feat(bff): migrate BFF handlers to OpenShell Go SDK [RHOAIENG-83116]

.gitignore

@@ -4,6 +4,7 @@ frontend/dist/
 
 # Go
 backend/bin/
+backend/server
 
 # Editor / OS
 .DS_Store

backend/cmd/server/main.go

@@ -12,15 +12,19 @@ package main
 
 import (
 	"flag"
+	"fmt"
 	"log/slog"
 	"net"
 	"net/http"
 	"os"
+	"strings"
 	"time"
 
+	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+
 	"github.com/Gkrumbach07/openshell-dashboard/backend/internal/api"
 	"github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/internal/gateway"
+	"github.com/Gkrumbach07/openshell-dashboard/backend/internal/sdkclient"
 )
 
 const (
@@ -35,7 +39,7 @@ func envOr(key, fallback string) string {
 	return fallback
 }
 
-func main() {
+func main() { //nolint:gocyclo // main is inherently branchy due to flag/config handling
 	var (
 		port              = flag.String("port", envOr("PORT", defaultPort), "listen port (env PORT)")
 		listenAddress     = flag.String("listen-address", envOr("LISTEN_ADDRESS", ""), "listen address (env LISTEN_ADDRESS)")
@@ -58,6 +62,13 @@ func main() {
 	if *gatewayURL == defaultGatewayURL {
 		slog.Warn("gateway URL is the default — verify OPENSHELL_GATEWAY_URL is configured correctly", "url", *gatewayURL)
 	}
+	if *gatewayCACert != "" && !strings.HasPrefix(*gatewayURL, "grpcs://") && !strings.HasPrefix(*gatewayURL, "https://") {
+		slog.Warn(
+			"gateway CA cert is set but gateway URL has no TLS scheme; use grpcs:// or https:// for TLS gateways",
+			"url", *gatewayURL,
+			"caCert", *gatewayCACert,
+		)
+	}
 	if *authDisabled {
 		slog.Warn("AUTH_DISABLED=true — authentication is OFF; never use this outside local development")
 	}
@@ -83,14 +94,58 @@ func main() {
 		},
 	}
 
-	gatewayClient, err := gateway.New(*gatewayURL, *gatewayCACert, *gatewayClientCert, *gatewayClientKey)
+	useTLS := strings.HasPrefix(*gatewayURL, "grpcs://") || strings.HasPrefix(*gatewayURL, "https://")
+	sdkAddress := *gatewayURL
+	switch {
+	case strings.HasPrefix(sdkAddress, "grpcs://"):
+		sdkAddress = "https://" + strings.TrimPrefix(sdkAddress, "grpcs://")
+	case strings.HasPrefix(sdkAddress, "grpc://"):
+		sdkAddress = "http://" + strings.TrimPrefix(sdkAddress, "grpc://")
+	case !strings.HasPrefix(sdkAddress, "https://") && !strings.HasPrefix(sdkAddress, "http://"):
+		scheme := "http"
+		if useTLS {
+			scheme = "https"
+		}
+		sdkAddress = fmt.Sprintf("%s://%s", scheme, sdkAddress)
+	}
+	if (*gatewayClientCert == "") != (*gatewayClientKey == "") {
+		slog.Error("gateway mTLS requires both --gateway-client-cert and --gateway-client-key")
+		os.Exit(1)
+	}
+	sdkCfg := openshell.Config{
+		Address: sdkAddress,
+		Auth:    sdkclient.ContextAuthProvider{RequireTLS: useTLS},
+	}
+	if useTLS {
+		tlsCfg := &openshell.TLSConfig{CAFile: *gatewayCACert}
+		if *gatewayClientCert != "" {
+			tlsCfg.CertFile = *gatewayClientCert
+			tlsCfg.KeyFile = *gatewayClientKey
+		}
+		sdkCfg.TLS = tlsCfg
+	} else {
+		sdkCfg.TLS = &openshell.TLSConfig{Insecure: true}
+	}
+	sdkClient, err := openshell.NewClient(sdkCfg)
+	if err != nil {
+		slog.Error("SDK client setup failed", "error", err)
+		os.Exit(1)
+	}
+	defer sdkClient.Close()
+
+	// Dedicated raw client for the one gateway capability the SDK omits:
+	// non-TTY, stdin-carrying ExecSandbox, used for binary file upload.
+	rawHost := sdkAddress
+	rawHost = strings.TrimPrefix(rawHost, "https://")
+	rawHost = strings.TrimPrefix(rawHost, "http://")
+	uploadExec, err := sdkclient.NewRawExecClient(rawHost, *gatewayCACert, *gatewayClientCert, *gatewayClientKey, useTLS)
 	if err != nil {
-		slog.Error("gateway client setup failed", "error", err)
+		slog.Error("upload exec client setup failed", "error", err)
 		os.Exit(1)
 	}
-	defer gatewayClient.Close()
+	defer uploadExec.Close()
 
-	app := api.NewApp(gatewayClient, authMiddleware, *staticDir, authCfg)
+	app := api.NewApp(sdkClient, uploadExec, authMiddleware, *staticDir, authCfg)
 
 	addr := net.JoinHostPort(*listenAddress, *port)
 	slog.Info("openshell-dashboard BFF listening",