From ea204604930a9513c30fc1574521a4938e65b4a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gy=C3=B6rgy=20Krajcsovits?= <gyorgy.krajcsovits@grafana.com>
Date: Tue, 21 Jul 2026 09:04:44 +0200
Subject: [PATCH] web: add TLSConfig.IsEnabled() method
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add an exported IsEnabled() method on TLSConfig that reports whether TLS
is configured, i.e. whether at least one TLS-related field is set. This
mirrors the existing check in validateTLSPaths, which is refactored to
call it, so behaviour is unchanged.

The method lets callers determine whether the server will serve HTTPS
without duplicating the field list or reading the certificate files from
disk (as ConfigToTLSConfig does). For example, Prometheus infers the
scheme of its external URL from the web config file, and previously had
to reimplement this check.

Signed-off-by: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
---
 web/tls_config.go      | 17 ++++++++++++----
 web/tls_config_test.go | 45 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 58 insertions(+), 4 deletions(-)

diff --git a/web/tls_config.go b/web/tls_config.go
index 7245f741..b077ccff 100644
--- a/web/tls_config.go
+++ b/web/tls_config.go
@@ -90,6 +90,18 @@ func (c *FlagConfig) checkFlags() error {
 	return nil
 }
 
+// IsEnabled reports whether the TLSConfig configures TLS, i.e. whether at least
+// one TLS-related field is set. It does not validate that the configuration is
+// complete or that the referenced files exist; use ConfigToTLSConfig for that.
+// This is useful for callers that need to know whether the server will serve
+// HTTPS, for example to infer the scheme of an external URL.
+func (t *TLSConfig) IsEnabled() bool {
+	return t.TLSCertPath != "" || t.TLSCert != "" ||
+		t.TLSKeyPath != "" || t.TLSKey != "" ||
+		t.ClientCAs != "" || t.ClientCAsText != "" ||
+		t.ClientAuth != ""
+}
+
 // SetDirectory joins any relative file paths with dir.
 func (t *TLSConfig) SetDirectory(dir string) {
 	t.TLSCertPath = config_util.JoinDir(dir, t.TLSCertPath)
@@ -165,10 +177,7 @@ func getTLSConfig(configPath string) (*tls.Config, error) {
 }
 
 func validateTLSPaths(c *TLSConfig) error {
-	if c.TLSCertPath == "" && c.TLSCert == "" &&
-		c.TLSKeyPath == "" && c.TLSKey == "" &&
-		c.ClientCAs == "" && c.ClientCAsText == "" &&
-		c.ClientAuth == "" {
+	if !c.IsEnabled() {
 		return errNoTLSConfig
 	}
 
diff --git a/web/tls_config_test.go b/web/tls_config_test.go
index a0dd1d41..289a5d23 100644
--- a/web/tls_config_test.go
+++ b/web/tls_config_test.go
@@ -712,3 +712,48 @@ func TestUsers(t *testing.T) {
 		t.Run(testInputs.Name, testInputs.Test)
 	}
 }
+
+func TestTLSConfigIsEnabled(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		config   TLSConfig
+		expected bool
+	}{
+		{
+			name:     "empty config",
+			config:   TLSConfig{},
+			expected: false,
+		},
+		{
+			name:     "only non-enabling fields set",
+			config:   TLSConfig{MinVersion: tls.VersionTLS12, PreferServerCipherSuites: true},
+			expected: false,
+		},
+		{
+			name:     "cert_file and key_file set",
+			config:   TLSConfig{TLSCertPath: "server.crt", TLSKeyPath: "server.key"},
+			expected: true,
+		},
+		{
+			name:     "inline cert and key set",
+			config:   TLSConfig{TLSCert: "cert", TLSKey: "key"},
+			expected: true,
+		},
+		{
+			name:     "only client CA file set",
+			config:   TLSConfig{ClientCAs: "client_ca.crt"},
+			expected: true,
+		},
+		{
+			name:     "only client auth type set",
+			config:   TLSConfig{ClientAuth: "RequireAndVerifyClientCert"},
+			expected: true,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.config.IsEnabled(); got != tc.expected {
+				t.Errorf("IsEnabled() = %v, expected %v", got, tc.expected)
+			}
+		})
+	}
+}