Function check_push_credentials

atomic-cli/src/commands/auth.rs:420–450

Verify, before a push begins, that the client can produce credentials for `remote_url`. Fails fast with an actionable error instead of letting the push proceed into a confusing 404 (which the server returns for private projects the caller isn't authorized to see). Returns `Ok(())` when an identity is resolvable (from `--identity`, the URL, or the default identity), exists in the local store, and

(remote_url: &str, identity_override: Option<&str>)

/// `--identity` explicitly names an identity that doesn't exist — that is a
/// clear error, not a silent substitution.
pub fn check_push_credentials(remote_url: &str, identity_override: Option<&str>) -> CliResult<()> {
    let store = IdentityStore::open_default()
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to open identity store: {e}")))?;

    let inferred = resolve_identity_name_with_override(remote_url, identity_override);
    let explicit = identity_override.is_some();

    // Resolve a concrete identity, falling back to the default when the
    // inferred name doesn't match (and the name didn't come from --identity).
    let identity =
        resolve_identity_with_default_fallback(&store, inferred.as_deref(), explicit, "push");
    let resolved_name = identity.as_ref().map(|id| id.name.clone());

    let issue = evaluate_push_credentials(
        explicit,
        inferred.as_deref(),
        resolved_name.as_deref(),
        |name| {
            load_identity_lenient(&store, name)
                .map(|id| store.load_keypair(&id.id, None).is_ok())
                .unwrap_or(false)
        },
    );

    match issue {
        Some(issue) => Err(CliError::AuthenticationFailed {
            remote: format!("{remote_url}: {}", issue.message()),
        }),
        None => Ok(()),
    }
}

/// Pure decision core for [`check_push_credentials`], split out so it can be
/// unit-tested without touching the on-disk identity store.