Method AuthenticateRequest

internal/auth/auth.go:85–120

AuthenticateRequest sets the appropriate auth header on an HTTP request. Uses Bearer token if available, otherwise falls back to session cookie.

(ctx context.Context, req *http.Request)

// AuthenticateRequest sets the appropriate auth header on an HTTP request.
// Uses Bearer token if available, otherwise falls back to session cookie.
func (m *Manager) AuthenticateRequest(ctx context.Context, req *http.Request) error {
	if token := os.Getenv("HEY_TOKEN"); token != "" {
		req.Header.Set("Authorization", "Bearer "+token)
		return nil
	}

	m.mu.Lock()
	defer m.mu.Unlock()

	creds, err := m.store.Load(m.baseURL)
	if err != nil {
		return fmt.Errorf("not authenticated: %w", err)
	}

	if creds.AccessToken != "" {
		// Auto-refresh if needed
		if creds.ExpiresAt > 0 && time.Now().Unix() >= creds.ExpiresAt-300 {
			if err = m.refreshLocked(ctx, creds); err != nil {
				return err
			}
			creds, err = m.store.Load(m.baseURL)
			if err != nil {
				return fmt.Errorf("failed to load refreshed credentials: %w", err)
			}
		}
		req.Header.Set("Authorization", "Bearer "+creds.AccessToken)
		return nil
	}

	if creds.SessionCookie != "" {
		req.Header.Set("Cookie", "session_token="+creds.SessionCookie)
		return nil
	}

	return fmt.Errorf("no access token or session cookie available")
}

// IsAuthenticated checks if there are valid credentials.
func (m *Manager) IsAuthenticated() bool {