Validate WireGuard keys in the UI layer with clear error messages.
Fixes issue #3 — "failed to set private_key: hex string does not fit the slice".
Before this commit the hexKey() helper in TunnelManager.swift silently returned an empty string whenever Swift's Data(base64Encoded:) refused the input (common causes: leading/trailing whitespace, missing = padding, URL-safe Base64 alphabet -_ instead of +/). That empty string made it into the UAPI config as private_key=, which wireguard-go tried to hex-decode into a 32-byte slice and produced the baffling "failed to set private_key: hex string does not fit the slice" error.
Fix:
- New
KeyError(LocalizedError) with distinct messages for empty input, invalid Base64, and wrong decoded length. parseWireGuardKey()is now tolerant of common paste artifacts: trims whitespace/newlines, normalizes URL-safe Base64 (-_→+/), and ignores internal whitespace via.ignoreUnknownCharacters. Also explicitly enforces the 32-byte length.buildUAPIConfig()is nowthrows;connect()'s existingdo/catchsurfaces theKeyErrormessage viaerrorMessage, so the user sees e.g."Private Key is not valid Base64. Expected 44 characters ending with '=' (output of wg genkey)."instead of wireguard-go's cryptic hex complaint.