fix(auth): refresh tokens before authenticated requests

Move token refresh checks into the shared Rust connection/API path so long-running authenticated operations stop reusing stale access tokens. This covers recursive download and upload traversal, recursive ls via the shared APIs, and direct authenticated commands such as cp, mv, rm, and chacl.

Also surface HTTP failures earlier in the affected API methods instead of failing later during response parsing.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/api/folders.rs

@@ -8,24 +8,25 @@ impl MDRSConnection {
         &self,
         lab_id: u32,
         path: &str,
-    ) -> Result<Vec<FolderSimple>, reqwest::Error> {
-        let resp = self
-            .client
-            .get(self.build_url("v3/folders/"))
-            .headers(self.prepare_headers())
-            .query(&[
-                ("laboratory_id", lab_id.to_string()),
-                ("path", path.to_string()),
-            ])
-            .send()
-            .await?;
-        resp.json::<Vec<FolderSimple>>().await
+    ) -> Result<Vec<FolderSimple>, anyhow::Error> {
+        let params = [
+            ("laboratory_id", lab_id.to_string()),
+            ("path", path.to_string()),
+        ];
+        let resp = self.get_with_query("v3/folders/", &params).await?;
+        if !resp.status().is_success() {
+            bail!("List folders failed: {}", resp.status());
+        }
+        Ok(resp.json::<Vec<FolderSimple>>().await?)
     }
 
     /// Retrieve full folder details including sub_folders (GET v3/folders/{id}/)
-    pub async fn retrieve_folder(&self, id: &str) -> Result<FolderDetail, reqwest::Error> {
+    pub async fn retrieve_folder(&self, id: &str) -> Result<FolderDetail, anyhow::Error> {
         let resp = self.get(&format!("v3/folders/{}/", id)).await?;
-        resp.json::<FolderDetail>().await
+        if !resp.status().is_success() {
+            bail!("Retrieve folder failed: {}", resp.status());
+        }
+        Ok(resp.json::<FolderDetail>().await?)
     }
 
     /// Create a new folder under `parent_id` (POST v3/folders/).
@@ -33,30 +34,24 @@ impl MDRSConnection {
         &self,
         parent_id: &str,
         folder_name: &str,
-    ) -> reqwest::Result<reqwest::Response> {
+    ) -> Result<reqwest::Response, anyhow::Error> {
         let body = serde_json::json!({
             "name": folder_name,
             "parent_id": parent_id,
             "description": "",
             "template_id": -1,
         });
-        self.client
-            .post(self.build_url("v3/folders/"))
-            .headers(self.prepare_headers())
-            .json(&body)
-            .send()
-            .await
+        self.post_json("v3/folders/", &body).await
     }
 
     /// Authenticate against a password-locked folder (POST v3/folders/{id}/auth/).
     /// Returns `Err` if the password is incorrect or the request fails.
     pub async fn folder_auth(&self, folder_id: &str, password: &str) -> Result<(), anyhow::Error> {
         let resp = self
-            .client
-            .post(self.build_url(&format!("v3/folders/{}/auth/", folder_id)))
-            .headers(self.prepare_headers())
-            .json(&serde_json::json!({"password": password}))
-            .send()
+            .post_json(
+                &format!("v3/folders/{}/auth/", folder_id),
+                &serde_json::json!({"password": password}),
+            )
             .await?;
         if resp.status() == reqwest::StatusCode::UNAUTHORIZED {
             bail!("Password is incorrect.");