update

internal/oauth2/oauth2.go

@@ -154,6 +154,20 @@ func truncate(b []byte, n int) string {
 	return string(b)
 }
 
+// NewAuthedRequest builds an HTTP request with the OAuth2 access token
+// attached as a Bearer Authorization header — shared by anything that
+// calls a provider's REST API (userinfo lookup, Gmail API, Graph API)
+// rather than IMAP/SMTP. Callers still do their own Do()/JSON decoding,
+// since every API's response shape differs.
+func NewAuthedRequest(ctx context.Context, method, url, accessToken string, body io.Reader) (*http.Request, error) {
+	req, err := http.NewRequestWithContext(ctx, method, url, body)
+	if err != nil {
+		return nil, fmt.Errorf("building request: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+	return req, nil
+}
+
 // XOAUTH2SASLString builds the SASL XOAUTH2 initial-response string (used
 // by IMAP/SMTP clients authenticating with an OAuth2 access token instead
 // of a password) per Google's documented format, which Microsoft also