Drop cached S3 clients on logout so credentials stop working immediately (#766)

Author: fiskus

Cargo.lock

@@ -9,6 +9,12 @@
 <!-- markdownlint-disable MD013 -->
 # Changelog
 
+## [v0.33.0-alpha9] - 2026-07-13
+
+### Added
+
+- `RemoteS3` now exposes clearing its cached S3 clients (per host or all) so callers can invalidate credentials on logout (<https://github.com/quiltdata/quilt-rs/pull/766>)
+
 ## [v0.33.0-alpha8] - 2026-07-10
 
 ### Added

quilt-rs/CHANGELOG.md

@@ -3,7 +3,7 @@ name = "quilt-rs"
 description = "Rust library for accessing Quilt data packages."
 
 # Inherit from workspace
-version = "0.33.0-alpha8"
+version = "0.33.0-alpha9"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true

quilt-rs/Cargo.toml

@@ -155,4 +155,13 @@ pub trait Remote {
     /// HEAD-bucket endpoint returns the region for any existing bucket
     /// regardless of permissions.
     fn verify_bucket(&self, bucket: &str) -> impl Future<Output = Res> + Send;
+
+    /// Drop any cached clients (and their in-memory credentials) for the
+    /// given `host`, or for all hosts when `None`. Lets callers invalidate
+    /// credentials immediately on logout instead of waiting for them to
+    /// expire. Default no-op: only stateful remotes such as [`RemoteS3`]
+    /// cache clients, so mocks and other impls need no change.
+    fn clear_client_cache(&self, host: Option<&Host>) {
+        let _ = host;
+    }
 }

quilt-rs/src/io/remote.rs

@@ -290,6 +290,32 @@ impl RemoteS3 {
         }
     }
 
+    /// Drop cached S3 clients so the next request rebuilds them with a
+    /// fresh credential provider. Called on logout: a cached client still
+    /// holds the STS credentials minted before logout (valid ~1h), so
+    /// without this the running app keeps serving reads/writes after the
+    /// on-disk auth token is erased.
+    ///
+    /// `Some(host)` clears only the clients for that catalog host;
+    /// `None` (global logout) clears every cached client.
+    ///
+    /// The `regions` cache is left intact: it is keyed by bucket name and
+    /// holds only public HEAD-bucket region lookups — no credentials — so
+    /// it never goes stale on logout.
+    pub fn clear_client_cache(&self, host: Option<&Host>) {
+        // On a poisoned lock, recover the guard and clear anyway: dropping
+        // stale clients on logout is the safe outcome, never leaving
+        // credentials cached.
+        let mut map = match self.s3.write() {
+            Ok(map) => map,
+            Err(poisoned) => poisoned.into_inner(),
+        };
+        match host {
+            Some(host) => map.retain(|creds_ref, _| creds_ref.host.as_ref() != Some(host)),
+            None => map.clear(),
+        }
+    }
+
     async fn get_client_for_bucket(
         &self,
         host: &Option<Host>,
@@ -439,6 +465,10 @@ impl Remote for RemoteS3 {
         self.get_region_for_bucket(bucket).await?;
         Ok(())
     }
+
+    fn clear_client_cache(&self, host: Option<&Host>) {
+        RemoteS3::clear_client_cache(self, host);
+    }
 }
 
 #[cfg(test)]
@@ -589,6 +619,66 @@ mod tests {
         Ok(())
     }
 
+    /// Building a real, offline `aws_sdk_s3::Client` for a region so the
+    /// cache-clearing test exercises the actual `s3` map, not a stand-in.
+    fn dummy_client(region: &str) -> aws_sdk_s3::Client {
+        let conf = aws_sdk_s3::Config::builder()
+            .behavior_version(BehaviorVersion::latest())
+            .region(Region::new(region.to_string()))
+            .build();
+        aws_sdk_s3::Client::from_conf(conf)
+    }
+
+    /// `clear_client_cache(Some(host))` drops only that host's clients and
+    /// keeps the rest; `clear_client_cache(None)` empties the whole cache.
+    #[test]
+    fn test_clear_client_cache_filters_by_host() {
+        use std::str::FromStr;
+
+        let host_a = Host::from_str("a.example.com").unwrap();
+        let host_b = Host::from_str("b.example.com").unwrap();
+
+        let remote = RemoteS3::new(DomainPaths::default(), LocalStorage::new());
+
+        {
+            let mut map = remote.s3.write().unwrap();
+            map.insert(
+                CredsRef {
+                    region: Region::new("us-east-1"),
+                    host: Some(host_a.clone()),
+                },
+                dummy_client("us-east-1"),
+            );
+            map.insert(
+                CredsRef {
+                    region: Region::new("us-west-2"),
+                    host: Some(host_b.clone()),
+                },
+                dummy_client("us-west-2"),
+            );
+            map.insert(
+                CredsRef {
+                    region: Region::new("eu-west-1"),
+                    host: None,
+                },
+                dummy_client("eu-west-1"),
+            );
+        }
+
+        // Clearing host_a leaves host_b and the host-less entry.
+        remote.clear_client_cache(Some(&host_a));
+        {
+            let map = remote.s3.read().unwrap();
+            assert_eq!(map.len(), 2);
+            assert!(!map.keys().any(|k| k.host.as_ref() == Some(&host_a)));
+            assert!(map.keys().any(|k| k.host.as_ref() == Some(&host_b)));
+        }
+
+        // Clearing None empties everything.
+        remote.clear_client_cache(None);
+        assert!(remote.s3.read().unwrap().is_empty());
+    }
+
     /// When storage holds valid credentials, the provider must surface them
     /// as `aws_credential_types::Credentials` on every call. This proves
     /// the async plumbing compiles and runs, and that the quilt-side

