core: add setting to open application launch URL in a new browser tab (#3037)

* core: add setting to open application launch URL in a new browser tab

* core: fix failing applications unit tests

* core: fix formatting

* core: include models only generated when debug mode is enabled

authentik/core/api/applications.py

@@ -63,6 +63,7 @@ class ApplicationSerializer(ModelSerializer):
             "provider",
             "provider_obj",
             "launch_url",
+            "open_in_new_tab",
             "meta_launch_url",
             "meta_icon",
             "meta_description",

authentik/core/migrations/0020_application_open_in_new_tab.py

@@ -0,0 +1,20 @@
+# Generated by Django 4.0.5 on 2022-06-04 06:54
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0019_application_group"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="application",
+            name="open_in_new_tab",
+            field=models.BooleanField(
+                default=False, help_text="Open launch URL in a new browser tab or window."
+            ),
+        ),
+    ]

authentik/core/models.py

@@ -278,6 +278,11 @@ class Application(PolicyBindingModel):
     meta_launch_url = models.TextField(
         default="", blank=True, validators=[DomainlessURLValidator()]
     )
+
+    open_in_new_tab = models.BooleanField(
+        default=False, help_text=_("Open launch URL in a new browser tab or window.")
+    )
+
     # For template applications, this can be set to /static/authentik/applications/*
     meta_icon = models.FileField(
         upload_to="application-icons/",

authentik/core/tests/test_applications_api.py

@@ -29,6 +29,7 @@ class TestApplicationsAPI(APITestCase):
             name="allowed",
             slug="allowed",
             meta_launch_url="https://goauthentik.io/%(username)s",
+            open_in_new_tab=True,
             provider=self.provider,
         )
         self.denied = Application.objects.create(name="denied", slug="denied")
@@ -100,6 +101,7 @@ class TestApplicationsAPI(APITestCase):
                         },
                         "launch_url": f"https://goauthentik.io/{self.user.username}",
                         "meta_launch_url": "https://goauthentik.io/%(username)s",
+                        "open_in_new_tab": True,
                         "meta_icon": None,
                         "meta_description": "",
                         "meta_publisher": "",
@@ -148,6 +150,7 @@ class TestApplicationsAPI(APITestCase):
                         },
                         "launch_url": f"https://goauthentik.io/{self.user.username}",
                         "meta_launch_url": "https://goauthentik.io/%(username)s",
+                        "open_in_new_tab": True,
                         "meta_icon": None,
                         "meta_description": "",
                         "meta_publisher": "",
@@ -158,6 +161,7 @@ class TestApplicationsAPI(APITestCase):
                         "meta_description": "",
                         "meta_icon": None,
                         "meta_launch_url": "",
+                        "open_in_new_tab": False,
                         "meta_publisher": "",
                         "group": "",
                         "name": "denied",

schema.yml

@@ -19163,6 +19163,9 @@ components:
           type: string
           nullable: true
           readOnly: true
+        open_in_new_tab:
+          type: boolean
+          description: Open launch URL in a new browser tab or window.
         meta_launch_url:
           type: string
           format: uri
@@ -19202,6 +19205,9 @@ components:
         provider:
           type: integer
           nullable: true
+        open_in_new_tab:
+          type: boolean
+          description: Open launch URL in a new browser tab or window.
         meta_launch_url:
           type: string
           format: uri
@@ -26753,6 +26759,9 @@ components:
         provider:
           type: integer
           nullable: true
+        open_in_new_tab:
+          type: boolean
+          description: Open launch URL in a new browser tab or window.
         meta_launch_url:
           type: string
           format: uri

web/src/locales/de.po

@@ -2540,6 +2540,10 @@ msgstr "Kennung"
 msgid "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 msgstr ""
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+msgstr ""
+
 #: src/pages/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
 msgid "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
 msgstr ""
@@ -3608,6 +3612,10 @@ msgstr "API-Browser öffnen"
 #~ msgid "Open application"
 #~ msgstr "Öffne Anwendung"
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "Open in new tab"
+msgstr ""
+
 #: src/pages/events/EventInfo.ts
 msgid "Open issue on GitHub..."
 msgstr "Offenes Problem auf GitHub..."

