feat: add Device Auth Tokens tab to User Preferences by olexii4 · Pull Request #1633 · eclipse-che/che-dashboard

olexii4 · 2026-07-10T09:46:24Z

What does this PR do?

Adds a Device Auth Tokens tab to the User Preferences page with two capabilities:

Connect to GitHub — A Connect to GitHub button opens a modal displaying a one-time code with a copy button and a "Copy & Continue to Browser" primary button. The backend polls GitHub for authorization (RFC 8628) and on success writes a che.eclipse.org/device-authentication=true Kubernetes Secret to the user's namespace. The button appears automatically when the device-auth-config ConfigMap is present in the Che namespace — fully independent of Git Services OAuth configuration.
View & delete (single and bulk) — A compact card list (matching SSH Keys UI) shows stored tokens. A per-row Actions ⋮ menu provides Delete and Reconnect actions. Deleting removes the K8s Secret and revokes the GitHub token via POST /credentials/revoke (no app credentials required). Reconnecting replaces the existing token (single-active-token model matching che-code). Replacing an existing secret preserves its resourceVersion and any extra labels applied by che-code or a mutating webhook.

Device Authentication tokens are GitHub OAuth tokens generated by the device authorization flow (RFC 8628). They are stored as Kubernetes Secrets labeled che.eclipse.org/device-authentication=true. Previously the only way to generate or remove a token was through the VS Code command palette inside a running workspace.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

fixes https://redhat.atlassian.net/browse/CRW-11582

Is it tested? How?

Unit / integration tests

getDeviceAuthClientId.spec.ts — 6 tests: ConfigMap read, TTL cache hit, env-var override, missing namespace, K8s 404
deviceAuthToken.spec.ts — 4 route tests: 503 when ConfigMap absent, correct delegation when present
deviceAuthTokenApi.spec.ts — 27 tests updated: clientId passed as parameter, revocation success path, createNamespacedSecret argument shape

Deploy and verify

Deploy Che with the PR image:

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p='[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {"containers": [{"image": "quay.io/eclipse/che-dashboard:pr-1633", "name": "che-dashboard"}]}}]'

Apply the device-auth-config ConfigMap. Use VS Code's public OAuth App (01ab8ac9400c4e429b23) — it has Device Flow enabled by default and supports GitHub Copilot:

kubectl -n eclipse-che create configmap device-auth-config \
  --from-literal=github_client_id=01ab8ac9400c4e429b23

Navigate to User Preferences → Device Auth Tokens.
Click Copy & Continue to Browser → paste the code on github.com/login/device → authorize.
Verify: the token card appears with a validity icon.
Click ⋮ → Reconnect to replace the token; ⋮ → Delete to revoke and remove it.
Delete the ConfigMap and reload — verify the Connect to GitHub button is hidden.
Without the ConfigMap, call POST .../device-auth-token/initiate directly — verify HTTP 503 is returned.

Release Notes

Added a Device Auth Tokens tab to User Preferences. Users can connect their GitHub account using device authorization directly from the Dashboard, view tokens with on-demand validity checks, and delete/revoke tokens without requiring app credentials. The feature is enabled by creating a device-auth-config ConfigMap in the Che namespace — fully independent of Git Services OAuth.

Docs PR

eclipse-che/che-docs#3168

che-bot · 2026-07-10T09:46:32Z

Click here to review and test in web IDE:

olexii4

PR Review Summary

Verdict: 💬 Comment - No blocking issues. Design is sound, follows established project patterns consistently.

Criticality: 🟡 Important (DELETE endpoint on K8s Secrets)

Integration contracts verified against che-code extension source:

✅ Label che.eclipse.org/device-authentication=true matches
✅ Secret name pattern compatible
✅ No secret data exposed (only metadata returned)

Positive feedback:

Clean layered architecture matching SSH keys / PATs / AI provider keys patterns
23 new frontend tests with good assertion rigor
Minimal DTO - no secret data leakage
Consistent error handling across all layers

5 inline comments posted below covering schema constraints, backend tests, reducer tests, label verification, and card distinguishability.

