review comments

shared/management/client/client_test.go

@@ -316,27 +316,74 @@ func TestClient_Sync(t *testing.T) {
 
 	select {
 	case resp := <-ch:
-		if resp.GetPeerConfig() == nil {
+		if resp.GetPeerConfig() == nil && resp.GetNetworkMap().GetPeerConfig() == nil {
 			t.Error("expecting non nil PeerConfig got nil")
 		}
 		if resp.GetNetbirdConfig() == nil {
 			t.Error("expecting non nil NetbirdConfig got nil")
 		}
-		if len(resp.GetRemotePeers()) != 1 {
-			t.Errorf("expecting RemotePeers size %d got %d", 1, len(resp.GetRemotePeers()))
+		// Component-capable clients receive a NetworkMapEnvelope; the
+		// remote-peers list is encoded inside it. Decode it and check the
+		// envelope's peers slice. Legacy peers populate the top-level
+		// RemotePeers; both shapes must surface exactly one remote peer.
+		remotePeerKeys := remotePeerKeysFromSync(resp, testKey.PublicKey().String())
+		if len(remotePeerKeys) != 1 {
+			t.Errorf("expecting RemotePeers size %d got %d", 1, len(remotePeerKeys))
 			return
 		}
-		if resp.GetRemotePeersIsEmpty() == true {
+		if resp.GetNetworkMap() != nil && resp.GetRemotePeersIsEmpty() {
 			t.Error("expecting RemotePeers property to be false, got true")
 		}
-		if resp.GetRemotePeers()[0].GetWgPubKey() != remoteKey.PublicKey().String() {
-			t.Errorf("expecting RemotePeer public key %s got %s", remoteKey.PublicKey().String(), resp.GetRemotePeers()[0].GetWgPubKey())
+		if remotePeerKeys[0] != remoteKey.PublicKey().String() {
+			t.Errorf("expecting RemotePeer public key %s got %s", remoteKey.PublicKey().String(), remotePeerKeys[0])
 		}
 	case <-time.After(3 * time.Second):
 		t.Error("timeout waiting for test to finish")
 	}
 }
 
+// remotePeerKeysFromSync extracts the remote-peer WG keys from either the
+// legacy NetworkMap.RemotePeers list or the components NetworkMapEnvelope's
+// inner peers slice (filtering out the local receiving peer identified by
+// localKey, since the envelope's peers list is index-addressed and includes
+// the local peer alongside remotes).
+func remotePeerKeysFromSync(resp *mgmtProto.SyncResponse, localKey string) []string {
+	if rp := resp.GetRemotePeers(); len(rp) > 0 {
+		out := make([]string, 0, len(rp))
+		for _, p := range rp {
+			out = append(out, p.GetWgPubKey())
+		}
+		return out
+	}
+	env := resp.GetNetworkMapEnvelope().GetFull()
+	if env == nil {
+		return nil
+	}
+	out := make([]string, 0, len(env.GetPeers()))
+	for _, p := range env.GetPeers() {
+		key := wgKeyFromBytes(p.GetWgPubKey())
+		if key == "" || key == localKey {
+			continue
+		}
+		out = append(out, key)
+	}
+	return out
+}
+
+// wgKeyFromBytes mirrors the client-side decoder: the envelope ships raw 32
+// bytes; reconstruct the standard base64 key the test compares against.
+func wgKeyFromBytes(raw []byte) string {
+	if len(raw) == 0 {
+		return ""
+	}
+	var k wgtypes.Key
+	if len(raw) != len(k) {
+		return ""
+	}
+	copy(k[:], raw)
+	return k.String()
+}
+
 func Test_SystemMetaDataFromClient(t *testing.T) {
 	s, lis, mgmtMockServer, serverKey := startMockManagement(t)
 	defer s.GracefulStop()

