refactor: extract getActiveEnvVarName() shared helper in db/auth.ts

Replace the duplicated 3-line env var name extraction pattern in
login, logout, and refresh commands with a single getActiveEnvVarName()
helper exported from db/auth.ts.

Addresses BugBot feedback about code duplication across commands.

Author: BYK

src/commands/auth/login.ts

@@ -3,8 +3,7 @@ import { getCurrentUser, getUserRegions } from "../../lib/api-client.js";
 import { buildCommand, numberParser } from "../../lib/command.js";
 import {
   clearAuth,
-  ENV_SOURCE_PREFIX,
-  getAuthConfig,
+  getActiveEnvVarName,
   isAuthenticated,
   isEnvTokenActive,
   setAuthToken,
@@ -52,10 +51,7 @@ export const loginCommand = buildCommand({
     // Check if already authenticated
     if (await isAuthenticated()) {
       if (isEnvTokenActive()) {
-        const config = getAuthConfig();
-        const envVar = config?.source.startsWith(ENV_SOURCE_PREFIX)
-          ? config.source.slice(ENV_SOURCE_PREFIX.length)
-          : "SENTRY_AUTH_TOKEN";
+        const envVar = getActiveEnvVarName();
         stdout.write(
           `Authentication is provided via ${envVar} environment variable. ` +
             `Unset ${envVar} to use OAuth-based login instead.\n`

src/commands/auth/logout.ts

@@ -8,8 +8,7 @@ import type { SentryContext } from "../../context.js";
 import { buildCommand } from "../../lib/command.js";
 import {
   clearAuth,
-  ENV_SOURCE_PREFIX,
-  getAuthConfig,
+  getActiveEnvVarName,
   isAuthenticated,
   isEnvTokenActive,
 } from "../../lib/db/auth.js";
@@ -34,10 +33,7 @@ export const logoutCommand = buildCommand({
     }
 
     if (isEnvTokenActive()) {
-      const config = getAuthConfig();
-      const envVar = config?.source.startsWith(ENV_SOURCE_PREFIX)
-        ? config.source.slice(ENV_SOURCE_PREFIX.length)
-        : "SENTRY_AUTH_TOKEN";
+      const envVar = getActiveEnvVarName();
       stdout.write(
         `Authentication is provided via ${envVar} environment variable.\n` +
           `Unset ${envVar} to log out.\n`

src/commands/auth/refresh.ts

@@ -7,7 +7,7 @@
 import type { SentryContext } from "../../context.js";
 import { buildCommand } from "../../lib/command.js";
 import {
-  ENV_SOURCE_PREFIX,
+  getActiveEnvVarName,
   getAuthConfig,
   isEnvTokenActive,
   refreshToken,
@@ -69,10 +69,7 @@ Examples:
 
     // Env var tokens can't be refreshed
     if (isEnvTokenActive()) {
-      const config = getAuthConfig();
-      const envVar = config?.source.startsWith(ENV_SOURCE_PREFIX)
-        ? config.source.slice(ENV_SOURCE_PREFIX.length)
-        : "SENTRY_AUTH_TOKEN";
+      const envVar = getActiveEnvVarName();
       throw new AuthError(
         "invalid",
         "Cannot refresh an environment variable token.\n" +

src/lib/db/auth.ts

@@ -59,6 +59,22 @@ export function isEnvTokenActive(): boolean {
   return getEnvToken() !== undefined;
 }
 
+/**
+ * Get the name of the active env var providing authentication.
+ * Returns the specific variable name (e.g. "SENTRY_AUTH_TOKEN" or "SENTRY_TOKEN").
+ *
+ * **Important**: Call only after checking {@link isEnvTokenActive} returns true.
+ * Falls back to "SENTRY_AUTH_TOKEN" if no env source is active, which is a safe
+ * default for error messages but may be misleading if used unconditionally.
+ */
+export function getActiveEnvVarName(): string {
+  const env = getEnvToken();
+  if (env) {
+    return env.source.slice(ENV_SOURCE_PREFIX.length);
+  }
+  return "SENTRY_AUTH_TOKEN";
+}
+
 export function getAuthConfig(): AuthConfig | undefined {
   const envToken = getEnvToken();
   if (envToken) {

test/commands/auth/login.test.ts

@@ -130,18 +130,17 @@ describe("loginCommand.func --token path", () => {
   test("already authenticated (env token SENTRY_TOKEN): shows specific var name", async () => {
     isAuthenticatedSpy.mockResolvedValue(true);
     isEnvTokenActiveSpy.mockReturnValue(true);
-    const getAuthConfigSpy = spyOn(dbAuth, "getAuthConfig");
-    getAuthConfigSpy.mockReturnValue({
-      token: "sntrys_token_456",
-      source: "env:SENTRY_TOKEN",
-    });
+    // Set env var directly — getActiveEnvVarName() reads env vars via getEnvToken()
+    process.env.SENTRY_TOKEN = "sntrys_token_456";
 