Review generated by ok-pr-review (standard + deep)

tolusha · 2026-07-10T09:53:33Z

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

/che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
/che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
/che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
/che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
/che-ai-assistant help — Show this help message

github-actions · 2026-07-13T14:55:41Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1633 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1633", name: che-dashboard}]}}]"

github-actions · 2026-07-14T12:16:54Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1633 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1633", name: che-dashboard}]}}]"

olexii4 · 2026-07-14T13:42:11Z

/che-ai-assistant ok-pr-review

Task completed.

tolusha

Well-structured PR with solid test coverage across all layers. The security model is sound with proper label validation on delete and correct use of user bearer tokens throughout. A few findings worth discussing before merging:

Date type mismatch (I1): The DeviceAuthToken DTO declares creationTimestamp?: Date but Fastify serializes it to an ISO 8601 string. The frontend receives a string at runtime. See inline comment on the DTO.
Error conflation in deleteToken (D2): The catch block in deleteToken wraps the intentional label-mismatch throw alongside network errors, making all failure modes indistinguishable to the caller.
Bootstrap fetch for all users (W1/P1): fetchDeviceAuthTokens adds a K8s API call to every dashboard load. Since the component already lazy-loads on tab visit, removing the bootstrap call would improve initial load time for users who never use this tab.

All other findings are minor (ordering, modal UX, extensibility). See inline comments for details.

github-actions · 2026-07-16T08:30:20Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1633 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1633", name: che-dashboard}]}}]"

olexii4 · 2026-07-16T11:03:05Z

/che-ai-assistant ok-pr-review

Task completed.

olexii4 · 2026-07-16T11:03:15Z

/retest

olexii4 · 2026-07-17T23:11:31Z

/retest

github-actions · 2026-07-20T22:25:03Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1633 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1633", name: che-dashboard}]}}]"

olexii4

PR Review Summary

Verdict: 🔄 Request Changes — 2 critical issues, 4 suggestions

Criticality: 🟡 Important (K8s Secrets + GitHub OAuth tokens)

Integration contracts verified:

✅ Label che.eclipse.org/device-authentication=true matches che-code
✅ GitHub Device Flow API endpoints and grant type match docs
✅ GitHub revocation API matches docs
✅ No secret data exposed (only metadata returned)

Critical:

Math.random() for K8s secret names — collision risk in multi-user deployments (inline #1)
response.ok not checked on GitHub API calls — silent failures on non-2xx (inline #2)

Warnings:
3. slow_down response not propagated — violates GitHub Device Flow spec (inline #3)
4. PF v5 CSS variable in PF 6 codebase (inline #4)
5. onSuccess callback drops token argument — stale UI on re-fetch failure (inline #5)
6. Missing maxLength on deviceCode schema field (inline #6)

Positive feedback:

Clean layered architecture matching SSH keys / PATs patterns
Comprehensive backend test suite (321 lines) with strong assertion rigor
resourceVersion precondition on delete is a genuine hardening improvement
Delete modal includes helpful GitHub settings link
Provider field + label is nice forward-looking extensibility

All prior review feedback (tolusha + self-review: 12 comments) has been addressed.

