From 24f3fcdc7bb86fb242bd1d5771c8bee9ba645034 Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Tue, 7 Jul 2026 12:42:49 +0000
Subject: [PATCH] Workforce: bearer token only, remove email/password fields

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/integrations/schema.js |  2 +-
 src/routes/integrations.js | 25 ++++++-------------------
 2 files changed, 7 insertions(+), 20 deletions(-)

diff --git a/src/integrations/schema.js b/src/integrations/schema.js
index 0f0325a..fe47349 100644
--- a/src/integrations/schema.js
+++ b/src/integrations/schema.js
@@ -30,7 +30,7 @@ export const INTEGRATIONS = {
   workforce: {
     name: 'Workforce',
     configFields: ['base_url', 'sync_hours'],
-    secretFields: ['bearer_token', 'email', 'password'],
+    secretFields: ['bearer_token'],
   },
   smtp: {
     name: 'SMTP Email',
diff --git a/src/routes/integrations.js b/src/routes/integrations.js
index 0fba04a..d7936d2 100644
--- a/src/routes/integrations.js
+++ b/src/routes/integrations.js
@@ -88,26 +88,13 @@ export async function integrationRoutes(app) {
       if (req.params.slug === 'newbook') await newbookTest(creds)
       else if (req.params.slug === 'resos') await resosTest(creds)
       else if (req.params.slug === 'workforce') {
+        if (!creds.bearer_token) throw new Error('Workforce bearer token not configured')
         const baseUrl = creds.base_url || 'https://my.workforce.com'
-        if (creds.bearer_token) {
-          // Test bearer token directly with a lightweight API call
-          const res = await fetch(`${baseUrl}/api/v2/users?page=1&page_size=1`, {
-            headers: { Authorization: `Bearer ${creds.bearer_token}` },
-            signal: AbortSignal.timeout(8000),
-          })
-          if (!res.ok) throw new Error(`Workforce bearer token invalid (${res.status})`)
-        } else {
-          if (!creds.email || !creds.password) throw new Error('No bearer token or email/password configured')
-          const res = await fetch(`${baseUrl}/api/oauth/token`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({ grant_type: 'password', username: creds.email, password: creds.password, scope: 'platform' }).toString(),
-            signal: AbortSignal.timeout(8000),
-          })
-          if (!res.ok) throw new Error(`Workforce auth failed (${res.status})`)
-          const data = await res.json()
-          if (!data.access_token) throw new Error('No access token returned')
-        }
+        const res = await fetch(`${baseUrl}/api/v2/users/me`, {
+          headers: { Authorization: `Bearer ${creds.bearer_token}` },
+          signal: AbortSignal.timeout(8000),
+        })
+        if (!res.ok) throw new Error(`Workforce bearer token invalid (${res.status})`)
       }
       else if (req.params.slug === 'smtp') {
         const nodemailer = await import('nodemailer')