@xh/hoist 73.0.0-SNAPSHOT.1747153991877 → 73.0.0-SNAPSHOT.1747155067044

package/CHANGELOG.md

@@ -35,6 +35,8 @@
    allow the client to do a potentially interactive popup login during the session to re-establish
    the login.  This is especially useful to allow recovery from expired or invalidated refresh
    tokens.
+*  New utility method `XH.openWindow()` for ensuring that new windows/tabs are opened without
+   an unintended `opener` relationship with the original window.
 * Improvements to  Grid columns `HeaderFilter` component:
     * `GridFilterModel` `commitOnChage` now set to `false` by default
     * Addition of ability to append terms to active filter **only** when `commitOnChage:false`

package/admin/AppModel.ts

@@ -155,7 +155,8 @@ export class AppModel extends HoistAppModel {
 
     /** Open the primary business-facing application, typically 'app'. */
     openPrimaryApp() {
-        window.open(`/${this.getPrimaryAppCode()}`);
+        const appCode = this.getPrimaryAppCode();
+        XH.openWindow(`/${appCode}`, appCode);
     }
 
     getPrimaryAppCode() {

package/build/types/core/XH.d.ts

@@ -218,6 +218,14 @@ export declare class XHApi {
      * {@link reloadApp} instead.
      */
     refreshAppAsync(): Promise<void>;
+    /**
+     * Open a url in an external browser window/tab.
+     *
+     * Unlike a simple call to `open`, this method ensures the "opener" method on the
+     * new window is null. This ensures that the new page will not share sessionState with
+     * this page.  See https://developer.mozilla.org/en-US/docs/Web/API/Window/sessionStorage
+     */
+    openWindow(url: string, target?: string): void;
     /**
      * Flags for controlling experimental, hotfix, or otherwise provisional features.
      *

package/core/XH.ts

@@ -442,6 +442,17 @@ export class XHApi {
         return this.refreshContextModel.refreshAsync();
     }
 
+    /**
+     * Open a url in an external browser window/tab.
+     *
+     * Unlike a simple call to `open`, this method ensures the "opener" method on the
+     * new window is null. This ensures that the new page will not share sessionState with
+     * this page.  See https://developer.mozilla.org/en-US/docs/Web/API/Window/sessionStorage
+     */
+    openWindow(url: string, target?: string) {
+        window.open(url, target ?? '_blank', 'noopener=true');
+    }
+
     /**
      * Flags for controlling experimental, hotfix, or otherwise provisional features.
      *

package/desktop/appcontainer/VersionBar.ts

@@ -55,7 +55,7 @@ export const versionBar = hoistCmp.factory({
                 Icon.wrench({
                     omit: isAdminApp || !XH.getUser().isHoistAdminReader,
                     title: 'Open Admin Console',
-                    onClick: () => window.open('/admin')
+                    onClick: () => XH.openWindow('/admin', 'xhAdmin')
                 })
             ]
         });

package/desktop/cmp/button/AppMenuButton.ts

@@ -143,7 +143,7 @@ function buildMenuItems(props: AppMenuButtonProps) {
             omit: hideAdminItem,
             text: 'Admin',
             icon: Icon.wrench(),
-            actionFn: () => window.open('/admin')
+            actionFn: () => XH.openWindow('/admin', 'xhAdmin')
         },
         {
             omit: hideImpersonateItem,

package/desktop/cmp/button/LaunchAdminButton.ts

@@ -25,7 +25,7 @@ export const [LaunchAdminButton, launchAdminButton] = hoistCmp.withFactory<Launc
             ref,
             icon: Icon.wrench(),
             title: 'Launch admin client...',
-            onClick: () => window.open('/admin'),
+            onClick: () => XH.openWindow('/admin', 'xhAdmin'),
             ...props
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xh/hoist",
-  "version": "73.0.0-SNAPSHOT.1747153991877",
+  "version": "73.0.0-SNAPSHOT.1747155067044",
   "description": "Hoist add-on for building and deploying React Applications.",
   "repository": "github:xh/hoist-react",
   "homepage": "https://xh.io",