quak logout ends the session on the server (closes #108)

logout now calls POST /users/logout with the saved token through the new
Client.logoutOnServer(), then deletes session.json even when that call
fails; in that case it says the server session could not be ended and
exits 1. It prints the account's cache directory and says it still holds
decrypted data. The default cache path moves into
defaultCacheDirectory(), shared with Library.open, so both name the same
directory.

Model: opus-5-5

src/cli-commands.ts

@@ -17,7 +17,11 @@ import {
 import { join } from "node:path";
 import { Client, type ClientSnapshot } from "./client.js";
 import { init } from "./crypto/index.js";
-import { Library, type LibraryClient } from "./library/index.js";
+import {
+    defaultCacheDirectory,
+    Library,
+    type LibraryClient,
+} from "./library/index.js";
 import {
     fileListRow,
     fileListLine,
@@ -146,14 +150,43 @@ export const whoamiCommand = async (ctx: CliContext): Promise<number> => {
     return 0;
 };
 
+// Ends the session on the server, then deletes the session file even when that
+// failed, and exits 1 if it did. The cache is left in place; the user is told
+// where it is.
 export const logoutCommand = async (ctx: CliContext): Promise<number> => {
-    if (existsSync(sessionPath(ctx))) {
-        unlinkSync(sessionPath(ctx));
-        ctx.stderr.write("Session deleted.\n");
-    } else {
+    const path = sessionPath(ctx);
+    if (!existsSync(path)) {
         ctx.stderr.write("No session found.\n");
+        return 0;
     }
-    return 0;
+    await init();
+    let cacheDir = ctx.cacheDir;
+    let failure: string | undefined;
+    try {
+        const client = ctx.loadSession(path);
+        if (client) {
+            cacheDir ??= defaultCacheDirectory(client.whoami().userID);
+            await client.logoutOnServer();
+            client.logout();
+        }
+    } catch (err) {
+        failure = err instanceof Error ? err.message : String(err);
+    }
+    unlinkSync(path);
+    if (failure === undefined) {
+        ctx.stderr.write("Session ended on the server.\n");
+    } else {
+        ctx.stderr.write(
+            `Could not end the session on the server: ${failure}\n`,
+        );
+    }
+    ctx.stderr.write("Session deleted.\n");
+    if (cacheDir !== undefined) {
+        ctx.stderr.write(
+            `Cache directory ${cacheDir} still holds decrypted data; delete it to remove that data.\n`,
+        );
+    }
+    return failure === undefined ? 0 : 1;
 };
 
 export const collectionsCommand = async (

src/client.ts

@@ -217,6 +217,14 @@ export class Client {
         };
     }
 
+    // Ends this client's session on the server (`POST /users/logout`), so the
+    // token stops working everywhere, including in any saved copy of it. This
+    // client is left as it was; call `logout()` to clear it.
+    async logoutOnServer(): Promise<void> {
+        this.assertLoggedIn();
+        await this.api.postJSON("/users/logout", {});
+    }
+
     // Zeroes the key buffers in place, so any copy of the reference held
     // elsewhere is wiped too. Every method checks `assertLoggedIn` before
     // touching the keys, so nothing decrypts with the zeroed keys.

src/library/index.ts

@@ -98,6 +98,11 @@ export {
 
 export const DEFAULT_REFRESH_INTERVAL_SECONDS = 3;
 
+// The account's cache directory when `cacheDirectory` is not given: the
+// env-paths cache directory plus the user id, so each account has its own.
+export const defaultCacheDirectory = (userID: number): string =>
+    join(envPaths("quak", { suffix: "" }).cache, String(userID));
+
 // Project a metadata store into by-id records, filling each record's cache
 // paths from the content cache when one is given. Shared by the live read
 // projection and the precache's initial seeding at open().
@@ -344,8 +349,7 @@ export class Library {
     static async open(opts: LibraryOptions): Promise<Library> {
         const { userID } = opts.client.whoami();
         const cacheDirectory =
-            opts.cacheDirectory ??
-            join(envPaths("quak", { suffix: "" }).cache, String(userID));
+            opts.cacheDirectory ?? defaultCacheDirectory(userID);
         const metadataPath = join(cacheDirectory, "metadata.json");
         let store = await MetadataStore.load(metadataPath);
         // A cache directory given explicitly can hold another account's cache.