From edb852ce23f3ac3e2dd8a53bf03b476ba9f137bc Mon Sep 17 00:00:00 2001
From: Virgil <virgil@lethean.io>
Date: Fri, 3 Apr 2026 23:51:36 +0000
Subject: [PATCH] feat(dns): fall back mainchain auth to HSD credentials

Co-Authored-By: Virgil <virgil@lethean.io>
---
 mainchain_test.go | 31 +++++++++++++++++++++++++++++++
 service.go        | 14 ++++++--------
 service_test.go   |  4 ++--
 3 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/mainchain_test.go b/mainchain_test.go
index 8291f47..3953173 100644
--- a/mainchain_test.go
+++ b/mainchain_test.go
@@ -566,3 +566,34 @@ func TestExtractAliasFromCommentParsesCaseInsensitiveHNSPrefix(t *testing.T) {
 		t.Fatalf("expected gateway.charon.lthn, got %s", got)
 	}
 }
+
+func TestNewServiceBuildsMainchainAliasClientWithHSDFallbackCredentials(t *testing.T) {
+	service := NewService(ServiceOptions{
+		MainchainURL: "http://127.0.0.1:14037",
+		HSDUsername:  "mainchain-user",
+		HSDPassword:  "mainchain-pass",
+		HSDApiKey:    "ignored-token",
+	})
+
+	if service.mainchainAliasClient == nil {
+		t.Fatal("expected default mainchain alias client with fallback credentials")
+	}
+	if got := service.mainchainAliasClient.username; got != "mainchain-user" {
+		t.Fatalf("expected mainchain username to fall back to hsd username, got %q", got)
+	}
+	if got := service.mainchainAliasClient.password; got != "mainchain-pass" {
+		t.Fatalf("expected mainchain password to fall back to hsd password, got %q", got)
+	}
+
+	serviceFromToken := NewService(ServiceOptions{
+		MainchainURL: "http://127.0.0.1:14037",
+		HSDUsername:  "token-user",
+		HSDApiKey:    "token-pass",
+	})
+	if serviceFromToken.mainchainAliasClient == nil {
+		t.Fatal("expected default mainchain alias client with fallback token credentials")
+	}
+	if got := serviceFromToken.mainchainAliasClient.password; got != "token-pass" {
+		t.Fatalf("expected mainchain password to fall back to hsd api key token, got %q", got)
+	}
+}
diff --git a/service.go b/service.go
index 406ce51..8f14aa7 100644
--- a/service.go
+++ b/service.go
@@ -210,17 +210,15 @@ func NewService(options ServiceOptions) *Service {
 		}
 		mainchainPassword := options.MainchainPassword
 		mainchainUsername := options.MainchainUsername
-		if strings.TrimSpace(options.MainchainURL) == "" {
+		if mainchainPassword == "" {
+			mainchainPassword = options.HSDPassword
 			if mainchainPassword == "" {
-				mainchainPassword = options.HSDPassword
-				if mainchainPassword == "" {
-					mainchainPassword = options.HSDApiKey
-				}
-			}
-			if mainchainUsername == "" {
-				mainchainUsername = options.HSDUsername
+				mainchainPassword = options.HSDApiKey
 			}
 		}
+		if mainchainUsername == "" {
+			mainchainUsername = options.HSDUsername
+		}
 		mainchainClient = NewMainchainAliasClient(MainchainClientOptions{
 			URL:      mainchainURL,
 			Username: mainchainUsername,
diff --git a/service_test.go b/service_test.go
index df71cb6..3e5c18d 100644
--- a/service_test.go
+++ b/service_test.go
@@ -1035,8 +1035,8 @@ func TestNewServiceBuildsRPCClientsFromOptions(t *testing.T) {
 		switch payload.Method {
 		case "get_all_alias_details":
 			atomic.AddInt32(&chainCalls, 1)
-			if got := request.Header.Get("Authorization"); got != "" {
-				t.Fatalf("expected no auth header for mainchain request, got %q", got)
+			if got := request.Header.Get("Authorization"); got != expectedAuth {
+				t.Fatalf("expected hsd-auth header for mainchain request %q, got %q", expectedAuth, got)
 			}
 			responseWriter.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(responseWriter).Encode(map[string]any{