evaluate_hazards triggers interactive Earth Engine auth for credential-free sources

[Sammyjoseph999]

While using evaluate_hazards with a credential-free source (nasa_power), the toolkit launched an interactive Earth Engine OAuth flow (ee.Authenticate()) in the browser and saved a credential token to ~/.config/earthengine/credentials — with no opt-in. A data-analysis call should never launch interactive auth implicitly.

Reproduce

import climate_toolkit as ct
ct.evaluate_hazards(
    crop_name="maize", location_coord=(-1.286, 36.817),
    date_from="2020-01-01", date_to="2020-06-30",
    source="nasa_power",           # no Earth Engine requested
)

Actual: prints To authorize access needed by Earth Engine, open the following URL ..., opens a browser, and on completion writes ~/.config/earthengine/credentials.

Expected: degrade gracefully with no auth prompt — exactly like download_station_data/compare_station_to_grids already do:

Anchor elevation unavailable; continuing without elevation guard.
Reason: Earth Engine project ID missing. ...

Cause

The livestock heat-stress branch auto-fetches an elevation anchor:

• climate_toolkit/calculate_hazards/hazards.py:351-352 → elevation resolver with auto_fetch_elevation=True
• that reaches climate_toolkit/fetch_data/source_data/sources/gee.py:42, which calls ee.Authenticate() unconditionally when EE is not already initialized

By contrast, the weather-station elevation path (climate_toolkit/weather_station/dem.py:98 fetch_anchor_elevation → initialize_earth_engine) catches the missing-project condition and continues without the elevation guard.

Suggested fix

1. Never call ee.Authenticate() implicitly from a library/analysis path.
2. Have the hazards elevation auto-fetch use the same graceful degradation as the weather-station path: if Earth Engine is not configured (no GCP_PROJECT_ID / not authenticated), skip the elevation guard and continue, with a one-line note.
3. Optionally gate auto_fetch_elevation behind an explicit EE-availability check.

Impact

Users running credential-free workflows (e.g. source="nasa_power") unexpectedly get an interactive auth prompt and a saved Google credential on their machine.

[Sammyjoseph999]

Correction after a closer look: the root cause I first gave (the hazards elevation path) is not it — that path is already safe (heat_stress.py wraps the DEM fetch in try/except, and xee_common.initialize_earth_engine only calls ee.Initialize, raising a clear error when no project id is set).

The real defect is gee.py:_ensure_gee_initialized() calling ee.Authenticate() unconditionally — the only spot in the codebase that launches an interactive browser OAuth flow from library code. Any path reaching a GEE-backed fetch triggers it.

Fix in #126: initialize only (no Authenticate), with a clear setup error, matching the Xee path. A follow-up question remains — why evaluate_hazards(source="nasa_power") reaches a GEE path at all — but the interactive-auth side effect is removed regardless of caller.

[Sammyjoseph999]

Follow-up resolved (traced the call chain): evaluate_hazards reaches Earth Engine to fetch soil properties for the water-balance soil-storage parameters — calculate_hazards → _resolve_soil_storage_params → _fetch_soil_grid_snapshot / _fetch_hwsd_snapshot → fetch_data(source="soil_grid" / "hwsd") → gee.py. SoilGrids/HWSD are the only soil sources and are GEE-backed, so this is expected (soil data needs GEE even when the climate source is nasa_power).

Not a bug in itself. With #126, that soil fetch now degrades gracefully — I verified evaluate_hazards(source="nasa_power", fixed_season=...) completes and returns a full result dict, falling back to default soil params, with no auth prompt.

Optional future nicety (separate from this issue): skip the soil fetch entirely when the caller passes explicit soilcp/soilsat, to avoid a doomed lookup + log noise for credential-free users.

[Sammyjoseph999]

Reopening: the fix (#126) is still an open PR and hasn't merged to main yet. This should auto-close when #126 merges (its body has Fixes #125).