fix(auth): delete jurisdiction tokens on logout

`git-remote-entire` caches its jurisdiction (data-plane) access token in the
credential store at `entire-jurisdiction:<audience>`, keyed by the context
handle, so a fresh helper process per git command doesn't re-run the RFC 8693
exchange. Logout deleted only the `entire-core:<core>` access + refresh slots,
so that token — a bearer for every repo the account can reach in its
jurisdiction, with an 8h server-side TTL — survived `entire logout`,
`--everywhere` and `--all-contexts` alike.

The credential store has no enumeration API and the audience isn't derivable
offline, so track it: `contexts.Context.JurisdictionAudiences` records the
audiences a context has a token filed for, and `deleteContextKeychain` walks
that list. Deletion order is longest-lived-first (refresh, jurisdiction,
access) so a mid-sequence failure leaves behind only the shorter-lived
credential, and a failed delete still aborts the logout rather than reporting
success over a surviving credential.

`jurisdictionTokenSource.persistToken` records the audience *before* writing
the token, and skips the write when recording fails: a persisted-but-unrecorded
token is invisible to logout, whereas skipping costs one exchange. The recorder
being non-nil now also selects the persisted flavour, replacing the `persist`
flag, so the two can't disagree — the ENTIRE_TOKEN path passes none and stays
in-process-only. `RecordLoginContext` carries the audience list across the
re-login upsert, since the tokens are keyed by audience + handle rather than by
login session and outlive a fresh login.

Deletion is scoped to the outgoing context: only its recorded audiences, only
under its own handle, so another account's tokens are untouched. Slots written
before this bookkeeping are unreachable and expire with their TTL.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01KYNRX5J3PM8D1SD0RQ0ZXCCR

Author: stiak

cmd/entire/cli/auth/context_store.go

@@ -3,6 +3,8 @@ package auth
 import (
 	"errors"
 	"fmt"
+	"slices"
+	"strings"
 
 	"github.com/entireio/cli/internal/entireclient/contexts"
 	"github.com/entireio/cli/internal/entireclient/tokenstore"
@@ -34,6 +36,34 @@ func RemoveContext(name string) error {
 	return nil
 }
 
+// RememberJurisdictionAudience adds audience to context `name`'s
+// JurisdictionAudiences, so logout can find the matching keyring slot.
+// Idempotent: an already-recorded audience rewrites nothing.
+//
+// Callers MUST record before writing the token to the credential store — a
+// persisted-but-unrecorded token is a bearer logout can't find, whereas a
+// failed record that aborts the write costs only one token exchange.
+func RememberJurisdictionAudience(name, audience string) error {
+	aud := strings.TrimRight(strings.TrimSpace(audience), "/")
+	if name == "" || aud == "" {
+		return errors.New("context name and jurisdiction audience are both required")
+	}
+	if err := contexts.Modify(userdirs.Config(), func(f *contexts.File) (bool, error) {
+		c := f.Find(name)
+		if c == nil {
+			return false, fmt.Errorf("no login context named %q", name)
+		}
+		if slices.Contains(c.JurisdictionAudiences, aud) {
+			return false, nil
+		}
+		c.JurisdictionAudiences = append(c.JurisdictionAudiences, aud)
+		return true, nil
+	}); err != nil {
+		return fmt.Errorf("record jurisdiction audience %q for context %q: %w", aud, name, err)
+	}
+	return nil
+}
+
 // removeContextLocked deletes the context selected by pick — keyring slots
 // first, then the contexts.json entry — inside a single locked Modify, so
 // selection, credential deletion, and entry removal can't interleave with a
@@ -53,28 +83,42 @@ func removeContextLocked(pick func(*contexts.File) *contexts.Context) error {
 		if c == nil {
 			return false, nil
 		}
-		if err := deleteContextKeychain(c.KeychainService, c.Handle); err != nil {
+		if err := deleteContextKeychain(c); err != nil {
 			return false, fmt.Errorf("remove credentials for %q: %w", c.Name, err)
 		}
 		f.Delete(c.Name)
 		return true, nil
 	})
 }
 
