Repository navigation
fix(auth): sign-out ends the session on the platform (0.1.28) - #45
Merged
Merged
Conversation
`nan auth logout` and the panel's `o o` only deleted session.json. The session token stayed valid on the platform until it expired, so any copy of it kept working. Both now POST /api/auth/logout with the session (as a bearer, and as the nan_session cookie every other call already uses, so a platform that predates bearer logout still revokes it) BEFORE deleting the local file. A 401 counts as already signed out. A platform that does not answer does not keep the member signed in locally: the file still goes and the member is told the session may outlive it. The logout call is bounded at 10s. The existing panel sign-out tests now talk to a fake platform instead of the real cloud-api. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review follow-up (QA blockers): - The panel no longer blocks on the logout call: the second o sends it as a tea.Cmd, shows 'signing out...', ignores further o presses, and does the local teardown when signedOutMsg arrives. Quitting before then leaves the member signed in locally, consistent with nothing being revoked. - Failure warnings are now asserted: the panel message (also appended when the tools removal failed) and the stderr line of nan auth logout, which names the real portal control and never prints the token. - Logout does not follow redirects (a 3xx is not a revocation), its timeout is testable, WithBaseURL lives in client.go and trims a trailing slash. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
nan auth logoutand the panel sign-out (otwice) now end the session on the platform (POST /api/auth/logout) before deletingsession.json. Version 0.1.27 -> 0.1.28.Why
Prod E2E 2026-10-12: both paths only deleted the local file. The session token stayed valid on the platform until expiry, so any copy of it (another machine, a leaked file) kept working.
How
api.Client.Logout(): POST/auth/logoutwith the session asAuthorization: Bearer(what the platform now honours, helmcode/nan-cloud-api#340) and as thenan_sessioncookie every other call of this client already uses, so the currently deployed platform (cookie-only logout) revokes it too. Both name the same session; the server revokes it once. 401 = already dead = success; any other non-2xx or a network error is reported. Bounded at 10s. No request when there is no session token (a PAT-only or API-key-only session has no platform session to end).nan auth logout: calls it while the file still exists; on failure prints a warning to stderr (no token in the message) and still signs out locally.api.Client.WithBaseURL+cmd.apiBaseURLfor tests. The two existing panel sign-out tests used to hit the real cloud-api with tokent; they now talk to a fake platform.Tests (spec first)
internal/api/logout_test.go: POST path, bearer + cookie headers; 401 not an error; 502 and unreachable are errors; no token sends nothing.cmd/logout_test.go: platform is asked whilesession.jsonstill exists, then the file goes; platform failure still signs out locally; PAT-only session sends nothing.internal/tui/signout_server_test.go: one press sends nothing; two presses send one POST with the bearer before the file is deleted; 200 and 502 both end signed out.go build ./...,go vet ./...,go test ./...: all ok.Deploy notes
Merging auto-publishes 0.1.28. Works against the current platform (cookie) and after nan-cloud-api#340 (bearer).
🤖 Generated with Claude Code