fix: show sequential TLS trust dialogs during OpenShift connect

Parent trust prompts to the wizard, use invokeLater instead of invokeAndWait,
and split TLS setup from authentication so API and OAuth certificates can
both be accepted. Add TLS trust logging and surface OAuth discovery failures.

Signed-off-by: Andre Dietisheim <adietish@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: adietish

src/main/kotlin/com/redhat/devtools/gateway/auth/code/OpenShiftAuthCodeFlow.kt

@@ -18,6 +18,7 @@ import com.nimbusds.oauth2.sdk.id.State
 import com.nimbusds.oauth2.sdk.pkce.CodeChallengeMethod
 import com.nimbusds.oauth2.sdk.pkce.CodeVerifier
 import com.nimbusds.openid.connect.sdk.Nonce
+import com.intellij.openapi.diagnostic.logger
 import com.redhat.devtools.gateway.util.toServerBaseUrl
 import kotlinx.coroutines.future.await
 import kotlinx.serialization.SerialName
@@ -44,6 +45,8 @@ class OpenShiftAuthCodeFlow(
     private val sslContext: SSLContext
 ) : AuthCodeFlow {
 
+    private val logger = logger<OpenShiftAuthCodeFlow>()
+
     private lateinit var codeVerifier: CodeVerifier
     private lateinit var state: State
 
@@ -75,24 +78,37 @@ class OpenShiftAuthCodeFlow(
     )
 
     companion object {
+        private val logger = logger<OpenShiftAuthCodeFlow>()
         private val json = Json { ignoreUnknownKeys = true }
 
         /** OAuth HTTP endpoint base URLs discovered from the API server. */
         suspend fun discoverOAuthEndpointBaseUrls(
             apiServerUrl: String,
             sslContext: SSLContext,
         ): List<String> {
+            val discoveryUrl = "$apiServerUrl/.well-known/oauth-authorization-server"
+            logger.info("TLS trust: discovering OAuth endpoints from $discoveryUrl")
             val client = HttpClient.newBuilder()
                 .sslContext(sslContext)
                 .version(HttpClient.Version.HTTP_1_1)
                 .followRedirects(HttpClient.Redirect.NORMAL)
                 .build()
 
-            val response = sendGetRequest(client, "$apiServerUrl/.well-known/oauth-authorization-server", "OAuth discovery failed")
+            val response = try {
+                sendGetRequest(client, discoveryUrl, "OAuth discovery failed")
+            } catch (e: Exception) {
+                logger.error("TLS trust: OAuth discovery request to $discoveryUrl failed", e)
+                throw e
+            }
             val metadata = json.decodeFromString(OAuthMetadata.serializer(), response.body())
-            return listOf(metadata.tokenEndpoint, metadata.authorizationEndpoint)
+            val urls = listOf(metadata.tokenEndpoint, metadata.authorizationEndpoint)
                 .map { URI(it).toServerBaseUrl() }
                 .distinct()
+            logger.info(
+                "TLS trust: OAuth discovery succeeded (issuer=${metadata.issuer}, " +
+                    "endpoints=${urls.joinToString()})"
+            )
+            return urls
         }
 
         private suspend fun sendGetRequest(httpClient: HttpClient, url: String, errorPrefix: String = "Request failed"): HttpResponse<String> {
@@ -211,7 +227,12 @@ class OpenShiftAuthCodeFlow(
             *if (clientIdInForm) arrayOf("client_id" to clientId) else emptyArray()
         )
 
