Website: Update Vanta authorization URL when a redirect URL is specified (#19798)

Closes: https://github.com/fleetdm/confidential/issues/6069

Changes:
- Added a new route going to the create-vanta-authorization-request
action: `/api/v1/create-external-vanta-authorization-request`
- Added a new input to the create-vanta-authorization-request action:
`sharedSecret` - A secret that must match
`sails.config.custom.sharedSecretForExternalVantaRequests` when an
external request is made to the
`/api/v1/create-external-vanta-authorization-request` endpoint
- Updated the authorization URL returned by the
create-vanta-authorization-request endpoint
- Updated the redirect in the view-vanta-authorization endpoint (if a
redirect URL is provided) to not use res.redirect() (it causes 500
errors) when redirecting users.

website/api/controllers/create-vanta-authorization-request.js

@@ -23,6 +23,11 @@ module.exports = {
     redirectToExternalPageAfterAuthorization: {
       type: 'string',
       description: 'If provided, the user will be sent to this URL after they complete the setup of this integration'
+    },
+    sharedSecret: {
+      type: 'string',
+      description: 'A shared secret used to verify external requests to this endpoint.',
+      extendedDescription: 'This input is used only when this action runs at the "/api/v1/create-external-vanta-authorization-request" endpoint'
     }
   },
 
@@ -59,10 +64,18 @@ module.exports = {
       description: 'The api-only user associated with the provided token does not have the propper permissions to query the users endpoint.',
       statusCode: 403,
     },
-
+    missingOrInvalidSharedSecret: {
+      description: 'The request to set up a Vanta integration has an invalid shared secret',
+      statusCode: 401
+    }
   },
 
   fn: async function (inputs) {
+    require('assert')(sails.config.custom.sharedSecretForExternalVantaRequests);
+    if(this.req.url === '/api/v1/create-external-vanta-authorization-request' && inputs.sharedSecret !== sails.config.custom.sharedSecretForExternalVantaRequests) {
+      throw 'missingOrInvalidSharedSecret';
+    }
+
     let url = require('url');
 
     // Look for any existing VantaConnection records that use this fleet instance URL.
@@ -142,12 +155,8 @@ module.exports = {
         fleetApiKey: inputs.fleetApiKey,
       });
     }
-    let callbackUrl = `/vanta-authorization`;
-    if(inputs.redirectToExternalPageAfterAuthorization){
-      callbackUrl += `?redirectAfterSetup=${inputs.redirectToExternalPageAfterAuthorization}`;
-    }
     // Build the authorization URL for this request.
-    let vantaAuthorizationRequestURL = `https://app.vanta.com/oauth/authorize?client_id=${encodeURIComponent(sails.config.custom.vantaAuthorizationClientId)}&scope=connectors.self:write-resource connectors.self:read-resource&state=${encodeURIComponent(generatedStateForThisRequest)}&source_id=${encodeURIComponent(sourceIDForThisRequest)}&redirect_uri=${encodeURIComponent(url.resolve(sails.config.custom.baseUrl, callbackUrl))}&response_type=code`;
+    let vantaAuthorizationRequestURL = `https://app.vanta.com/oauth/authorize?client_id=${encodeURIComponent(sails.config.custom.vantaAuthorizationClientId)}&scope=connectors.self:write-resource connectors.self:read-resource&state=${encodeURIComponent(generatedStateForThisRequest)}&source_id=${encodeURIComponent(sourceIDForThisRequest)}&redirect_uri=${encodeURIComponent(url.resolve(sails.config.custom.baseUrl, '/vanta-authorization'))}&response_type=code`;
 
     if(inputs.redirectToExternalPageAfterAuthorization){
       let internalRedirectUrl =  `${sails.config.custom.baseUrl}/redirect-vanta-authorization-request?vantaSourceId=${encodeURIComponent(sourceIDForThisRequest)}&state=${encodeURIComponent(generatedStateForThisRequest)}&vantaAuthorizationRequestURL=${encodeURIComponent(vantaAuthorizationRequestURL)}&redirectAfterSetup=${encodeURIComponent(inputs.redirectToExternalPageAfterAuthorization)}`;

website/api/controllers/view-vanta-authorization.js

@@ -28,6 +28,10 @@ module.exports = {
       viewTemplatePath: 'pages/vanta-authorization',
     },
 
+    redirect: {
+      description: 'The requesting user will be redirected to the URL they specified after set up.',
+      responseType: 'redirect'
+    },
 
   },
 
@@ -90,8 +94,10 @@ module.exports = {
       throw new Error(`When trying to update a VantaConnection record (id: ${recordOfThisAuthorization.id}) with an authorization token from Vanta, the database record associated with this request has gone missing.`);
     }
     if(this.req.signedCookies.redirectAfterSetup){
-      return this.res.redirect(this.req.signedCookies.redirectAfterSetup);
+      let redirectUrl = this.req.signedCookies.redirectAfterSetup;
+      throw {redirect: redirectUrl};
     }
+
     return {
       showSuccessMessage: true
     };

website/config/routes.js

@@ -580,7 +580,8 @@ module.exports.routes = {
   'POST /api/v1/create-or-update-one-newsletter-subscription': { action: 'create-or-update-one-newsletter-subscription' },
   '/api/v1/unsubscribe-from-all-newsletters': { action: 'unsubscribe-from-all-newsletters' },
   'POST /api/v1/admin/build-license-key': { action: 'admin/build-license-key' },
-  'POST /api/v1/create-vanta-authorization-request': { action: 'create-vanta-authorization-request', csrf: false },
+  'POST /api/v1/create-vanta-authorization-request': { action: 'create-vanta-authorization-request'},
+  'POST /api/v1/create-external-vanta-authorization-request': { action: 'create-vanta-authorization-request', csrf: false },
   'GET /redirect-vanta-authorization-request': { action: 'redirect-vanta-authorization-request' },
   'POST /api/v1/deliver-mdm-beta-signup':                   { action: 'deliver-mdm-beta-signup' },
   'POST /api/v1/get-human-interpretation-from-osquery-sql': { action: 'get-human-interpretation-from-osquery-sql', csrf: false },