Skip to content

feat: Support logout command#635

Open
lukaszsocha2 wants to merge 5 commits intoadd_pkce_supportfrom
support-logout-command
Open

feat: Support logout command#635
lukaszsocha2 wants to merge 5 commits intoadd_pkce_supportfrom
support-logout-command

Conversation

@lukaszsocha2
Copy link
Contributor

No description provided.

@lukaszsocha2 lukaszsocha2 requested a review from a team March 6, 2026 16:16
@lukaszsocha2 lukaszsocha2 changed the base branch from main to add_pkce_support March 6, 2026 16:16
@lukaszsocha2 lukaszsocha2 changed the title Support logout command feat: Support logout command Mar 6, 2026
assert.isTrue(mockTokenCache.get.called);
});

it('should successfully logout and clear cache when revoke succeeds', async function () {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldnt we add atleast one test case scenario covering revoke failure (retry/abort/clear)?

);
}

if (environment.authMethod !== 'oauth20') {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why only oauth?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought it was suppose to be just for box official app. I'll change it

try {
await sdk.revokeTokens(accessToken);
revoked = true;
} catch (error) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How you are handling the 401 status, where an access token is already invalid, but refresh token is?
Maybe we should handle it in a different manner, like just displaying dedicated text and ask user (or even not) to proceed

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is actually 400 error, but I'll add special handling for this case

docs/logout.md Outdated
`box logout`
===========

Sign out and clear local authentication state. Revokes the current session's access token on Box servers and removes cached tokens from the local machine. Only supported for OAuth environments. Prompts for confirmation unless `--force` is used.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about explicitly mentioning here (and in command description) that after this call, user will have to authorize again to use an cli?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It depends on the auth type. For JWT and CCG it won't be necessary

},
]);

if (action === 'clear') {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about switch case here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll rework this part of the code a bit

@@ -0,0 +1,191 @@
'use strict';
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe that we have are using another test library from oclif for all other commands, can we use the same here or at least have one test by that lib?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants