From 2c1f02d6c715a78fb759c9061b139f3a5c3baa06 Mon Sep 17 00:00:00 2001
From: Chris Troutner <chris.troutner@gmail.com>
Date: Wed, 4 Feb 2026 14:31:06 -0700
Subject: [PATCH] fix(auth token): Passing auth token to internal bch-js

---
 .../rest-api/fulcrum/controller.js            | 27 +++++++++++++++--
 src/use-cases/fulcrum-use-cases.js            | 30 ++++++++++++++++---
 2 files changed, 51 insertions(+), 6 deletions(-)

diff --git a/src/controllers/rest-api/fulcrum/controller.js b/src/controllers/rest-api/fulcrum/controller.js
index ca018df..f6e6d45 100644
--- a/src/controllers/rest-api/fulcrum/controller.js
+++ b/src/controllers/rest-api/fulcrum/controller.js
@@ -424,7 +424,20 @@ class FulcrumRESTController {
 
       const cashAddr = this._validateAndConvertAddress(address)
 
-      const result = await this.fulcrumUseCases.getTransactions({ address: cashAddr, allTxs })
+      // Extract bearer token from request header if present
+      let bearerToken = null
+      if (req.headers && req.headers.authorization) {
+        const parts = req.headers.authorization.split(' ')
+        if (parts.length === 2 && parts[0] === 'Bearer') {
+          bearerToken = parts[1]
+        }
+      }
+
+      const result = await this.fulcrumUseCases.getTransactions({
+        address: cashAddr,
+        allTxs,
+        bearerToken
+      })
       return res.status(200).json(result)
     } catch (err) {
       return this.handleError(err, res)
@@ -470,9 +483,19 @@ class FulcrumRESTController {
         }
       }
 
+      // Extract bearer token from request header if present
+      let bearerToken = null
+      if (req.headers && req.headers.authorization) {
+        const parts = req.headers.authorization.split(' ')
+        if (parts.length === 2 && parts[0] === 'Bearer') {
+          bearerToken = parts[1]
+        }
+      }
+
       const result = await this.fulcrumUseCases.getTransactionsBulk({
         addresses: validatedAddresses,
-        allTxs
+        allTxs,
+        bearerToken
       })
       return res.status(200).json(result)
     } catch (err) {
diff --git a/src/use-cases/fulcrum-use-cases.js b/src/use-cases/fulcrum-use-cases.js
index edf9ece..c7ab6b1 100644
--- a/src/use-cases/fulcrum-use-cases.js
+++ b/src/use-cases/fulcrum-use-cases.js
@@ -106,13 +106,24 @@ class FulcrumUseCases {
     }
   }
 
-  async getTransactions ({ address, allTxs }) {
+  async getTransactions ({ address, allTxs, bearerToken = null }) {
     try {
       const response = await this.fulcrum.get(`electrumx/transactions/${address}`)
 
       // Sort transactions in descending order, so that newest transactions are first.
       if (response.transactions && Array.isArray(response.transactions)) {
-        response.transactions = await this.bchjs.Electrumx.sortAllTxs(response.transactions, 'DESCENDING')
+        // Use bearer token from request if provided, otherwise use the default bchjs instance
+        let bchjsInstance = this.bchjs
+        if (bearerToken) {
+          // Create a temporary bchjs instance with the bearer token from the request
+          const restURL = process.env.RESTURL || process.env.REST_URL || process.env.LOCAL_RESTURL || config.restURL
+          bchjsInstance = new BCHJS({
+            restURL,
+            bearerToken
+          })
+        }
+
+        response.transactions = await bchjsInstance.Electrumx.sortAllTxs(response.transactions, 'DESCENDING')
 
         if (!allTxs) {
           // Return only the first 100 transactions of the history.
@@ -127,16 +138,27 @@ class FulcrumUseCases {
     }
   }
 
-  async getTransactionsBulk ({ addresses, allTxs }) {
+  async getTransactionsBulk ({ addresses, allTxs, bearerToken = null }) {
     try {
       const response = await this.fulcrum.post('electrumx/transactions/', { addresses })
 
       // Sort transactions in descending order for each address entry.
       if (response.transactions && Array.isArray(response.transactions)) {
+        // Use bearer token from request if provided, otherwise use the default bchjs instance
+        let bchjsInstance = this.bchjs
+        if (bearerToken) {
+          // Create a temporary bchjs instance with the bearer token from the request
+          const restURL = process.env.RESTURL || process.env.REST_URL || process.env.LOCAL_RESTURL || config.restURL
+          bchjsInstance = new BCHJS({
+            restURL,
+            bearerToken
+          })
+        }
+
         for (let i = 0; i < response.transactions.length; i++) {
           const thisEntry = response.transactions[i]
           if (thisEntry.transactions && Array.isArray(thisEntry.transactions)) {
-            thisEntry.transactions = await this.bchjs.Electrumx.sortAllTxs(thisEntry.transactions, 'DESCENDING')
+            thisEntry.transactions = await bchjsInstance.Electrumx.sortAllTxs(thisEntry.transactions, 'DESCENDING')
 
             if (!allTxs && thisEntry.transactions.length > 100) {
               // Extract only the first 100 transactions.