comments cleanup

management/internals/controllers/network_map/controller/controller.go

@@ -56,13 +56,10 @@ type Controller struct {
 
 	integratedPeerValidator integrated_validator.IntegratedValidator
 
-	// componentsDisabled is the kill switch for the component-based wire
-	// format. When true the controller emits legacy proto.NetworkMap to every
-	// peer regardless of capability — used to roll back instantly via a
-	// management restart from a bad components encoder.
-	//
-	// Set once in NewController from NB_NETWORK_MAP_COMPONENTS_DISABLE and
-	// never written after — readers race-free without a mutex.
+	// componentsDisabled, when true, forces the controller to emit legacy
+	// proto.NetworkMap to every peer regardless of capability. Set once at
+	// construction and never written after — readers race-free without a
+	// mutex.
 	componentsDisabled bool
 }
 
@@ -98,17 +95,14 @@ func NewController(ctx context.Context, store store.Store, metrics telemetry.App
 }
 
 // PeerNeedsComponents reports whether the gRPC layer should emit the
-// component-based wire format for this peer. Combines the peer's advertised
-// capability with the controller-level kill switch — callers ask exactly
-// this question, so encapsulating it removes accidental double-checks.
+// component-based wire format for this peer.
 func (c *Controller) PeerNeedsComponents(p *nbpeer.Peer) bool {
 	return p != nil && p.SupportsComponentNetworkMap() && !c.componentsDisabled
 }
 
 // parseBoolEnv reads an env var via strconv.ParseBool so callers accept the
 // usual "1/t/T/TRUE/true/True" set instead of being strict about a single
-// literal — matches the convention used elsewhere in the codebase
-// (e.g. event.go's NB_TRAFFIC_EVENT_*) and reduces operator surprises.
+// literal.
 func parseBoolEnv(key string) bool {
 	v, _ := strconv.ParseBool(os.Getenv(key))
 	return v
@@ -420,9 +414,8 @@ func (c *Controller) BufferUpdateAccountPeers(ctx context.Context, accountID str
 // GetValidatedPeerWithMap. It returns raw NetworkMapComponents for capable
 // peers along with the proxy NetworkMap fragment (BYOP / port-forwarding
 // data the legacy server folds in via NetworkMap.Merge). The gRPC layer
-// encodes both into the wire envelope. The caller is responsible for
-// checking peer capability + componentsDisabled before dispatching here —
-// this method does NOT branch on capability itself.
+// encodes both into the wire envelope. Callers must gate on capability
+// themselves before dispatching here — this method does NOT branch on it.
 func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, peer *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*posture.Checks, int64, error) {
 	if isRequiresApproval {
 		network, err := c.repo.GetAccountNetwork(ctx, accountID)

management/internals/shared/grpc/components_encoder.go

@@ -18,9 +18,9 @@ import (
 const wgKeyRawLen = 32
 
 // ComponentsEnvelopeInput bundles the data the component-format encoder needs.
-// In Step 2 the envelope is fully self-contained — every field needed by the
-// client's local Calculate() comes from the components struct itself. The
-// only externally-supplied data is the receiving peer's PeerConfig (which is
+// The envelope is fully self-contained — every field needed by the client's
+// local Calculate() comes from the components struct itself. The only
+// externally-supplied data is the receiving peer's PeerConfig (which is
 // computed alongside the components in the network_map controller and reused
 // from the legacy proto path) and the dns_domain string.
 type ComponentsEnvelopeInput struct {
@@ -48,21 +48,19 @@ type ComponentsEnvelopeInput struct {
 // not byte-equal.
 //
 // Callers must NOT concatenate or merge envelopes from different encodes —
-// index spaces are local to a single envelope. Delta sync (Step 3+) will
-// use a different shape for the same reason.
+// index spaces are local to a single envelope.
 func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvelope {
 	c := in.Components
 
 	// Graceful degrade when components is nil — matches the legacy path's
-	// account_components.go:43 behaviour for missing/unvalidated peers
-	// (return a NetworkMap with only Network populated). The receiver gets
-	// an envelope it can decode without crashing; AccountSettings stays
-	// non-nil so client-side dereferences are safe.
+	// behaviour for missing/unvalidated peers (return a NetworkMap with only
+	// Network populated). The receiver gets an envelope it can decode
+	// without crashing; AccountSettings stays non-nil so client-side
+	// dereferences are safe.
 	if c == nil {
 		// Match legacy missing-peer minimum: a NetworkMap with only Network
-		// populated (account_components.go:43). The receiver gets enough to
-		// bootstrap (Network identifier, dns_domain, account_settings) and
-		// nothing else.
+		// populated. The receiver gets enough to bootstrap (Network
+		// identifier, dns_domain, account_settings) and nothing else.
 		return &proto.NetworkMapEnvelope{
 			Payload: &proto.NetworkMapEnvelope_Full{
 				Full: &proto.NetworkMapComponentsFull{
@@ -129,8 +127,8 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 }
 
