From c3bc745210fd121976351122676e93b853222016 Mon Sep 17 00:00:00 2001
From: Dawn <jiaxin.duan@psi.ch>
Date: Wed, 10 Jun 2026 14:24:08 +0200
Subject: [PATCH] add support for configurable certificate paths per beamline
 in GUI

---
 src/aare/gui/gui.py | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/aare/gui/gui.py b/src/aare/gui/gui.py
index 18baa785..aceb5334 100644
--- a/src/aare/gui/gui.py
+++ b/src/aare/gui/gui.py
@@ -46,6 +46,7 @@ def main():
         match mx_beamline():
             case MXBeamline.X06DA:
                 default_url = cfg_get("gui.daq.daq_url", "https://mx-x06da-queue-01.psi.ch")
+                default_cert_path = cfg_get("gui.daq.cert_path", "/sls/x06da/misc/.cert/6d.crt")
                 default_zmq_addr = cfg_get("gui.cameras.sample_camera_zmq_url", "tcp://x06da-pserv-01:9089")
                 default_pred_zmq_addr = cfg_get("gui.cameras.prediction_zmq_url", "tcp://mx-ml:9091")
                 default_beamline_cam_addr = cfg_get("gui.cameras.beamline_camera_url", "x06da-axis-1.psi.ch")
@@ -53,6 +54,7 @@ def main():
                 default_gonio_camera_id = int(cfg_get("gui.cameras.gonio_camera_id", 3))
             case MXBeamline.X10SA:
                 default_url = cfg_get("gui.daq.daq_url", "https://mx-x10sa-queue-01.psi.ch")
+                default_cert_path = cfg_get("gui.daq.cert_path", "/sls/x10sa/misc/.cert/10s.crt")
                 default_zmq_addr = cfg_get("gui.cameras.sample_camera_zmq_url", "tcp://x10sa-spark-01:9091")
                 default_pred_zmq_addr = cfg_get("gui.cameras.prediction_zmq_url", "tcp://x10sa-spark-01:9091")
                 default_beamline_cam_addr = cfg_get("gui.cameras.beamline_camera_url", "axis-accc8eb02488.psi.ch")
@@ -60,6 +62,7 @@ def main():
                 default_gonio_camera_id = int(cfg_get("gui.cameras.gonio_camera_id", 1))
             case MXBeamline.X06SA:
                 default_url = cfg_get("gui.daq.daq_url", "https://mx-x06sa-queue-01.psi.ch")
+                default_cert_path = cfg_get("gui.daq.cert_path", "/sls/x06sa/misc/.cert/6s.crt")
                 default_zmq_addr = cfg_get("gui.cameras.sample_camera_zmq_url", "")
                 default_pred_zmq_addr = cfg_get("gui.cameras.prediction_zmq_url", "")
                 default_beamline_cam_addr = cfg_get("gui.cameras.beamline_camera_url", "")
@@ -67,6 +70,7 @@ def main():
                 default_gonio_camera_id = int(cfg_get("gui.cameras.gonio_camera_id", 1))
             case _:
                 default_url = cfg_get("gui.daq.daq_url", "")
+                default_cert_path = cfg_get("gui.daq.cert_path", "")
                 default_zmq_addr = cfg_get("gui.cameras.sample_camera_zmq_url", "")
                 default_pred_zmq_addr = cfg_get("gui.cameras.prediction_zmq_url", "")
                 default_beamline_cam_addr = cfg_get("gui.cameras.beamline_camera_url", "")
@@ -79,6 +83,11 @@ def main():
                                        "url", default_url)
         parser.addOption(urlOption)
 
+        certPath = QCommandLineOption(["u", "aaredaq-cert-path"],
+                                       "Server Certificate Path (for self-signed certificates)",
+                                       "cert", default_cert_path)
+        parser.addOption(certPath)
+
         defaultImage = QCommandLineOption(["i", "image"],
                                           "Default image to display in absence of the ZMQ stream",
                                           "image")
@@ -105,6 +114,10 @@ def main():
         if base_url == "" or base_url.lower() == "none":
             base_url = None
 
+        cert_path = parser.value(certPath)
+        if cert_path == "" or cert_path.lower() == "none":
+            cert_path = None
+
         zmq_addr = parser.value(cameraZeroMQ)
         if zmq_addr == "":
             zmq_addr = None
@@ -123,7 +136,7 @@ def main():
 
         try:
             splash.set_progress(50, f"Connecting to {base_url or 'backend'}...")
-            token = auth(base_url)
+            token = auth(base_url, cert_path)
             if not token or token.count(".") != 2:
                 raise RuntimeError(
                     "Authentication did not return a valid token. "