From 8bf747def294cffa27a0ffe4c9a600da44f08a3f Mon Sep 17 00:00:00 2001
From: qiqi <qiqi@g1.timqi.com>
Date: Wed, 8 Jul 2026 10:01:51 +0800
Subject: [PATCH] fix(auth): honor NOTION_TOKEN in auth status and doctor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

auth status and auth doctor read the token directly from the config
file, bypassing the NOTION_TOKEN environment variable that every other
command resolves via getToken(). As a result, authenticating solely
through NOTION_TOKEN made 'auth status' report '✗ Not authenticated'
(and 'auth doctor' report 'no token found') even though commands like
'user me' worked fine. This regressed with the multi-profile refactor;
0.3 was unaffected.

Route both commands through getToken() so env-var auth is recognized,
and surface the token source (NOTION_TOKEN env vs profile).
---
 cmd/auth.go | 49 +++++++++++++++++++++++++------------------------
 1 file changed, 25 insertions(+), 24 deletions(-)

diff --git a/cmd/auth.go b/cmd/auth.go
index 5bacdea..1aba9e4 100644
--- a/cmd/auth.go
+++ b/cmd/auth.go
@@ -111,19 +111,15 @@ var authStatusCmd = &cobra.Command{
 Examples:
   notion auth status`,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		cfg, err := config.Load()
+		// Resolve token from env or config (same precedence as every
+		// other command), so `NOTION_TOKEN` alone counts as authenticated.
+		token, err := getToken()
 		if err != nil {
 			fmt.Println("✗ Not authenticated")
 			return nil
 		}
 
-		profile := cfg.GetCurrentProfile()
-		if profile == nil || profile.Token == "" {
-			fmt.Println("✗ Not authenticated")
-			return nil
-		}
-
-		c := client.New(profile.Token)
+		c := client.New(token)
 		me, err := c.GetMe()
 		if err != nil {
 			return fmt.Errorf("token is invalid: %w", err)
@@ -136,13 +132,19 @@ Examples:
 
 		render.Title("✓", "Authenticated")
 
-		// Show current profile name
-		profileName := cfg.CurrentProfile
-		if profileName == "" {
-			profileName = "default"
+		// Config-based profile details are only shown when a config file
+		// exists; env-var auth has no profile.
+		var profiles []string
+		profileName := "default"
+		if cfg, err := config.Load(); err == nil {
+			if cfg.CurrentProfile != "" {
+				profileName = cfg.CurrentProfile
+			}
+			profiles = cfg.ListProfiles()
 		}
-		profiles := cfg.ListProfiles()
-		if len(profiles) > 1 {
+		if os.Getenv("NOTION_TOKEN") != "" {
+			render.Field("Source", "NOTION_TOKEN env")
+		} else if len(profiles) > 1 {
 			render.Field("Profile", profileName)
 		}
 
@@ -156,7 +158,7 @@ Examples:
 		}
 
 		// Show other available profiles
-		if len(profiles) > 1 {
+		if os.Getenv("NOTION_TOKEN") == "" && len(profiles) > 1 {
 			var others []string
 			for _, p := range profiles {
 				if p != profileName {
@@ -353,19 +355,18 @@ Examples:
 		fmt.Println("Notion CLI Health Check")
 		fmt.Println()
 
-		// Check 1: Config file
-		cfg, err := config.Load()
-		profile := cfg.GetCurrentProfile()
-		token := cfg.Token
-		if token == "" && profile != nil {
-			token = profile.Token
-		}
+		// Check 1: Token (env var or config file)
+		token, err := getToken()
 		if err != nil || token == "" {
 			fmt.Println("  ✗ Config: no token found")
-			fmt.Println("    Run: notion auth login --with-token")
+			fmt.Println("    Run: notion auth login --with-token, or set NOTION_TOKEN")
 			return nil
 		}
-		fmt.Println("  ✓ Config: token found")
+		if os.Getenv("NOTION_TOKEN") != "" {
+			fmt.Println("  ✓ Config: token found (NOTION_TOKEN env)")
+		} else {
+			fmt.Println("  ✓ Config: token found")
+		}
 
 		// Check 2: Token validity
 		c := client.New(token)