feat: rfe-7592: Add support for custom login server URL in console

[sandert-k8s]

Community contribution.

Adds RFE-7592. Adds the possibility to use the Capsule Proxy as a Server Address. It's only a optical change, it doesn't change anything to the api itself.

Should be reviewed/implemented together with openshift/api#2754

Summary by CodeRabbit

New Features

• Added support for configuring a custom login server URL that displays in generated login commands, allowing the displayed URL to differ from the actual API server connection without affecting system functionality.

[openshift-ci-robot]

@sandert-k8s: This pull request references rfe-7592 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the feature request to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Community contribution.

Adds RFE-7592. Adds the possibility to use the Capsule Proxy as a Server Address. It's only a optical change, it doesn't change anything to the api itself.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sandert-k8s
Once this PR has been reviewed and has the lgtm label, please assign spadgett for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @sandert-k8s. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci-robot]

@sandert-k8s: This pull request references rfe-7592 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the feature request to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Community contribution.

Adds RFE-7592. Adds the possibility to use the Capsule Proxy as a Server Address. It's only a optical change, it doesn't change anything to the api itself.

Should be reviewed/implemented together with openshift/api#2754

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@sandert-k8s: This pull request references rfe-7592 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the feature request to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Community contribution.

Adds RFE-7592. Adds the possibility to use the Capsule Proxy as a Server Address. It's only a optical change, it doesn't change anything to the api itself.

Should be reviewed/implemented together with openshift/api#2754

Summary by CodeRabbit

New Features

• Added support for configuring a custom login server URL that displays in generated login commands, allowing the displayed URL to differ from the actual API server connection without affecting system functionality.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request introduces support for customizing the login server URL displayed in OpenShift Console's copy login commands feature. Changes span the Go backend, configuration layer, and TypeScript frontend. The backend adds a LoginServerURL field to the server configuration, accepts a --custom-login-server-url flag, and applies this URL to OC login commands using regex-based substitution. The configuration layer adds a CustomLoginServerURL field to the Customization struct. The frontend extends the useCopyLoginCommands hook to handle and return the custom login server URL from API responses, while adding the corresponding TypeScript type definitions.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main feature addition: custom login server URL support, directly reflecting the core change across the codebase.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

pkg/server/server.go (1)

842-857: Consider URL sanitization before command string concatenation.

The loginServerURL is concatenated directly into a shell command string without any sanitization. While the operator API enforces HTTPS URL format via regex, shell metacharacters in the URL path or query parameters (e.g., $, `, $(...)) could theoretically cause issues when users copy-paste the generated command.

Given that:

1. The API validation restricts to HTTPS URLs
2. The URL validation suggested for cmd/bridge/main.go would further constrain input
3. Users are expected to review commands before execution

This is low risk but worth documenting the trust boundary. The function assumes valid, well-formed URLs.

📝 Optional: Add defensive comment documenting the trust assumption

 // applyLoginServerURL substitutes (or appends) the --server= flag in an oc
 // login command string with loginServerURL. Returns cmd unchanged when either
 // argument is empty.
+//
+// IMPORTANT: loginServerURL is expected to be a validated HTTPS URL from either
+// the operator API (regex-validated) or CLI flag (URL-validated). No additional
+// sanitization is performed here.
 func applyLoginServerURL(cmd, loginServerURL string) string {

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pkg/server/server.go` around lines 842 - 857, The function
applyLoginServerURL concatenates loginServerURL directly into a shell command
(references: applyLoginServerURL, loginServerURL, cmd, serverFlagRe) which can
allow shell metacharacters in the URL to be interpreted if the command is
copy-pasted; fix by sanitizing/escaping the URL before concatenation — e.g.,
URL-encode the path/query or wrap the value in a shell-safe form (escape
internal single quotes and enclose in single quotes) and use that escaped value
when building serverFlag, or alternatively add a clear defensive comment in
applyLoginServerURL documenting the trust boundary and that the value must be
validated/HTTPS-only upstream if you choose not to escape here.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@cmd/bridge/main.go`:
- Line 131: The fCustomLoginServerURL flag value is not validated; add the same
URL validation used for other flags by calling flags.ValidateFlagIsURL on
*fCustomLoginServerURL (with the flag name "custom-login-server-url") before
assigning to srv.LoginServerURL; if validation returns an error,
propagate/return it so malformed URLs are rejected early (mirror the pattern
used for
alermanager-public-url/grafana-public-url/prometheus-public-url/thanos-public-url).

---

Nitpick comments:
In `@pkg/server/server.go`:
- Around line 842-857: The function applyLoginServerURL concatenates
loginServerURL directly into a shell command (references: applyLoginServerURL,
loginServerURL, cmd, serverFlagRe) which can allow shell metacharacters in the
URL to be interpreted if the command is copy-pasted; fix by sanitizing/escaping
the URL before concatenation — e.g., URL-encode the path/query or wrap the value
in a shell-safe form (escape internal single quotes and enclose in single
quotes) and use that escaped value when building serverFlag, or alternatively
add a clear defensive comment in applyLoginServerURL documenting the trust
boundary and that the value must be validated/HTTPS-only upstream if you choose
not to escape here.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 702897d7-376d-4b80-9f4d-07ac082a8d06

📥 Commits

Reviewing files that changed from the base of the PR and between 8c805f5 and d802c07.

📒 Files selected for processing (7)

• cmd/bridge/main.go
• frontend/@types/console/window.d.ts
• frontend/packages/console-shared/src/hooks/useCopyLoginCommands.ts
• pkg/server/server.go
• pkg/serverconfig/config.go
• pkg/serverconfig/types.go
• vendor/github.com/openshift/api/operator/v1/types_console.go