-// deleteContextKeychain removes a context's keyring slots. A missing entry
-// is fine; any other failure surfaces so logout doesn't claim success over
-// surviving credentials. The refresh slot goes first — it's the long-lived
-// credential, and if the second delete then fails, the leftover access
-// token at least expires on its own.
-func deleteContextKeychain(svc, handle string) error {
-	if svc == "" || handle == "" {
+// deleteContextKeychain removes every keyring slot a context owns: the paired
+// refresh + access tokens, plus one jurisdiction (data-plane) access token per
+// recorded audience — each of those authorizes git against every repo the
+// account can reach. A missing entry is fine; any other failure surfaces so
+// logout doesn't claim success over surviving credentials.
+//
+// Deletion runs longest-lived-first — refresh (indefinite), jurisdiction (8h),
+// access (an hour at most) — so a mid-sequence failure leaves behind only the
+// shorter-lived credential. Unrecorded jurisdiction slots are unreachable (no
+// enumeration API) and left to expire.
+func deleteContextKeychain(c *contexts.Context) error {
+	if c == nil || c.Handle == "" {
 		return nil
 	}
-	if err := tokenstore.Delete(tokenstore.RefreshService(svc), handle); err != nil && !errors.Is(err, tokenstore.ErrNotFound) {
-		return fmt.Errorf("delete refresh token: %w", err)
+	if c.KeychainService != "" {
+		if err := tokenstore.Delete(tokenstore.RefreshService(c.KeychainService), c.Handle); err != nil && !errors.Is(err, tokenstore.ErrNotFound) {
+			return fmt.Errorf("delete refresh token: %w", err)
+		}
+	}
+	for _, audience := range c.JurisdictionAudiences {
+		if err := tokenstore.Delete(tokenstore.JurisdictionService(audience), c.Handle); err != nil && !errors.Is(err, tokenstore.ErrNotFound) {
+			return fmt.Errorf("delete jurisdiction token for %s: %w", audience, err)
+		}
 	}
-	if err := tokenstore.Delete(svc, handle); err != nil && !errors.Is(err, tokenstore.ErrNotFound) {
-		return fmt.Errorf("delete access token: %w", err)
+	if c.KeychainService != "" {
+		if err := tokenstore.Delete(c.KeychainService, c.Handle); err != nil && !errors.Is(err, tokenstore.ErrNotFound) {
+			return fmt.Errorf("delete access token: %w", err)
+		}
 	}
 	return nil
 }

