[dashboard] Improve dashboard session params by lllamnyp · Pull Request #1913 · cozystack/cozystack

Timofei Larkin (lllamnyp) · 2026-01-26T16:48:23Z

What this PR does

This patch enables the offline_access scope for the dashbord keycloak client, so that users get a refresh token which gatekeeper can use to automatically refresh an expiring access token. Also session timeouts were increased.

Release note

[dashboard] Increase session timeouts, add the offline_access scope,
enable refresh tokens to improve the overall user experience when
working with the dashboard.

Summary by CodeRabbit

Chores
- Updated authentication configuration with additional OAuth2 scope parameters to enhance security credentials handling.
- Enhanced Keycloak client configuration with optional client scopes and session management attributes, including logout redirect settings and session timeout controls for improved session lifecycle management.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

## What this PR does This patch enables the `offline_access` scope for the dashbord keycloak client, so that users get a refresh token which gatekeeper can use to automatically refresh an expiring access token. Also session timeouts were increased. ### Release note ```release-note [dashboard] Increase session timeouts, add the offline_access scope, enable refresh tokens to improve the overall user experience when working with the dashboard. ``` Signed-off-by: Timofei Larkin <[email protected]>

gemini-code-assist · 2026-01-26T16:48:37Z

Summary of Changes

Hello Timofei Larkin (@lllamnyp), I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the dashboard's user experience by enhancing its authentication and session management. By enabling refresh tokens and extending session durations, users will experience fewer interruptions due to expiring sessions, as Gatekeeper can now automatically refresh access tokens.

Highlights

Offline Access Scope Enabled: The offline_access scope has been enabled for the dashboard's Keycloak client, allowing users to receive refresh tokens for extended sessions.
Session Timeouts Increased: The session idle and maximum lifespan timeouts for the Keycloak client have been significantly extended to improve user experience and reduce re-authentication frequency.
Automatic Token Refresh: These changes facilitate automatic refreshing of expiring access tokens by Gatekeeper, leveraging the newly enabled refresh tokens.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-01-26T16:48:52Z

📝 Walkthrough

Walkthrough

This change adds OAuth2 scope configuration to the OAuth proxy invocation and extends the KeycloakClient specification with optional client scopes and session/logout attributes in the dashboard system templates. Both are configuration-only additions with no functional logic modifications.

Changes

Cohort / File(s)	Summary
Dashboard OAuth & Keycloak Configuration `packages/system/dashboard/templates/gatekeeper.yaml`, `packages/system/dashboard/templates/keycloakclient.yaml`	Added OAuth2 proxy scope parameter (`openid email profile offline_access`) to gatekeeper invocation; extended KeycloakClient with `optionalClientScopes` list and `attributes` map (post.logout.redirect.uris, client.session.idle.timeout, client.session.max.lifespan)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 Hops of joy through configs small,
Scopes and sessions, we've got 'em all!
OAuth dances, timeouts gleam,
Dashboard dreams in YAML dream! 🌟

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: improving dashboard session parameters by adding offline_access scope and increasing session timeouts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request enables the offline_access scope and increases session timeouts for the dashboard, which should improve the user experience by allowing automatic token refreshes. The changes in gatekeeper.yaml and keycloakclient.yaml are correct and achieve the stated goal. My review includes suggestions to make the new session timeout values and OAuth scopes configurable through Helm values. This will enhance the chart's flexibility and maintainability by allowing different configurations for different environments.

gemini-code-assist · 2026-01-26T16:49:23Z

            - --cookie-secure=true
            - --cookie-secret=$(OAUTH2_PROXY_COOKIE_SECRET)
            - --skip-provider-button
+            - --scope=openid email profile offline_access


The OAuth scopes are hardcoded. To provide more flexibility, consider making the scopes configurable via the Helm chart's values.yaml. This would allow administrators to easily customize the requested scopes, for example, to disable offline_access if it's not desired in a specific environment.