shared/management/networkmap/decode.go

@@ -80,6 +80,9 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	// for peers (and never has).
 	peerIDByIndex := make([]string, len(full.Peers))
 	for idx, pc := range full.Peers {
+		if pc == nil {
+			return nil, fmt.Errorf("invalid envelope: peers[%d] is nil", idx)
+		}
 		peerID := synthPeerID(uint32(idx))
 		peer := decodePeerCompact(pc, peerID, full.AgentVersions)
 		c.Peers[peerID] = peer
@@ -88,7 +91,10 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 
 	// Phase 2: groups. AccountSeqID becomes both the synthesized string ID
 	// and the GroupCompact.id wire value.
-	for _, gc := range full.Groups {
+	for i, gc := range full.Groups {
+		if gc == nil {
+			return nil, fmt.Errorf("invalid envelope: groups[%d] is nil", i)
+		}
 		groupID := synthGroupID(gc.Id)
 		peerIDs := make([]string, 0, len(gc.PeerIndexes))
 		for _, idx := range gc.PeerIndexes {
@@ -108,23 +114,35 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	// model is 1 rule per policy). Policy.ID is synthesized from the
 	// per-account seq id; proto.FirewallRule.PolicyID downstream carries
 	// the same synth string (no xid on the wire).
-	for _, pc := range full.Policies {
+	for i, pc := range full.Policies {
+		if pc == nil {
+			return nil, fmt.Errorf("invalid envelope: policies[%d] is nil", i)
+		}
 		policyID := synthPolicyID(pc.Id)
 		c.Policies = append(c.Policies, decodePolicyCompact(pc, policyID, peerIDByIndex))
 	}
 
 	// Phase 4: routes.
-	for _, rr := range full.Routes {
+	for i, rr := range full.Routes {
+		if rr == nil {
+			return nil, fmt.Errorf("invalid envelope: routes[%d] is nil", i)
+		}
 		c.Routes = append(c.Routes, decodeRouteRaw(rr, peerIDByIndex))
 	}
 
 	// Phase 5: NSGs.
-	for _, nsg := range full.NameserverGroups {
+	for i, nsg := range full.NameserverGroups {
+		if nsg == nil {
+			return nil, fmt.Errorf("invalid envelope: nameserver_groups[%d] is nil", i)
+		}
 		c.NameServerGroups = append(c.NameServerGroups, decodeNameServerGroupRaw(nsg))
 	}
 
 	// Phase 6: network resources.
-	for _, nr := range full.NetworkResources {
+	for i, nr := range full.NetworkResources {
+		if nr == nil {
+			return nil, fmt.Errorf("invalid envelope: network_resources[%d] is nil", i)
+		}
 		c.NetworkResources = append(c.NetworkResources, decodeNetworkResource(nr))
 	}
 
@@ -513,6 +531,9 @@ func portRangesFromProto(ranges []*proto.PortInfo_Range) []types.RulePortRange {
 	}
 	out := make([]types.RulePortRange, 0, len(ranges))
 	for _, r := range ranges {
+		if r == nil || r.Start > 65535 || r.End > 65535 {
+			continue
+		}
 		out = append(out, types.RulePortRange{
 			Start: uint16(r.Start),
 			End:   uint16(r.End),

shared/management/networkmap/encode.go

@@ -307,7 +307,7 @@ func BuildAuthorizedUsersProto(ctx context.Context, authorizedUsers map[string]m
 			if !exists {
 				hash, err := sshauth.HashUserID(userID)
 				if err != nil {
-					log.WithContext(ctx).Errorf("failed to hash user id %s: %v", userID, err)
+					log.WithContext(ctx).WithError(err).Error("failed to hash user id")
 					continue
 				}
 				idx = uint32(len(hashedUsers))

shared/management/networkmap/envelope.go

@@ -52,8 +52,8 @@ func EnvelopeToNetworkMap(ctx context.Context, env *proto.NetworkMapEnvelope, lo
 	}
 	components.PeerID = localPeerID
 
-	includeIPv6 := localPeer != nil && localPeer.SupportsIPv6() && localPeer.IPv6.IsValid()
-	useSourcePrefixes := localPeer != nil && localPeer.SupportsSourcePrefixes()
+	includeIPv6 := localPeer.SupportsIPv6() && localPeer.IPv6.IsValid()
+	useSourcePrefixes := localPeer.SupportsSourcePrefixes()
 
 	typedNM := components.Calculate(ctx)
 
@@ -149,9 +149,15 @@ func appendUniquePeers(dst, extra []*proto.RemotePeerConfig) []*proto.RemotePeer
 	}
 	seen := make(map[string]struct{}, len(dst))
 	for _, p := range dst {
+		if p == nil {
+			continue
+		}
 		seen[p.WgPubKey] = struct{}{}
 	}
 	for _, p := range extra {
+		if p == nil {
+			continue
+		}
 		if _, ok := seen[p.WgPubKey]; ok {
 			continue
 		}