fix(security): harden BFF auth endpoints and federated CSS

[gmenher]

Jira: RHOAIENG-83129

Summary

Security hardening for the openshell-dashboard BFF, addressing findings from an initial security review. Also removes local CSS files that broke PatternFly theming in Module Federation consumption.

Changes

Security (backend)

1. Rate-limit auth endpoints — Token exchange and refresh are now throttled at 10 req/min/IP to prevent brute-force refresh token abuse and IdP amplification. Only trusts X-Forwarded-For from loopback connections; direct clients are identified by RemoteAddr. Returns 429 with Retry-After: 60.

2. OIDC issuer + token_endpoint HTTPS enforcement — Rejects non-HTTPS issuer URLs and token endpoints to prevent MITM on token exchange. Plaintext HTTP is only permitted for exact localhost/127.0.0.1 development addresses (with port separator to block localhost.evil.com variants).

3. Stop forwarding stale tokens in dev mode — When AUTH_DISABLED=true, the auth middleware no longer reads or forwards tokens from request headers. Prevents "invalid token" errors when the gateway is configured with allowUnauthenticatedUsers=true.

4. Workspace URL param validation — Adds validateURLParam("workspace") middleware that rejects paths not matching DNS-1123 before they reach the gateway.

5. WebSocket origin relaxed in dev mode — checkWebSocketOrigin accepts all origins when auth is disabled, simplifying local development with proxied frontends.

Frontend

6. Terminal WebSocket URL — Uses getApiBasePath() so the terminal connects to the correct path in federated mode (/openshell/api/v1/.../terminal).

7. CSS removal — Deletes SandboxCard.css and SandboxEgressSummary.css that broke PatternFly theming in federated consumption. Replaced with inline styles using PF design tokens.

Testing

• go build ./... — pass
• go vet ./... — pass
• go test ./... — 4 packages, all pass (includes new tests for rate-limiter, input validation, OIDC enforcement, clientIP trust logic)
• Manual: rate-limit returns 429 on 11th request, invalid workspace returns 400, valid workspace returns 200

Known limitations

• Rate-limiter is in-memory/per-process (defense-in-depth; production ingress is primary control)
• {name}, {provider} params not yet validated (follow-up)
• Token in sessionStorage remains a security gap — feat/cookie-session-auth branch addresses this separately

Depends on

PR #18 should merge first (shared base commit 516da0c).

[Gkrumbach07]

Thanks — four of these I want to keep: CSS deletion, dev mode token fix, terminal basePath, and the writeGrpcError wrapped-error fix (all gateway methods use fmt.Errorf wrapping so every error was returning 500).

Drop the rate limiter, HTTPS enforcement, workspace validation, and CORS credentials header. Our BFF is relay-only (ADR 0002) — no OIDC endpoints. The genai BFF doesn't have rate limiting or HTTPS enforcement either; that belongs at the ingress layer.

One thing on the CSS: replace the inline style={{}} props with PF component props (<FlexItem flex={{ default: 'flex_1' }}>, <Content component="p">, etc.) or PF utility classes as fallback. No inline styles.