Function evaluate_push_credentials

atomic-cli/src/commands/auth.rs:345–365

Pure decision core for [`check_push_credentials`], split out so it can be unit-tested without touching the on-disk identity store. `identity_name` — the resolved identity (override or URL-inferred), if any. `from_flag` — whether `identity_name` came from `--identity` (vs. the URL). `identity_exists` — whether an identity with the given name is in the store. `keypair_loadable` — whether that ident

(
    identity_name: Option<String>,
    from_flag: bool,
    identity_exists: impl Fn(&str) -> bool,
    keypair_loadable: impl Fn(&str) -> bool,
)

/// Returns `None` when credentials are usable, or `Some(issue)` describing the
/// first problem encountered.
fn evaluate_push_credentials(
    identity_name: Option<String>,
    from_flag: bool,
    identity_exists: impl Fn(&str) -> bool,
    keypair_loadable: impl Fn(&str) -> bool,
) -> Option<CredentialIssue> {
    let name = match identity_name {
        Some(n) => n,
        None => return Some(CredentialIssue::NoIdentityInUrl),
    };

    if !identity_exists(&name) {
        return Some(CredentialIssue::IdentityNotFound { name, from_flag });
    }

    if !keypair_loadable(&name) {
        return Some(CredentialIssue::KeypairUnavailable { name });
    }

    None
}

/// Derive the apex server URL (scheme + host without the leading subdomain
/// label + port) from a tenant-scoped remote URL.