From d698b9657914d9557f6c382ec5657e702ae1c5cf Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Thu, 22 Oct 2026 11:21:00 +0400
Subject: [PATCH] fix(search): make the Qdrant clients trust the CAStore bundle

The Qdrant and OpenAI clients do not go through Pleroma.HTTP, so on
Hackney they trusted certifi. Both send API keys. Give them the
configured adapter with the same TLS options.
---
 lib/pleroma/http/adapter_helper.ex            | 18 ++++++++++
 lib/pleroma/search/qdrant_search.ex           |  4 +--
 .../adapter_helper/tesla_adapter_test.exs     | 34 +++++++++++++++++++
 3 files changed, 54 insertions(+), 2 deletions(-)
 create mode 100644 test/pleroma/http/adapter_helper/tesla_adapter_test.exs

diff --git a/lib/pleroma/http/adapter_helper.ex b/lib/pleroma/http/adapter_helper.ex
index 32c1080f7..4f0e23f20 100644
--- a/lib/pleroma/http/adapter_helper.ex
+++ b/lib/pleroma/http/adapter_helper.ex
@@ -46,6 +46,24 @@ defmodule Pleroma.HTTP.AdapterHelper do
     |> adapter_helper().options(uri)
   end
 
+  @doc """
+  The configured Tesla adapter with TLS options, for clients that do not go
+  through `Pleroma.HTTP`.
+  """
+  @spec tesla_adapter() :: module() | {module(), keyword()}
+  def tesla_adapter do
+    case adapter() do
+      Tesla.Adapter.Hackney ->
+        {Tesla.Adapter.Hackney, Pleroma.HTTP.TLS.put_hackney_ssl_options([])}
+
+      Tesla.Adapter.Gun ->
+        {Tesla.Adapter.Gun, certificates_verification: true}
+
+      adapter ->
+        adapter
+    end
+  end
+
   defp adapter, do: Application.get_env(:tesla, :adapter)
 
   defp adapter_helper do
diff --git a/lib/pleroma/search/qdrant_search.ex b/lib/pleroma/search/qdrant_search.ex
index 4d57cfa88..a8c5a3eb9 100644
--- a/lib/pleroma/search/qdrant_search.ex
+++ b/lib/pleroma/search/qdrant_search.ex
@@ -160,7 +160,7 @@ defmodule Pleroma.Search.QdrantSearch.OpenAIClient do
   end
 
   defp client do
-    Tesla.client(middleware())
+    Tesla.client(middleware(), Pleroma.HTTP.AdapterHelper.tesla_adapter())
   end
 
   defp middleware do
@@ -191,7 +191,7 @@ defmodule Pleroma.Search.QdrantSearch.QdrantClient do
   end
 
   defp client do
-    Tesla.client(middleware())
+    Tesla.client(middleware(), Pleroma.HTTP.AdapterHelper.tesla_adapter())
   end
 
   defp middleware do
diff --git a/test/pleroma/http/adapter_helper/tesla_adapter_test.exs b/test/pleroma/http/adapter_helper/tesla_adapter_test.exs
new file mode 100644
index 000000000..1ee2f13ba
--- /dev/null
+++ b/test/pleroma/http/adapter_helper/tesla_adapter_test.exs
@@ -0,0 +1,34 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.HTTP.AdapterHelper.TeslaAdapterTest do
+  use ExUnit.Case, async: false
+
+  alias Pleroma.HTTP.AdapterHelper
+  alias Pleroma.HTTP.TLS
+
+  setup do
+    adapter = Application.get_env(:tesla, :adapter)
+    on_exit(fn -> Application.put_env(:tesla, :adapter, adapter) end)
+  end
+
+  test "adds the TLS options to Hackney" do
+    Application.put_env(:tesla, :adapter, Tesla.Adapter.Hackney)
+
+    assert AdapterHelper.tesla_adapter() ==
+             {Tesla.Adapter.Hackney, ssl_options: TLS.ssl_options()}
+  end
+
+  test "turns on certificate checks for Gun" do
+    Application.put_env(:tesla, :adapter, Tesla.Adapter.Gun)
+
+    assert AdapterHelper.tesla_adapter() == {Tesla.Adapter.Gun, certificates_verification: true}
+  end
+
+  test "keeps other adapters" do
+    Application.put_env(:tesla, :adapter, {Tesla.Adapter.Finch, name: MyFinch})
+
+    assert AdapterHelper.tesla_adapter() == {Tesla.Adapter.Finch, name: MyFinch}
+  end
+end