refactor(cli): hoist require_api_key and reuse CI-detection check

src/achievements.rs

@@ -1,4 +1,4 @@
-use crate::auth::{AuthManager, AuthSource};
+use crate::auth::require_api_key;
 use crate::config;
 use anyhow::{Context, Result};
 use serde::Deserialize;
@@ -80,17 +80,6 @@ async fn upload_achievement_image(
     Ok(presigned.r2_key)
 }
 
-fn require_api_key() -> Result<String> {
-    let auth_manager = AuthManager::new()?;
-    let auth_info = auth_manager.get_auth_info();
-    match auth_info.source {
-        AuthSource::None => {
-            anyhow::bail!("Not authenticated. Run `wavedash auth login` first.")
-        }
-        _ => Ok(auth_info.api_key.unwrap()),
-    }
-}
-
 pub struct CreateAchievementArgs<'a> {
     pub game_id: &'a str,
     pub identifier: &'a str,

src/auth.rs

@@ -158,6 +158,20 @@ impl AuthManager {
     }
 }
 
+/// Return the active API key, or bail with the standard "not authenticated"
+/// message. Shared by every scripted command so the message and the
+/// [`AuthSource`] match stay in sync in one place.
+pub(crate) fn require_api_key() -> Result<String> {
+    let auth_manager = AuthManager::new()?;
+    let auth_info = auth_manager.get_auth_info();
+    match auth_info.source {
+        AuthSource::None => {
+            bail!("Not authenticated. Run `wavedash auth login` first.")
+        }
+        _ => Ok(auth_info.api_key.unwrap()),
+    }
+}
+
 pub(crate) fn generate_state() -> String {
     use std::time::{SystemTime, UNIX_EPOCH};
     SystemTime::now()

src/clear_playtest_data.rs

@@ -1,11 +1,10 @@
-use crate::auth::{AuthManager, AuthSource};
+use crate::auth::require_api_key;
 use crate::config;
 use anyhow::Result;
 use colored::Colorize;
 use serde::Deserialize;
 use serde_json::json;
 use std::collections::BTreeMap;
-use std::io::IsTerminal;
 
 /// A single kind of playtest data that can be wiped for a game.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -90,29 +89,6 @@ impl ClearPlaytestDataArgs<'_> {
     }
 }
 
-fn require_api_key() -> Result<String> {
-    let auth_manager = AuthManager::new()?;
-    let auth_info = auth_manager.get_auth_info();
-    match auth_info.source {
-        AuthSource::None => {
-            anyhow::bail!("Not authenticated. Run `wavedash auth login` first.")
-        }
-        _ => Ok(auth_info.api_key.unwrap()),
-    }
-}
-
-/// True when we can't safely prompt for confirmation (CI or piped stdin).
-/// Mirrors `is_browser_login_unavailable` in main.rs.
-fn is_non_interactive() -> bool {
-    let ci = std::env::var("CI")
-        .map(|value| {
-            let value = value.trim().to_ascii_lowercase();
-            !value.is_empty() && value != "0" && value != "false"
-        })
-        .unwrap_or(false);
-    ci || !std::io::stdin().is_terminal()
-}
-
 #[derive(Debug, Deserialize)]
 struct ClearResult {
     /// Per-category result, keyed by the category's `api_key`. Values are counts
@@ -147,9 +123,11 @@ pub async fn handle_clear_playtest_data(args: ClearPlaytestDataArgs<'_>) -> Resu
         None => "ALL players".to_string(),
     };
 
-    // Confirm before doing anything destructive.
+    // Confirm before doing anything destructive. When we can't prompt (CI or
+    // piped stdin), the same check `wavedash auth login` uses, refuse rather
+    // than silently deleting.
     if !args.force {
-        if is_non_interactive() {
+        if crate::is_browser_login_unavailable() {
             anyhow::bail!(
                 "Refusing to clear playtest data without confirmation.\n\
                  Re-run with --force (alias --yes / -y) to proceed non-interactively."

src/init.rs

@@ -1,4 +1,4 @@
-use crate::auth::{AuthManager, AuthSource};
+use crate::auth::{require_api_key, AuthManager, AuthSource};
 use crate::config;
 use anyhow::Result;
 use comfy_table::modifiers::UTF8_ROUND_CORNERS;
@@ -444,17 +444,6 @@ pub async fn handle_init() -> Result<()> {
 
 // ── Scripted create commands ─────────────────────────────────────────
 
-fn require_api_key() -> Result<String> {
-    let auth_manager = AuthManager::new()?;
-    let auth_info = auth_manager.get_auth_info();
-    match auth_info.source {
-        AuthSource::None => {
-            anyhow::bail!("Not authenticated. Run `wavedash auth login` first.")
-        }
-        _ => Ok(auth_info.api_key.unwrap()),
-    }
-}
-
 pub async fn handle_team_create(name: &str) -> Result<()> {
     let api_key = require_api_key()?;
     let team = create_organization(&api_key, name).await?;

src/main.rs

@@ -430,7 +430,7 @@ enum AchievementCommands {
     },
 }
 
-fn env_flag_enabled(name: &str) -> bool {
+pub(crate) fn env_flag_enabled(name: &str) -> bool {
     std::env::var(name)
         .map(|value| {
             let value = value.trim().to_ascii_lowercase();
@@ -439,7 +439,9 @@ fn env_flag_enabled(name: &str) -> bool {
         .unwrap_or(false)
 }
 
-fn is_browser_login_unavailable() -> bool {
+/// True when we can't drive an interactive flow (CI or piped stdin), so
+/// browser login and confirmation prompts must be skipped.
+pub(crate) fn is_browser_login_unavailable() -> bool {
     env_flag_enabled("CI") || !std::io::stdin().is_terminal()
 }
 

src/stats.rs

@@ -1,4 +1,4 @@
-use crate::auth::{AuthManager, AuthSource};
+use crate::auth::require_api_key;
 use crate::config;
 use anyhow::Result;
 use serde::Deserialize;
@@ -12,17 +12,6 @@ struct Stat {
     display_name: String,
 }
 
-fn require_api_key() -> Result<String> {
-    let auth_manager = AuthManager::new()?;
-    let auth_info = auth_manager.get_auth_info();
-    match auth_info.source {
-        AuthSource::None => {
-            anyhow::bail!("Not authenticated. Run `wavedash auth login` first.")
-        }
-        _ => Ok(auth_info.api_key.unwrap()),
-    }
-}
-
 pub async fn handle_stat_create(game_id: &str, identifier: &str, name: &str) -> Result<()> {
     let api_key = require_api_key()?;
     let client = config::create_http_client()?;