-        val token = sendPostRequest(client, metadata.tokenEndpoint, authHeader, form, errorPrefix = "Token request failed")
+        val token = try {
+            sendPostRequest(client, metadata.tokenEndpoint, authHeader, form, errorPrefix = "Token request failed")
+        } catch (e: Exception) {
+            logger.error("TLS trust: token request to ${metadata.tokenEndpoint} failed", e)
+            throw e
+        }
         val expiresAt = if (token.expiresIn > 0) System.currentTimeMillis() + token.expiresIn * 1000 else null
         return SSOToken(accessToken = token.accessToken, idToken = "", accountLabel = accountLabel, expiresAt = expiresAt)
     }

src/main/kotlin/com/redhat/devtools/gateway/auth/tls/DefaultTlsTrustManager.kt

@@ -11,6 +11,7 @@
  */
 package com.redhat.devtools.gateway.auth.tls
 
+import com.intellij.openapi.diagnostic.thisLogger
 import com.redhat.devtools.gateway.auth.code.OpenShiftAuthCodeFlow
 import com.redhat.devtools.gateway.kubeconfig.KubeConfigNamedCluster
 import com.redhat.devtools.gateway.kubeconfig.KubeConfigUtils
@@ -29,13 +30,20 @@ class DefaultTlsTrustManager(
     private val persistentKeyStore: PersistentKeyStore
 ) : TlsTrustManager {
 
+    private val logger = thisLogger()
+
     override suspend fun ensureTrusted(
         serverUrl: String,
         decisionHandler: suspend (TlsServerCertificateInfo) -> TlsTrustDecision,
         certificateAuthority: CertificateSource?,
+        endpointKind: TlsEndpointKind,
     ): TlsContext {
 
         val serverUri = URI(serverUrl)
+        logger.info(
+            "TLS trust: probing ${endpointKind.label} at $serverUrl " +
+                "(wizard CA=${certificateAuthority != null}, kind=$endpointKind)"
+        )
 
         val namedCluster =
             KubeConfigUtils.getClusterByServer(
@@ -44,22 +52,34 @@ class DefaultTlsTrustManager(
             )
 
         if (namedCluster?.cluster?.insecureSkipTlsVerify == true) {
+            logger.warn("TLS trust: using insecure skip for $serverUrl (kubeconfig insecure-skip-tls-verify)")
             return SslContextFactory.insecure()
         }
 
         val trustedCerts = getTrustedCerts(namedCluster, serverUri.host, certificateAuthority) +
             sessionTrustStore.get(serverUrl)
 
         if (trustedCerts.isNotEmpty()) {
+            logger.debug(
+                "TLS trust: trying ${trustedCerts.size} known certificate(s) for $serverUrl " +
+                    "(session=${sessionTrustStore.get(serverUrl).size}, " +
+                    "preconfigured=${trustedCerts.size - sessionTrustStore.get(serverUrl).size})"
+            )
             try {
                 val tlsContext = SslContextFactory.fromTrustedCerts(trustedCerts)
                 withContext(Dispatchers.IO) {
                     TlsProbe.connect(serverUri, tlsContext.sslContext)
                 }
+                logger.info("TLS trust: existing trust accepted for $serverUrl")
                 return tlsContext
             } catch (e: SSLHandshakeException) {
-                // Certificate changed or invalid → continue to capture
+                logger.warn(
+                    "TLS trust: handshake failed with known certificate(s) for $serverUrl; " +
+                        "will prompt (${e.message})"
+                )
             }
+        } else {
+            logger.info("TLS trust: no known certificate for $serverUrl; will capture server certificate")
         }
 
         val captureContext = SslContextFactory.captureOnly()
@@ -68,6 +88,7 @@ class DefaultTlsTrustManager(
             withContext(Dispatchers.IO) {
                 TlsProbe.connect(serverUri, captureContext.sslContext)
             }
+            logger.warn("TLS trust: probe unexpectedly succeeded without trust for $serverUrl")
             return captureContext // should not normally succeed
         } catch (e: SSLHandshakeException) {
             val chain = (captureContext.trustManager as? CapturingTrustManager)
@@ -87,14 +108,26 @@ class DefaultTlsTrustManager(
                 serverUrl = serverUrl,
                 certificateChain = chain,
                 fingerprintSha256 = sha256Fingerprint(trustAnchor),
-                problem = problem
+                problem = problem,
+                endpointKind = endpointKind,
+            )
+
+            logger.info(
+                "TLS trust: prompting user for ${endpointKind.label} at $serverUrl " +
+                    "(problem=$problem, fingerprint=${info.fingerprintSha256})"
             )
 
             val decision = decisionHandler(info)
             if (!decision.trusted) {
+                logger.info("TLS trust: user rejected certificate for $serverUrl")
                 throw TlsTrustRejectedException()
             }
 
