Merge pull request #99 from ls1intum/feat/server-side-logout

feat: server-side logout + developer JWT reveal command

Author: Predixx

extension/package.json

@@ -82,12 +82,18 @@
       {
         "command": "artemis.clearTrustedDomains",
         "title": "Artemis: Clear Trusted Domains"
+      },
+      {
+        "command": "artemis.showJwtToken",
+        "title": "Artemis: Show JWT Token (Developer)",
+        "icon": "$(key)"
       }
     ],
     "menus": {
       "commandPalette": [
         { "command": "artemis.login", "when": "!iris:managedEnvironment" },
-        { "command": "artemis.logout", "when": "!iris:managedEnvironment" }
+        { "command": "artemis.logout", "when": "!iris:managedEnvironment" },
+        { "command": "artemis.showJwtToken", "when": "config.artemis.developerMode" }
       ]
     },
     "viewsContainers": {

extension/src/extension/activation/extensionCommands.ts

@@ -6,7 +6,7 @@ import type { IProviderRegistry } from '../services/ui';
 import type { TelemetryManager } from '../services/telemetry';
 import type { ArtemisWebviewProvider, ChatWebviewProvider } from '../provider';
 import { logger, LogCategory } from '../services/loggingService';
-import { processPlantUml, normalizeRelativePath, extractErrorMessage } from '../utils';
+import { processPlantUml, normalizeRelativePath, extractErrorMessage, VSCODE_CONFIG } from '../utils';
 import { executeReplayCommand } from '../services/telemetry/replay';
 
 // ── Individual command registrations ─────────────────────────────────
@@ -19,11 +19,15 @@ function registerLoginCommand(): vscode.Disposable {
 
 function registerLogoutCommand(
     authManager: AuthManager,
+    artemisApiService: ArtemisApiService,
     updateAuthContext: (isAuthenticated: boolean) => Promise<void>,
     artemisWebviewProvider: ArtemisWebviewProvider,
 ): vscode.Disposable {
     return vscode.commands.registerCommand('artemis.logout', async () => {
         try {
+            // Best-effort server-side logout before clearing local state.
+            // Never throws — local cleanup proceeds regardless.
+            await artemisApiService.logoutFromServer();
             await authManager.clear();
             await updateAuthContext(false);
             vscode.window.showInformationMessage('Successfully logged out of Artemis');
@@ -418,6 +422,50 @@ function registerReplaySessionCommand(globalStorageUri: vscode.Uri): vscode.Disp
     });
 }
 
+/**
+ * Developer-only command: copy the current raw JWT to the clipboard for use
+ * in curl/Postman based server testing. Gated on the `artemis.developerMode`
+ * setting both at the menu level (commandPalette `when` clause) and at runtime
+ * (defense-in-depth against direct invocation via `vscode.commands.executeCommand`).
+ *
+ * The full token is NEVER shown in the UI or written to logs — only a masked
+ * preview appears in the notification, and the full value lands in the clipboard.
+ */
+function registerShowJwtTokenCommand(authManager: AuthManager): vscode.Disposable {
+    return vscode.commands.registerCommand('artemis.showJwtToken', async () => {
+        const config = vscode.workspace.getConfiguration(VSCODE_CONFIG.ARTEMIS_SECTION);
+        const developerMode = config.get<boolean>(VSCODE_CONFIG.DEVELOPER_MODE_KEY, false);
+        if (!developerMode) {
+            vscode.window.showErrorMessage(
+                `Enable '${VSCODE_CONFIG.ARTEMIS_SECTION}.${VSCODE_CONFIG.DEVELOPER_MODE_KEY}' in settings to use this command.`
+            );
+            return;
+        }
+
+        const hasToken = await authManager.hasAuthToken();
+        if (!hasToken) {
+            vscode.window.showInformationMessage('Not logged in to Artemis — no JWT to show.');
+            return;
+        }
+
+        const rawJwt = await authManager.getRawJwt();
+        if (!rawJwt) {
+            vscode.window.showErrorMessage('Failed to retrieve JWT token from secret storage.');
+            logger.error('getRawJwt returned undefined despite hasAuthToken=true', LogCategory.AUTH);
+            return;
+        }
+
+        await vscode.env.clipboard.writeText(rawJwt);
+
+        const preview = `${rawJwt.substring(0, 20)}...`;
+        logger.info(`JWT copied to clipboard via developer command (preview: ${preview})`, LogCategory.AUTH);
+
+        vscode.window.showWarningMessage(
+            `JWT copied to clipboard (${preview}). Do not share, do not commit.`
+        );
+    });
+}
+
 // ── Aggregate registration ───────────────────────────────────────────
 