Review generated by ok-pr-review (standard + deep)

github-actions · 2026-07-20T23:09:00Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1633 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1633", name: che-dashboard}]}}]"

github-actions · 2026-07-20T23:12:21Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1633 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1633", name: che-dashboard}]}}]"

Documents the Device Auth Tokens tab in User Preferences introduced in eclipse-che/che-dashboard#1633. New article (connecting-to-github-using-device-authorization.adoc): - Connect to GitHub using the device authorization flow (RFC 8628) - Reconnect to replace a revoked or expired token in-place - Delete a single token or multiple tokens in bulk - Troubleshooting for expired one-time codes Updated admin procedure (proc_setting-up-the-github-oauth-app.adoc): - Optional steps to enable Device Flow on the GitHub OAuth App - Step to create the device-auth-config ConfigMap that enables the Connect to GitHub button in the Dashboard Updated assembly (configuring-oauth-2-for-github.adoc): - NOTE for admins who already configured the OAuth App and want to enable Device Auth Tokens without repeating the full setup Navigation: added the new article under Using credentials and configurations in workspaces > Mounting secrets. Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

vinokurig · 2026-08-17T11:12:56Z

LGTM but we should have automatic dashboard pod reconcile on the device-auth-config configmap is added or removed. We should consider this feature for the next iteration.

openshift-ci · 2026-08-17T11:13:31Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: olexii4, svor, vinokurig

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

…ferences tab Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

…error handling Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

…rovements Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

…ap fallback Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

openshift-ci · 2026-08-25T05:36:46Z

New changes are detected. LGTM label has been removed.

POST /credentials/revoke is for reporting exposed credentials found by third parties; it returns 403 when called by the token owner. The correct self-revocation endpoint (DELETE /applications/{client_id}/token) requires the OAuth app client secret, which this service does not hold. Remove the revocation attempt and its test coverage. The GitHub token remains valid until the user revokes it manually from GitHub Settings → Applications → Authorized OAuth Apps. Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

github-actions · 2026-08-25T05:50:59Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1633 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1633", name: che-dashboard}]}}]"

github-actions · 2026-08-25T05:57:13Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1633 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1633", name: che-dashboard}]}}]"

olexii4 · 2026-08-25T13:50:21Z

/retest

openshift-ci · 2026-08-25T15:07:37Z

@olexii4: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v19-dashboard-happy-path	`adb5bc9`	link	true	`/test v19-dashboard-happy-path`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

olexii4 · 2026-08-31T12:20:27Z

/retest

Documents the Device Auth Tokens tab in User Preferences introduced in eclipse-che/che-dashboard#1633. New article (connecting-to-github-using-device-authorization.adoc): - Connect to GitHub using the device authorization flow (RFC 8628) - Reconnect to replace a revoked or expired token in-place - Delete a single token or multiple tokens in bulk - Troubleshooting for expired one-time codes Updated admin procedure (proc_setting-up-the-github-oauth-app.adoc): - Optional steps to enable Device Flow on the GitHub OAuth App - Step to create the device-auth-config ConfigMap that enables the Connect to GitHub button in the Dashboard Updated assembly (configuring-oauth-2-for-github.adoc): - NOTE for admins who already configured the OAuth App and want to enable Device Auth Tokens without repeating the full setup Navigation: added the new article under Using credentials and configurations in workspaces > Mounting secrets. Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com> Co-authored-by: Oleksii Orel <oorel@redhat.com>

olexii4 requested review from akurinnoy and ibuziuk as code owners July 10, 2026 09:46

olexii4 commented Jul 10, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/constants/schemas.ts

olexii4 commented Jul 10, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/devworkspaceClient/services/deviceAuthTokenApi.ts Outdated

olexii4 commented Jul 10, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/devworkspaceClient/services/deviceAuthTokenApi.ts Outdated

olexii4 commented Jul 10, 2026

View reviewed changes

Comment thread packages/dashboard-frontend/src/store/DeviceAuthToken/reducer.ts

olexii4 commented Jul 10, 2026

View reviewed changes

Comment thread packages/dashboard-frontend/src/pages/UserPreferences/DeviceAuthTokens/List/index.tsx Outdated

olexii4 requested a review from RomanNikitenko July 13, 2026 14:16

tolusha reviewed Jul 14, 2026

View reviewed changes

github-advanced-security Bot found potential problems Jul 20, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/routes/api/deviceAuthToken.ts Fixed

