Host-Scoped Auth HTTP Client (httpclient/auth.go)

HTTP client that injects a Bearer token only for requests to allowlisted hosts, preventing credential leaks to unrelated domains. Reuse for any authenticated API client needing host-scoped auth.

// Source: https://github.com/betterleaks/betterleaks | License: MIT | Copyright 2026 Zachary Rice
// Provided via justclaw.it.com; keep this notice with the code.
package httpclient

import (
	"net/http"
	"net/url"
	"strings"
)

// NewAuthenticatedClient returns an HTTP client that adds a Bearer token only
// when the request URL's host matches one of allowedHosts (case-insensitive;
// port in allowedHosts entries is ignored; request hosts are compared via
// URL.Hostname()).
//
// When token is empty, or no allowedHosts remain after normalization, it
// returns a client with only base (no Authorization injection), avoiding
// accidentally leaking credentials to unrelated hosts (e.g. release-asset CDNs).
//
// When base is nil, it uses [http.DefaultTransport].
func NewAuthenticatedClient(

... (truncated -- full source via MCP)