Fix OpenShift OAuth flow and Gateway connection hangs

[csfercoci]

Summary

• preserve default JVM trust roots when building TLS contexts with additional trusted certificates
• validate OpenShift authentication with SelfSubjectAccessReview instead of listing namespaces
• cancel the OAuth progress cancel-watcher after browser login completes so the coroutine can finish
• remove Red Hat SSO initialization from the OpenShift connection step to avoid unrelated OIDC discovery during OpenShift OAuth
• avoid blocking the connection flow on optional kubeconfig persistence
• complete Gateway connection when the thin client is already present and add a readiness timeout

Problem

Against OpenShift clusters that delegate login through OpenShift OAuth, for example Entra ID behind OpenShift OAuth, Gateway could get stuck or fail in several places:

• unrelated Red Hat SSO/OIDC discovery could run while opening the OpenShift connector
• TLS contexts built from an empty/custom trust set could lose default JVM trust roots
• browser OAuth could remain on 'Validating cluster access...' after login because the cancellation watcher remained active inside the coroutine scope
• namespace listing was used only to validate authentication and could be slow or require broader permissions than needed
• optional kubeconfig saving could block the connection flow
• the remote IDE readiness event could be missed if the thin client was already present before listeners were attached

Testing

• Built locally with the plugin source using a local Gradle build script
• Installed into JetBrains Gateway 2026.1 and validated token-based connection
• Validated OpenShift browser OAuth flow no longer stays stuck at cluster validation

Note: Local build/install helper scripts used during debugging are intentionally not included in this PR.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: b227c97e-b067-45e3-9e6e-a085fd17d389

📥 Commits

Reviewing files that changed from the base of the PR and between 1230ab0 and 653de2a.

📒 Files selected for processing (6)

• src/main/kotlin/com/redhat/devtools/gateway/DevSpacesConnectionProvider.kt
• src/main/kotlin/com/redhat/devtools/gateway/auth/tls/SslContextFactory.kt
• src/main/kotlin/com/redhat/devtools/gateway/openshift/OpenShiftClientFactory.kt
• src/main/kotlin/com/redhat/devtools/gateway/openshift/Projects.kt
• src/main/kotlin/com/redhat/devtools/gateway/view/steps/DevSpacesServerStepView.kt
• src/main/kotlin/com/redhat/devtools/gateway/view/steps/auth/OpenShiftOAuthAuthenticationStrategy.kt

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added support for combining custom certificates with the system’s trusted certificates.
  • Added clearer authentication handling for OpenShift project access.

• Bug Fixes

  • Improved workspace connection handling when the IDE is already available.
  • Added a timeout and clearer feedback when workspace readiness takes too long.
  • Improved browser-based login cancellation and cleanup.

• Improvements

  • Reduced connection delays with a 15-second network timeout.
  • Kubeconfig updates now save in the background.
  • Removed the Red Hat SSO sign-in option.

Walkthrough

The changes update Dev Spaces connection readiness handling, combine default and custom TLS trust managers, add an OpenShift client timeout, change authentication checks to access reviews, remove Red Hat SSO authentication, and make kubeconfig persistence asynchronous.

Changes

Gateway authentication and connection flows

Layer / File(s)	Summary
Connection readiness handling src/main/kotlin/com/redhat/devtools/gateway/DevSpacesConnectionProvider.kt	Existing IDE connections resume immediately, while readiness waits now time out after 60 seconds and report an explicit runtime error.
TLS trust and client timeout src/main/kotlin/com/redhat/devtools/gateway/auth/tls/SslContextFactory.kt, src/main/kotlin/com/redhat/devtools/gateway/openshift/OpenShiftClientFactory.kt	SSL contexts combine JVM-default and custom certificate trust managers, and OpenShift HTTP clients use a 15-second connection timeout.
OpenShift authentication validation src/main/kotlin/com/redhat/devtools/gateway/openshift/Projects.kt	Authentication checks use a SelfSubjectAccessReview for listing OpenShift projects instead of listing namespaces.
Authentication strategy and kubeconfig flow src/main/kotlin/com/redhat/devtools/gateway/view/steps/DevSpacesServerStepView.kt, src/main/kotlin/com/redhat/devtools/gateway/view/steps/auth/OpenShiftOAuthAuthenticationStrategy.kt	The Red Hat SSO strategy is removed, kubeconfig writes run asynchronously with trimmed values, and OAuth cancellation watchers are always cancelled after authentication.

Estimated code review effort: 4 (Complex) | ~45 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 6.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main changes around OpenShift OAuth and Gateway connection hangs.
Description check	✅ Passed	The description matches the PR's changes and objectives, covering TLS, OpenShift auth, kubeconfig, and connection flow fixes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[adietish]

Hi @csfercoci, thanks a lot for contributing.
I noticed the issue and have a similar fix in my PRs (#330 or #317) that are in review.
Once I have those merged I'll look into yours a will merge if yours helps even better/more.

[adietish]

I removed OpenShiftClientFactory and made builders instead (were present for 1 use case before).
The new BaseClientBuilder now has the connect timeout, too:

    OkHttpClient.Builder()
            .sslSocketFactory(sslContext.socketFactory, trustManager)
==>         .connectTimeout(DEFAULT_HTTP_TIMEOUT_SECONDS, TimeUnit.SECONDS)
            .readTimeout(DEFAULT_HTTP_TIMEOUT_SECONDS, TimeUnit.SECONDS)
            .writeTimeout(DEFAULT_HTTP_TIMEOUT_SECONDS, TimeUnit.SECONDS)
            .callTimeout(DEFAULT_HTTP_TIMEOUT_SECONDS, TimeUnit.SECONDS)
            .protocols(listOf(Protocol.HTTP_1_1))
            .build()

[adietish]

@csfercoci: I included your 3 commits in #317.
Dare to verify things are fine to you? If yes, I'd close this PR.

[adietish]

The 3 commits in this PR were added to #317.
#317 was merged. Closing this PR.
@csfercoci: Thanks for your contribution!