+            logger.info(
+                "TLS trust: user accepted certificate for $serverUrl " +
+                    "(scope=${decision.scope}, endpoint=${endpointKind.label})"
+            )
+
             val keyStore = persistentKeyStore.loadOrCreate()
             val persistentAlias = hostAlias(serverUri.host)
 
@@ -123,7 +156,12 @@ class DefaultTlsTrustManager(
             val finalCerts = (trustedCerts + trustAnchor)
                 .distinctBy { it.serialNumber }
 
-            return SslContextFactory.fromTrustedCerts(finalCerts)
+            val tlsContext = SslContextFactory.fromTrustedCerts(finalCerts)
+            withContext(Dispatchers.IO) {
+                TlsProbe.connect(serverUri, tlsContext.sslContext)
+            }
+            logger.info("TLS trust: verified connection to $serverUrl after user acceptance")
+            return tlsContext
         }
     }
 
@@ -136,25 +174,57 @@ class DefaultTlsTrustManager(
         certificateAuthority: CertificateSource? = null,
     ): TlsContext {
         val apiBaseUrl = URI(apiServerUrl).toServerBaseUrl()
+        logger.info("TLS trust: establishing OpenShift TLS context for API $apiBaseUrl")
 
-        ensureTrusted(apiBaseUrl, decisionHandler, certificateAuthority)
+        ensureTrusted(
+            apiBaseUrl,
+            decisionHandler,
+            certificateAuthority,
+            TlsEndpointKind.API_SERVER,
+        )
 
         val apiTls = mergedContextFor(listOf(apiBaseUrl), certificateAuthority)
-        val oauthUrls = runCatching {
+        val oauthUrls = try {
             OpenShiftAuthCodeFlow.discoverOAuthEndpointBaseUrls(
                 apiBaseUrl,
                 apiTls.sslContext,
             )
-        }.getOrDefault(emptyList())
+        } catch (e: Exception) {
+            logger.error(
+                "TLS trust: failed to discover OAuth endpoints from $apiBaseUrl. " +
+                    "Login may fail if the OAuth host uses a different certificate.",
+                e
+            )
+            throw e
+        }
+
+        if (oauthUrls.isEmpty()) {
+            logger.warn(
+                "TLS trust: OAuth discovery returned no endpoints for $apiBaseUrl. " +
+                    "Only the API server certificate will be trusted."
+            )
+        } else {
+            logger.info("TLS trust: discovered OAuth endpoint host(s): ${oauthUrls.joinToString()}")
+        }
 
         val allUrls = (listOf(apiBaseUrl) + oauthUrls).distinct()
         for (url in allUrls) {
             if (url != apiBaseUrl) {
-                ensureTrusted(url, decisionHandler, certificateAuthority)
+                ensureTrusted(
+                    url,
+                    decisionHandler,
+                    certificateAuthority,
+                    TlsEndpointKind.OAUTH,
+                )
             }
         }
 
-        return mergedContextFor(allUrls, certificateAuthority)
+        val merged = mergedContextFor(allUrls, certificateAuthority)
+        logger.info(
+            "TLS trust: OpenShift TLS context ready for ${allUrls.size} endpoint(s): " +
+                allUrls.joinToString()
+        )
+        return merged
     }
 
     suspend fun mergedContextFor(

src/main/kotlin/com/redhat/devtools/gateway/auth/tls/TlsEndpointKind.kt

@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) 2026 Red Hat, Inc.
+ * This program and the accompanying materials are made
+ * available under the terms of the Eclipse Public License 2.0
+ * which is available at https://www.eclipse.org/legal/epl-2.0/
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *
+ * Contributors:
+ *   Red Hat, Inc. - initial API and implementation
+ */
+package com.redhat.devtools.gateway.auth.tls
+
+/** Identifies which cluster endpoint triggered a TLS trust prompt or handshake. */
+enum class TlsEndpointKind(val label: String) {
+    UNKNOWN("server"),
+    API_SERVER("OpenShift API server"),
+    OAUTH("OpenShift OAuth endpoint"),
+}

