From 3c9886fa10144b3ada5749d6a592f265958f38aa Mon Sep 17 00:00:00 2001
From: "M. L. Giannotta" <sunyatasattva@gmail.com>
Date: Sun, 10 May 2026 17:20:43 +0800
Subject: [PATCH] fix(mcp-server): set Authorization header on
 Send{Message,File,AudioVoiceMessage}

The three Send* helpers in helpers/whatsapp.go construct their HTTP
requests directly instead of going through callAPI, and were missing the
Bearer token that the bridge's JWT middleware requires. Calls reached the
bridge as 401 Unauthorized.

In practice sendMessageHandler in mcp_tool.go bypasses SendMessage and
calls callAPI directly, so the text-send path happens to work; but the
file and audio-message MCP handlers route through SendFile and
SendAudioVoiceMessage respectively, so send_file and send_audio_message
were broken end-to-end.

Same shape as the recent DownloadMedia fix: fetch a JWT via
GetOrRefreshJwtToken and add Authorization: Bearer <token> on the
outgoing request.
---
 whatsapp-mcp-server/helpers/whatsapp.go | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/whatsapp-mcp-server/helpers/whatsapp.go b/whatsapp-mcp-server/helpers/whatsapp.go
index b7bdf4f..daebd41 100644
--- a/whatsapp-mcp-server/helpers/whatsapp.go
+++ b/whatsapp-mcp-server/helpers/whatsapp.go
@@ -67,6 +67,11 @@ func SendMessage(recipient, message string) (bool, string) {
 		return false, "Recipient must be provided"
 	}
 
+	token, err := GetOrRefreshJwtToken()
+	if err != nil {
+		return false, "Authentication failed: " + err.Error()
+	}
+
 	payload := map[string]string{
 		"recipient": recipient,
 		"message":   message,
@@ -75,6 +80,7 @@ func SendMessage(recipient, message string) (bool, string) {
 	body, _ := json.Marshal(payload)
 	req, _ := http.NewRequest("POST", apiBaseURL+"/send", bytes.NewBuffer(body))
 	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
 
 	client := &http.Client{}
 	resp, err := client.Do(req)
@@ -113,6 +119,11 @@ func SendFile(recipient, mediaPath string) (bool, string) {
 		return false, "Media file not found: " + mediaPath
 	}
 
+	token, err := GetOrRefreshJwtToken()
+	if err != nil {
+		return false, "Authentication failed: " + err.Error()
+	}
+
 	payload := map[string]string{
 		"recipient":  recipient,
 		"media_path": mediaPath,
@@ -121,6 +132,7 @@ func SendFile(recipient, mediaPath string) (bool, string) {
 	body, _ := json.Marshal(payload)
 	req, _ := http.NewRequest("POST", apiBaseURL+"/send", bytes.NewBuffer(body))
 	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
 
 	client := &http.Client{}
 	resp, err := client.Do(req)
@@ -174,6 +186,11 @@ func SendAudioVoiceMessage(recipient, mediaPath string) (bool, string) {
 		}(finalPath)
 	}
 
+	token, err := GetOrRefreshJwtToken()
+	if err != nil {
+		return false, "Authentication failed: " + err.Error()
+	}
+
 	payload := map[string]string{
 		"recipient":  recipient,
 		"media_path": finalPath,
@@ -182,6 +199,7 @@ func SendAudioVoiceMessage(recipient, mediaPath string) (bool, string) {
 	body, _ := json.Marshal(payload)
 	req, _ := http.NewRequest("POST", apiBaseURL+"/send", bytes.NewBuffer(body))
 	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
 
 	client := &http.Client{}
 	resp, err := client.Do(req)