- --scope={{ .Values.dashboard.oauth.scopes | default "openid email profile offline_access" }}

gemini-code-assist · 2026-01-26T16:49:23Z

+    client.session.idle.timeout: "86400"
+    client.session.max.lifespan: "604800"


The session idle timeout and max lifespan are hardcoded. It's a good practice to make these values configurable through the Helm chart's values.yaml file. This improves flexibility and maintainability, allowing for easier customization across different deployment environments which may have different security requirements.

client.session.idle.timeout: {{ .Values.dashboard.session.idleTimeout | default "86400" | quote }} client.session.max.lifespan: {{ .Values.dashboard.session.maxLifespan | default "604800" | quote }}

github-actions · 2026-01-27T17:18:44Z

Successfully created backport PR for release-0.40:

[Backport release-0.40] [dashboard] Improve dashboard session params #1919

github-actions · 2026-01-27T17:18:45Z

Successfully created backport PR for release-0.41:

[Backport release-0.41] [dashboard] Improve dashboard session params #1920

…1919) # Description Backport of #1913 to `release-0.40`.

…1920) # Description Backport of #1913 to `release-0.41`.

Timofei Larkin (lllamnyp) requested review from Andrei Kvapil (kvaps) and Nikita (nbykov0) as code owners January 26, 2026 16:48

Timofei Larkin (lllamnyp) added kind/backport Categorizes issue or PR as requiring a backport to the current release line kind/backport-previous Categorizes issue or PR as requiring a backport to the previous release line labels Jan 26, 2026

dosubot Bot added the size/XS This PR changes 0-9 lines, ignoring generated files label Jan 26, 2026

dosubot Bot added the kind/feature Categorizes issue or PR as related to a new feature label Jan 26, 2026

gemini-code-assist Bot reviewed Jan 26, 2026

View reviewed changes

Andrei Kvapil (kvaps) approved these changes Jan 26, 2026

View reviewed changes

dosubot Bot added the lgtm This PR has been approved by a maintainer label Jan 26, 2026

Andrei Kvapil (kvaps) merged commit 3a75868 into main Jan 27, 2026
16 checks passed

Andrei Kvapil (kvaps) deleted the feat/better-dashboard-client branch January 27, 2026 17:18

This was referenced Jan 27, 2026

[Backport release-0.40] [dashboard] Improve dashboard session params #1919

Merged

[Backport release-0.41] [dashboard] Improve dashboard session params #1920

Merged

Andrei Kvapil (kvaps) added a commit that referenced this pull request Jan 27, 2026

[Backport release-0.40] [dashboard] Improve dashboard session params (#…

8bd3861

…1919) # Description Backport of #1913 to `release-0.40`.

Andrei Kvapil (kvaps) added a commit that referenced this pull request Jan 27, 2026

[Backport release-0.41] [dashboard] Improve dashboard session params (#…

f54a1e6

…1920) # Description Backport of #1913 to `release-0.41`.

Navigation Menu

Repository navigation

[dashboard] Improve dashboard session params - #1913

[dashboard] Improve dashboard session params#1913
Andrei Kvapil (kvaps) merged 1 commit into
mainfrom
feat/better-dashboard-client

Timofei Larkin (lllamnyp) commented Jan 26, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Jan 26, 2026

Uh oh!

coderabbitai Bot commented Jan 26, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jan 26, 2026

Uh oh!

gemini-code-assist Bot Jan 26, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jan 27, 2026

Uh oh!

github-actions Bot commented Jan 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		client.session.idle.timeout: "86400"
		client.session.max.lifespan: "604800"

Conversation

Timofei Larkin (lllamnyp) commented Jan 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Jan 26, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai Bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jan 27, 2026

Uh oh!

github-actions Bot commented Jan 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Timofei Larkin (lllamnyp) commented Jan 26, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jan 26, 2026 •

edited

Loading