Release v1.1.0

crates/nx9-wg-core/src/crypto.rs

@@ -43,6 +43,26 @@ pub fn generate_keypair() -> (WireGuardPrivateKey, WireGuardPublicKey) {
     )
 }
 
+/// Derive a WireGuard public key (x25519) from a base64-encoded private key.
+pub fn derive_public_key(private_key_b64: &str) -> Result<WireGuardPublicKey> {
+    use base64::Engine;
+    use base64::engine::general_purpose::STANDARD;
+    use x25519_dalek::{PublicKey, StaticSecret};
+    let key_bytes = STANDARD
+        .decode(private_key_b64.trim())
+        .map_err(|e| Nx9Error::Validation(format!("invalid base64 private key: {e}")))?;
+    if key_bytes.len() != 32 {
+        return Err(Nx9Error::Validation(
+            "private key must be exactly 32 bytes (256 bits)".to_string(),
+        ));
+    }
+    let mut bytes = [0u8; 32];
+    bytes.copy_from_slice(&key_bytes);
+    let secret = StaticSecret::from(bytes);
+    let public = PublicKey::from(&secret);
+    Ok(WireGuardPublicKey::new(STANDARD.encode(public.as_bytes())))
+}
+
 /// Generate a WireGuard preshared key (32 random bytes, base64).
 pub fn generate_preshared_key() -> WireGuardPresharedKey {
     use base64::Engine;
@@ -106,6 +126,15 @@ mod tests {
         let (priv_key, pub_key) = generate_keypair();
         assert!(!priv_key.as_str().is_empty());
         assert!(!pub_key.as_str().is_empty());
+
+        let derived_pub = derive_public_key(priv_key.as_str()).unwrap();
+        assert_eq!(derived_pub.as_str(), pub_key.as_str());
+    }
+
+    #[test]
+    fn test_derive_public_key_invalid() {
+        assert!(derive_public_key("not-base64!").is_err());
+        assert!(derive_public_key("dG9vLXNob3J0").is_err());
     }
 
     #[test]