From f18d6242ec2784f30b31aceaeec238e53db95399 Mon Sep 17 00:00:00 2001 From: Viv B Date: Mon, 12 Oct 2026 15:56:57 +1100 Subject: [PATCH] fix(place/staff_api): match transport TLS verification in placeos_client PlaceOS::Client verified certificates by default while the driver's HTTP transport does not, so calls like `zone` and `metadata` failed with "certificate verify failed" against the same URI that `systems` and `query_bookings` used successfully. Only verify when `https_verify` sets the PEER flag ("peer", "all", or an odd integer), matching the transport's default of no verification. Co-Authored-By: Claude Opus 5.5 --- drivers/place/staff_api.cr | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/place/staff_api.cr b/drivers/place/staff_api.cr index 0c15e26bb2..5a0d191a34 100644 --- a/drivers/place/staff_api.cr +++ b/drivers/place/staff_api.cr @@ -1379,7 +1379,16 @@ class Place::StaffAPI < PlaceOS::Driver # For accessing PlaceOS APIs protected getter placeos_client : PlaceOS::Client do - insecure = setting?(Bool, :https_insecure) || setting?(String, :https_verify) == "none" + # match the driver transport: only verify certificates when https_verify sets the PEER flag + verify = case mode = setting?(String | Int32, :https_verify) + in String + {"peer", "all"}.includes?(mode.camelcase.downcase) + in Int32 + mode.bits_set?(OpenSSL::SSL::VerifyMode::PEER.value) + in Nil + false + end + insecure = setting?(Bool, :https_insecure) || !verify PlaceOS::Client.new( @place_domain, host_header: @host_header,