CLI: logout never revokes the server session, and no session commands exist #114

New issue

Closed

opened 2026-08-18 10:45:21 +00:00 by nalum · 0 comments

nalum commented

2026-08-18 10:45:21 +00:00

Owner

From the surface parity report (2026-08-18), defect 2.

eagraiclainne logout deletes the local token file only. The server session survives until expiry or a JWT secret rotation. The CLI also has no ListSessions / RevokeSession commands (no client wrappers are called from cmd/). So the CLI can mint sessions it can never end.

Where: cmd/eagraiclainne/commands/logout.go.

Fix:

Make logout call UserService/Logout (revoke) before it deletes the token file.
Add session list and session revoke commands — session management is a natural maintenance-tier verb.

Related: #112 (session behavior oddities on web).

From the surface parity report (2026-08-18), defect 2. `eagraiclainne logout` deletes the local token file only. The server session survives until expiry or a JWT secret rotation. The CLI also has no `ListSessions` / `RevokeSession` commands (no client wrappers are called from `cmd/`). So the CLI can mint sessions it can never end. Where: `cmd/eagraiclainne/commands/logout.go`. Fix: 1. Make `logout` call `UserService/Logout` (revoke) before it deletes the token file. 2. Add `session list` and `session revoke` commands — session management is a natural maintenance-tier verb. Related: #112 (session behavior oddities on web).

nalum added the

bug

label

2026-08-18 10:45:21 +00:00

nalum referenced this issue

2026-08-18 11:22:44 +00:00

Order of work for the open backlog (#107–#136) #137

nalum referenced this issue from a commit

2026-08-18 12:59:24 +00:00

fix(cli): a logout that ends the session, and session commands

nalum referenced this issue from a pull request that will close it,

2026-08-18 12:59:38 +00:00