From 6a1c8365132aee7af05edb6acf0d8ad0e541daeb Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Thu, 2 Jul 2026 22:29:43 +1000
Subject: [PATCH] fix: repair master build after conflicting merges

Merging the bearer-token cache (#92), streaming (#94) and HEAD (#89) PRs
independently left master not compiling: fetchBearerToken now returns
three values but headUpstream still assigned two, and cachedBearerToken
referenced sha256Hash which the streaming PR had removed. Restore the
sha256Hash helper (with its crypto/sha256 + encoding/hex imports) and fix
the headUpstream call site.
---
 internal/proxy/engine.go | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/internal/proxy/engine.go b/internal/proxy/engine.go
index 7774c62..7997a96 100644
--- a/internal/proxy/engine.go
+++ b/internal/proxy/engine.go
@@ -2,6 +2,8 @@ package proxy
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -233,7 +235,7 @@ func (e *Engine) headUpstream(ctx context.Context, remote models.Remote, path st
 	}
 	if resp.StatusCode == http.StatusUnauthorized {
 		resp.Body.Close()
-		token, terr := fetchBearerToken(ctx, resp.Header.Get("Www-Authenticate"), remote)
+		token, _, terr := fetchBearerToken(ctx, resp.Header.Get("Www-Authenticate"), remote)
 		if terr == nil && token != "" {
 			resp, err = doHead(http.Header{"Authorization": []string{"Bearer " + token}})
 			if err != nil {
@@ -514,6 +516,11 @@ const (
 	bearerTokenTTLMargin  = 10 * time.Second
 )
 
+func sha256Hash(data []byte) string {
+	h := sha256.Sum256(data)
+	return hex.EncodeToString(h[:])
+}
+
 // cachedBearerToken returns a bearer token for the given challenge, reusing a
 // Redis-cached token for the same remote+challenge while it is still valid.
 func (e *Engine) cachedBearerToken(ctx context.Context, wwwAuth string, remote models.Remote) (string, error) {