Logout doesn't fully clear credentials

[ethanndickson]

Issue:
After logging out, the extension still logs in automatically on the next login without prompting for a token.

Repro steps:

1. Log in with a token.
2. Click Logout in the UI.
3. Restart VS Code.
4. Attempt to log in to the same deployment

Expected: prompted for an API key.
Actual: logs in without prompting, suggesting I wasn't fully logged out.

From looking at the code, it looks like logout clears the active session but leaves the session token in VS Code SecretStorage, so login reuses the saved token instead of prompting.

[EhabY]

From looking at the code, it looks like logout clears the active session but leaves the session token in VS Code SecretStorage, so login reuses the saved token instead of prompting.

Indeed, that's not really a bug but a feature. Do note, that you will get the prompt if the token is invalid.

This is done because if we clear the secret storage then we would be logged out in all windows (potentially even those connected to the deployment) so we keep the token until it's actually invalid.

[kasdvn17]

From looking at the code, it looks like logout clears the active session but leaves the session token in VS Code SecretStorage, so login reuses the saved token instead of prompting.

Indeed, that's not really a bug but a feature. Do note, that you will get the prompt if the token is invalid.

This is done because if we clear the secret storage then we would be logged out in all windows (potentially even those connected to the deployment) so we keep the token until it's actually invalid.

This shouldn't be a default feature, but rather an optional one. The logout button exists to invalidate the session, require logging in on the next session, and prevent other people from accessing the resources. You can check whether all windows are closed, then notify the users whether to keep the token or close all remote sessions and clear them.