bug: gateway add defaults to Cloudflare edge-auth for HTTPS endpoints — no fallback or guidance for non-CF deployments #2057

Agent Diagnostic

• Explored crates/openshell-server/src/auth/http.rs:87-141 — the auth_connect() handler checks for a CF_Authorization cookie. Without Cloudflare Access, the cookie never arrives and the page polls via <meta http-equiv="refresh"> indefinitely.
• Explored crates/openshell-cli/src/auth.rs:84-176 — the browser_auth_flow() function opens a local listener, launches the browser to /auth/connect, and waits 120 seconds for a callback that never comes.
• Explored crates/openshell-cli/src/run.rs:940-960 — gateway_add() defaults to edge-auth for any https:// endpoint unless --oidc-issuer or --local is passed. No auto-detection of the gateway's auth mode.
• Verified the OIDC flow works correctly when --oidc-issuer is passed — the issue is purely the default behavior and discoverability.
• Tested on ROSA HCP 4.21 with a reencrypt route (HTTP/2 confirmed working) and Keycloak OIDC.

Description

When registering a gateway with an https:// endpoint, the CLI defaults to the Cloudflare Access edge-auth flow — opening a browser to /auth/connect and waiting for a CF_Authorization cookie. Without Cloudflare Access in front of the gateway, this hangs indefinitely with an "Authenticating..." spinner and times out after 120 seconds with no actionable guidance.

The CLI supports OIDC authentication via --oidc-issuer, which works correctly, but:

1. There is no indication that the edge-auth flow requires Cloudflare Access specifically
2. When the flow fails (no CF cookie arrives), the timeout message doesn't suggest alternatives
3. The user must already know about --oidc-issuer to use OIDC — it's not discoverable from the failure path

Reproduction Steps

1. Deploy the gateway on any Kubernetes cluster without Cloudflare Access (OpenShift, GKE, EKS, k3d...)
2. Configure OIDC on the gateway (e.g., Keycloak)
3. Run openshell gateway add https://<endpoint> --gateway-insecure
4. Press Enter to open the browser for authentication

Expected: Either auto-detect the gateway's auth mode, or fail fast with a message like:

Edge authentication requires Cloudflare Access. If your gateway uses OIDC, re-run with:
  openshell gateway add <endpoint> --oidc-issuer <issuer-url>

Actual: Browser shows "Authenticating..." spinner page that polls /auth/connect every 2 seconds indefinitely. The CLI times out after 120 seconds with:

⚠ Authentication skipped: authentication timed out after 120 seconds.
Try again with: openshell gateway login

Re-running gateway login produces the same result.

Environment

• OS: macOS 15.x (Apple Silicon)
• OpenShift: ROSA HCP 4.21 (Kubernetes 1.34.2)
• OpenShell: gateway v0.0.70 chart, CLI v0.0.45
• Keycloak operator with openshift-v4 identity provider
• Route: reencrypt with backend-protocol=h2 annotation (HTTP/2 confirmed)

Logs

Gateway logs show only the HTML page polling — no gRPC auth calls arrive:

INFO request{method=GET path="/auth/connect"}: response status=200 latency_ms=0
INFO request{method=GET path="/auth/connect"}: response status=200 latency_ms=0
INFO request{method=GET path="/auth/connect"}: response status=200 latency_ms=0
# repeats every 2 seconds until CLI timeout

Root Cause

The /auth/connect handler (crates/openshell-server/src/auth/http.rs:101-104) looks for a CF_Authorization cookie in the request headers. Without Cloudflare, the cookie is never set. The handler returns render_waiting_page() which includes a <meta http-equiv="refresh" content="2"> tag, causing the browser to poll indefinitely.

The CLI side (crates/openshell-cli/src/auth.rs:158-168) waits for a POST to its localhost callback server, which only happens after the gateway serves the confirmation page — but the confirmation page is never shown because the CF cookie never arrives.

Proposed Fix

Make OIDC the default for HTTPS endpoints and require an explicit --edge-auth flag for Cloudflare deployments. This inverts the current default without breaking existing CF deployments.

As a complementary improvement, the timeout error message should suggest alternatives (OIDC, --local) instead of "Try again with: openshell gateway login".

• I pointed my agent at the repo and had it investigate this issue
• I loaded relevant skills (e.g., debug-openshell-cluster, debug-inference, openshell-cli)
• My agent could not resolve this — the diagnostic above explains why