registry/cmd/publisher/commands/logout.go
Radoslav Dimitrov 90baa0528f
fix: store tokens in ~/.config/mcp-publisher/ instead of cwd (#1166)
## Summary

Fixes #663

- **Security fix**: `mcp-publisher login` no longer writes
`.mcpregistry_github_token` and `.mcpregistry_registry_token` to the
current working directory. GitHub tokens are kept in memory during the
login→exchange flow and cleared immediately after.
- **Token location**: Unified token moved from `~/.mcp_publisher_token`
to `~/.config/mcp-publisher/token.json` (dir 0700, file 0600), following
the convention used by `gh`, `docker`, and `kubectl`.
- **Dead code removed**: `NeedsLogin()` was on the `Provider` interface
but never called — removed from interface and all 4 implementations.
`forceLogin` field also removed.
- **Auth tests added**: 11 new tests for `GitHubATProvider` (package
previously had 0 tests).
- **Test isolation**: `SetupTestToken` now uses `t.TempDir()` +
`t.Setenv("HOME", ...)` instead of writing to real `$HOME`.

### Breaking change

Users must re-login after upgrading (`mcp-publisher login <method>`).
Existing tokens at `~/.mcp_publisher_token` are not auto-migrated.
`logout` cleans up both old and new locations.

## Test plan

- [x] `make check` passes (lint, unit tests, integration tests)
- [x] `mcp-publisher login none` stores token at
`~/.config/mcp-publisher/token.json`
- [x] No `.mcpregistry_*` files created in cwd after login (with
`--token`, `MCP_GITHUB_TOKEN`, or device flow)
- [x] `mcp-publisher publish` reads token from new location
- [x] `mcp-publisher validate` reads registry URL from new location
- [x] `mcp-publisher logout` cleans up new location, legacy
`~/.mcp_publisher_token`, and cwd `.mcpregistry_*` files
- [x] `mcp-publisher logout` when not logged in shows "Not logged in"
- [x] File permissions: dir 0700, file 0600

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-15 03:23:07 -04:00

63 lines
1.3 KiB
Go

package commands
import (
"fmt"
"os"
"path/filepath"
)
func LogoutCommand() error {
tokenPath, err := tokenFilePath()
if err != nil {
return err
}
// Check if token file exists at new location or legacy location
homeDir, err := os.UserHomeDir()
if err != nil {
homeDir = "" // degrade gracefully for legacy cleanup
}
legacyTokenPath := ""
if homeDir != "" {
legacyTokenPath = filepath.Join(homeDir, LegacyTokenFileName)
}
newExists := fileExists(tokenPath)
legacyExists := legacyTokenPath != "" && fileExists(legacyTokenPath)
if !newExists && !legacyExists {
_, _ = fmt.Fprintln(os.Stdout, "Not logged in")
return nil
}
// Remove token file from new location
os.Remove(tokenPath)
// Remove from legacy location
if legacyTokenPath != "" {
os.Remove(legacyTokenPath)
}
// Clean up legacy intermediate token files from $HOME and cwd
legacyIntermediateFiles := []string{
".mcpregistry_github_token",
".mcpregistry_registry_token",
}
for _, file := range legacyIntermediateFiles {
// Clean from $HOME
if homeDir != "" {
os.Remove(filepath.Join(homeDir, file))
}
// Clean from cwd (the original bug location)
os.Remove(file)
}
_, _ = fmt.Fprintln(os.Stdout, "✓ Successfully logged out")
return nil
}
func fileExists(path string) bool {
_, err := os.Stat(path)
return err == nil
}