feat(oauth): add OAuth IDE redirect proxy for browser-based extensions

[RomanNikitenko]

What does this PR do?

• Extensions like GitLab Workflow can initiate an OAuth authorization flow directly from the editor running inside a workspace
• Each workspace has a dynamic URL, but the OAuth application flow requires a static callback URL registered in advance. Since different workspaces have different URLs, a single static redirect URI cannot point directly to any specific workspace.
• This adds a stable /api/oauth/ide-redirect endpoint on the Che server that acts as a redirect proxy: it receives the OAuth callback from the identity provider and forwards the authorization code to the originating workspace.
• The callback URL is validated against an allowed-host pattern to prevent open redirects.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

https://redhat.atlassian.net/browse/CRW-11743

How to test this PR?

1. Deploy Che using image with the current PR changes:

chectl server:deploy -p openshift --cheimage=quay.io/eclipse/che-server:pr-1070

2. Go to your Gitlab account => Applications => Add new application
3. Set a name
4. Set Redirect URI: <instance for testing>/api/oauth/ide-redirect
5. Select api, read_api, read_user scopes
6. Unselect Confidential
7. Add the following ConfigMap with configurable OAuth parameters via environment variables

kind: ConfigMap
apiVersion: v1
metadata:
  name: gitlab-workflow
  namespace: eclipse-che
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/component: workspaces-config
    controller.devfile.io/mount-to-devworkspace: 'true'
    controller.devfile.io/watch-configmap: 'true'
  annotations:
       controller.devfile.io/mount-as: env
data:
  GITLAB_WORKFLOW_OAUTH_CLIENT_ID: <Application ID of the registered Gitlab app>
  GITLAB_WORKFLOW_OAUTH_REDIRECT_URI: <instance for testing>/api/oauth/ide-redirect 

8. You need to install Gitlab extension with my changes: https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/merge_requests/3355
9. Download the VSIX: https://gitlab.com/rnikiten/gitlab-vscode-extension/-/blob/test-custom-redirect-uri/gitlab-workflow-6.90.6.vsix?ref_type=heads
10. Start a workspace for a gitlab project with Che-Code/Dev Spaces Code editor, for example:

https://gitlab.com/rnikiten/gitlab-vscode-extension/-/tree/test-custom-redirect-uri

11. F1 => Install From VSIX => Select the VSIX
12. Go to the Gitlab panel => Authenticate to Gitlab instance => https://gitlab.com/ => OAuth => Open => Autorize <App name> => Come back to the IDE
13. Check Gitlab panel

Before authenticaion:

After:

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Sections What issues does this PR fix or reference and How to test this PR completed
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Release Notes

Reviewers

Reviewers, please comment how you tested the PR when approving it.

Assisted-by: Cursor AI

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: RomanNikitenko

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Docker image build succeeded: quay.io/eclipse/che-server:pr-1070

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1070", name: che}]}}]"

[RomanNikitenko]

/retest

[openshift-ci]

@RomanNikitenko: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v19-gitlab-with-oauth-setup-flow	e8283c0	link	true	/test v19-gitlab-with-oauth-setup-flow
ci/prow/v19-gitlab-no-pat-oauth-flow-ssh-url	e8283c0	link	true	/test v19-gitlab-no-pat-oauth-flow-ssh-url
ci/prow/v19-github-no-pat-oauth-flow-ssh-url	e8283c0	link	true	/test v19-github-no-pat-oauth-flow-ssh-url
ci/prow/v19-bitbucket-no-pat-oauth-flow	e8283c0	link	true	/test v19-bitbucket-no-pat-oauth-flow
ci/prow/v19-gitea-no-pat-oauth-flow	e8283c0	link	true	/test v19-gitea-no-pat-oauth-flow
ci/prow/v19-gitlab-no-pat-oauth-flow	e8283c0	link	true	/test v19-gitlab-no-pat-oauth-flow
ci/prow/v19-github-no-pat-oauth-flow	e8283c0	link	true	/test v19-github-no-pat-oauth-flow
ci/prow/v19-azure-no-pat-oauth-flow	e8283c0	link	true	/test v19-azure-no-pat-oauth-flow
ci/prow/v19-azure-no-pat-oauth-flow-ssh-url	e8283c0	link	true	/test v19-azure-no-pat-oauth-flow-ssh-url
ci/prow/v19-github-no-pat-oauth-flow-raw-devfile-url	e8283c0	link	true	/test v19-github-no-pat-oauth-flow-raw-devfile-url
ci/prow/v19-azure-no-pat-oauth-flow-raw-devfile-url	e8283c0	link	true	/test v19-azure-no-pat-oauth-flow-raw-devfile-url
ci/prow/v19-bitbucket-no-pat-oauth-flow-raw-devfile-url	e8283c0	link	true	/test v19-bitbucket-no-pat-oauth-flow-raw-devfile-url
ci/prow/v19-bitbucket-no-pat-oauth-flow-ssh-url	e8283c0	link	true	/test v19-bitbucket-no-pat-oauth-flow-ssh-url
ci/prow/v19-gitea-with-pat-setup-flow	e8283c0	link	true	/test v19-gitea-with-pat-setup-flow
ci/prow/v19-che-smoke-test	e8283c0	link	true	/test v19-che-smoke-test
ci/prow/v19-azure-with-pat-setup-flow	e8283c0	link	true	/test v19-azure-with-pat-setup-flow
ci/prow/v19-gitlab-no-pat-oauth-flow-raw-devfile-url	e8283c0	link	true	/test v19-gitlab-no-pat-oauth-flow-raw-devfile-url
ci/prow/v19-gitlab-with-pat-setup-flow	e8283c0	link	true	/test v19-gitlab-with-pat-setup-flow
ci/prow/v19-github-with-pat-setup-flow	e8283c0	link	true	/test v19-github-with-pat-setup-flow

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.