fix: DevWorkspace watcher handling for forbidden namespaces (crw-12318)

[msivasubramaniaan]

fixes https://redhat.atlassian.net/browse/CRW-12318

What does this PR do?

Handles Kubernetes 403 Forbidden and 404 Not Found errors when creating DevWorkspace watchers for namespaces where the user does not have permission to watch devworkspaces.

Why is this needed?

The initial DevWorkspace listing can succeed even when the user does not have watch permission. The watcher was created outside the exception handling block, causing the ApiException to escape the coroutine and terminate the watcher.

This change:

• Creates the watcher inside the try block.
• Properly propagates coroutine cancellation.
• Handles 403/404 errors without repeatedly retrying.
• Ensures the watcher is closed correctly when the watch terminates.
• Continues retrying for other connection/API failures.

This allows the Gateway to gracefully handle namespaces where DevWorkspace watch permissions are unavailable.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: da964643-03f2-4f7f-89ac-45725c51258e

📥 Commits

Reviewing files that changed from the base of the PR and between 72b3285 and defcea4.

📒 Files selected for processing (1)

• src/main/kotlin/com/redhat/devtools/gateway/devworkspace/DevWorkspaceWatcher.kt

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved reliability when monitoring development workspaces.
  • Watchers now close cleanly during errors or cancellation.
  • Authorization and missing-resource errors stop monitoring appropriately.
  • Temporary API and connection failures automatically retry after a delay.

Walkthrough

The DevWorkspace watcher now handles Kubernetes ApiException cases. It closes watchers during all exit paths, rethrows cancellation, stops on HTTP 403/404 errors, and reconnects after other API or connection errors.

Changes

DevWorkspace watcher lifecycle

Layer / File(s)	Summary
Watch error handling and cleanup src/main/kotlin/com/redhat/devtools/gateway/devworkspace/DevWorkspaceWatcher.kt	The watch loop handles typed Kubernetes API errors, propagates cancellation, stops for HTTP 403/404 errors, retries other API and connection errors, and closes the watcher in all cases.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to defce

The change improves handling of forbidden and missing namespaces without any actionable merge-blocking risk remaining; it is merge-ready after normal checks and review.

Suggested reviewers: adietish, vrubezhny, azatsarynnyy

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description clearly explains handling forbidden and not-found Kubernetes watcher errors and related retry and cleanup behavior.
Title check	✅ Passed	The title clearly identifies the fix for DevWorkspace watcher handling in forbidden namespaces.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 35.45%. Comparing base (71098f6) to head (83a986d).
⚠️ Report is 421 commits behind head on main.

Files with missing lines	Patch %	Lines
...vtools/gateway/devworkspace/DevWorkspaceWatcher.kt	0.00%	16 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##            main     #365       +/-   ##
==========================================
+ Coverage   0.00%   35.45%   +35.45%     
==========================================
  Files          4      114      +110     
  Lines         26     4978     +4952     
  Branches       0      962      +962     
==========================================
+ Hits           0     1765     +1765     
- Misses        26     2958     +2932     
- Partials       0      255      +255     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[adietish]

we're returning if we hit a 403/404 when watching the current namespace and stop trying to watch it. We should therefore set stopped = true

[adietish]

@msivasubramaniaan: thanks! change is good, beside the additional change that I pointed out.
Added it, rebased and will merge it.