Method makeAuthenticatedRequest

lib/mcp_handler.go:624–744

(method, apiURL string, body interface{})

}

func (h *CronitorMCPHandler) makeAuthenticatedRequest(method, apiURL string, body interface{}) ([]byte, error) {
	// For state-changing requests, we need to get a CSRF token first
	if method == "POST" || method == "PUT" || method == "DELETE" {
		// First, make a GET request to get a CSRF token
		getReq, err := http.NewRequest("GET", h.apiURL+"/api/settings", nil)
		if err != nil {
			return nil, fmt.Errorf("failed to create CSRF token request: %v", err)
		}

		// Set auth header for the GET request
		if h.username != "" && h.password != "" {
			getReq.SetBasicAuth(h.username, h.password)
		}

		getResp, err := httpClient.Do(getReq)
		if err != nil {
			return nil, fmt.Errorf("failed to get CSRF token: %v", err)
		}
		defer getResp.Body.Close()

		// Check for authentication error
		if getResp.StatusCode == 401 {
			return nil, fmt.Errorf("authentication failed - check username and password for instance '%s'", h.instanceName)
		}

		// Read the response body to ensure cookies are set
		io.ReadAll(getResp.Body)

		// Extract CSRF token from response header
		csrfToken := getResp.Header.Get("X-CSRF-Token")

		// If no token in header, try to extract from cookies
		if csrfToken == "" {
			parsedURL, _ := url.Parse(h.apiURL)
			for _, cookie := range httpClient.Jar.Cookies(parsedURL) {
				if cookie.Name == "csrf_token" {
					csrfToken = cookie.Value
					break
				}
			}
		}

		if csrfToken == "" {
			return nil, fmt.Errorf("failed to obtain CSRF token")
		}

		// Now make the actual request with the CSRF token
		var reqBody io.Reader
		if body != nil {
			jsonBody, err := json.Marshal(body)
			if err != nil {
				return nil, err
			}
			reqBody = bytes.NewReader(jsonBody)
		}

		req, err := http.NewRequest(method, apiURL, reqBody)
		if err != nil {