3 files changed, 47 insertions, 1 deletions
diff --git a/gui/src/renderer/components/NotificationArea.tsx b/gui/src/renderer/components/NotificationArea.tsx
index 8e14cdf68a..012fa89d57 100644
--- a/gui/src/renderer/components/NotificationArea.tsx
+++ b/gui/src/renderer/components/NotificationArea.tsx
@@ -3,13 +3,14 @@ import log from 'electron-log';
 import React, { useCallback } from 'react';
 import { useSelector } from 'react-redux';
 import {
-  CloseToAccountExpiryNotificationProvider,
   BlockWhenDisconnectedNotificationProvider,
+  CloseToAccountExpiryNotificationProvider,
   ConnectingNotificationProvider,
   ErrorNotificationProvider,
   InAppNotificationProvider,
   InconsistentVersionNotificationProvider,
   NotificationAction,
+  NoValidKeyNotificationProvider,
   ReconnectingNotificationProvider,
   UnsupportedVersionNotificationProvider,
   UpdateAvailableNotificationProvider,
@@ -38,12 +39,19 @@ export default function NotificationArea(props: IProps) {
   const blockWhenDisconnected = useSelector(
     (state: IReduxState) => state.settings.blockWhenDisconnected,
   );
+  const tunnelProtocol = useSelector((state: IReduxState) =>
+    'normal' in state.settings.relaySettings
+      ? state.settings.relaySettings.normal.tunnelProtocol
+      : undefined,
+  );
+  const wireGuardKey = useSelector((state: IReduxState) => state.settings.wireguardKeyState);
 
   const notificationProviders: InAppNotificationProvider[] = [
     new ConnectingNotificationProvider({ tunnelState }),
     new ReconnectingNotificationProvider(tunnelState),
     new BlockWhenDisconnectedNotificationProvider({ tunnelState, blockWhenDisconnected }),
     new ErrorNotificationProvider({ tunnelState, accountExpiry }),
+    new NoValidKeyNotificationProvider({ tunnelProtocol, wireGuardKey }),
     new InconsistentVersionNotificationProvider({ consistent: version.consistent }),
     new UnsupportedVersionNotificationProvider(version),
     new UpdateAvailableNotificationProvider(version),
diff --git a/gui/src/shared/notifications/no-valid-key.ts b/gui/src/shared/notifications/no-valid-key.ts
new file mode 100644
index 0000000000..d1b90095e2
--- /dev/null
+++ b/gui/src/shared/notifications/no-valid-key.ts
@@ -0,0 +1,37 @@
+import { WgKeyState } from '../../renderer/redux/settings/reducers';
+import { messages } from '../../shared/gettext';
+import { LiftedConstraint, TunnelProtocol } from '../daemon-rpc-types';
+import { InAppNotification, InAppNotificationProvider } from './notification';
+
+interface NoValidKeyNotificationContext {
+  tunnelProtocol?: LiftedConstraint<TunnelProtocol>;
+  wireGuardKey: WgKeyState;
+}
+
+export class NoValidKeyNotificationProvider implements InAppNotificationProvider {
+  public constructor(private context: NoValidKeyNotificationContext) {}
+
+  public mayDisplay() {
+    const usingWireGuard =
+      this.context.tunnelProtocol === 'wireguard' ||
+      (this.context.tunnelProtocol === 'any' && process.platform !== 'win32');
+    const keyInvalid =
+      this.context.wireGuardKey.type === 'key-not-set' ||
+      this.context.wireGuardKey.type === 'too-many-keys' ||
+      this.context.wireGuardKey.type === 'generation-failure' ||
+      (this.context.wireGuardKey.type === 'key-set' &&
+        this.context.wireGuardKey.key.valid === false) ||
+      (this.context.wireGuardKey.type === 'key-set' &&
+        this.context.wireGuardKey.key.replacementFailure === 'too_many_keys');
+
+    return usingWireGuard && keyInvalid;
+  }
+
+  public getInAppNotification(): InAppNotification {
+    return {
+      indicator: 'warning',
+      title: messages.pgettext('in-app-notifications', 'VALID WIREGUARD KEY IS MISSING'),
+      subtitle: messages.pgettext('in-app-notifications', 'Manage keys under Advanced settings.'),
+    };
+  }
+}
diff --git a/gui/src/shared/notifications/notification.ts b/gui/src/shared/notifications/notification.ts
index adbf3ae746..4bfd90463f 100644
--- a/gui/src/shared/notifications/notification.ts
+++ b/gui/src/shared/notifications/notification.ts
@@ -41,6 +41,7 @@ export * from './connected';
 export * from './connecting';
 export * from './disconnected';
 export * from './error';
+export * from './no-valid-key';
 export * from './inconsistent-version';
 export * from './reconnecting';
 export * from './unsupported-version';