credentials: drop plaintext auth when the helper erase fails

cli/config/credentials/native_store.go

@@ -31,12 +31,15 @@ func NewNativeStore(file store, helperSuffix string) Store {
 
 // Erase removes the given credentials from the native store.
 func (c *nativeStore) Erase(serverAddress string) error {
-	if err := client.Erase(c.programFunc, serverAddress); err != nil {
-		return err
+	helperErr := client.Erase(c.programFunc, serverAddress)
+	// Drop the plaintext copy even when the helper fails. Logout tries
+	// several server-address spellings, and a clean erase of another
+	// spelling used to hide this failure while leaving the auth entry.
+	fileErr := c.fileStore.Erase(serverAddress)
+	if helperErr != nil {
+		return helperErr
 	}
-
-	// Fallback to plain text store to remove email
-	return c.fileStore.Erase(serverAddress)
+	return fileErr
 }
 
 // Get retrieves credentials for a specific server from the native store.

cli/config/credentials/native_store_test.go

@@ -243,3 +243,20 @@ func TestNativeStoreEraseInvalidAddress(t *testing.T) {
 	err := s.Erase(invalidServerAddress)
 	assert.ErrorContains(t, err, "program failed")
 }
+
+func TestNativeStoreEraseDropsPlaintextWhenHelperFails(t *testing.T) {
+	f := &fakeStore{configs: map[string]types.AuthConfig{
+		invalidServerAddress: {
+			Username: "other",
+			Password: "secret",
+		},
+	}}
+
+	s := &nativeStore{
+		programFunc: mockCommandFn,
+		fileStore:   NewFileStore(f),
+	}
+	err := s.Erase(invalidServerAddress)
+	assert.ErrorContains(t, err, "program failed")
+	assert.Check(t, is.Len(f.GetAuthConfigs(), 0))
+}