refactor: extract getActiveEnvVarName() shared helper in db/auth.ts

Replace the duplicated 3-line env var name extraction pattern in
login, logout, and refresh commands with a single getActiveEnvVarName()
helper exported from db/auth.ts.

Addresses BugBot feedback about code duplication across commands.

Author: BYK

src/commands/auth/login.ts

@@ -3,8 +3,7 @@ import { getCurrentUser, getUserRegions } from "../../lib/api-client.js";
 import { buildCommand, numberParser } from "../../lib/command.js";
 import {
   clearAuth,
-  ENV_SOURCE_PREFIX,
-  getAuthConfig,
+  getActiveEnvVarName,
   isAuthenticated,
   isEnvTokenActive,
   setAuthToken,
@@ -52,10 +51,7 @@ export const loginCommand = buildCommand({
     // Check if already authenticated
     if (await isAuthenticated()) {
       if (isEnvTokenActive()) {
-        const config = getAuthConfig();
-        const envVar = config?.source.startsWith(ENV_SOURCE_PREFIX)
-          ? config.source.slice(ENV_SOURCE_PREFIX.length)
-          : "SENTRY_AUTH_TOKEN";
+        const envVar = getActiveEnvVarName();
         stdout.write(
           `Authentication is provided via ${envVar} environment variable. ` +
             `Unset ${envVar} to use OAuth-based login instead.\n`

src/commands/auth/logout.ts

@@ -8,8 +8,7 @@ import type { SentryContext } from "../../context.js";
 import { buildCommand } from "../../lib/command.js";
 import {
   clearAuth,
-  ENV_SOURCE_PREFIX,
-  getAuthConfig,
+  getActiveEnvVarName,
   isAuthenticated,
   isEnvTokenActive,
 } from "../../lib/db/auth.js";
@@ -34,10 +33,7 @@ export const logoutCommand = buildCommand({
     }
 
     if (isEnvTokenActive()) {
-      const config = getAuthConfig();
-      const envVar = config?.source.startsWith(ENV_SOURCE_PREFIX)
-        ? config.source.slice(ENV_SOURCE_PREFIX.length)
-        : "SENTRY_AUTH_TOKEN";
+      const envVar = getActiveEnvVarName();
       stdout.write(
         `Authentication is provided via ${envVar} environment variable.\n` +
           `Unset ${envVar} to log out.\n`

src/commands/auth/refresh.ts

@@ -7,7 +7,7 @@
 import type { SentryContext } from "../../context.js";
 import { buildCommand } from "../../lib/command.js";
 import {
-  ENV_SOURCE_PREFIX,
+  getActiveEnvVarName,
   getAuthConfig,
   isEnvTokenActive,
   refreshToken,
@@ -69,10 +69,7 @@ Examples:
 
     // Env var tokens can't be refreshed
     if (isEnvTokenActive()) {
-      const config = getAuthConfig();
-      const envVar = config?.source.startsWith(ENV_SOURCE_PREFIX)
-        ? config.source.slice(ENV_SOURCE_PREFIX.length)
-        : "SENTRY_AUTH_TOKEN";
+      const envVar = getActiveEnvVarName();
       throw new AuthError(
         "invalid",
         "Cannot refresh an environment variable token.\n" +

src/lib/db/auth.ts

@@ -59,6 +59,22 @@ export function isEnvTokenActive(): boolean {
   return getEnvToken() !== undefined;
 }
 
+/**
+ * Get the name of the active env var providing authentication.
+ * Returns the specific variable name (e.g. "SENTRY_AUTH_TOKEN" or "SENTRY_TOKEN").
+ *
+ * **Important**: Call only after checking {@link isEnvTokenActive} returns true.
+ * Falls back to "SENTRY_AUTH_TOKEN" if no env source is active, which is a safe
+ * default for error messages but may be misleading if used unconditionally.
+ */
+export function getActiveEnvVarName(): string {
+  const config = getAuthConfig();
+  if (config?.source.startsWith(ENV_SOURCE_PREFIX)) {
+    return config.source.slice(ENV_SOURCE_PREFIX.length);
+  }
+  return "SENTRY_AUTH_TOKEN";
+}
+
 export function getAuthConfig(): AuthConfig | undefined {
   const envToken = getEnvToken();
   if (envToken) {

test/lib/db/auth.test.ts

@@ -8,6 +8,7 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import {
   type AuthSource,
+  getActiveEnvVarName,
   getAuthConfig,
   getAuthToken,
   isAuthenticated,
@@ -155,6 +156,28 @@ describe("env var auth: isEnvTokenActive", () => {
   });
 });
 
+describe("env var auth: getActiveEnvVarName", () => {
+  test("returns SENTRY_AUTH_TOKEN when that var is set", () => {
+    process.env.SENTRY_AUTH_TOKEN = "test_token";
+    expect(getActiveEnvVarName()).toBe("SENTRY_AUTH_TOKEN");
+  });
+
+  test("returns SENTRY_TOKEN when only that var is set", () => {
+    process.env.SENTRY_TOKEN = "test_token";
+    expect(getActiveEnvVarName()).toBe("SENTRY_TOKEN");
+  });
+
+  test("prefers SENTRY_AUTH_TOKEN when both are set", () => {
+    process.env.SENTRY_AUTH_TOKEN = "primary";
+    process.env.SENTRY_TOKEN = "secondary";
+    expect(getActiveEnvVarName()).toBe("SENTRY_AUTH_TOKEN");
+  });
+
+  test("falls back to SENTRY_AUTH_TOKEN when no env var is set", () => {
+    expect(getActiveEnvVarName()).toBe("SENTRY_AUTH_TOKEN");
+  });
+});
+
 describe("env var auth: refreshToken", () => {
   test("returns env token without refreshing", async () => {
     process.env.SENTRY_AUTH_TOKEN = "env_token";