     const { context, getStdout } = createContext();
-    await func.call(context, { timeout: 900 });
-
-    expect(getStdout()).toContain("SENTRY_TOKEN");
-    expect(getStdout()).not.toContain("SENTRY_AUTH_TOKEN");
-    getAuthConfigSpy.mockRestore();
+    try {
+      await func.call(context, { timeout: 900 });
+      expect(getStdout()).toContain("SENTRY_TOKEN");
+      expect(getStdout()).not.toContain("SENTRY_AUTH_TOKEN");
+    } finally {
+      delete process.env.SENTRY_TOKEN;
+    }
   });
 
   test("--token: stores token, fetches user, writes success", async () => {

test/commands/auth/logout.test.ts

@@ -117,17 +117,18 @@ describe("logoutCommand.func", () => {
   test("env token (SENTRY_TOKEN): shows correct env var name", async () => {
     isAuthenticatedSpy.mockResolvedValue(true);
     isEnvTokenActiveSpy.mockReturnValue(true);
-    getAuthConfigSpy.mockReturnValue({
-      token: "sntrys_token_456",
-      source: "env:SENTRY_TOKEN",
-    });
+    // Set env var directly — getActiveEnvVarName() reads env vars via getEnvToken()
+    process.env.SENTRY_TOKEN = "sntrys_token_456";
 
     const { context, getStdout } = createContext();
-    await func.call(context, {});
-
-    expect(clearAuthSpy).not.toHaveBeenCalled();
-    expect(getStdout()).toContain("SENTRY_TOKEN");
-    expect(getStdout()).not.toContain("SENTRY_AUTH_TOKEN");
+    try {
+      await func.call(context, {});
+      expect(clearAuthSpy).not.toHaveBeenCalled();
+      expect(getStdout()).toContain("SENTRY_TOKEN");
+      expect(getStdout()).not.toContain("SENTRY_AUTH_TOKEN");
+    } finally {
+      delete process.env.SENTRY_TOKEN;
+    }
   });
 
   test("env token: falls back to SENTRY_AUTH_TOKEN if source is unexpected", async () => {

test/commands/auth/refresh.test.ts

@@ -87,10 +87,8 @@ describe("refreshCommand.func", () => {
 
   test("env token (SENTRY_TOKEN): throws AuthError with SENTRY_TOKEN in message", async () => {
     isEnvTokenActiveSpy.mockReturnValue(true);
-    getAuthConfigSpy.mockReturnValue({
-      token: "sntrys_token_456",
-      source: "env:SENTRY_TOKEN",
-    });
+    // Set env var directly — getActiveEnvVarName() reads env vars via getEnvToken()
+    process.env.SENTRY_TOKEN = "sntrys_token_456";
 
     const { context } = createContext();
 
@@ -102,6 +100,8 @@ describe("refreshCommand.func", () => {
       expect((err as AuthError).message).toContain("Update SENTRY_TOKEN");
       // Should NOT say SENTRY_AUTH_TOKEN
       expect((err as AuthError).message).not.toContain("SENTRY_AUTH_TOKEN");
+    } finally {
+      delete process.env.SENTRY_TOKEN;
     }
 
     expect(refreshTokenSpy).not.toHaveBeenCalled();

test/lib/db/auth.test.ts

@@ -8,6 +8,7 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import {
   type AuthSource,
+  getActiveEnvVarName,
   getAuthConfig,
   getAuthToken,
   isAuthenticated,
@@ -155,6 +156,28 @@ describe("env var auth: isEnvTokenActive", () => {
   });
 });
 
+describe("env var auth: getActiveEnvVarName", () => {
+  test("returns SENTRY_AUTH_TOKEN when that var is set", () => {
+    process.env.SENTRY_AUTH_TOKEN = "test_token";
+    expect(getActiveEnvVarName()).toBe("SENTRY_AUTH_TOKEN");
+  });
+
+  test("returns SENTRY_TOKEN when only that var is set", () => {
+    process.env.SENTRY_TOKEN = "test_token";
+    expect(getActiveEnvVarName()).toBe("SENTRY_TOKEN");
+  });
+
+  test("prefers SENTRY_AUTH_TOKEN when both are set", () => {
+    process.env.SENTRY_AUTH_TOKEN = "primary";
+    process.env.SENTRY_TOKEN = "secondary";
+    expect(getActiveEnvVarName()).toBe("SENTRY_AUTH_TOKEN");
+  });
+
+  test("falls back to SENTRY_AUTH_TOKEN when no env var is set", () => {
+    expect(getActiveEnvVarName()).toBe("SENTRY_AUTH_TOKEN");
+  });
+});
+
 describe("env var auth: refreshToken", () => {
   test("returns env token without refreshing", async () => {
     process.env.SENTRY_AUTH_TOKEN = "env_token";