fix(auth): make logout reject only the credential tea stored

Signed-off-by: bircni <bircni@icloud.com>

internal/git/credentials.go

@@ -153,25 +153,23 @@ func (s System) Input(ctx context.Context, dir, input string, args ...string) (s
 	return s.Output(ctx, dir, true, args...)
 }
 
-// RejectCredentials asks Git's credential helpers to erase the credentials they stored for user on
-// instance, such as a copy of tea's token that another helper kept after a push. Runners that cannot
-// send input reject nothing.
-func RejectCredentials(ctx context.Context, runner Runner, dir, instance, user string) error {
+// RejectCredentials asks Git's credential helpers to erase the copies of token they stored for user on
+// instance, such as one that a keychain kept after a push. Helpers keep entries with another password,
+// such as the user's own. Runners that cannot send input reject nothing.
+func RejectCredentials(ctx context.Context, runner Runner, dir, instance, user, token string) error {
 	input, ok := runner.(InputRunner)
-	if !ok {
+	if !ok || user == "" || token == "" {
 		return nil
 	}
 	u, err := url.Parse(instance)
 	if err != nil || u.Host == "" {
 		return fmt.Errorf("invalid instance URL %q", instance)
 	}
-	if strings.ContainsAny(user, "\x00\r\n") {
-		return errors.New("invalid account name")
-	}
-	request := "protocol=" + u.Scheme + "\nhost=" + u.Host + "\n"
-	if user != "" {
-		request += "username=" + user + "\n"
+	if strings.ContainsAny(user+token, "\x00\r\n") {
+		return errors.New("invalid account name or token")
 	}
+	// No path: copies are stored per repository when useHttpPath is set, and a path must match exactly.
+	request := "protocol=" + u.Scheme + "\nhost=" + u.Host + "\nusername=" + user + "\npassword=" + token + "\n"
 	_, err = input.Input(ctx, dir, request+"\n", "credential", "reject")
 	return err
 }

internal/git/credentials_test.go

@@ -102,11 +102,23 @@ func TestRejectCredentialsAsksHelpersToEraseTheAccount(t *testing.T) {
 	runner := System{}
 	_, err := runner.Output(ctx, home, false, "config", "--global", "credential.helper", "!f() { echo \"op=$1\" >> '"+log+"'; cat >> '"+log+"'; }; f")
 	require.NoError(t, err)
+	store := filepath.Join(home, "git-credentials")
+	_, err = runner.Output(ctx, home, false, "config", "--global", "--add", "credential.helper", "store --file="+store)
+	require.NoError(t, err)
+	own := "http://alice:own-password@localhost:3001\n"
+	require.NoError(t, os.WriteFile(store, []byte(own+"http://alice:tea-token@localhost:3001/gitea/alice/project.git\n"), 0o600))
 	require.Empty(t, HelperScope(ctx, runner, home, "http://localhost:3001"))
-	require.NoError(t, RejectCredentials(ctx, runner, home, "http://localhost:3001/gitea", "alice"))
+	require.NoError(t, RejectCredentials(ctx, runner, home, "http://localhost:3001/gitea", "alice", "tea-token"))
 	data, err := os.ReadFile(log)
 	require.NoError(t, err)
-	require.Equal(t, "op=erase\nprotocol=http\nhost=localhost:3001\nusername=alice\n", string(data))
+	require.Equal(t, "op=erase\nprotocol=http\nhost=localhost:3001\nusername=alice\npassword=tea-token\n", string(data))
+	data, err = os.ReadFile(store)
+	require.NoError(t, err)
+	require.Equal(t, own, string(data), "only the copy of tea's token is erased")
+	require.NoError(t, RejectCredentials(ctx, runner, home, "http://localhost:3001", "alice", ""))
+	data, err = os.ReadFile(store)
+	require.NoError(t, err)
+	require.Equal(t, own, string(data), "without a token nothing is erased")
 	executable, err := os.Executable()
 	require.NoError(t, err)
 	require.NoError(t, SetupCredentials(ctx, runner, CredentialSetup{Directory: home, Instance: "http://localhost:3001", Executable: executable}))