Function evaluate_push_credentials

atomic-cli/src/commands/auth.rs:464–492

Pure decision core for [`check_push_credentials`], split out so it can be unit-tested without touching the on-disk identity store. `explicit` — whether `--identity` was passed. `inferred` — the name inferred from the URL/flag (before fallback); used only to name the missing identity in the error message. `resolved_name` — the identity name to use **after** the default fallback (`None` when nothin

(
    explicit: bool,
    inferred: Option<&str>,
    resolved_name: Option<&str>,
    keypair_loadable: impl Fn(&str) -> bool,
)

/// Returns `None` when credentials are usable, or `Some(issue)` describing the
/// problem.
fn evaluate_push_credentials(
    explicit: bool,
    inferred: Option<&str>,
    resolved_name: Option<&str>,
    keypair_loadable: impl Fn(&str) -> bool,
) -> Option<CredentialIssue> {
    match resolved_name {
        Some(name) => {
            if !keypair_loadable(name) {
                return Some(CredentialIssue::KeypairUnavailable {
                    name: name.to_string(),
                });
            }
            None
        }
        None => {
            // No usable identity. If --identity was explicit, name the missing
            // identity so the user knows which input was wrong. Otherwise the
            // fallback to default also failed (no default) — report that.
            if explicit {
                Some(CredentialIssue::ExplicitIdentityNotFound {
                    name: inferred.unwrap_or_default().to_string(),
                })
            } else {
                Some(CredentialIssue::NoIdentity)
            }
        }
    }
}

/// Derive the apex server URL (scheme + host without the leading subdomain
/// label + port) from a tenant-scoped remote URL.