Website: don't require an API key on Microsoft compliance proxy requests (#49434)

**Related issue:** Resolves #47699

## Testing

- [x] QA'd all new/changed functionality manually

## What & why

Entra conditional access is becoming available to self-hosted Fleet
Premium instances, which don't have the shared `MS-API-KEY` that
cloud-managed customers use. This makes the `microsoft-proxy/*`
endpoints reachable without that key by dropping the `is-cloud-customer`
policy gate (and the now-unused shared-secret config comments / policy
file).

A replacement auth mechanism for the proxy is tracked separately in
#47702.

> Split out of #49414 so the website change can ship independently.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Security / Access Control**
* Updated Microsoft proxy access handling to bypass the prior
cloud-customer check for matching requests.
* **Configuration**
* Removed unused cloud-customer compliance proxy shared-secret settings.
* **Bug Fixes**
* Improved compliance partner tenant creation by detecting existing
tenants using the provided Entra tenant ID and corrected the success
message text.
* **Data Model**
* Removed uniqueness enforcement for stored fleet instance URLs to
prevent avoidable conflicts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Eric <eashaw@sailsjs.com>

website/api/controllers/microsoft-proxy/create-compliance-partner-tenant.js

@@ -16,7 +16,7 @@ module.exports = {
 
 
   exits: {
-    success: { description: 'Details about a new Microsoft complaince tsenant have been returned to a Fleet isntance' },
+    success: { description: 'Details about a new Microsoft compliance tenant have been returned to a Fleet instance' },
     connectionAlreadyExists: {description: 'A Microsoft compliance tenant already exists for the provided entra tenant id.', statusCode: 409},
     missingOriginHeader: { description: 'No Origin header set', responseType: 'badRequest'},
   },
@@ -29,8 +29,8 @@ module.exports = {
       throw 'missingOriginHeader';
     }
 
-    // Look for an existing microsoftComplianceTenant record using the requesting Fleet instances URL.
-    let existingComplianceTenant = await MicrosoftComplianceTenant.findOne({fleetInstanceUrl: this.req.get('origin')});
+    // Look for an existing microsoftComplianceTenant record using the provided entraTenantId.
+    let existingComplianceTenant = await MicrosoftComplianceTenant.findOne({entraTenantId});
     if(existingComplianceTenant) {
       // If we found one with the provided tenant ID, and setup was not completed, delete the incomplete compliance tenant and create a new one.
       if(!existingComplianceTenant.setupCompleted) {

website/api/models/MicrosoftComplianceTenant.js

@@ -28,7 +28,6 @@ module.exports = {
     fleetInstanceUrl: {
       type: 'string',
       description: 'The url of the connected Fleet instance.',
-      unique: true,
       required: true,
     },
 

website/api/policies/is-cloud-customer.js

@@ -1,24 +0,0 @@
-/**
- * is-cloud-customer
- *
- * A simple policy that allows requests to microsoft proxy endpoints from a cloud customer.
- *
- * For more about how to use policies, see:
- *   https://sailsjs.com/config/policies
- *   https://sailsjs.com/docs/concepts/policies
- *   https://sailsjs.com/docs/concepts/policies/access-control-and-permissions
- */
-module.exports = async function (req, res, proceed) {
-
-  // If an MS API KEY header was provided, check to see if it matches the entraSharedSecret.
-  if (req.get('MS-API-KEY')) {
-    if([sails.config.custom.cloudCustomerCompliancePartnerSharedSecret, sails.config.custom.alternateCompliancePartnerSharedSecret].includes(req.get('MS-API-KEY'))){
-      return proceed();
-    }
-  }
-
-  //--•
-  // Otherwise, this request did not come from a cloud customer.
-  return res.unauthorized();
-
-};

website/config/custom.js

@@ -515,8 +515,6 @@ module.exports.custom = {
   // Microsoft compliance proxy
   // compliancePartnerClientId: '…',
   // compliancePartnerClientSecret: '…',
-  // cloudCustomerCompliancePartnerSharedSecret: '…',
-  // alternateCompliancePartnerSharedSecret: '…',
 
 
   // Android proxy

website/config/policies.js

@@ -13,7 +13,7 @@ module.exports.policies = {
   '*': 'is-logged-in',
   'admin/*': 'is-super-admin',
   'query-generator/*': 'has-query-generator-access',
-  'microsoft-proxy/*': 'is-cloud-customer',
+  'microsoft-proxy/*': true,
   // Bypass the `is-logged-in` policy for:
 
   'entrance/*': true,