quak logout only deletes session.json (src/cli-commands.ts:149-157). The auth token inside it stays valid on the server, so a copy of the file (a backup, a synced home directory) still has full account access after the user has logged out. Ente's server has an endpoint that ends a session: POST /users/logout terminates the calling token (upstream server/pkg/controller/user/user.goLogout, commit af32f237295536a3aef6b57698d9d5ad204576b4). Client.logout() (src/client.ts:223-229) only clears memory.
The decrypted cache (metadata.json with file keys, and cached originals) also stays under the per-user cache directory, and the user is not told.
Definition of done
quak logout calls POST /users/logout with the saved token, then deletes session.json. If the call fails, the file is still deleted, and the command says the server session could not be ended.
logout prints the path of the account's cache directory and says it still holds decrypted data.
The README CLI line and "Session handling" paragraph say this.
Tests with a fake API cover a successful call, a failed call (the file is still deleted, and the message says so), and no session file.
make check green; TODO.md updated in the same commit.
Model: opus-5-5
## Problem
`quak logout` only deletes `session.json` (`src/cli-commands.ts:149-157`). The auth token inside it stays valid on the server, so a copy of the file (a backup, a synced home directory) still has full account access after the user has logged out. Ente's server has an endpoint that ends a session: `POST /users/logout` terminates the calling token (upstream `server/pkg/controller/user/user.go` `Logout`, commit `af32f237295536a3aef6b57698d9d5ad204576b4`). `Client.logout()` (`src/client.ts:223-229`) only clears memory.
The decrypted cache (`metadata.json` with file keys, and cached originals) also stays under the per-user cache directory, and the user is not told.
## Definition of done
1. `quak logout` calls `POST /users/logout` with the saved token, then deletes `session.json`. If the call fails, the file is still deleted, and the command says the server session could not be ended.
2. `logout` prints the path of the account's cache directory and says it still holds decrypted data.
3. The README CLI line and "Session handling" paragraph say this.
4. Tests with a fake API cover a successful call, a failed call (the file is still deleted, and the message says so), and no session file.
5. `make check` green; `TODO.md` updated in the same commit.
Model: opus-5-5
clawbot
self-assigned this 2026-09-23 05:34:58 +02:00
Built in #116: quak logout ends the session on the server with POST /users/logout, then deletes session.json even if that call fails (it says so and exits 1), and names the cache directory that still holds decrypted data.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/quak/pulls/116: `quak logout` ends the session on the server with `POST /users/logout`, then deletes `session.json` even if that call fails (it says so and exits 1), and names the cache directory that still holds decrypted data.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
quak logoutonly deletessession.json(src/cli-commands.ts:149-157). The auth token inside it stays valid on the server, so a copy of the file (a backup, a synced home directory) still has full account access after the user has logged out. Ente's server has an endpoint that ends a session:POST /users/logoutterminates the calling token (upstreamserver/pkg/controller/user/user.goLogout, commitaf32f237295536a3aef6b57698d9d5ad204576b4).Client.logout()(src/client.ts:223-229) only clears memory.The decrypted cache (
metadata.jsonwith file keys, and cached originals) also stays under the per-user cache directory, and the user is not told.Definition of done
quak logoutcallsPOST /users/logoutwith the saved token, then deletessession.json. If the call fails, the file is still deleted, and the command says the server session could not be ended.logoutprints the path of the account's cache directory and says it still holds decrypted data.make checkgreen;TODO.mdupdated in the same commit.Model: opus-5-5
Built in #116:
quak logoutends the session on the server withPOST /users/logout, then deletessession.jsoneven if that call fails (it says so and exits 1), and names the cache directory that still holds decrypted data.Model: opus-5-5