JetBrains Gateway module

[bpmct]

A discussion dedicated to the JetBrains Gateway module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	24 / 25	20 / 20	13 / 20	9 / 10	91 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: default usage, specific IDE selection, latest vs fixed versions, EAP channel, custom base links. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and JetBrains Gateway, explains it adds a one-click button to the dashboard, and shows where Coder fits (workspace access via Gateway protocol). Includes recommendation for Toolbox alternative.
Visual preview	5	5	README includes  showing the module in action.

IDE Integration — 24 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper external launch behavior via jetbrains-gateway:// protocol URL.
Managed configuration	6	6	Documented support for managed IDE selection via coder_parameter, version pinning via jetbrains_ide_versions, channel selection, and custom download/release links.
Configurable folder or workdir	6	6	folder variable with validation, documented in all examples, passed to Gateway URL as &folder= parameter.
Pre-installed extensions	6	5	Not applicable (Gateway is not a web IDE; it's a protocol launcher for native JetBrains IDEs). However, the module does support selecting which IDEs are available and their versions, which is analogous configuration. Scoring 5 for partial applicability.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in the module. Uses $SESSION_TOKEN placeholder in URL which is handled by Coder runtime. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Uses Coder's native $SESSION_TOKEN mechanism, avoiding raw key management entirely.

Restricted-Environment Readiness — 13 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	5	releases_base_link and download_base_link variables allow overriding JetBrains endpoints. However, these only affect the URL passed to Gateway client; the module itself downloads nothing. The actual download is performed by the user's local Gateway installation. Scoring half for indirect control.
Bring-your-own binary	5	5	Module generates only a protocol URL; no installation occurs. Users can pre-configure Gateway with offline IDEs. Custom base link example documents this for offline mode.
Egress transparency	3	1.5	Custom base link example mentions offline mode and shows URL override, but no dedicated section enumerates the actual endpoints contacted (data.services.jetbrains.com, download.jetbrains.com). Endpoints are inferable from code but not explicitly documented.
Runs without sudo	2	1.5	Module contains no scripts (only Terraform resources generating URLs). However, the actual Gateway client and IDE installation on user's machine may require privileges. Since the module itself has no scripts, this is partially N/A, but the end-to-end flow involves external tooling. Scoring half for ambiguity.

Engineering Quality — 9 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (IU as default IDE, release channel, standard JetBrains URLs). Comprehensive validation on arch, folder, channel, jetbrains_ides, jetbrains_ide_versions, and URL formats.
Test coverage	4	3	TypeScript tests in main.test.ts cover required variables, default values, IDE selection, agent name handling. Tests verify URL construction and coder_app creation. No .tftest.hcl file present. Business logic testing is adequate but not comprehensive (missing tests for latest=true, custom links, all IDE types).

Overall — 91 / 100

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.