feat(app-shell): zero-roundtrip newTabUrl fast path for opensInNewTab actions (#1675)

Actions that declare newTabUrl (spec: a path template with a {recordId}
placeholder whose target endpoint performs all auth/authz itself) now
drive the pre-opened popup straight to that URL on click, skipping the
action POST entirely. Applied to both server-action paths (list rows
via useConsoleActionRuntime, record header via RecordDetailView).

The popup paints the existing spinner page and keeps it visible until
the (possibly slow) endpoint commits its redirect; the URL is resolved
absolute because about:blank gives a bare-relative href no reliable
resolution base. Popup-blocked fallback keeps the existing toast.

First consumer: cloud sys_environment.sso_as_owner -> GET /sso-open,
which re-runs every check the POST half would have done. Removes one
full round trip of white-screen latency from every Open click.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

packages/app-shell/src/hooks/useConsoleActionRuntime.tsx

@@ -373,6 +373,41 @@ export function useConsoleActionRuntime(opts: ConsoleActionRuntimeOptions): Cons
     }
     try {
       const baseUrl = import.meta.env.VITE_SERVER_URL || '';
+      // ── Zero-roundtrip fast path ────────────────────────────────────────
+      // `newTabUrl` names a GET endpoint that performs ALL auth/authz itself
+      // (e.g. /sso-open re-runs every check the POST half would have done),
+      // so the POST round trip would add nothing but click latency. Drive the
+      // pre-opened tab there immediately — the spinner page stays painted
+      // until the (possibly slow) endpoint commits its redirect.
+      const newTabUrl = typeof (action as any).newTabUrl === 'string' ? (action as any).newTabUrl as string : '';
+      if ((action as any).opensInNewTab && newTabUrl) {
+        if (resolvedRecordId == null) {
+          if (preOpenedTab) { try { preOpenedTab.close(); } catch { /* ignore */ } }
+          return { success: false, error: 'This action runs on a single record — no record id available.' };
+        }
+        // Absolute URL required: the pre-opened tab is an about:blank document,
+        // so a bare-relative href has no reliable resolution base.
+        const directUrl = `${baseUrl || window.location.origin}${newTabUrl.replace('{recordId}', encodeURIComponent(String(resolvedRecordId)))}`;
+        if (preOpenedTab) {
+          try { preOpenedTab.location.href = directUrl; }
+          catch {
+            try { preOpenedTab.close(); } catch { /* ignore */ }
+            window.location.href = directUrl;
+          }
+        } else {
+          let popup: Window | null = null;
+          try { popup = window.open(directUrl, '_blank'); } catch { popup = null; }
+          if (!popup) {
+            toast('浏览器拦截了弹窗 / Popup blocked', {
+              description: '点击在新标签页打开环境',
+              action: { label: '打开环境', onClick: () => { try { window.open(directUrl, '_blank'); } catch { window.location.href = directUrl; } } },
+              duration: 10000,
+            });
+          }
+        }
+        if (action.refreshAfter === true) refresh();
+        return { success: true };
+      }
       const obj = action.objectName || objApiName || 'global';
       const res = await authFetch(
         `${baseUrl}/api/v1/actions/${encodeURIComponent(obj)}/${encodeURIComponent(targetName)}`,

packages/app-shell/src/views/RecordDetailView.tsx

@@ -496,6 +496,41 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
 
     try {
       const baseUrl = import.meta.env.VITE_SERVER_URL || '';
+      // ── Zero-roundtrip fast path ────────────────────────────────────────
+      // `newTabUrl` names a GET endpoint that performs ALL auth/authz itself
+      // (e.g. /sso-open re-runs every check the POST half would have done),
+      // so the POST round trip would add nothing but click latency. Drive the
+      // pre-opened tab there immediately — the spinner page stays painted
+      // until the (possibly slow) endpoint commits its redirect.
+      const newTabUrl = typeof (action as any).newTabUrl === 'string' ? (action as any).newTabUrl as string : '';
+      if ((action as any).opensInNewTab && newTabUrl) {
+        if (pureRecordId == null) {
+          if (preOpenedTab) { try { preOpenedTab.close(); } catch { /* ignore */ } }
+          return { success: false, error: 'This action runs on a single record — no record id available.' };
+        }
+        // Absolute URL required: the pre-opened tab is an about:blank document,
+        // so a bare-relative href has no reliable resolution base.
+        const directUrl = `${baseUrl || window.location.origin}${newTabUrl.replace('{recordId}', encodeURIComponent(String(pureRecordId)))}`;
+        if (preOpenedTab) {
+          try { preOpenedTab.location.href = directUrl; }
+          catch {
+            try { preOpenedTab.close(); } catch { /* ignore */ }
+            window.location.href = directUrl;
+          }
+        } else {
+          let popup: Window | null = null;
+          try { popup = window.open(directUrl, '_blank'); } catch { popup = null; }
+          if (!popup) {
+            toast('浏览器拦截了弹窗 / Popup blocked', {
+              description: '点击在新标签页打开环境',
+              action: { label: '打开环境', onClick: () => { try { window.open(directUrl, '_blank'); } catch { window.location.href = directUrl; } } },
+              duration: 10000,
+            });
+          }
+        }
+        if (action.refreshAfter === true) setActionRefreshKey(k => k + 1);
+        return { success: true };
+      }
       const obj = action.objectName || objectName || 'global';
       const res = await authFetch(
         `${baseUrl}/api/v1/actions/${encodeURIComponent(obj)}/${encodeURIComponent(targetName)}`,

packages/core/src/actions/ActionRunner.ts

@@ -127,6 +127,12 @@ export interface ActionDef {
    *  handler can drive it to a returned `redirectUrl` after an awaited fetch
    *  without tripping popup blockers. Used by actions like `sso_as_owner`. */
   opensInNewTab?: boolean;
+  /** Zero-roundtrip new-tab target: a path template (`{recordId}` placeholder)
+   *  the handler navigates the pre-opened tab to IMMEDIATELY on click, skipping
+   *  the action POST entirely. Only valid with `opensInNewTab`; the endpoint
+   *  must perform all auth/authz itself (e.g. the cloud `/sso-open` endpoint,
+   *  which re-runs every check the POST half would have done). */
+  newTabUrl?: string;
   /** Any additional properties */
   [key: string]: any;
 }