web/src/locales/en.po

@@ -2582,6 +2582,10 @@ msgstr "Identifier"
 msgid "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 msgstr "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+msgstr "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+
 #: src/pages/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
 msgid "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
 msgstr "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
@@ -3667,6 +3671,10 @@ msgstr "Open API Browser"
 #~ msgid "Open application"
 #~ msgstr "Open application"
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "Open in new tab"
+msgstr "Open in new tab"
+
 #: src/pages/events/EventInfo.ts
 msgid "Open issue on GitHub..."
 msgstr "Open issue on GitHub..."

web/src/locales/es.po

@@ -2531,6 +2531,10 @@ msgstr "Identificador"
 msgid "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 msgstr ""
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+msgstr ""
+
 #: src/pages/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
 msgid "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
 msgstr ""
@@ -3601,6 +3605,10 @@ msgstr "Abrir navegador de API"
 #~ msgid "Open application"
 #~ msgstr "Solicitud abierta"
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "Open in new tab"
+msgstr ""
+
 #: src/pages/events/EventInfo.ts
 msgid "Open issue on GitHub..."
 msgstr "Problema abierto en GitHub..."

web/src/locales/fr_FR.po

@@ -2560,6 +2560,10 @@ msgstr "Identifiant"
 msgid "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 msgstr ""
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+msgstr ""
+
 #: src/pages/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
 msgid "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
 msgstr ""
@@ -3635,6 +3639,10 @@ msgstr ""
 #~ msgid "Open application"
 #~ msgstr "Ouvrir l'appication"
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "Open in new tab"
+msgstr ""
+
 #: src/pages/events/EventInfo.ts
 msgid "Open issue on GitHub..."
 msgstr "Ouvrir un ticket sur GitHub..."

web/src/locales/pl.po

@@ -2528,6 +2528,10 @@ msgstr "Identyfikator"
 msgid "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 msgstr ""
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+msgstr ""
+
 #: src/pages/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
 msgid "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
 msgstr ""
@@ -3598,6 +3602,10 @@ msgstr "Otwórz przeglądarkę API"
 #~ msgid "Open application"
 #~ msgstr "Otwórz aplikację"
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "Open in new tab"
+msgstr ""
+
 #: src/pages/events/EventInfo.ts
 msgid "Open issue on GitHub..."
 msgstr "Otwórz problem w serwisie GitHub..."

web/src/locales/pseudo-LOCALE.po

@@ -2568,6 +2568,10 @@ msgstr ""
 msgid "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 msgstr ""
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+msgstr ""
+
 #: src/pages/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
 msgid "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
 msgstr ""
@@ -3649,6 +3653,10 @@ msgstr ""
 #~ msgid "Open application"
 #~ msgstr ""
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "Open in new tab"
+msgstr ""
+
 #: src/pages/events/EventInfo.ts
 msgid "Open issue on GitHub..."
 msgstr ""

web/src/locales/tr.po

@@ -2531,6 +2531,10 @@ msgstr "Tanımlayıcı"
 msgid "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 msgstr ""
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+msgstr ""
+
 #: src/pages/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
 msgid "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
 msgstr ""
@@ -3603,6 +3607,10 @@ msgstr "API Tarayıcısını aç"
 #~ msgid "Open application"
 #~ msgstr "Uygulamayı aç"
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "Open in new tab"
+msgstr ""
+
 #: src/pages/events/EventInfo.ts
 msgid "Open issue on GitHub..."
 msgstr "GitHub'da açık sorun..."

