From 75d373c2c53e5635d941bb0c3e1927e946c7d187 Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Tue, 7 Jul 2026 12:34:56 +0000
Subject: [PATCH] Use Workforce bearer token directly if configured, skip OAuth

If a bearer_token is stored in settings, getWorkforceToken() returns it
immediately without doing an OAuth password grant. Validation accepts
either bearer_token or email+password.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/workforce.js | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/workforce.js b/src/workforce.js
index 7918053..19c1644 100644
--- a/src/workforce.js
+++ b/src/workforce.js
@@ -13,7 +13,9 @@ async function getWorkforceCreds() {
   })
   if (!res.ok) throw new Error(`Failed to fetch Workforce credentials from settings: ${res.status}`)
   const creds = await res.json()
-  if (!creds.email || !creds.password) throw new Error('Workforce credentials not configured in settings')
+  if (!creds.bearer_token && (!creds.email || !creds.password)) {
+    throw new Error('Workforce credentials not configured in settings — set a bearer token or email/password')
+  }
   _credsCache = { creds, expires_at: Date.now() + 5 * 60_000 }
   return creds
 }
@@ -21,6 +23,12 @@ async function getWorkforceCreds() {
 async function getWorkforceToken() {
   const creds = await getWorkforceCreds()
   const baseUrl = creds.base_url || 'https://my.workforce.com'
+
+  // Use bearer token directly if configured — no OAuth exchange needed
+  if (creds.bearer_token) {
+    return { token: creds.bearer_token, baseUrl }
+  }
+
   if (_tokenCache && _tokenCache.base_url === baseUrl && Date.now() < _tokenCache.expires_at) {
     return { token: _tokenCache.access_token, baseUrl }
   }