From dbd95999132b55f02dd17b9a7234a6e1a11c6bff Mon Sep 17 00:00:00 2001
From: dj-oyu <68707227+dj-oyu@users.noreply.github.com>
Date: Sat, 14 Mar 2026 19:58:03 +0900
Subject: [PATCH] fix: enable TLS when WebAppURL is manually configured as
 HTTPS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The TLS certificate fetch was coupled inside the auto-detection block,
so a manually configured https:// WebAppURL would skip cert loading
entirely, causing the server to serve plain HTTP while Telegram
expected HTTPS — resulting in a blank Mini App.

Split URL resolution and TLS setup into separate steps so that any
https:// URL (auto-detected or configured) triggers cert loading.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 cmd/picoclaw/internal/gateway/helpers.go | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/cmd/picoclaw/internal/gateway/helpers.go b/cmd/picoclaw/internal/gateway/helpers.go
index 101ca16f5..77ccd5460 100644
--- a/cmd/picoclaw/internal/gateway/helpers.go
+++ b/cmd/picoclaw/internal/gateway/helpers.go
@@ -274,7 +274,7 @@ func setupAndStartServices(
 	if cfg.Channels.Telegram.Enabled {
 		webAppURL := cfg.Channels.Telegram.WebAppURL
 		if webAppURL == "" {
-			// Auto-detect Tailscale hostname and fetch TLS cert
+			// Auto-detect Tailscale hostname and build the WebAppURL
 			hostname, tsErr := tailscale.DetectHostname()
 			if tsErr != nil {
 				logger.InfoCF(
@@ -282,15 +282,26 @@ func setupAndStartServices(
 					"Tailscale not available, Mini App disabled",
 					map[string]any{"error": tsErr.Error()},
 				)
+			} else {
+				hostPort := net.JoinHostPort(hostname, strconv.Itoa(cfg.Gateway.Port))
+				webAppURL = "https://" + hostPort + "/miniapp"
+				cfg.Channels.Telegram.WebAppURL = webAppURL
+			}
+		}
+
+		// When the URL is HTTPS, fetch a TLS certificate from Tailscale so
+		// the server can actually serve over TLS. This covers both the
+		// auto-detected case above and a manually configured https:// URL.
+		if strings.HasPrefix(webAppURL, "https://") {
+			hostname, tsErr := tailscale.DetectHostname()
+			if tsErr != nil {
+				logger.ErrorCF("miniapp", "HTTPS URL configured but Tailscale not available", map[string]any{"error": tsErr.Error()})
 			} else {
 				certDir := filepath.Join(cfg.WorkspacePath(), "state", "certs")
 				certFile, keyFile, certErr := tailscale.FetchCert(hostname, certDir)
 				if certErr != nil {
 					logger.ErrorCF("miniapp", "Failed to fetch TLS cert", map[string]any{"error": certErr.Error()})
 				} else {
-					hostPort := net.JoinHostPort(hostname, strconv.Itoa(cfg.Gateway.Port))
-					webAppURL = "https://" + hostPort + "/miniapp"
-					cfg.Channels.Telegram.WebAppURL = webAppURL
 					tlsCert, tlsKey = certFile, keyFile
 					useTLS = true
 				}