quilt-rs/src/io/remote/s3.rs

@@ -9,6 +9,12 @@
 <!-- markdownlint-disable MD013 -->
 # Changelog
 
+## [v0.18.3-alpha15] - 2026-07-13
+
+### Fixed
+
+- Logging out now immediately drops the in-memory S3 credential cache, so reads and writes stop working right away instead of lingering until the cached credentials expire (<https://github.com/quiltdata/quilt-rs/pull/766>)
+
 ## [v0.18.3-alpha14] - 2026-07-13
 
 ### Changed

quilt-sync/CHANGELOG.md

@@ -1,6 +1,6 @@
 [package]
 name = "quilt-sync"
-version = "0.18.3-alpha14"
+version = "0.18.3-alpha15"
 authors = ["Quilt Data, Inc."]
 description = "Cross-platform desktop application for editing Quilt data packages"
 documentation = "https://docs.quiltdata.com"

quilt-sync/src-tauri/Cargo.toml

@@ -6,6 +6,8 @@ use serde::Serialize;
 use tauri::Manager;
 use tokio::sync;
 
+use quilt_uri::Host;
+
 use crate::Error;
 use crate::model;
 use crate::notify::Notify;
@@ -84,6 +86,7 @@ async fn erase_auth_command(app_handle: &tauri::AppHandle, host: &str) -> Result
 #[tauri::command]
 pub async fn erase_auth(
     app_handle: tauri::State<'_, sync::Mutex<tauri::AppHandle>>,
+    m: tauri::State<'_, model::Model>,
     tracing: tauri::State<'_, crate::telemetry::Telemetry>,
     host: String,
 ) -> Result<String, String> {
@@ -95,11 +98,25 @@ pub async fn erase_auth(
     let msg_ok = format!("Successfully erased auth for {host}");
     let msg_err = |err: &Error| format!("Failed to erase auth: {err}");
 
-    Notify::new(msg_init).map(
-        erase_auth_command(&app_handle, &host).await,
-        msg_ok,
-        msg_err,
-    )
+    // Delete the on-disk token first, then invalidate the in-memory S3
+    // client cache. A cached client holds STS credentials minted before
+    // logout (valid ~1h), so without this the running app keeps serving
+    // reads/writes until they expire.
+    let result = erase_auth_command(&app_handle, &host).await;
+    if result.is_ok() {
+        // Global logout (empty host) clears every cached client; a per-host
+        // logout clears only that host's. An unparseable non-empty host can
+        // have no client keyed under it (cache keys are valid `Host`s), so
+        // there is nothing to clear — and we must NOT fall back to clearing
+        // everything, which would drop unrelated hosts' clients.
+        if host.is_empty() {
+            m.clear_remote_client_cache(None).await;
+        } else if let Ok(host) = Host::from_str(&host) {
+            m.clear_remote_client_cache(Some(&host)).await;
+        }
+    }
+
+    Notify::new(msg_init).map(result, msg_ok, msg_err)
 }
 
 /// Navigate to a page after successful login.

quilt-sync/src-tauri/src/commands/auth.rs

@@ -19,6 +19,8 @@ use quilt_rs::io::remote::WorkflowsConfig;
 use quilt_rs::io::remote::fetch_workflows_config_for_bucket;
 use quilt_rs::workflow::WorkflowRules;
 
+use quilt_uri::Host;
+
 /// Result of checking whether a package is already installed.
 #[derive(Debug)]
 pub enum InstallCheck {
@@ -422,6 +424,18 @@ impl Model {
     ) -> Result<quilt::lineage::Home, Error> {
         Ok(self.get_quilt().lock().await.set_home(directory).await?)
     }
+
+    /// Drop the remote's cached S3 clients (and their in-memory
+    /// credentials) for `host`, or for all hosts when `None`. Invoked on
+    /// logout so credentials stop working immediately rather than
+    /// lingering in a cached client until STS expiry.
+    pub async fn clear_remote_client_cache(&self, host: Option<&Host>) {
+        self.quilt
+            .lock()
+            .await
+            .get_remote()
+            .clear_client_cache(host);
+    }
 }
 
 mod ops;