src/main/kotlin/com/redhat/devtools/gateway/auth/tls/TlsServerCertificateInfo.kt

@@ -17,5 +17,6 @@ data class TlsServerCertificateInfo(
     val serverUrl: String,
     val certificateChain: List<X509Certificate>,
     val fingerprintSha256: String,
-    val problem: TlsTrustProblem
+    val problem: TlsTrustProblem,
+    val endpointKind: TlsEndpointKind = TlsEndpointKind.UNKNOWN,
 )

src/main/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTrustManager.kt

@@ -23,5 +23,6 @@ interface TlsTrustManager {
         serverUrl: String,
         decisionHandler: suspend (TlsServerCertificateInfo) -> TlsTrustDecision,
         certificateAuthority: CertificateSource? = null,
+        endpointKind: TlsEndpointKind = TlsEndpointKind.UNKNOWN,
     ): TlsContext
 }

src/main/kotlin/com/redhat/devtools/gateway/auth/tls/ui/TLSTrustDecisionHandler.kt

@@ -22,7 +22,9 @@ import com.intellij.ui.dsl.builder.BottomGap
 import com.intellij.ui.dsl.builder.TopGap
 import com.intellij.ui.dsl.builder.panel
 import com.intellij.util.ui.JBUI
+import com.redhat.devtools.gateway.auth.tls.TlsEndpointKind
 import java.awt.BorderLayout
+import java.awt.Component
 import java.awt.Dimension
 import java.awt.FlowLayout
 import java.awt.event.ActionEvent
@@ -38,9 +40,11 @@ import javax.swing.JPanel
  * @param certificateInfo PEM/text representation of the certificate.
  */
 class TLSTrustDecisionHandler(
+    parent: Component,
     private val serverUrl: String,
+    private val endpointKind: TlsEndpointKind,
     private val certificateInfo: String
-) : DialogWrapper(true) {
+) : DialogWrapper(parent, true) {
 
     companion object {
         val PREFERRED_SIZE = Dimension(500, 400)
@@ -55,7 +59,7 @@ class TLSTrustDecisionHandler(
         private set
 
     init {
-        title = "Untrusted TLS Certificate"
+        title = "Untrusted TLS Certificate — ${endpointKind.label}"
         init()
     }
 
@@ -75,7 +79,7 @@ class TLSTrustDecisionHandler(
                         isOpaque = false
                         add(JPanel(FlowLayout(FlowLayout.LEFT, 0, 0)).apply {
                                 isOpaque = false
-                                add(JBLabel("The server at "))
+                                add(JBLabel("The ${endpointKind.label} at "))
                                 add(HyperlinkLabel(serverUrl).apply { setHyperlinkTarget(serverUrl) })
                                 add(JBTextArea("presents a TLS certificate that is not trusted."))
                             }

src/main/kotlin/com/redhat/devtools/gateway/auth/tls/ui/TlsDecisionUiContext.kt

@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2026 Red Hat, Inc.
+ * This program and the accompanying materials are made
+ * available under the terms of the Eclipse Public License 2.0
+ * which is available at https://www.eclipse.org/legal/epl-2.0/
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *
+ * Contributors:
+ *   Red Hat, Inc. - initial API and implementation
+ */
+package com.redhat.devtools.gateway.auth.tls.ui
+
+import java.awt.Component
+
+/**
+ * UI anchor for TLS trust dialogs shown during the connection wizard.
+ *
+ * Trust prompts must be parented to the wizard so they stack above the progress
+ * dialog and can be shown repeatedly (API host, then OAuth host).
+ */
+object TlsDecisionUiContext {
+    var parentComponent: Component? = null
+}