user.rb

class User < ActiveRecord::Base
  validates :username, presence: :true
  validates :password_digest, presence: :true

  has_secure_password
end

user_test.rb

test "username is required" do
  @user = User.new(password: 's3kr3t')
  assert !@user.valid? && @user.errors[:username].include?("can't be blank")
end

test "password is required" do
  @user = User.new(username: 'johndoe')
  assert !@user.valid? && @user.errors[:password].include?("can't be blank")
end

# de acordo com a documentação has_secure_password não adiciona validação de tamanho do campo password
# http://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password