Skip to content

Clear all cached registry tokens on logout#5382

Merged
rdimitrov merged 1 commit into
mainfrom
steady-hadrosaurus
May 26, 2026
Merged

Clear all cached registry tokens on logout#5382
rdimitrov merged 1 commit into
mainfrom
steady-hadrosaurus

Conversation

@rdimitrov
Copy link
Copy Markdown
Member

Summary

thv registry logout left the cached access token stored under <key>_AT behind, so the next thv registry login short-circuited through tier 2 of the shared OAuthTokenSource and returned the cached token without ever triggering a browser flow. The same gap also left stale entries under derived keys after a registry URL or issuer change.

  • pkg/registry/auth/login.goLogout now lists every secret visible to the registry-scoped provider and deletes them in one shot, mirroring pkg/llm.DeleteCachedTokens. The refresh-token key, its _AT companion, and any stale entries from previous configs are all cleared in a single pass.
  • pkg/registry/auth/login_test.go — replaces the targeted-delete tests with cases covering: full cleanup (including _AT and a stale entry), no-op on empty list, no-op for providers that can't list/delete, error propagation on ListSecrets/DeleteSecrets, and config-update error propagation.

Closes #5373

Type of change

  • Bug fix (non-breaking change which fixes an issue)

Test plan

  • Unit tests added/updated — go test -race ./pkg/registry/auth/... ./pkg/auth/tokensource/... ./pkg/llm/... passes
  • task lint-fix reports 0 issues

Does this introduce a user-facing change?

thv registry logout now fully clears all cached registry OAuth credentials, so a subsequent thv registry login always triggers a fresh browser auth flow rather than silently reusing a cached access token.

Generated with Claude Code

thv registry logout only deleted the refresh-token key and its derived
fallback. The shared OAuthTokenSource also persists an access-token
cache under "<key>_AT", and its tier-2 lookup reads that key directly.
The cached access token survived logout, so the next thv registry login
short-circuited through the cache instead of triggering a fresh browser
flow.

Replace the targeted deletes with a list-and-bulk-delete over every
secret visible to the registry-scoped provider, mirroring
pkg/llm.DeleteCachedTokens. This also catches stale entries left behind
under derived keys after a registry URL or issuer change.

Closes #5373
@rdimitrov rdimitrov requested a review from JAORMX as a code owner May 26, 2026 07:14
@github-actions github-actions Bot added the size/S Small PR: 100-299 lines changed label May 26, 2026
@codecov
Copy link
Copy Markdown

codecov Bot commented May 26, 2026

Codecov Report

❌ Patch coverage is 93.75000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 68.81%. Comparing base (2043cf6) to head (56d311d).

Files with missing lines Patch % Lines
pkg/registry/auth/login.go 93.75% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main    #5382   +/-   ##
=======================================
  Coverage   68.81%   68.81%           
=======================================
  Files         627      627           
  Lines       63594    63600    +6     
=======================================
+ Hits        43762    43767    +5     
+ Misses      16583    16581    -2     
- Partials     3249     3252    +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@rdimitrov rdimitrov merged commit 394b2e7 into main May 26, 2026
45 checks passed
@rdimitrov rdimitrov deleted the steady-hadrosaurus branch May 26, 2026 14:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/S Small PR: 100-299 lines changed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

thv registry logout leaves cached access token, allowing silent re-auth

2 participants