## Summary Fixes #663 - **Security fix**: `mcp-publisher login` no longer writes `.mcpregistry_github_token` and `.mcpregistry_registry_token` to the current working directory. GitHub tokens are kept in memory during the login→exchange flow and cleared immediately after. - **Token location**: Unified token moved from `~/.mcp_publisher_token` to `~/.config/mcp-publisher/token.json` (dir 0700, file 0600), following the convention used by `gh`, `docker`, and `kubectl`. - **Dead code removed**: `NeedsLogin()` was on the `Provider` interface but never called — removed from interface and all 4 implementations. `forceLogin` field also removed. - **Auth tests added**: 11 new tests for `GitHubATProvider` (package previously had 0 tests). - **Test isolation**: `SetupTestToken` now uses `t.TempDir()` + `t.Setenv("HOME", ...)` instead of writing to real `$HOME`. ### Breaking change Users must re-login after upgrading (`mcp-publisher login <method>`). Existing tokens at `~/.mcp_publisher_token` are not auto-migrated. `logout` cleans up both old and new locations. ## Test plan - [x] `make check` passes (lint, unit tests, integration tests) - [x] `mcp-publisher login none` stores token at `~/.config/mcp-publisher/token.json` - [x] No `.mcpregistry_*` files created in cwd after login (with `--token`, `MCP_GITHUB_TOKEN`, or device flow) - [x] `mcp-publisher publish` reads token from new location - [x] `mcp-publisher validate` reads registry URL from new location - [x] `mcp-publisher logout` cleans up new location, legacy `~/.mcp_publisher_token`, and cwd `.mcpregistry_*` files - [x] `mcp-publisher logout` when not logged in shows "Not logged in" - [x] File permissions: dir 0700, file 0600 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
63 lines
1.3 KiB
Go
63 lines
1.3 KiB
Go
package commands
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
)
|
|
|
|
func LogoutCommand() error {
|
|
tokenPath, err := tokenFilePath()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// Check if token file exists at new location or legacy location
|
|
homeDir, err := os.UserHomeDir()
|
|
if err != nil {
|
|
homeDir = "" // degrade gracefully for legacy cleanup
|
|
}
|
|
legacyTokenPath := ""
|
|
if homeDir != "" {
|
|
legacyTokenPath = filepath.Join(homeDir, LegacyTokenFileName)
|
|
}
|
|
|
|
newExists := fileExists(tokenPath)
|
|
legacyExists := legacyTokenPath != "" && fileExists(legacyTokenPath)
|
|
|
|
if !newExists && !legacyExists {
|
|
_, _ = fmt.Fprintln(os.Stdout, "Not logged in")
|
|
return nil
|
|
}
|
|
|
|
// Remove token file from new location
|
|
os.Remove(tokenPath)
|
|
|
|
// Remove from legacy location
|
|
if legacyTokenPath != "" {
|
|
os.Remove(legacyTokenPath)
|
|
}
|
|
|
|
// Clean up legacy intermediate token files from $HOME and cwd
|
|
legacyIntermediateFiles := []string{
|
|
".mcpregistry_github_token",
|
|
".mcpregistry_registry_token",
|
|
}
|
|
|
|
for _, file := range legacyIntermediateFiles {
|
|
// Clean from $HOME
|
|
if homeDir != "" {
|
|
os.Remove(filepath.Join(homeDir, file))
|
|
}
|
|
// Clean from cwd (the original bug location)
|
|
os.Remove(file)
|
|
}
|
|
|
|
_, _ = fmt.Fprintln(os.Stdout, "✓ Successfully logged out")
|
|
return nil
|
|
}
|
|
|
|
func fileExists(path string) bool {
|
|
_, err := os.Stat(path)
|
|
return err == nil
|
|
}
|