lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(xcecli): call the logout API so the token is revoked (bug-1959)

Browse source 
xcecli logout only removed the token from the local config, so the token
stayed valid on the server until it expired. It now first sends
POST /xce/v1/auth/logout with the bearer token (APIClient.Logout), which
revokes it server side since bug-1946. Best effort: if the server is
unreachable or rejects the token, the local login info is still cleared
and a warning says the revocation could not be confirmed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-10-10 10:21:11 +00:00
parent c71049f28d
commit 0379823098
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
3 changed files with 139 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/frontend/xcecli/common/request/request.go
View file

@ -75,6 +75,22 @@ func (c *APIClient) Logon(username, password string) (*models.LogonResponse, err
return &loginResp, nil
}
// Logout asks the API server to revoke the token (bug-1959): from then on
// the server rejects it, although it has not expired yet.
func (c *APIClient) Logout(token string) error {
resp, err := c.Client.R().
SetHeader("Authorization", "Bearer "+token).
Post(c.BaseURL + "/xce/v1/auth/logout")
if err != nil {
errMsg := ExtractErrorMessage(err)
return fmt.Errorf("logout failed: [%s]", errMsg)
}
if resp.StatusCode() != http.StatusOK {
return HandleErrorResponse(resp, "logout request")
}
return nil
}
func (c *APIClient) GetRequestFromAPIServer(token, pageToken, dst string, resp any, params map[string]string) error {
baseURL := c.BaseURL
if idx := strings.Index(baseURL, dst); idx != -1 {