Fix: Clone default HTTP transport before mutating TLS config in createAPIConfigWithToken

[coderabbitai]

Summary

The shared promapi.DefaultRoundTripper transport is mutated directly in createAPIConfigWithToken (pkg/toolset/tools/prometheus_client.go) without cloning first. This causes TLS settings to leak across concurrent requests and different toolsets, creating race conditions.

Details

In createAPIConfigWithToken, the code casts promapi.DefaultRoundTripper to *http.Transport and then sets TLSClientConfig on it directly:

defaultRt, ok := promapi.DefaultRoundTripper.(*http.Transport)
// ...
defaultRt.TLSClientConfig = &tls.Config{ ... }  // mutates the global shared transport

Fix

Clone the transport before modifying its TLSClientConfig:

 defaultRt, ok := promapi.DefaultRoundTripper.(*http.Transport)
 if !ok {
     return promapi.Config{}, fmt.Errorf(...)
 }
+rt := defaultRt.Clone()

 if insecure {
-    defaultRt.TLSClientConfig = &tls.Config{...}
+    rt.TLSClientConfig = &tls.Config{...}
 } else {
-    defaultRt.TLSClientConfig = &tls.Config{...}
+    rt.TLSClientConfig = &tls.Config{...}
 }

 if token !=  {
     apiConfig.RoundTripper = promcfg.NewAuthorizationCredentialsRoundTripper(
-        "Bearer", promcfg.NewInlineSecret(token), defaultRt)
+        "Bearer", promcfg.NewInlineSecret(token), rt)
 } else {
-    apiConfig.RoundTripper = defaultRt
+    apiConfig.RoundTripper = rt
 }

References

• Identified in PR Add Traces toolset #29 (comment: Add Traces toolset #29 (comment))
• Requested by @andreasgerstmayr to be tracked separately

/cc @andreasgerstmayr