Function check_push_credentials

atomic-cli/src/commands/auth.rs:312–333

Verify, before a push begins, that the client can produce credentials for `remote_url`. Fails fast with an actionable error instead of letting the push proceed into a confusing 404 (which the server returns for private projects the caller isn't authorized to see). Returns `Ok(())` when an identity is resolvable (from `--identity` or the URL), exists in the local store, and has a loadable signing

(remote_url: &str, identity_override: Option<&str>)

/// it. The two must agree, or the fail-fast check here would reject a push that
/// `attach_identity` would have authenticated.
pub fn check_push_credentials(remote_url: &str, identity_override: Option<&str>) -> CliResult<()> {
    let store = IdentityStore::open_default()
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to open identity store: {e}")))?;

    let issue = evaluate_push_credentials(
        resolve_identity_name_with_override(remote_url, identity_override),
        identity_override.is_some(),
        |name| load_identity_lenient(&store, name).is_some(),
        |name| {
            load_identity_lenient(&store, name)
                .map(|id| store.load_keypair(&id.id, None).is_ok())
                .unwrap_or(false)
        },
    );

    match issue {
        Some(issue) => Err(CliError::AuthenticationFailed {
            remote: format!("{remote_url}: {}", issue.message()),
        }),
        None => Ok(()),
    }
}

/// Pure decision core for [`check_push_credentials`], split out so it can be
/// unit-tested without touching the on-disk identity store.