Subject: [PATCH] luks: add test for FIDO2

---
 tests/luks-fido2.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 tests/luks-fido2.nix

diff --git a/tests/luks-fido2.nix b/tests/luks-fido2.nix
new file mode 100644
index 0000000..35b7d74
--- /dev/null
+++ b/tests/luks-fido2.nix
@@ -0,0 +1,18 @@
+{
+  pkgs ? import <nixpkgs> { },
+  diskoLib ? pkgs.callPackage ../lib { },
+}:
+diskoLib.testLib.makeDiskoTest {
+  inherit pkgs;
+  name = "luks-fido2";
+  disko-config = ../example/luks-fido2.nix;
+  enableCanokey = true;
+  extraTestScript = ''
+    machine.succeed("cryptsetup isLuks /dev/vda2");
+    machine.succeed("mountpoint /");
+
+    machine.succeed("systemd-cryptenroll /dev/vda2 | grep -qw fido2")
+    # Recovery should be disabled
+    machine.fail("systemd-cryptenroll /dev/vda2 | grep -qw recovery")
+  '';
+}