Fix OAuth navigation from sandboxed Space iframe

app.py

@@ -74,15 +74,17 @@ def stats_line(rec):
 
 
 def auth_control(profile: gr.OAuthProfile | None):
-    """Render an OAuth link that always leaves the embedded Space iframe."""
+    """Render OAuth controls that work inside the sandboxed Space iframe."""
     if profile is None:
         href = "/oauth-login"
+        target = "_blank"
         label = "🤗 Sign in with Hugging Face"
     else:
         href = "/logout?_target_url=/"
+        target = "_self"
         label = f"Logout (@{escape(profile.username)})"
     return (
-        f'<a href="{href}" target="_top" role="button" '
+        f'<a href="{href}" target="{target}" rel="noopener" role="button" '
         'style="display:inline-block;background:#111827;color:#fff;font-weight:700;'
         'padding:10px 18px;border-radius:8px;text-decoration:none">'
         f"{label}</a>"

test_app.py

@@ -12,6 +12,7 @@ os.environ.setdefault("OAUTH_CLIENT_ID", "test-client")
 os.environ.setdefault("OAUTH_CLIENT_SECRET", "test-secret")
 os.environ.setdefault("OAUTH_SCOPES", "openid profile")
 os.environ.setdefault("OPENID_PROVIDER_URL", "https://huggingface.co")
+os.environ.setdefault("GRADIO_SSR_MODE", "true")
 
 certificate_app = importlib.import_module("app")
 
@@ -30,15 +31,17 @@ def test_oauth_login_clears_stale_session_before_redirecting():
     assert "secure" in cookie
 
 
-def test_auth_control_uses_top_level_navigation():
+def test_auth_control_uses_sandbox_safe_navigation():
     logged_out = certificate_app.auth_control(None)
     logged_in = certificate_app.auth_control(
         SimpleNamespace(username='person<script>alert("x")</script>')
     )
 
     assert 'href="/oauth-login"' in logged_out
-    assert 'target="_top"' in logged_out
+    assert 'target="_blank"' in logged_out
     assert 'href="/logout?_target_url=/"' in logged_in
+    assert 'target="_self"' in logged_in
+    assert 'target="_top"' not in logged_out + logged_in
     assert "<script>" not in logged_in
     assert "&lt;script&gt;" in logged_in