refactor(api): switch to header-based auth for GET requests

- Replace body parsing with header validation for GET endpoints
- Update router to properly handle GET vs POST requests
- Add new ValidateRequestWithHeader function
- Update README to document header requirements

handlers.go

@@ -249,6 +249,47 @@ func ValidateRequestWithBody(w http.ResponseWriter, r *http.Request, body []byte
 	return userID, token, nil
 }
 
+func ValidateRequestWithHeader(w http.ResponseWriter, r *http.Request, requiredFields ...string) (int, string, error) {
+	token := r.Header.Get("X-Token")
+	if token == "" {
+		return 0, "", errors.New("token is required in header")
+	}
+
+	timeStampStr := r.Header.Get("X-Timestamp")
+	timeStamp := int64(0)
+	if timeStampStr != "" {
+		var err error
+		timeStamp, err = strconv.ParseInt(timeStampStr, 10, 64)
+		if err != nil {
+			return 0, "", errors.New("invalid timestamp format in header")
+		}
+	} else if !globalConfig.Debug {
+		return 0, "", errors.New("timestamp is required in header")
+	}
+
+	if err := ValidateTimeStamp(timeStamp); err != nil {
+		return 0, "", err
+	}
+
+	userID, err := extractUserIDFromToken(token)
+	if err != nil {
+		return 0, "", err
+	}
+
+	if err := ValidateToken(userID, token); err != nil {
+		return 0, "", err
+	}
+
+	for _, field := range requiredFields {
+		headerValue := r.Header.Get(fmt.Sprintf("X-%s", field))
+		if headerValue == "" {
+			return 0, "", fmt.Errorf("required field %s is missing in header", field)
+		}
+	}
+
+	return userID, token, nil
+}
+
 func GetUserType(userID int) (string, error) {
 	user, err := GetUserByID(userID)
 	if err != nil {