From a6f647812901a11572b9143607ec24445574fed7 Mon Sep 17 00:00:00 2001
From: Nick Khyl <nickk@tailscale.com>
Date: Mon, 7 Jul 2025 11:50:59 -0500
Subject: [PATCH] util/syspolicy: add HasAnyOf to check if any specified policy
 settings are configured

Updates tailscale/corp#29969

Signed-off-by: Nick Khyl <nickk@tailscale.com>
---
 util/syspolicy/syspolicy.go | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/util/syspolicy/syspolicy.go b/util/syspolicy/syspolicy.go
index afcc28ff1..a84afa5db 100644
--- a/util/syspolicy/syspolicy.go
+++ b/util/syspolicy/syspolicy.go
@@ -56,6 +56,27 @@ func MustRegisterStoreForTest(tb testenv.TB, name string, scope setting.PolicySc
 	return reg
 }
 
+// HasAnyOf returns whether at least one of the specified policy settings is configured,
+// or an error if no keys are provided or the check fails.
+func HasAnyOf(keys ...Key) (bool, error) {
+	if len(keys) == 0 {
+		return false, errors.New("at least one key must be specified")
+	}
+	policy, err := rsop.PolicyFor(setting.DefaultScope())
+	if err != nil {
+		return false, err
+	}
+	effective := policy.Get()
+	for _, k := range keys {
+		_, err := effective.GetErr(k)
+		if errors.Is(err, setting.ErrNotConfigured) || errors.Is(err, setting.ErrNoSuchKey) {
+			continue
+		}
+		return err == nil, err // err may be nil or non-nil
+	}
+	return false, nil
+}
+
 // GetString returns a string policy setting with the specified key,
 // or defaultValue if it does not exist.
 func GetString(key Key, defaultValue string) (string, error) {