fix(search): make the Qdrant clients trust the CAStore bundle

The Qdrant and OpenAI clients do not go through Pleroma.HTTP, so on
Hackney they trusted certifi. Both send API keys. Give them the
configured adapter with the same TLS options.

lib/pleroma/http/adapter_helper.ex

@@ -46,6 +46,24 @@ defmodule Pleroma.HTTP.AdapterHelper do
     |> adapter_helper().options(uri)
   end
 
+  @doc """
+  The configured Tesla adapter with TLS options, for clients that do not go
+  through `Pleroma.HTTP`.
+  """
+  @spec tesla_adapter() :: module() | {module(), keyword()}
+  def tesla_adapter do
+    case adapter() do
+      Tesla.Adapter.Hackney ->
+        {Tesla.Adapter.Hackney, Pleroma.HTTP.TLS.put_hackney_ssl_options([])}
+
+      Tesla.Adapter.Gun ->
+        {Tesla.Adapter.Gun, certificates_verification: true}
+
+      adapter ->
+        adapter
+    end
+  end
+
   defp adapter, do: Application.get_env(:tesla, :adapter)
 
   defp adapter_helper do

lib/pleroma/search/qdrant_search.ex

@@ -160,7 +160,7 @@ defmodule Pleroma.Search.QdrantSearch.OpenAIClient do
   end
 
   defp client do
-    Tesla.client(middleware())
+    Tesla.client(middleware(), Pleroma.HTTP.AdapterHelper.tesla_adapter())
   end
 
   defp middleware do
@@ -191,7 +191,7 @@ defmodule Pleroma.Search.QdrantSearch.QdrantClient do
   end
 
   defp client do
-    Tesla.client(middleware())
+    Tesla.client(middleware(), Pleroma.HTTP.AdapterHelper.tesla_adapter())
   end
 
   defp middleware do

test/pleroma/http/adapter_helper/tesla_adapter_test.exs

@@ -0,0 +1,34 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.HTTP.AdapterHelper.TeslaAdapterTest do
+  use ExUnit.Case, async: false
+
+  alias Pleroma.HTTP.AdapterHelper
+  alias Pleroma.HTTP.TLS
+
+  setup do
+    adapter = Application.get_env(:tesla, :adapter)
+    on_exit(fn -> Application.put_env(:tesla, :adapter, adapter) end)
+  end
+
+  test "adds the TLS options to Hackney" do
+    Application.put_env(:tesla, :adapter, Tesla.Adapter.Hackney)
+
+    assert AdapterHelper.tesla_adapter() ==
+             {Tesla.Adapter.Hackney, ssl_options: TLS.ssl_options()}
+  end
+
+  test "turns on certificate checks for Gun" do
+    Application.put_env(:tesla, :adapter, Tesla.Adapter.Gun)
+
+    assert AdapterHelper.tesla_adapter() == {Tesla.Adapter.Gun, certificates_verification: true}
+  end
+
+  test "keeps other adapters" do
+    Application.put_env(:tesla, :adapter, {Tesla.Adapter.Finch, name: MyFinch})
+
+    assert AdapterHelper.tesla_adapter() == {Tesla.Adapter.Finch, name: MyFinch}
+  end
+end