cmd/entire/cli/auth/context_store_test.go

@@ -0,0 +1,261 @@
+package auth
+
+import (
+	"errors"
+	"fmt"
+	"path/filepath"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/entireio/cli/internal/entireclient/contexts"
+	"github.com/entireio/cli/internal/entireclient/tokenstore"
+)
+
+// testCoreURL is the login server every context in this file is recorded
+// against; seedLoginWithJurisdictionTokens keys its keyring slots off it.
+const testCoreURL = "https://core.example.com"
+
+// seedAccountWithJurisdictionTokens records a login context for `handle`
+// against testCoreURL, notes `audiences` on it, and files a jurisdiction access
+// token in each of those keyring slots under that handle — the state
+// git-remote-entire leaves behind after a few git operations. Returns the
+// context name and the core keyring service its login tokens live in.
+func seedAccountWithJurisdictionTokens(t *testing.T, handle string, audiences ...string) (name, coreService string) {
+	t.Helper()
+
+	exp := time.Now().Add(time.Hour).Unix()
+	token := makeJWT(t, fmt.Sprintf(`{"iss":%q,"handle":%q,"exp":%d}`, testCoreURL, handle, exp))
+	name, err := RecordLoginContext(token, testRefreshToken, true)
+	if err != nil {
+		t.Fatalf("RecordLoginContext(%s): %v", handle, err)
+	}
+
+	for _, audience := range audiences {
+		if err := RememberJurisdictionAudience(name, audience); err != nil {
+			t.Fatalf("RememberJurisdictionAudience(%q): %v", audience, err)
+		}
+		if err := tokenstore.Set(tokenstore.JurisdictionService(audience), handle, "juri-jwt"); err != nil {
+			t.Fatalf("seed jurisdiction token for %q: %v", audience, err)
+		}
+	}
+	return name, tokenstore.CoreKeyringService(testCoreURL)
+}
+
+// seedLoginWithJurisdictionTokens is seedAccountWithJurisdictionTokens for the
+// single-account tests, which all use handle "alice".
+func seedLoginWithJurisdictionTokens(t *testing.T, audiences ...string) (name, coreService string) {
+	t.Helper()
+	return seedAccountWithJurisdictionTokens(t, "alice", audiences...)
+}
+
+// TestRemoveContext_DeletesJurisdictionTokens pins the logout contract for
+// data-plane credentials: the jurisdiction access tokens git-remote-entire
+// filed are bearers for every repo the account can reach, with an 8h
+// server-side TTL, so logout must delete them alongside the login slots rather
+// than leave them usable on the machine.
+func TestRemoveContext_DeletesJurisdictionTokens(t *testing.T) {
+	cfgDir := t.TempDir()
+	t.Setenv("ENTIRE_CONFIG_DIR", cfgDir)
+	t.Cleanup(tokenstore.UseFileBackendForTesting(filepath.Join(t.TempDir(), "tokens.json")))
+
+	name, coreService := seedLoginWithJurisdictionTokens(t,
+		"https://eu.example.io", "https://au.example.io/")
+
+	if err := RemoveContext(name); err != nil {
+		t.Fatalf("RemoveContext: %v", err)
+	}
+
+	for _, audience := range []string{"https://eu.example.io", "https://au.example.io/"} {
+		svc := tokenstore.JurisdictionService(audience)
+		if v, err := tokenstore.Get(svc, "alice"); !errors.Is(err, tokenstore.ErrNotFound) {
+			t.Fatalf("jurisdiction token for %q survived logout: value=%q err=%v", audience, v, err)
+		}
+	}
+	if v, err := tokenstore.Get(coreService, "alice"); !errors.Is(err, tokenstore.ErrNotFound) {
+		t.Fatalf("access slot survived logout: value=%q err=%v", v, err)
+	}
+	if v, err := tokenstore.Get(tokenstore.RefreshService(coreService), "alice"); !errors.Is(err, tokenstore.ErrNotFound) {
+		t.Fatalf("refresh slot survived logout: value=%q err=%v", v, err)
+	}
+	f, err := contexts.Load(cfgDir)
+	if err != nil {
+		t.Fatalf("load contexts: %v", err)
+	}
+	if f.Find(name) != nil {
+		t.Fatalf("context %q should have been removed", name)
+	}
+}
+
+// TestRemoveContext_LeavesOtherAccountsJurisdictionTokens pins the scope of the
+// sweep: jurisdiction slots are keyed by (audience, handle), and logout only
+// deletes the audiences recorded on the context it is removing, under that
+// context's own handle. Two accounts sharing a jurisdiction have separate slots,
