refactor: relay-only BFF — remove the in-app identity layer (ADR 0014)

[Gkrumbach07]

Summary

Implements the shape A / relay-only decision (ADR 0002 (relay-only auth), on the docs/adrs branch → PR #17): the BFF is a pure token relay in every deployment. Browser authentication — login, cookie sessions, refresh, logout, CSRF — belongs to the auth proxy in front of the BFF (oauth2-proxy standalone, kube-auth-proxy federated), which is how every production deployment already ran. The secure-agent-workspace validated pattern deploys this dashboard behind oauth2-proxy today and never used the built-in custodian.

Net: −2,000 lines. One auth pattern, one trust story: the thing in front of me authenticated this request.

Removed

• The standalone OIDC custodian (~1,500 lines): oidc_handler.go, auth/session.go (AES-256-GCM cookie codec), session_manager.go (transparent refresh), CSRF middleware, and the /auth/discovery, /auth/token-exchange, /auth/session, /auth/logout endpoints + tests
• Frontend PKCE flow: oidc.ts, AuthCallbackPage, useSession probe; login page is dev-mode only
• CORS allowlist + ALLOWED_ORIGINS — same-origin-only behind the proxy; the three divergent origin checks collapse to one (same-origin enforcement on the terminal WS handshake)
• Mode machinery: OIDC_ISSUER/CLIENT_ID/CLIENT_SECRET/SCOPES/USER_ROLE, SESSION_SECRET, DEPLOYMENT_CONTEXT, TrustProxyHeader. AUTH_DISABLED is the only switch left — this also removes the FE/BE mode-detection mismatch class entirely
• Dead extension surface: workspaceBinding slot, workspaceBinding/resourceLinks feature flags, SandboxPolicyTab.tsx

Fixed

• Dev-mode whoami returns the configured ADMIN_ROLE instead of hardcoded role names that never matched it (admin pages were silently inaccessible in dev)
• 401 outside dev mode reloads the page (guarded, once) so the proxy re-authenticates — the old redirect targeted a /login route that doesn't exist in proxied deployments
• Logout goes straight to LOGOUT_URL (default /oauth2/sign_out), no double fallback
• make dev-full: the local gateway allows unauthenticated calls so the auth-disabled BFF works against it; Keycloak still mints real JWTs for exercising the Bearer relay path with curl/CLI

Deployment requirement (documented in README)

Unconditional trust in x-forwarded-access-token is safe only when the proxy is the sole network path to the BFF (sidecar, pod-internal port, proxy-only ingress) — the standard contract for every x-forwarded-* consumer.

Relationship to other PRs

• Supersedes the custodian from feat: cookie-based BFF sessions for standalone OIDC #24 (ADR 0010 → Superseded by ADR 0002 (relay-only auth)). What feat: cookie-based BFF sessions for standalone OIDC #24 got right — no tokens in JS, cookies authenticating WS, server-side refresh — is preserved verbatim, just in oauth2-proxy where Red Hat already operates it at fleet scale.
• PR fix(security): harden BFF auth endpoints and federated CSS #25: the rate-limiting/HTTPS-enforcement/CSRF hardening targets endpoints this PR deletes; its CSS-removal half remains relevant.
• PR docs: ADRs, governance, and community foundation #17 (docs/adrs) carries ADR 0002 (relay-only auth) and the v3 rewrites of ADRs 0001/0003/0011 that this implements. This PR is deliberately code-only.

Test plan

• go build ./... && go vet ./... && go test ./... — all green
• tsc --noEmit, jest (168/168), eslint, prettier — all green
• webpack production build — green
• Live validation: make dev-full → Continue as developer → workspaces/sandboxes/terminal
• Live validation: oauth2-proxy in front → login via Dex/OpenShift SSO → relay path → workspaces render (verified on the ROSA cluster, image pr-29; terminal WS pending a browser check)

🤖 Generated with Claude Code