web/src/locales/zh-Hans.po

@@ -2517,6 +2517,10 @@ msgstr "标识符"
 msgid "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 msgstr "如果上面所选类型的任意设备在此期限内被使用，此阶段会被跳过。"
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+msgstr ""
+
 #: src/pages/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
 msgid "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
 msgstr "如果启用，仅保存电话号码的哈希。这是出于数据保护的原因。如果设备创建自启用此选项的阶段，则无法在验证阶段使用身份验证器。"
@@ -3579,6 +3583,10 @@ msgstr "打开 API 浏览器"
 #~ msgid "Open application"
 #~ msgstr "打开应用程序"
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "Open in new tab"
+msgstr ""
+
 #: src/pages/events/EventInfo.ts
 msgid "Open issue on GitHub..."
 msgstr "在 GitHub 上提出议题..."

web/src/locales/zh-Hant.po

@@ -2520,6 +2520,10 @@ msgstr "标识符"
 msgid "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 msgstr ""
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+msgstr ""
+
 #: src/pages/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
 msgid "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
 msgstr ""
@@ -3584,6 +3588,10 @@ msgstr "打开 API 浏览器"
 #~ msgid "Open application"
 #~ msgstr "打开应用程序"
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "Open in new tab"
+msgstr ""
+
 #: src/pages/events/EventInfo.ts
 msgid "Open issue on GitHub..."
 msgstr "在 GitHub 上打开问题..."

web/src/locales/zh_TW.po

@@ -2520,6 +2520,10 @@ msgstr "标识符"
 msgid "If any of the devices user of the types selected above have been used within this duration, this stage will be skipped."
 msgstr ""
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+msgstr ""
+
 #: src/pages/stages/authenticator_sms/AuthenticatorSMSStageForm.ts
 msgid "If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons.Devices created from a stage with this enabled cannot be used with the authenticator validation stage."
 msgstr ""
@@ -3584,6 +3588,10 @@ msgstr "打开 API 浏览器"
 #~ msgid "Open application"
 #~ msgstr "打开应用程序"
 
+#: src/pages/applications/ApplicationForm.ts
+msgid "Open in new tab"
+msgstr ""
+
 #: src/pages/events/EventInfo.ts
 msgid "Open issue on GitHub..."
 msgstr "在 GitHub 上打开问题..."

web/src/pages/applications/ApplicationForm.ts

@@ -187,6 +187,12 @@ export class ApplicationForm extends ModelForm<Application, string> {
                             ${t`If left empty, authentik will try to extract the launch URL based on the selected provider.`}
                         </p>
                     </ak-form-element-horizontal>
+                    <ak-form-element-horizontal label=${t`Open in new tab`} name="openInNewTab">
+                        <input type="checkbox" ?checked=${this.instance?.openInNewTab} />
+                        <p class="pf-c-form__helper-text">
+                            ${t`If checked, the launch URL will open in a new browser tab or window from the user's application library.`}
+                        </p>
+                    </ak-form-element-horizontal>
                     ${until(
                         config().then((c) => {
                             if (c.capabilities.includes(CapabilitiesEnum.SaveMedia)) {

web/src/user/LibraryApplication.ts

@@ -88,7 +88,12 @@ export class LibraryApplication extends LitElement {
             style="background: ${this.background} !important"
         >
             <div class="pf-c-card__header">
-                <a href="${ifDefined(this.application.launchUrl ?? "")}"> ${this.renderIcon()} </a>
+                <a
+                    href="${ifDefined(this.application.launchUrl ?? "")}"
+                    target="${ifDefined(this.application.openInNewTab ? "_blank" : undefined)}"
+                >
+                    ${this.renderIcon()}
+                </a>
                 ${until(
                     uiConfig().then((config) => {
                         if (!config.enabledFeatures.applicationEdit) {
@@ -110,7 +115,9 @@ export class LibraryApplication extends LitElement {
             </div>
             <div class="pf-c-card__title">
                 <p>
-                    <a href="${ifDefined(this.application.launchUrl ?? "")}"
+                    <a
+                        href="${ifDefined(this.application.launchUrl ?? "")}"
+                        target="${ifDefined(this.application.openInNewTab ? "_blank" : undefined)}"
                         >${this.application.name}</a
                     >
                 </p>