From 22e2ce72a33b7f43f2c98e17bfe4a56e04d07fc2 Mon Sep 17 00:00:00 2001
From: carole-lavillonniere <carole.lavillonniere@gmail.com>
Date: Tue, 3 Mar 2026 10:13:13 +0100
Subject: [PATCH] fix: logout message when auth token env var is set

---
 internal/auth/auth.go           | 13 ++++++++-----
 test/integration/logout_test.go | 18 ++++++++++++++++++
 2 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index a2fb3d9..ac56ba1 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -62,15 +62,18 @@ func (a *Auth) Logout() error {
 	output.EmitSpinnerStart(a.sink, "Logging out...")
 
 	_, err := a.tokenStorage.GetAuthToken()
-	if errors.Is(err, ErrTokenNotFound) {
+	if err != nil {
 		output.EmitSpinnerStop(a.sink)
+		if env.Vars.AuthToken != "" {
+			output.EmitNote(a.sink, "Authenticated via LOCALSTACK_AUTH_TOKEN environment variable; unset it to log out")
+			return nil
+		}
+		if !errors.Is(err, ErrTokenNotFound) {
+			return fmt.Errorf("failed to read auth token: %w", err)
+		}
 		output.EmitNote(a.sink, "Not currently logged in")
 		return ErrNotLoggedIn
 	}
-	if err != nil {
-		output.EmitSpinnerStop(a.sink)
-		return fmt.Errorf("failed to read auth token: %w", err)
-	}
 
 	if err := a.tokenStorage.DeleteAuthToken(); err != nil {
 		output.EmitSpinnerStop(a.sink)
diff --git a/test/integration/logout_test.go b/test/integration/logout_test.go
index c574668..bf6e56d 100644
--- a/test/integration/logout_test.go
+++ b/test/integration/logout_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -44,9 +45,26 @@ func TestLogoutCommandSucceedsWhenNoToken(t *testing.T) {
 	defer cancel()
 
 	cmd := exec.CommandContext(ctx, binaryPath(), "logout")
+	cmd.Env = env.Without(env.AuthToken)
 	output, err := cmd.CombinedOutput()
 
 	// Should succeed even if no token
 	require.NoError(t, err, "lstk logout should succeed even with no token: %s", output)
 	assert.Contains(t, string(output), "Not currently logged in")
 }
+
+func TestLogoutCommandWithEnvVarToken(t *testing.T) {
+	// Ensure no keyring token — only the env var is set
+	_ = DeleteAuthTokenFromKeyring()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, binaryPath(), "logout")
+	cmd.Env = env.Without(env.AuthToken).With(env.AuthToken, "test-env-token")
+	output, err := cmd.CombinedOutput()
+
+	require.NoError(t, err, "lstk logout should succeed: %s", output)
+	assert.Contains(t, string(output), "LOCALSTACK_AUTH_TOKEN")
+}
+