Merge pull request 'Set explicit launch URL for the LiteLLM application' (#16) from benvin/litellm-app-visibility into main

Reviewed-on: #16

modules/authentik/main.tf

@@ -199,6 +199,8 @@ resource "authentik_application" "oauth2" {
   name              = each.value.name
   slug              = each.key
   protocol_provider = authentik_provider_oauth2.this[each.key].id
+  # Null keeps Authentik's derived launch URL (from the first redirect_uri).
+  meta_launch_url = each.value.launch_url
 }
 
 resource "authentik_application" "ldap" {

modules/authentik/variables.tf

@@ -82,6 +82,11 @@ variable "providers_oauth2" {
     })), [])
     signing_key           = optional(string, null)
     access_token_validity = optional(string, "minutes=10")
+    # Explicit launch URL for the app tile on the user dashboard ("My
+    # applications"). Null lets Authentik derive it from the first redirect_uri;
+    # set it to the app's UI to make the tile deterministic and to force an
+    # application re-save (which invalidates Authentik's cached access policy).
+    launch_url = optional(string, null)
     # Optional app-role claim computed from (hierarchical) group membership: emit
     # `claim` = the first matching rule's role, else `default`. The app requests
     # `claim` as a scope and reads it (e.g. LiteLLM GENERIC_USER_ROLE_ATTRIBUTE).