fix(auth): make logout reject only the credential tea stored

Signed-off-by: bircni <bircni@icloud.com>

internal/app/auth.go

@@ -709,7 +709,7 @@ instance, such as a copy of its token that a keychain kept after a push.`,
 			if err != nil {
 				return err
 			}
-			account, exists := t.host.Users[t.User]
+			_, exists := t.host.Users[t.User]
 			switch {
 			case len(t.host.Users) == 0:
 				return clierr.Wrap(clierr.Usage, fmt.Errorf("not logged in to %s", t.Host))
@@ -725,14 +725,14 @@ instance, such as a copy of its token that a keychain kept after a push.`,
 			if err != nil {
 				return err
 			}
-			if err := manager.Logout(t.Host, t.User); err != nil {
+			removed, err := manager.Logout(t.Host, t.User)
+			if err != nil {
 				return err
 			}
 			a.done(cmd, "Logged out of %s (%s)", t.Host, t.User)
-			if !account.Tokenless() {
-				if err := git.RejectCredentials(cmd.Context(), a.gitProbe(), a.options.cwd, t.Host, t.User); err != nil {
-					a.warn(cmd, "Could not ask git's credential helpers to forget %s on %s", t.User, t.Host)
-				}
+			// Helpers erase only the copies that hold the removed token, not the user's own credentials.
+			if err := git.RejectCredentials(cmd.Context(), a.gitProbe(), a.options.cwd, t.Host, t.User, removed.AccessToken); err != nil {
+				a.warn(cmd, "Could not ask git's credential helpers to forget %s on %s", t.User, t.Host)
 			}
 			if s, err := a.settings(); err == nil {
 				if active := s.Hosts.Hosts[t.Host].User; active != "" && active != t.host.User {

internal/app/auth_test.go

@@ -777,7 +777,7 @@ func TestLogoutAsksGitToForgetTheAccount(t *testing.T) {
 	deps.Git = runner
 	configureAccounts(t, deps, instance, "alice", "alice", "bob")
 	require.NoError(t, Execute(context.Background(), deps, []string{"auth", "logout", "--yes"}))
-	require.Equal(t, []string{"credential reject\nprotocol=https\nhost=example.org:3000\nusername=alice\n\n"}, runner.inputs)
+	require.Equal(t, []string{"credential reject\nprotocol=https\nhost=example.org:3000\nusername=alice\npassword=alice-token\n\n"}, runner.inputs)
 	require.Equal(t, "✓ Logged out of "+instance+" (alice)\n✓ Switched active account for "+instance+" to bob\n", withoutANSI(diagnostics.String()))
 	err := Execute(context.Background(), deps, []string{"auth", "logout", "carol", "--yes"})
 	require.EqualError(t, err, `account "carol" is not logged in on `+instance+" (accounts: bob)")