Function buildTargetPeerConfigs

backend/wireguard/user_common.go:144–164

buildTargetPeerConfigs converts targetPeers into WireGuard peer configs. Peers that fail key/IP parsing are quarantined (logged and skipped). Returns the config slice AND the set of public keys that were successfully built, so callers can filter the peerStore upsert list accordingly — the store must

(targetPeers map[string]*PeerInfo, presharedKey *wgtypes.Key)

// built, so callers can filter the peerStore upsert list accordingly — the
// store must only contain peers that were actually committed to the kernel.
func buildTargetPeerConfigs(targetPeers map[string]*PeerInfo, presharedKey *wgtypes.Key) ([]wgtypes.PeerConfig, map[string]struct{}) {
	keys := make([]string, 0, len(targetPeers))
	for key := range targetPeers {
		keys = append(keys, key)
	}
	sort.Strings(keys)

	configs := make([]wgtypes.PeerConfig, 0, len(keys))
	appliedKeys := make(map[string]struct{}, len(keys))
	for _, key := range keys {
		config, err := buildAddConfigFromPeerInfo(targetPeers[key], presharedKey)
		if err != nil {
			log.Printf("quarantining startup peer %s due to config error: %v", targetPeers[key].Email, err)
			continue
		}
		configs = append(configs, config)
		appliedKeys[key] = struct{}{}
	}

	return configs, appliedKeys
}

// filterUpsertsByAppliedKeys returns only the peers whose public key appears in appliedKeys.
// This keeps the peerStore in sync with what was actually committed to the kernel;