Authenticate reviews with Telegram init data

lib/api/mapflow_api.dart

@@ -3,21 +3,58 @@ import 'dart:convert';
 import 'package:http/http.dart' as http;
 import 'package:latlong2/latlong.dart';
 
+import '../auth/telegram_init_data.dart' as telegram_auth;
 import '../models/place_models.dart';
 
 class MapflowApi {
   MapflowApi({
     http.Client? client,
+    String? telegramInitData,
     String endpoint = const String.fromEnvironment(
       'API_BASE_URL',
       defaultValue: '/graphql',
     ),
   }) : _client = client ?? http.Client(),
+       _telegramInitData = telegramInitData ?? telegram_auth.telegramInitData(),
        _endpoint = Uri.base.resolve(endpoint);
 
   final http.Client _client;
+  final String _telegramInitData;
   final Uri _endpoint;
 
+  bool get hasTelegramAuth => _telegramInitData.isNotEmpty;
+
+  Future<AppUser?> authenticateTelegram() async {
+    if (_telegramInitData.isEmpty) {
+      return null;
+    }
+
+    final data = await _graphql(
+      '''
+        mutation AuthenticateTelegram(\$input: AuthenticateTelegramInput!) {
+          authenticateTelegram(input: \$input) {
+            user {
+              id
+              telegramId
+              username
+              firstName
+              lastName
+              photoUrl
+              languageCode
+            }
+          }
+        }
+      ''',
+      variables: {
+        'input': {'initData': _telegramInitData},
+      },
+    );
+
+    final payload = data['authenticateTelegram'] as Map<String, dynamic>;
+    final user = payload['user'] as Map<String, dynamic>;
+    return AppUser.fromJson(user);
+  }
+
   Future<List<PlaceRecommendation>> fetchPlaces() async {
     final data = await _graphql('''
       query Places {
@@ -61,6 +98,10 @@ class MapflowApi {
     required int durationSeconds,
     required String audioObjectKey,
   }) async {
+    if (_telegramInitData.isEmpty) {
+      throw StateError('Telegram authorization is required.');
+    }
+
     await _graphql(
       '''
         mutation CreateVoiceExperience(\$input: CreateVoiceExperienceInput!) {
@@ -88,7 +129,11 @@ class MapflowApi {
   }) async {
     final response = await _client.post(
       _endpoint,
-      headers: const {'content-type': 'application/json'},
+      headers: {
+        'content-type': 'application/json',
+        if (_telegramInitData.isNotEmpty)
+          'x-telegram-init-data': _telegramInitData,
+      },
       body: jsonEncode({'query': query, 'variables': variables ?? {}}),
     );