fix(core): drop logged-out wellknown endpoints instead of wiring empty api keys - #54687

This partly reverts #53667 (f108fa492), which deliberately kept an endpoint's last config even with no credential. Its comment said "including a missing credential", and the aim was that remote providers and enabled_providers/policies would not disappear. After this change, logging out of an endpoint also drops its allowlist and provider-use policies, not just the header that can no longer resolve. That probably matches what logout should mean, but please say so in the description so maintainers can confirm the trade-off. A narrower alternative would keep the cached config and skip only the values whose {env:} cannot be resolved.

Fair point — stating the trade-off explicitly (also added to the PR description):

What changes: after auth logout, the endpoint contributes no documents, so its cached config — including allowlist and provider-use policies — drops from the effective config until re-login. That is a deliberate narrowing of #53667, not an accident.

Why the split is principled: #53667's intent (a failed refresh must not make remote providers/allowlists disappear) is preserved — when the credential exists but the remote fetch fails, variables is still defined and the cached config keeps being used. The new return [] only fires when there is no credential at all (auth declared, credentials.list empty), i.e. after logout. In that state the endpoint cannot authenticate any request, so keeping its documents only preserves the #54645 shadowing vector: the empty-substituted header overlays the still-authenticated endpoint's wiring (later document wins in mergeHeaders → 401s surviving restarts).

Why not the narrower alternative (keep cached config, skip only the header): the shadowing is not limited to the key header — any field of the stale cached document overlays the live endpoint's — and listing models that cannot authenticate is worse UX than removing them until auth login re-resolves everything (policies included). Logout meaning "the endpoint is gone from the effective config" is the coherent semantic here.

Thanks, that matches the code. The early return [] only applies when auth is required and there's no usable key, so a failed refresh with a credential still falls back to wellknown.cached. The case #53667 protects is unchanged. With the trade-off now stated in the description, whether logout should also drop the endpoint's policies is a decision for maintainers. I have nothing further on this point.

This file is about 200 lines, mostly a copy of the KV/Credential/Bus setup in config.test.ts, to check one assertion. The changed expectation in config.test.ts (toEqual(removed) after logout) already covers logout dropping the endpoint's documents. Could you either drop this file or turn it into a short two-endpoint case next to the existing test? The aim is to keep the change small.

Done in 2020b9f — the standalone 197-line file is gone; the regression is now a compact two-endpoint case inside config.test.ts next to the existing logout test, reusing its fixtures. 43/43 tests pass in that file.

Thanks, I checked 2020b9f. The separate file is gone, and the source change is the same as the one I verified. The new case is shorter, but it's still about 130 lines: it builds its own servers, credential mock and layer rather than reusing the existing logout test's fixtures. It's fine if maintainers are happy with that size. Since the existing test's toEqual(removed) already covers logout, a much smaller case would be enough.

The point I raised on config.ts is still open. Logging out now drops the endpoint's whole cached config, including its enabled_providers and policies. #53667 deliberately kept that config. A sentence in the PR description saying this is intended would help maintainers decide.