Comment thread packages/dashboard-backend/src/routes/api/deviceAuthToken.ts Fixed

olexii4 commented Jul 20, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/devworkspaceClient/services/deviceAuthTokenApi.ts Outdated

olexii4 commented Jul 20, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/devworkspaceClient/services/deviceAuthTokenApi.ts Outdated

olexii4 commented Jul 20, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/devworkspaceClient/services/deviceAuthTokenApi.ts Outdated

olexii4 commented Jul 20, 2026

View reviewed changes

Comment thread packages/dashboard-frontend/src/pages/UserPreferences/DeviceAuthTokens/ConnectModal/index.tsx Outdated

olexii4 commented Jul 20, 2026

View reviewed changes

Comment thread packages/dashboard-frontend/src/pages/UserPreferences/DeviceAuthTokens/index.tsx Outdated

olexii4 commented Jul 20, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/constants/schemas.ts Outdated

openshift-ci Bot assigned svor Aug 13, 2026

openshift-ci Bot added the lgtm label Aug 13, 2026

vinokurig approved these changes Aug 17, 2026

View reviewed changes

openshift-ci Bot assigned vinokurig Aug 17, 2026

openshift-ci Bot added the needs-rebase label Aug 20, 2026

RomanNikitenko reviewed Aug 24, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/devworkspaceClient/services/deviceAuthTokenApi.ts Outdated

olexii4 added 8 commits August 25, 2026 08:35

feat(device-auth): add backend service, routes, and common types

58a3deb

Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

feat(device-auth): add frontend API client, Redux slice, and User Pre…

0a0a1b9

…ferences tab Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

fix(device-auth): add Reconnect action, rate limiting, timeouts, and …

1634245

…error handling Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

feat(device-auth): add token validity check, status icons, and UX imp…

b0020b0

…rovements Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

fix(device-auth): address PR review feedback

1ea2d26

Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

feat(device-auth): detect GitHub OAuth via Che Server API and ConfigM…

dbf22fa

…ap fallback Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

feat(device-auth): decouple from Git Services OAuth via ConfigMap

9abec57

Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

fix(device-auth): address final review feedback and regenerate licenses

0c93d88

Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

olexii4 force-pushed the CRW-11582 branch from a2b3ef5 to 0c93d88 Compare August 25, 2026 05:36

openshift-ci Bot removed the lgtm label Aug 25, 2026

openshift-ci Bot removed the needs-rebase label Aug 25, 2026

olexii4 merged commit cf13bee into main Aug 31, 2026
26 of 30 checks passed

olexii4 deleted the CRW-11582 branch August 31, 2026 14:00

Uh oh!

Conversation

olexii4 commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

Is it tested? How?

Release Notes

Docs PR

Uh oh!

che-bot commented Jul 10, 2026

Uh oh!

olexii4 left a comment

Choose a reason for hiding this comment

PR Review Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tolusha commented Jul 10, 2026

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

github-actions Bot commented Jul 14, 2026

Uh oh!

olexii4 commented Jul 14, 2026 • edited by tolusha Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tolusha left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

olexii4 commented Jul 16, 2026 • edited by tolusha Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

olexii4 commented Jul 16, 2026

Uh oh!

olexii4 commented Jul 17, 2026

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

olexii4 left a comment

Choose a reason for hiding this comment

PR Review Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

vinokurig commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Aug 17, 2026

Uh oh!

Uh oh!

openshift-ci Bot commented Aug 25, 2026

Uh oh!

github-actions Bot commented Aug 25, 2026

Uh oh!

github-actions Bot commented Aug 25, 2026

Uh oh!

olexii4 commented Jul 10, 2026 •

edited

Loading

olexii4 commented Jul 14, 2026 •

edited by tolusha

Loading

olexii4 commented Jul 16, 2026 •

edited by tolusha

Loading

vinokurig commented Aug 17, 2026 •

edited

Loading