refactor(auth): consolidate the auth-source secret lookup into one helper

The auth-source-search + funcall-the-secret block was copied four times: calendar-sync--calendar-url, cj/auth-source-secret (ai-config), cj/--auth-source-password (transcription), and cj/slack--get-credential. Each searched authinfo, pulled :secret, and called it when the netrc backend returned a function.

I pulled that into cj/auth-source-secret-value in system-lib (a leaf, so calendar-sync doesn't have to depend on ai-config and drag in the gptel stack). It takes an optional user and returns the secret or nil. The four callers now delegate to it: ai-config layers its required-secret error on top, and the others keep their nil-on-miss behavior. With the direct auth-source-search calls gone, I dropped the now-unused (require 'auth-source) from transcription, slack, and calendar-sync. The helper's autoload covers it.

The transcription tests that exercise the delegated path stay green, and the primitive and the error wrapper get their own tests.

1 files changed, 6 insertions, 8 deletions

diff --git a/modules/ai-config.el b/modules/ai-config.el
index 8cf70ee4..fad43584 100644
--- a/modules/ai-config.el
+++ b/modules/ai-config.el
@@ -29,6 +29,7 @@
 ;;; Code:
 
 (require 'keybindings)  ;; provides cj/custom-keymap
+(require 'system-lib)   ;; provides cj/auth-source-secret-value
 
 (autoload 'cj/gptel-save-conversation "ai-conversations" "Save the AI conversation to a file." t)
 (autoload 'cj/gptel-load-conversation "ai-conversations" "Load a saved AI conversation." t)
@@ -100,15 +101,12 @@ tools are reported with `message' and do not signal."
   (cj/gptel-load-local-tools))
 
 (defun cj/auth-source-secret (host user)
-  "Fetch a secret from auth-source for HOST and USER.
+  "Fetch a required secret from auth-source for HOST and USER.
 
-HOST and USER must be strings that identify the credential to return."
-  (let* ((found (auth-source-search :host host :user user :require '(:secret) :max 1))
-         (secret (plist-get (car found) :secret)))
-    (cond
-     ((functionp secret) (funcall secret))
-     ((stringp secret) secret)
-     (t (error "No usable secret found for host %s and user %s" host user)))))
+HOST and USER must be strings that identify the credential to return.
+Errors when no secret is found."
+  (or (cj/auth-source-secret-value host user)
+      (error "No usable secret found for host %s and user %s" host user)))
 
 (defun cj/anthropic-api-key ()
   "Return the Anthropic API key, caching the result after first retrieval."