config: guard against nil oauth2 credential in RoundTrip

toSecret returns (nil, nil) when no source is configured. Most callers
guarded the returned SecretReader with an `!= nil` check before
invoking Fetch, but oauth2RoundTripper.RoundTrip reached directly into
rt.oauthCredential.Immutable() and would nil-deref panic when someone
supplied an oauth2 block with no client-secret source (likely the
proximate cause of prometheus/prometheus#16622).

Return a clear error instead of panicking, and document toSecret's
nil-return contract so future callers explicitly acknowledge it.

Fixes #790

Signed-off-by: Ali <alliasgher123@gmail.com>

Author: Ali

config/http_config.go

@@ -828,7 +828,10 @@ func (*refSecret) Immutable() bool {
 }
 
 // toSecret returns a SecretReader from one of the given sources, assuming exactly
-// one or none of the sources are provided.
+// one or none of the sources are provided. When no source is provided it
+// returns (nil, nil); callers MUST guard the returned reader with a nil check
+// before invoking any method on it — see the nil-deref issue tracked at
+// https://github.com/prometheus/common/issues/790.
 func toSecret(secretManager SecretManager, text Secret, file, ref string) (SecretReader, error) {
 	if text != "" {
 		return NewInlineSecret(string(text)), nil
@@ -1053,6 +1056,15 @@ func (rt *oauth2RoundTripper) RoundTrip(req *http.Request) (*http.Response, erro
 		needsInit bool
 	)
 
+	// oauthCredential can be nil when the caller constructed an oauth2
+	// config without any client-secret source (Secret/File/Ref all empty).
+	// That is an invalid config — oauth2 requires a client secret — but
+	// rather than panicking on the Immutable()/Fetch() calls below, surface
+	// it as a request-time error so the caller can see it.
+	if rt.oauthCredential == nil {
+		return nil, errors.New("oauth2 client secret is required")
+	}
+
 	rt.mtx.RLock()
 	secret = rt.lastSecret
 	needsInit = rt.lastRT.Source == nil