[dawsontoth]

⊙ Problem

#1954 forgets a terminated cluster's sign-ins but keeps a removed self-hosted cluster's, whose servers may still run. So removing one left its sign-ins and any stored Basic Auth credential until the next app sign-out. Separately, a logout that answered late cleared a sign-in made after it was sent.

🤔 Should removing a self-hosted cluster log its sessions out?

Yes, as decided on #1954: log out of its servers, best effort, and forget the sign-ins. Keeping them leaves live sessions and stored credentials for a cluster Studio no longer shows.

💡 Solution

• Removing a self-hosted cluster sends a logout to its server and each instance's, and forgets those sign-ins, including ones another tab made.
• Each logout is one attempt with a 10s timeout, as app sign-out sends them. The removal doesn't wait, and a failed logout still forgets.
• A logout's late answer no longer clears a newer sign-in, in this tab or another. App sign-out shares the fix.
• Fabric cluster termination is unchanged.

⚖️ Alternatives

• Await the logouts in the removal: a slow or unreachable server would hold the Remove dialog for up to 10s, against "never block the removal".
• Copy the app sign-out loop: a later change to its timeout or failure reporting would then reach only one of the two paths.
• A per-tab counter for the late answer: misses another tab's sign-in.

🤔 Should a failed logout still forget the sign-in?

I chose yes, as decided. The cost: a server unreachable at removal keeps its session, and no later app sign-out retries it (#1967). Keeping the marker until a logout succeeds would trade that for leaving the sign-in remembered.

🔧 Changes

• authStore.ts:
  • signOutEntities(ids) builds one logout client per remembered id, reading the markers from storage too, passes each URL to buildLogoutClient, forgets the ids, drops another tab's marker for them, then sends. It never rejects.
  • sendBestEffortLogout, shared with app sign-out, takes a snapshot of the stored Basic Auth credential, Fabric Connect flag and connection generation when it sends.
• onInstanceLogoutSubmit.ts skips its clear when that snapshot has changed. Explicit sign-outs pass no check and clear as before.
• terminateCluster.ts: a self-hosted cluster goes through signOutEntities; a Fabric one goes through signOutEntitiesLocally as before.
• terminatedClusterSignIns.ts: clusterSignInIds split out, so terminatedClusterSignIns still returns none for a self-hosted cluster on render.
• cluster/DESIGN.md records the removal rule and the accepted cost.

✅ Verification

End-to-end route: (d). A real logout needs a running self-hosted server; the flows run in unit tests.

• lateLogoutAnswer.test.ts runs the real onInstanceLogoutSubmit behind both paths. A new Basic Auth credential (also one another tab stores), Fabric Connect flag or still-verifying token survives a late answer. With nothing replaced, the answer clears again. The eight replaced-sign-in cases fail on the previous head.
• signOutEntities.test.ts covers the logout's credential and timeout, a failed logout, a session-cookie sign-in, and another tab's sign-in.
• terminateCluster.test.ts: a self-hosted removal logs out and forgets the cluster and every instance, even when a logout fails, and without waiting. Keep checks need the whole sign-in. These fail on stage.
• vitest --maxWorkers=4 (560 files, 5,705 passed), tsc -b, oxlint and dprint check exit 0 on Node 24.21.0.

Mutation checks and a flaky unrelated file

• Each makes a test fail: no logouts; forgetting after the logouts answer; the self-hosted path forgetting locally only; the removal awaiting the logouts; no late-answer check; skipping the late clear always; dropping the stored Basic Auth, the Fabric Connect flag or the connection generation from the snapshot; not reading stored markers; not dropping another tab's marker.
• Keeping the logout client's response interceptors passes tests: a logout is a write, and curryRetryGatewayErrors (retryGatewayErrors.ts) replays reads only.
• Some full runs report an unhandled Radix focus-scope timer after teardown, in cardLinksDuringPendingNavigation.test.tsx or SecretsManager.delivery.test.tsx. Neither file runs this code, and both pass alone. The pre-commit run on the final commit was clean.

