feat: Option to invalidate api-keys on logout.

src/anaconda_auth/actions.py

@@ -304,6 +304,7 @@ def logout(config: Optional[AnacondaAuthSite] = None) -> None:
     # domains.
     try:
         token_info = TokenInfo.load(domain="anaconda.cloud")
+
         token_info.delete()
     except TokenNotFoundError:
         pass

src/anaconda_auth/cli.py

@@ -326,7 +326,19 @@ def auth_key(at: Optional[str] = None) -> None:
 
 
 @app.command(name="logout")
-def auth_logout(at: Optional[str] = None) -> None:
+def auth_logout(
+    at: Optional[str] = None,
+    invalidate: bool = typer.Option(
+        False, "--invalidate", "-i", help="Invalidate Api Key."
+    ),
+) -> None:
     """Logout"""
     _override_default_site(at)
+
+    if invalidate:
+        token_info = TokenInfo.load()
+        client = BaseClient()
+        response = client.delete(f"/api/auth/api-keys/{token_info.api_key_kid}")
+        response.raise_for_status()
+
     logout()

src/anaconda_auth/token.py

@@ -252,6 +252,16 @@ class TokenInfo(BaseModel):
     repo_tokens: List[RepoToken] = []
     version: Optional[int] = TOKEN_INFO_VERSION
 
+    @property
+    def decoded_api_key(self) -> dict:
+        return jwt.decode(
+            self.api_key, algorithms=["RS256"], options={"verify_signature": False}
+        )
+
+    @property
+    def api_key_kid(self) -> str:
+        return self.decoded_api_key.get("kid")
+
     @classmethod
     def _decode(cls, keyring_data: str) -> dict:
         decoded_bytes = base64.b64decode(keyring_data)