Update logout command to revoke token server-side

src/datachain/studio.py

@@ -201,6 +201,8 @@ def login(args: "Namespace"):
 
 
 def logout(local: bool = False):
+    from datachain.remote.studio import get_studio_env_variable
+
     level = ConfigLevel.LOCAL if local else ConfigLevel.GLOBAL
     with Config(level).edit() as conf:
         token = conf.get("studio", {}).get("token")
@@ -209,6 +211,37 @@ def logout(local: bool = False):
                 "Not logged in to Studio. Log in with 'datachain auth login'."
             )
 
+        studio_url = (
+            conf.get("studio", {}).get("url")
+            or get_studio_env_variable("URL")
+            or STUDIO_URL
+        )
+
+        try:
+            response = requests.post(
+                f"{studio_url.rstrip('/')}/api/token-logout",
+                headers={"Authorization": f"token {token}"},
+                timeout=10,
+            )
+            if response.status_code == 401:
+                print(
+                    "Token was already revoked or is invalid on Studio.",
+                    file=sys.stderr,
+                )
+            elif not response.ok:
+                print(
+                    f"Warning: Unexpected response from Studio "
+                    f"(HTTP {response.status_code}).",
+                    file=sys.stderr,
+                )
+        except requests.RequestException:
+            print(
+                "Warning: Could not reach Studio to revoke the token. "
+                "The token has been removed locally but may still be valid "
+                "on the server.",
+                file=sys.stderr,
+            )
+
         del conf["studio"]["token"]
 
     print("Logged out from Studio. (you can log back in with 'datachain auth login')")

tests/test_cli_studio.py

@@ -94,15 +94,57 @@ def test_studio_login_arguments(mocker):
 
 def test_studio_logout():
     with Config(ConfigLevel.GLOBAL).edit() as conf:
-        conf["studio"] = {"token": "isat_access_token"}
+        conf["studio"] = {"token": "isat_access_token", "url": STUDIO_URL}
+
+    with requests_mock.mock() as m:
+        m.post(
+            f"{STUDIO_URL}/api/token-logout",
+            json={"detail": "Token revoked successfully"},
+        )
+        assert main(["auth", "logout"]) == 0
+        assert m.called
+        assert m.last_request.headers["Authorization"] == "token isat_access_token"
 
-    assert main(["auth", "logout"]) == 0
     config = Config(ConfigLevel.GLOBAL).read()
     assert "token" not in config["studio"]
 
     assert main(["auth", "logout"]) == 1
 
 
+def test_studio_logout_token_already_revoked(capsys):
+    with Config(ConfigLevel.GLOBAL).edit() as conf:
+        conf["studio"] = {"token": "isat_access_token", "url": STUDIO_URL}
+
+    with requests_mock.mock() as m:
+        m.post(
+            f"{STUDIO_URL}/api/token-logout",
+            json={"detail": "Invalid token"},
+            status_code=401,
+        )
+        assert main(["auth", "logout"]) == 0
+
+    config = Config(ConfigLevel.GLOBAL).read()
+    assert "token" not in config["studio"]
+
+    err = capsys.readouterr().err
+    assert "already revoked or is invalid" in err
+
+
+def test_studio_logout_custom_url():
+    custom_url = "https://custom-studio.example.com"
+    with Config(ConfigLevel.GLOBAL).edit() as conf:
+        conf["studio"] = {"token": "isat_access_token", "url": custom_url}
+
+    with requests_mock.mock() as m:
+        m.post(
+            f"{custom_url}/api/token-logout",
+            json={"detail": "Token revoked successfully"},
+        )
+        assert main(["auth", "logout"]) == 0
+        assert m.called
+        assert m.last_request.url == f"{custom_url}/api/token-logout"
+
+
 def test_studio_token(capsys):
     with Config(ConfigLevel.GLOBAL).edit() as conf:
         conf["studio"] = {"token": "isat_access_token"}