From 9b6593285ccb9da24fc1c776d435b7078de53fdd Mon Sep 17 00:00:00 2001
From: andypalmi <andrea@flowfuse.com>
Date: Tue, 4 Aug 2026 17:15:21 +0200
Subject: [PATCH 1/2] Require broker.enabled for Expert central broker default

The Team Broker only renders when forge.broker.enabled is true, so the
centralBroker default must be gated on both forge.broker.enabled and
forge.broker.teamBroker.enabled. Otherwise enabling only the team broker
flag emits a centralBroker with no team broker to bridge from.
---
 helm/flowfuse/templates/configmap.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/helm/flowfuse/templates/configmap.yaml b/helm/flowfuse/templates/configmap.yaml
index effc9dff..8f0945e5 100644
--- a/helm/flowfuse/templates/configmap.yaml
+++ b/helm/flowfuse/templates/configmap.yaml
@@ -341,11 +341,11 @@ data:
         url: {{ ((.Values.forge.expert).service).url }}
         requestTimeout: {{ .Values.forge.expert.requestTimeout | default 60000 }}
       {{- $expertBrokerAddress := (((.Values.forge.expert).broker).address) }}
-      {{- if ((.Values.forge.broker.teamBroker).enabled) }}
+      {{- if (and .Values.forge.broker.enabled ((.Values.forge.broker.teamBroker).enabled)) }}
       centralBroker:
         server: {{ printf "%s:%v" ($expertBrokerAddress | default "expert-broker.flowfuse.com") (((.Values.forge.expert).broker).port | default 8883) }}
       {{- else if $expertBrokerAddress }}
-      {{- fail "forge.expert.broker requires the Team Broker to be enabled (forge.broker.teamBroker.enabled=true)" -}}
+      {{- fail "forge.expert.broker requires the Team Broker to be enabled (forge.broker.enabled=true and forge.broker.teamBroker.enabled=true)" -}}
       {{- end }}
       {{- end }}
     {{- end }}

From f5320051a655c86db2e6a93712280c02fcac5a8a Mon Sep 17 00:00:00 2001
From: andypalmi <andrea@flowfuse.com>
Date: Tue, 4 Aug 2026 17:27:52 +0200
Subject: [PATCH 2/2] Update central broker tests for broker.enabled
 requirement

Set forge.broker.enabled alongside teamBroker.enabled in the render
cases, update the guard error message, and add coverage for the default
server value and the broker-disabled regression.
---
 .../tests/expert_central_broker_test.yaml     | 40 ++++++++++++++++++-
 1 file changed, 38 insertions(+), 2 deletions(-)

diff --git a/helm/flowfuse/tests/expert_central_broker_test.yaml b/helm/flowfuse/tests/expert_central_broker_test.yaml
index 9606b374..8d50d003 100644
--- a/helm/flowfuse/tests/expert_central_broker_test.yaml
+++ b/helm/flowfuse/tests/expert_central_broker_test.yaml
@@ -41,6 +41,7 @@ tests:
   - it: should render central broker server when expert is enabled with broker address and port
     template: configmap.yaml
     set:
+      forge.broker.enabled: true
       forge.broker.teamBroker.enabled: true
       forge.expert:
         enabled: true
@@ -61,6 +62,7 @@ tests:
   - it: should render central broker server with custom port
     template: configmap.yaml
     set:
+      forge.broker.enabled: true
       forge.broker.teamBroker.enabled: true
       forge.expert:
         enabled: true
@@ -78,6 +80,7 @@ tests:
   - it: should default the central broker port to 8883 when not provided
     template: configmap.yaml
     set:
+      forge.broker.enabled: true
       forge.broker.teamBroker.enabled: true
       forge.expert:
         enabled: true
@@ -104,7 +107,7 @@ tests:
           port: 1883
     asserts:
       - failedTemplate:
-          errorMessage: "forge.expert.broker requires the Team Broker to be enabled (forge.broker.teamBroker.enabled=true)"
+          errorMessage: "forge.expert.broker requires the Team Broker to be enabled (forge.broker.enabled=true and forge.broker.teamBroker.enabled=true)"
 
   - it: should fail when expert broker address is set and team broker is explicitly disabled
     template: configmap.yaml
@@ -120,4 +123,37 @@ tests:
           port: 1883
     asserts:
       - failedTemplate:
-          errorMessage: "forge.expert.broker requires the Team Broker to be enabled (forge.broker.teamBroker.enabled=true)"
+          errorMessage: "forge.expert.broker requires the Team Broker to be enabled (forge.broker.enabled=true and forge.broker.teamBroker.enabled=true)"
+
+  - it: should default the central broker server when team broker is enabled and no address is set
+    template: configmap.yaml
+    set:
+      forge.broker.enabled: true
+      forge.broker.teamBroker.enabled: true
+      forge.expert:
+        enabled: true
+        service:
+          url: "https://expert.example.com"
+          token: "expert-token"
+    asserts:
+      - matchRegex:
+          path: data["flowforge.yml"]
+          pattern: "server: expert-broker\\.flowfuse\\.com:8883"
+
+  - it: should not render central broker when team broker is enabled but broker is disabled
+    template: configmap.yaml
+    set:
+      forge.broker.enabled: false
+      forge.broker.teamBroker.enabled: true
+      forge.expert:
+        enabled: true
+        service:
+          url: "https://expert.example.com"
+          token: "expert-token"
+    asserts:
+      - matchRegex:
+          path: data["flowforge.yml"]
+          pattern: "expert:"
+      - notMatchRegex:
+          path: data["flowforge.yml"]
+          pattern: "centralBroker:"