+// so logging one out must leave the other's data-plane token — and its
+// bookkeeping — intact.
+func TestRemoveContext_LeavesOtherAccountsJurisdictionTokens(t *testing.T) {
+	cfgDir := t.TempDir()
+	t.Setenv("ENTIRE_CONFIG_DIR", cfgDir)
+	t.Cleanup(tokenstore.UseFileBackendForTesting(filepath.Join(t.TempDir(), "tokens.json")))
+
+	// Both accounts have a token for the same jurisdiction, plus one audience
+	// only bob ever reached.
+	const shared = "https://eu.example.io"
+	const bobOnly = "https://au.example.io"
+	aliceName, _ := seedAccountWithJurisdictionTokens(t, "alice", shared)
+	bobName, _ := seedAccountWithJurisdictionTokens(t, "bob", shared, bobOnly)
+
+	if err := RemoveContext(aliceName); err != nil {
+		t.Fatalf("RemoveContext(%s): %v", aliceName, err)
+	}
+
+	if v, err := tokenstore.Get(tokenstore.JurisdictionService(shared), "alice"); !errors.Is(err, tokenstore.ErrNotFound) {
+		t.Fatalf("alice's jurisdiction token survived her logout: value=%q err=%v", v, err)
+	}
+	for _, audience := range []string{shared, bobOnly} {
+		if _, err := tokenstore.Get(tokenstore.JurisdictionService(audience), "bob"); err != nil {
+			t.Fatalf("bob's jurisdiction token for %q was deleted by alice's logout: %v", audience, err)
+		}
+	}
+	f, err := contexts.Load(cfgDir)
+	if err != nil {
+		t.Fatalf("load contexts: %v", err)
+	}
+	bob := f.Find(bobName)
+	if bob == nil {
+		t.Fatalf("context %q was removed by alice's logout", bobName)
+	}
+	if !slices.Equal(bob.JurisdictionAudiences, []string{shared, bobOnly}) {
+		t.Fatalf("bob's recorded audiences = %v, want [%s %s]", bob.JurisdictionAudiences, shared, bobOnly)
+	}
+}
+
+// TestRemoveCurrentContext_DeletesJurisdictionTokens covers the default
+// `entire logout` path (active context, not selected by name).
+func TestRemoveCurrentContext_DeletesJurisdictionTokens(t *testing.T) {
+	t.Setenv("ENTIRE_CONFIG_DIR", t.TempDir())
+	t.Cleanup(tokenstore.UseFileBackendForTesting(filepath.Join(t.TempDir(), "tokens.json")))
+
+	const audience = "https://eu.example.io"
+	seedLoginWithJurisdictionTokens(t, audience)
+
+	if err := RemoveCurrentContext(); err != nil {
+		t.Fatalf("RemoveCurrentContext: %v", err)
+	}
+	if v, err := tokenstore.Get(tokenstore.JurisdictionService(audience), "alice"); !errors.Is(err, tokenstore.ErrNotFound) {
+		t.Fatalf("jurisdiction token survived logout: value=%q err=%v", v, err)
+	}
+}
+
+// TestRemoveContext_JurisdictionDeleteFailureAbortsLogout extends the existing
+// keychain-delete contract to the jurisdiction slots: a failed delete must
+// surface and leave the context entry in place for a retry, never report
+// success over a surviving data-plane bearer.
+func TestRemoveContext_JurisdictionDeleteFailureAbortsLogout(t *testing.T) {
+	cfgDir := t.TempDir()
+	t.Setenv("ENTIRE_CONFIG_DIR", cfgDir)
+	path := filepath.Join(t.TempDir(), "tokens.json")
+	seedRestore := tokenstore.UseFileBackendForTesting(path)
+
+	const audience = "https://eu.example.io"
+	name, coreService := seedLoginWithJurisdictionTokens(t, audience)
+	seedRestore()
+
+	jurisdictionSvc := tokenstore.JurisdictionService(audience)
+	failJurisdictionDelete := func(service, _ string) bool { return service == jurisdictionSvc }
+	t.Cleanup(tokenstore.UseFailingDeleteBackendForTesting(path, failJurisdictionDelete))
+
+	if err := RemoveContext(name); err == nil {
+		t.Fatal("RemoveContext: want error when the jurisdiction-slot delete fails")
+	}
+	f, err := contexts.Load(cfgDir)
+	if err != nil {
+		t.Fatalf("load contexts: %v", err)
+	}
+	c := f.Find(name)
+	if c == nil {
+		t.Fatal("context entry was removed despite the failed credential delete")
+	}
+	if !slices.Contains(c.JurisdictionAudiences, audience) {
+		t.Fatalf("recorded audiences = %v, want %q retained for the retry", c.JurisdictionAudiences, audience)
+	}
+	// The access slot is deleted after the jurisdiction slots, so the abort
+	// must have left it alone.
+	if _, err := tokenstore.Get(coreService, "alice"); err != nil {
