From f5eb0d7d4f8096eb4a99ea96d0f2c39c95c60f0d Mon Sep 17 00:00:00 2001
From: Virgil <virgil@lethean.io>
Date: Fri, 3 Apr 2026 22:36:18 +0000
Subject: [PATCH] fix: support HSD api key option

---
 service.go      | 20 +++++++++++++-------
 service_test.go | 12 ++++++++++++
 2 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/service.go b/service.go
index ac90c4e..bc5721d 100644
--- a/service.go
+++ b/service.go
@@ -102,12 +102,14 @@ type ServiceOptions struct {
 	RecordDiscoverer         func() (map[string]NameRecords, error)
 	FallbackRecordDiscoverer func() (map[string]NameRecords, error)
 	// RecordTTL keeps forward records and the reverse index alive for the same duration.
-	RecordTTL                    time.Duration
-	DNSPort                      int
-	HTTPPort                     int
-	HSDURL                       string
-	HSDUsername                  string
-	HSDPassword                  string
+	RecordTTL   time.Duration
+	DNSPort     int
+	HTTPPort    int
+	HSDURL      string
+	HSDUsername string
+	HSDPassword string
+	// HSDApiKey is a compatibility alias for HSDPassword when only a token is available.
+	HSDApiKey                    string
 	MainchainURL                 string
 	MainchainUsername            string
 	MainchainPassword            string
@@ -150,10 +152,14 @@ func NewService(options ServiceOptions) *Service {
 
 	hsdClient := options.HSDClient
 	if hsdClient == nil && strings.TrimSpace(options.HSDURL) != "" {
+		hsdPassword := options.HSDPassword
+		if hsdPassword == "" {
+			hsdPassword = options.HSDApiKey
+		}
 		hsdClient = NewHSDClient(HSDClientOptions{
 			URL:      options.HSDURL,
 			Username: options.HSDUsername,
-			Password: options.HSDPassword,
+			Password: hsdPassword,
 		})
 	}
 
diff --git a/service_test.go b/service_test.go
index 34305b1..ce13afc 100644
--- a/service_test.go
+++ b/service_test.go
@@ -868,6 +868,7 @@ func TestNewServiceBuildsRPCClientsFromOptions(t *testing.T) {
 	var chainCalls int32
 	var treeRootCalls int32
 	var nameResourceCalls int32
+	expectedAuth := "Basic dXNlcjphcGkta2V5"
 
 	server := httptest.NewServer(http.HandlerFunc(func(responseWriter http.ResponseWriter, request *http.Request) {
 		var payload struct {
@@ -881,6 +882,9 @@ func TestNewServiceBuildsRPCClientsFromOptions(t *testing.T) {
 		switch payload.Method {
 		case "get_all_alias_details":
 			atomic.AddInt32(&chainCalls, 1)
+			if got := request.Header.Get("Authorization"); got != "" {
+				t.Fatalf("expected no auth header for mainchain request, got %q", got)
+			}
 			responseWriter.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(responseWriter).Encode(map[string]any{
 				"result": []any{
@@ -891,6 +895,9 @@ func TestNewServiceBuildsRPCClientsFromOptions(t *testing.T) {
 			})
 		case "getblockchaininfo":
 			atomic.AddInt32(&treeRootCalls, 1)
+			if got := request.Header.Get("Authorization"); got != expectedAuth {
+				t.Fatalf("expected hsd auth header %q, got %q", expectedAuth, got)
+			}
 			responseWriter.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(responseWriter).Encode(map[string]any{
 				"result": map[string]any{
@@ -899,6 +906,9 @@ func TestNewServiceBuildsRPCClientsFromOptions(t *testing.T) {
 			})
 		case "getnameresource":
 			atomic.AddInt32(&nameResourceCalls, 1)
+			if got := request.Header.Get("Authorization"); got != expectedAuth {
+				t.Fatalf("expected hsd auth header %q, got %q", expectedAuth, got)
+			}
 			if len(payload.Params) != 1 || payload.Params[0] != "gateway.charon.lthn" {
 				t.Fatalf("unexpected alias lookup: %#v", payload.Params)
 			}
@@ -917,6 +927,8 @@ func TestNewServiceBuildsRPCClientsFromOptions(t *testing.T) {
 	service := NewService(ServiceOptions{
 		MainchainURL: server.URL,
 		HSDURL:       server.URL,
+		HSDUsername:  "user",
+		HSDApiKey:    "api-key",
 	})
 
 	if err := service.DiscoverAliases(context.Background()); err != nil {
-- 
2.45.3