From c3785e2b9d9891492f418ea82b7a12307ebfcc75 Mon Sep 17 00:00:00 2001
From: Guilhem Lemouel <guilhemlemouel@gmail.com>
Date: Thu, 13 Aug 2026 11:09:10 +0200
Subject: [PATCH] fix(frontend): keep the supabase resource link off the popup
 callback path

---
 frontend/src/lib/components/ApiConnectForm.svelte | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/frontend/src/lib/components/ApiConnectForm.svelte b/frontend/src/lib/components/ApiConnectForm.svelte
index f86b913c98..a44fef60ed 100644
--- a/frontend/src/lib/components/ApiConnectForm.svelte
+++ b/frontend/src/lib/components/ApiConnectForm.svelte
@@ -219,8 +219,12 @@
 			{#if wizardEnabled}
 				<SupabaseResourceConnect onPicked={applySupabasePick} />
 			{:else}
+				<!-- `noopener` is what the callback reads to tell this leg from the wizard's popup,
+				which hands its token back through `window.opener`. Browsers imply it for
+				`target="_blank"`, but only since 2021 -- stating it keeps older ones on this path. -->
 				<a
 					target="_blank"
+					rel="noopener"
 					href="{base}/api/oauth/connect/supabase_wizard"
 					class="border rounded-lg flex flex-row gap-2 items-center text-xs px-3 py-1.5 h-8 bg-[#F1F3F5] hover:bg-[#E6E8EB] dark:bg-[#1C1C1C] dark:hover:bg-black"
 				>