+		t.Fatalf("access slot should be untouched by the aborted logout: %v", err)
+	}
+}
+
+func TestRememberJurisdictionAudience(t *testing.T) {
+	cfgDir := t.TempDir()
+	t.Setenv("ENTIRE_CONFIG_DIR", cfgDir)
+	t.Cleanup(tokenstore.UseFileBackendForTesting(filepath.Join(t.TempDir(), "tokens.json")))
+
+	exp := time.Now().Add(time.Hour).Unix()
+	name, err := RecordLoginContext(makeJWT(t, fmt.Sprintf(`{"iss":%q,"handle":"alice","exp":%d}`, testCoreURL, exp)), testRefreshToken, true)
+	if err != nil {
+		t.Fatalf("RecordLoginContext: %v", err)
+	}
+
+	// Recorded once, trailing slash trimmed so the audience matches the
+	// keyring service name the writer and logout both derive.
+	if err := RememberJurisdictionAudience(name, "https://eu.example.io/"); err != nil {
+		t.Fatalf("first record: %v", err)
+	}
+	// Idempotent: the same audience (in either spelling) doesn't duplicate.
+	if err := RememberJurisdictionAudience(name, "https://eu.example.io"); err != nil {
+		t.Fatalf("duplicate record: %v", err)
+	}
+	if err := RememberJurisdictionAudience(name, "https://au.example.io"); err != nil {
+		t.Fatalf("second audience: %v", err)
+	}
+
+	f, err := contexts.Load(cfgDir)
+	if err != nil {
+		t.Fatalf("load contexts: %v", err)
+	}
+	got := f.Find(name).JurisdictionAudiences
+	want := []string{"https://eu.example.io", "https://au.example.io"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("recorded audiences = %v, want %v", got, want)
+	}
+
+	// A context that isn't there can't be recorded against — the caller must
+	// not then persist a token no logout could find.
+	if err := RememberJurisdictionAudience("nope", "https://eu.example.io"); err == nil {
+		t.Fatal("want error for an unknown context")
+	}
+	if err := RememberJurisdictionAudience(name, "  "); err == nil {
+		t.Fatal("want error for a blank audience")
+	}
+}
+
+// TestRecordLoginContext_ReloginKeepsJurisdictionAudiences guards the upsert:
+// re-logging in replaces the context entry, but the jurisdiction tokens in the
+// keychain (keyed by audience + handle, not by login session) survive it — so
+// dropping the list would strand them beyond any future logout.
+func TestRecordLoginContext_ReloginKeepsJurisdictionAudiences(t *testing.T) {
+	cfgDir := t.TempDir()
+	t.Setenv("ENTIRE_CONFIG_DIR", cfgDir)
+	t.Cleanup(tokenstore.UseFileBackendForTesting(filepath.Join(t.TempDir(), "tokens.json")))
+
+	const audience = "https://eu.example.io"
+	name, _ := seedLoginWithJurisdictionTokens(t, audience)
+
+	exp := time.Now().Add(2 * time.Hour).Unix()
+	again, err := RecordLoginContext(makeJWT(t, fmt.Sprintf(`{"iss":%q,"handle":"alice","exp":%d}`, testCoreURL, exp)), testRefreshToken, true)
+	if err != nil {
+		t.Fatalf("re-login: %v", err)
+	}
+	if again != name {
+		t.Fatalf("re-login produced context %q, want %q", again, name)
+	}
+
+	f, err := contexts.Load(cfgDir)
+	if err != nil {
+		t.Fatalf("load contexts: %v", err)
+	}
+	if got := f.Find(name).JurisdictionAudiences; !slices.Equal(got, []string{audience}) {
+		t.Fatalf("recorded audiences after re-login = %v, want [%s]", got, audience)
+	}
+}

cmd/entire/cli/auth/contexts.go

@@ -111,12 +111,19 @@ func RecordLoginContext(rawToken, refreshToken string, activate bool) (string, e
 	cfgDir := userdirs.Config()
 	if modErr := contexts.Modify(cfgDir, func(f *contexts.File) (bool, error) {
 		name = pickContextName(f, coreURL, handle)
-		f.Upsert(&contexts.Context{
+		next := &contexts.Context{
 			Name:            name,
 			CoreURL:         coreURL,
 			Handle:          handle,
 			KeychainService: keychainService,
-		})
+		}
+		// Upsert replaces the whole entry, so carry the audiences over: the
+		// jurisdiction tokens are keyed by audience + handle, not by login
+		// session, so they survive this re-login and must stay findable.
+		if prev := f.Find(name); prev != nil {
+			next.JurisdictionAudiences = prev.JurisdictionAudiences
+		}
+		f.Upsert(next)
 		if activate || f.CurrentContext == "" {
 			f.CurrentContext = name
 		}