Add a note to cargo logout that it does not revoke the token.

src/cargo/ops/registry.rs

@@ -954,6 +954,20 @@ pub fn registry_logout(config: &Config, reg: Option<&str>) -> CargoResult<()> {
             reg_name
         ),
     )?;
+    let location = if source_ids.original.is_crates_io() {
+        "<https://crates.io/me>".to_string()
+    } else {
+        // The URL for the source requires network access to load the config.
+        // That could be a fairly heavy operation to perform just to provide a
+        // help message, so for now this just provides some generic text.
+        // Perhaps in the future this could have an API to fetch the config if
+        // it is cached, but avoid network access otherwise?
+        format!("the `{reg_name}` website")
+    };
+    config.shell().note(format!(
+        "This does not revoke the token on the registry server.\n    \
+        If you need to revoke the token, visit {location} and follow the instructions there."
+    ))?;
     Ok(())
 }
 

tests/testsuite/credential_process.rs

@@ -383,6 +383,9 @@ fn logout() {
             "\
 token for `crates-io` has been erased!
 [LOGOUT] token for `crates-io` has been removed from local storage
+[NOTE] This does not revoke the token on the registry server.
+    If you need to revoke the token, visit <https://crates.io/me> \
+    and follow the instructions there.
 ",
         )
         .run();

tests/testsuite/logout.rs

@@ -44,7 +44,7 @@ fn check_config_token(registry: Option<&str>, should_be_set: bool) {
     }
 }
 
-fn simple_logout_test(registry: &TestRegistry, reg: Option<&str>, flag: &str) {
+fn simple_logout_test(registry: &TestRegistry, reg: Option<&str>, flag: &str, note: &str) {
     let msg = reg.unwrap_or("crates-io");
     check_config_token(reg, true);
     let mut cargo = cargo_process(&format!("logout -Z unstable-options {}", flag));
@@ -55,9 +55,10 @@ fn simple_logout_test(registry: &TestRegistry, reg: Option<&str>, flag: &str) {
         .masquerade_as_nightly_cargo(&["cargo-logout"])
         .with_stderr(&format!(
             "\
-[LOGOUT] token for `{}` has been removed from local storage
-",
-            msg
+[LOGOUT] token for `{msg}` has been removed from local storage
+[NOTE] This does not revoke the token on the registry server.\n    \
+If you need to revoke the token, visit {note} and follow the instructions there.
+"
         ))
         .run();
     check_config_token(reg, false);
@@ -68,24 +69,24 @@ fn simple_logout_test(registry: &TestRegistry, reg: Option<&str>, flag: &str) {
     }
     cargo
         .masquerade_as_nightly_cargo(&["cargo-logout"])
-        .with_stderr(&format!(
-            "\
-[LOGOUT] not currently logged in to `{}`
-",
-            msg
-        ))
+        .with_stderr(&format!("[LOGOUT] not currently logged in to `{msg}`"))
         .run();
     check_config_token(reg, false);
 }
 
 #[cargo_test]
 fn default_registry() {
     let registry = registry::init();
-    simple_logout_test(&registry, None, "");
+    simple_logout_test(&registry, None, "", "<https://crates.io/me>");
 }
 
 #[cargo_test]
 fn other_registry() {
     let registry = registry::alt_init();
-    simple_logout_test(&registry, Some("alternative"), "--registry alternative");
+    simple_logout_test(
+        &registry,
+        Some("alternative"),
+        "--registry alternative",
+        "the `alternative` website",
+    );
 }