stacklok / toolhive / 26453858810

66%

Build Type

push

github

Committed by web-flow

Commit Message

Clear all cached registry tokens on logout (#5382)

thv registry logout only deleted the refresh-token key and its derived
fallback. The shared OAuthTokenSource also persists an access-token
cache under "<key>_AT", and its tier-2 lookup reads that key directly.
The cached access token survived logout, so the next thv registry login
short-circuited through the cache instead of triggering a fresh browser
flow.

Replace the targeted deletes with a list-and-bulk-delete over every
secret visible to the registry-scoped provider, mirroring
pkg/llm.DeleteCachedTokens. This also catches stale entries left behind
under derived keys after a registry URL or issuer change.

Closes #5373

Coverage Stats

20 of 20 new or added lines in 1 file covered. (100.0%)

8 existing lines in 2 files now uncovered.

65327 of 99139 relevant lines covered (65.89%)

62.19 hits per line