Follow-up to #1954 (#1931).

🤖 Generated with Claude Code

Related PRs: #1954 overlaps (merged; this builds on its terminate and DESIGN.md lines), #1956 independent
Complexity: medium

Deferred findings

• 360de88dc2418237 minor security — src/features/auth/store/authStore.ts — retry markers forgotten before the self-hosted logout is answered or dispatched — filed Self-hosted cluster removal: retry a logout that failed, or one skipped because the cluster couldn't be read #1967
• be82d5c881a51a56 minor security — src/features/auth/store/authStore.ts — marker writes serialize this tab's load-time map, erasing markers other tabs added; now also reached from signOutEntities — filed Sign-in markers: a tab's write erases sign-ins other tabs added, so app sign-out can skip their logout #1968
• 85883ef1b2f4b7a1 nit reliability — src/features/clusters/mutations/terminateCluster.ts — both cluster reads fail so self-hosted removal posts no logout — filed Self-hosted cluster removal: retry a logout that failed, or one skipped because the cluster couldn't be read #1967
• afad652932df433c nit reliability — src/features/clusters/mutations/terminateCluster.ts — managed termination skips forgetStoredMarkers, so a marker another tab added outlives the local forget — filed Sign-in markers: a tab's write erases sign-ins other tabs added, so app sign-out can skip their logout #1968

_{Review-Coverage: authored=claude; ran=codex,gemini,cursor-grok,cursor-muse; adjudicated=domain; declined=cursor-composer,cursor-kimi,muse; rounds=11; full=7 @ e61ed02}

_{Review-Attention: study ~20m (sensitive: authStore.ts, onInstanceLogoutSubmit.ts; decisions: forget-before-logout-answer, self-hosted-removal-logs-out, removal-not-awaiting-logouts, late-answer-guard-shape, managed-vs-self-hosted-split, do-less-alternative, forget-before-answer, snapshot-guard-shape, logout-only-on-studio-removal) @ e61ed02}

[gemini-code-assist]

Code Review

This pull request introduces the ability to sign out of self-hosted cluster entities when they are removed or terminated, ensuring their active sessions are closed. It adds a new signOutEntities method to AuthStore to perform concurrent, best-effort logouts, along with comprehensive unit tests and updated design documentation. Feedback on these changes highlights a potential race condition in terminateCluster.ts where concurrent deletion and retrieval can cause both reads to fail with a 404, preventing logouts from being sent. Additionally, it is recommended to unconditionally clear stored credentials and to improve type safety in Promise.all by returning Promise.resolve() instead of falsy values.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	79.99%	14915 / 18645
🔵	Statements	79.94%	15829 / 19799
🔵	Functions	75.43%	3977 / 5272
🔵	Branches	74.66%	11569 / 15495

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/features/auth/handlers/clearAuthStateLocally.ts	100%	100%	100%	100%
src/features/auth/queries/getCurrentUser.ts	90%	100%	66.66%	90%	37-41
src/features/auth/store/authStore.ts	94.74%	85.37%	97.16%	94.61%	138, 281-282, 291-294, 342, 363, 394-405, 413, 418-421, 528-531, 843, 963, 968, 1097, 1122
src/features/auth/store/signInMarkers.ts	98.36%	100%	100%	98.33%	58
src/features/auth/store/signInMarkersTestHelpers.ts	100%	100%	100%	100%
src/features/cluster/terminatedClusterSignIns.ts	100%	75%	100%	100%
src/features/clusters/mutations/terminateCluster.ts	86.66%	87.5%	66.66%	86.66%	45-46
src/integrations/api/instance/auth/onInstanceLogoutSubmit.ts	85.71%	75%	100%	85.71%	21

Generated in workflow #2386 for commit e7ae19f by the Vitest Coverage Report Action