 // networkSerial returns c.Network.CurrentSerial() with a nil guard. The
-// production path always populates c.Network (account_components.go:86), but
-// the encoder is exported and a hand-built components struct may omit it.
+// production path always populates c.Network, but the encoder is exported
+// and a hand-built components struct may omit it.
 func networkSerial(n *types.Network) uint64 {
 	if n == nil {
 		return 0

management/internals/shared/grpc/components_encoder_test.go

@@ -814,8 +814,8 @@ func TestToProxyPatch_PopulatesAllFields(t *testing.T) {
 
 // TestEncodeNetworkMapEnvelope_ProxyPatchPropagated covers the ProxyPatch
 // pass-through in both encoder branches (normal path + nil-Components
-// graceful-degrade). Without this test a regression that drops `ProxyPatch:`
-// from one of the struct literals in components_encoder.go would slip past CI.
+// graceful-degrade). Guards against a regression that drops `ProxyPatch:`
+// from one of the envelope struct literals.
 func TestEncodeNetworkMapEnvelope_ProxyPatchPropagated(t *testing.T) {
 	patch := &proto.ProxyPatch{
 		ForwardingRules: []*proto.ForwardingRule{{
@@ -850,7 +850,7 @@ func TestEncodeNetworkMapEnvelope_ProxyPatchPropagated(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
 	// nil Components → minimal envelope, no crash. Matches the legacy
-	// account_components.go:43 behaviour for missing/unvalidated peers.
+	// behaviour for missing/unvalidated peers.
 	env := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
 		Components: nil,
 		DNSDomain:  "netbird.cloud",

management/internals/shared/grpc/components_envelope_response.go

@@ -128,8 +128,7 @@ func toProxyPatch(nm *types.NetworkMap, dnsName string, includeIPv6, useSourcePr
 // that's the destination of an SSH-enabling policy without having
 // peer.SSHEnabled set locally.
 //
-// Mirrors the two activation paths in Calculate() (`networkmap_components.go`
-// `getPeerConnectionResources`):
+// Mirrors the two activation paths Calculate() uses:
 //  1. Explicit: rule.Protocol == NetbirdSSH and peer is in the rule's
 //     destinations.
 //  2. Legacy implicit: rule covers TCP/22 or TCP/22022 (or ALL), peer is in

management/internals/shared/grpc/components_envelope_response_test.go

@@ -12,9 +12,7 @@ import (
 // TestComputeSSHEnabledForPeer covers both Calculate-mirroring branches:
 // explicit NetbirdSSH protocol, and the legacy implicit case where a
 // TCP/22 (or 22022 / ALL / port-range-covering-22) rule activates SSH when
-// the destination peer has SSHEnabled=true locally. Belt-and-suspenders for
-// the B1 fix that the prod-DB equivalence test alone wouldn't have caught
-// if no account had this combination.
+// the destination peer has SSHEnabled=true locally.
 func TestComputeSSHEnabledForPeer(t *testing.T) {
 	const targetPeerID = "target"
 	const targetGroupID = "g_dst"

management/internals/shared/grpc/server.go

@@ -943,11 +943,11 @@ func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer
 		// (network_map.Controller.UpdateAccountPeers) skips this duplication
 		// because it dispatches by capability before computing.
 		//
-		// TODO(step-4-sync): refactor SyncPeer / SyncAndMarkPeer / their
-		// mocks + manager interfaces to return PeerNetworkMapResult so the
-		// initial-sync path stops doing duplicate work. ~13 files of churn,
-		// deferred until the client-side decoder lands and there's a real
-		// deployment of capability=3 peers worth optimizing for.
+		// TODO: refactor SyncPeer / SyncAndMarkPeer / their mocks + manager
+		// interfaces to return PeerNetworkMapResult so the initial-sync path
+		// stops doing duplicate work. Deferred until the client-side
+		// decoder lands and there's a real deployment of capability=3 peers
+		// worth optimizing for.
 		_, components, proxyPatch, _, _, err := s.networkMapController.GetValidatedPeerWithComponents(ctx, false, peer.AccountID, peer)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to build components for peer %s on initial sync: %v", peer.ID, err)

management/server/types/networkmap_wire_benchmark_test.go

@@ -15,9 +15,8 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 )
 
-// wireBenchScales mirrors the scales used by networkmap_benchmark_test.go but
-// trimmed: encoding+marshal are linear, so we don't need the 30k peer extreme
-// to see the trend.
+// wireBenchScales — trimmed scale set for wire-size measurements. Encoding
+// and marshalling are linear, so the largest extremes don't add signal.
 var wireBenchScales = []benchmarkScale{
 	{"100peers_5groups", 100, 5},
 	{"500peers_20groups", 500, 20},