fix(linstor-gui): stop requesting offline_access so logout can revoke sessions

Same offline-token-survives-logout issue as the dashboard: the linstor-gui
auth-proxy requested offline_access, so a copied kc-access cookie stayed valid
for the whole offline-session lifetime after logout.

Drop offline_access from the proxy --scope and the optional client scope, and
update the ingress auth unittest accordingly.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
(cherry picked from commit 51c34c236e)

packages/system/linstor-gui/templates/gatekeeper.yaml

@@ -89,7 +89,14 @@ spec:
             - --cookie-secure=true
             - --cookie-secret=$(OAUTH2_PROXY_COOKIE_SECRET)
             - --skip-provider-button
-            - --scope=openid email profile groups offline_access
+            # No offline_access: that scope makes Keycloak issue an *offline*
+            # refresh token, which is decoupled from the SSO session and is NOT
+            # revoked by logout (end_session). Since oauth2-proxy keeps the
+            # refresh token in the kc-access cookie and silently refreshes it,
+            # a copied cookie would stay valid for the whole offline-session
+            # lifetime (~30d) even after the user logs out. An online refresh
+            # token is bound to the SSO session and is revoked on logout.
+            - --scope=openid email profile groups
             - --allowed-group=cozystack-cluster-admin
             {{- if eq $oidcInsecureSkipVerify "true" }}
             - --ssl-insecure-skip-verify=true

packages/system/linstor-gui/templates/keycloakclient.yaml

@@ -63,8 +63,11 @@ spec:
   webUrl: "https://linstor-gui.{{ $host }}"
   defaultClientScopes:
     - groups
-  optionalClientScopes:
-    - offline_access
+  # offline_access is intentionally not offered: an offline refresh token
+  # survives logout (see the proxy Deployment's --scope). NB the
+  # keycloak-operator only adds client scopes, so dropping this does not strip
+  # the realm-default offline_access from an already-created client; the proxy
+  # --scope change is what prevents issuance.
   attributes:
     post.logout.redirect.uris: "+"
   redirectUris:

packages/system/linstor-gui/tests/ingress_auth_test.yaml

@@ -127,7 +127,7 @@ tests:
           content: --oidc-issuer-url=https://keycloak.dev10.example.org/realms/cozy
       - contains:
           path: spec.template.spec.containers[0].args
-          content: --scope=openid email profile groups offline_access
+          content: --scope=openid email profile groups
       - contains:
           path: spec.template.spec.containers[0].args
           content: --allowed-group=cozystack-cluster-admin