 export interface CommandDeps {
@@ -435,7 +483,7 @@ export interface CommandDeps {
 export function registerAllCommands(deps: CommandDeps): vscode.Disposable {
     return vscode.Disposable.from(
         registerLoginCommand(),
-        registerLogoutCommand(deps.authManager, deps.updateAuthContext, deps.artemisWebviewProvider),
+        registerLogoutCommand(deps.authManager, deps.artemisApiService, deps.updateAuthContext, deps.artemisWebviewProvider),
         registerResetIrisChatCommand(deps.chatWebviewProvider),
         registerIrisHealthCheckCommand(deps.authManager, deps.artemisApiService, deps.providerRegistry),
         registerWebSocketStatusCommand(deps.artemisWebsocketService),
@@ -445,5 +493,6 @@ export function registerAllCommands(deps: CommandDeps): vscode.Disposable {
         registerClearTrustedDomainsCommand(deps.context),
         registerStruggleScoreCommand(deps.telemetryManager),
         registerReplaySessionCommand(deps.context.globalStorageUri),
+        registerShowJwtTokenCommand(deps.authManager),
     );
 }

extension/src/extension/api/artemisApi.ts

@@ -303,6 +303,58 @@ export class ArtemisApiService {
         return { success: true };
     }
 
+    /**
+     * Inform the Artemis server that the user is logging out.
+     *
+     * Best-effort: this method never throws. The calling logout flow
+     * must always clear local state regardless of the server response,
+     * so any failure here is logged and swallowed.
+     *
+     * Uses a direct fetch instead of `makeRequest()` so a non-2xx
+     * response does not trigger the shared 401 handler (which would
+     * re-clear auth and fire the auth-expired callback — both
+     * pointless and confusing during an intentional logout).
+     *
+     * Note: Artemis uses stateless JWTs without server-side blacklisting,
+     * so this call does not invalidate the token on the server. It merely
+     * tells Artemis "the user intentionally logged out" (audit logs) and
+     * returns a Set-Cookie header that clears the jwt cookie in browser
+     * clients. For this Extension the benefit is protocol symmetry with
+     * the Artemis webapp.
+     */
+    async logoutFromServer(): Promise<void> {
+        const headers = await this.authManager.getAuthHeaders();
+        if (Object.keys(headers).length === 0) {
+            // Not authenticated — nothing to tell the server.
+            return;
+        }
+
+        try {
+            const response = await fetch(`${this.getServerUrl()}${CONFIG.API.ENDPOINTS.LOGOUT}`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'User-Agent': getUserAgent(),
+                    ...headers,
+                },
+            });
+            if (response.ok) {
+                logger.info('Server-side logout successful', LogCategory.AUTH);
+            } else {
+                logger.warn(
+                    `Server-side logout returned ${response.status}, continuing with local cleanup`,
+                    LogCategory.AUTH
+                );
+            }
+        } catch (err) {
+            logger.warn(
+                'Server-side logout failed, continuing with local cleanup',
+                LogCategory.AUTH,
+                err
+            );
+        }
+    }
+
     // Check Iris health status (course-scoped)
     async checkIrisHealth(courseId: number): Promise<IrisHealthStatus> {
         const response = await this.makeRequest(`/api/iris/courses/${courseId}/status`);

extension/src/extension/controller/commands/authCommands.ts

@@ -55,6 +55,9 @@ export class AuthCommandModule {
 
     private handleLogout = async (_message: WebviewToExtensionMessage): Promise<void> => {
         try {
+            // Best-effort server-side logout before clearing local state.
+            // Never throws — local cleanup proceeds regardless.
+            await this.context.artemisApi.logoutFromServer();
             await this.context.authManager.clear();
             await this.context.updateAuthContext(false);
 

extension/src/extension/services/auth/authManager.ts

@@ -57,6 +57,26 @@ export class AuthManager {
         return this.getStoredToken();
     }
 
+    /**
+     * Returns the raw JWT string (without any "jwt=" cookie prefix), suitable
+     * for use in a `Cookie: jwt=<value>` or `Authorization: Bearer <value>` header.
+     *
+     * Intended for developer/debug commands only — normal code paths should use
+     * `getAuthHeaders()` instead so auth-mode handling stays centralized.
+     *
+     * Returns `undefined` if not authenticated.
+     */
+    public async getRawJwt(): Promise<string | undefined> {
+        const stored = await this.getStoredToken();
+        if (!stored) {
+            return undefined;
+        }
+        // Desktop mode stores the token as "jwt=<value>" (cookie string).
+        // Theia mode stores the raw JWT directly. Strip the prefix if present.
+        const prefix = `${CONFIG.AUTH_COOKIE_NAME}=`;
+        return stored.startsWith(prefix) ? stored.substring(prefix.length) : stored;
+    }
+
     /**
      * Returns the stored token string.
      * In Desktop mode this is a cookie string ("jwt=<token>"),

extension/src/extension/utils/constants.ts

@@ -13,6 +13,7 @@ export const CONFIG = {
     API: {
         ENDPOINTS: {
             AUTHENTICATE: '/api/core/public/authenticate',
+            LOGOUT: '/api/core/public/logout',
         },
     },
 } as const;