hide tls certificate fields for backends that never use tls

tests/repo-predicates.test.ts

@@ -6,7 +6,7 @@
  * now advisory-only for the UI hint.
  */
 import { describe, test, expect } from 'bun:test';
-import { isLocalRepo, isRemoteEnvironment, localRepoNeedsSameHost } from '../src/lib/shared/repo-predicates';
+import { isLocalRepo, isRemoteEnvironment, localRepoNeedsSameHost, backendSupportsTls } from '../src/lib/shared/repo-predicates';
 
 describe('isLocalRepo', () => {
 	test('absolute and relative filesystem paths are local', () => {
@@ -55,3 +55,33 @@ describe('localRepoNeedsSameHost (#1316 advisory)', () => {
 		expect(localRepoNeedsSameHost(localDest, undefined)).toBe(false);
 	});
 });
+
+describe('backendSupportsTls (destination TLS fields visibility)', () => {
+	test('s3 and rest support TLS (self-hostable over HTTPS with a private CA)', () => {
+		expect(backendSupportsTls('s3')).toBe(true);
+		expect(backendSupportsTls('rest')).toBe(true);
+	});
+
+	test('local path and managed clouds do NOT show TLS fields', () => {
+		expect(backendSupportsTls('local')).toBe(false);
+		expect(backendSupportsTls('b2')).toBe(false);
+		expect(backendSupportsTls('azure')).toBe(false);
+		expect(backendSupportsTls('gs')).toBe(false);
+	});
+
+	test('editing a non-TLS backend that already has a cert stored still shows the section', () => {
+		// A destination created before this filter that carries a CA must not have its
+		// stored cert hidden on edit.
+		expect(backendSupportsTls('gs', { isEditing: true, hasStoredCert: true })).toBe(true);
+		expect(backendSupportsTls('local', { isEditing: true, hasStoredCert: true })).toBe(true);
+	});
+
+	test('editing without a stored cert keeps the section hidden for non-TLS backends', () => {
+		expect(backendSupportsTls('gs', { isEditing: true, hasStoredCert: false })).toBe(false);
+		expect(backendSupportsTls('azure', { isEditing: true, hasStoredCert: false })).toBe(false);
+	});
+
+	test('creating (not editing) never shows TLS for a non-TLS backend regardless of flags', () => {
+		expect(backendSupportsTls('local', { isEditing: false, hasStoredCert: true })).toBe(false);
+	});
+});