From e958f508cbd85e637bd62babaefc656295e8c390 Mon Sep 17 00:00:00 2001
From: sascha <sascha@sascha-lutz.de>
Date: Sun, 16 Aug 2026 20:08:07 +0200
Subject: [PATCH 1/2] Fix unprivileged WireGuard status parsing

---
 app.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app.py b/app.py
index c43dec1..37b94c6 100644
--- a/app.py
+++ b/app.py
@@ -1231,7 +1231,7 @@ try:
         for address in item.get("addr_info", []):
             result["addresses"].append(address["local"] + "/" + str(address["prefixlen"]))
     result["routes"] = json.loads(run(["ip", "-j", "route", "show", "dev", "wg0"]))
-    rows = run(["wg", "show", "wg0", "dump"]).splitlines()
+    rows = run(["sudo", "-n", "wg", "show", "wg0", "dump"]).splitlines()
     if rows:
         interface = rows[0].split("\\t")
         result["listen_port"] = int(interface[2])
@@ -1244,7 +1244,7 @@ try:
             "latest_handshake": int(fields[4]),
             "rx_bytes": int(fields[5]),
             "tx_bytes": int(fields[6]),
-            "persistent_keepalive": int(fields[7]),
+            "persistent_keepalive": 0 if fields[7] == "off" else int(fields[7]),
         })
 except Exception as exc:
     result["error"] = str(exc)[:300]

From 8e04a374e2a595c6073baf2090f2399d30952703 Mon Sep 17 00:00:00 2001
From: sascha <sascha@sascha-lutz.de>
Date: Sun, 16 Aug 2026 20:08:07 +0200
Subject: [PATCH 2/2] Fix unprivileged WireGuard status parsing

---
 tests/test_app.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tests/test_app.py b/tests/test_app.py
index eb3be0d..c49a918 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -92,6 +92,18 @@ def test_wireguard_status_rejects_unknown_host_without_ssh(monkeypatch):
     assert response.status_code == 404
 
 
+def test_wireguard_status_command_uses_sudo_and_accepts_off_keepalive():
+    import base64
+    import re
+
+    command = app._wireguard_status_command()
+    encoded = re.search(r"b64decode\('([^']+)'\)", command).group(1)
+    script = base64.b64decode(encoded).decode()
+
+    assert '["sudo", "-n", "wg", "show", "wg0", "dump"]' in script
+    assert '0 if fields[7] == "off" else int(fields[7])' in script
+
+
 def test_tts_generate_returns_cloned_wav(monkeypatch):
     captured = {}