feat(cdp): slack integration fixes

frontend/src/lib/integrations/integrationsLogic.ts

@@ -2,7 +2,7 @@ import { lemonToast } from '@posthog/lemon-ui'
 import { actions, afterMount, connect, kea, listeners, path, selectors } from 'kea'
 import { loaders } from 'kea-loaders'
 import { router, urlToAction } from 'kea-router'
-import api from 'lib/api'
+import api, { getCookie } from 'lib/api'
 import { fromParamsGivenUrl } from 'lib/utils'
 import IconGoogleAds from 'public/services/google-ads.png'
 import IconGoogleCloud from 'public/services/google-cloud.png'
@@ -97,7 +97,7 @@ export const integrationsLogic = kea<integrationsLogicType>([
     listeners(({ actions }) => ({
         handleOauthCallback: async ({ kind, searchParams }) => {
             const { state, code, error } = searchParams
-            const { next } = fromParamsGivenUrl(state)
+            const { next, token } = fromParamsGivenUrl(state)
             let replaceUrl: string = next || urls.settings('project-integrations')
 
             if (error) {
@@ -107,6 +107,10 @@ export const integrationsLogic = kea<integrationsLogicType>([
             }
 
             try {
+                if (token !== getCookie('ph_oauth_state')) {
+                    throw new Error('Invalid state token')
+                }
+
                 const integration = await api.integrations.create({
                     kind,
                     config: { state, code },

posthog/api/integration.py

@@ -1,5 +1,6 @@
 import json
 
+import os
 from typing import Any
 
 from django.http import HttpResponse
@@ -75,11 +76,15 @@ class IntegrationViewSet(
     def authorize(self, request: Request, *args: Any, **kwargs: Any) -> HttpResponse:
         kind = request.GET.get("kind")
         next = request.GET.get("next", "")
+        token = os.urandom(33).hex()
 
         if kind in OauthIntegration.supported_kinds:
             try:
-                auth_url = OauthIntegration.authorize_url(kind, next=next)
-                return redirect(auth_url)
+                auth_url = OauthIntegration.authorize_url(kind, next=next, token=token)
+                response = redirect(auth_url)
+                response.set_cookie("ph_oauth_state", token, max_age=60 * 5)
+
+                return response
             except NotImplementedError:
                 raise ValidationError("Kind not configured")
 

posthog/cdp/templates/slack/template_slack.py

@@ -7,7 +7,7 @@
     type="destination",
     id="template-slack",
     name="Slack",
-    description="Sends a message to a slack channel",
+    description="Sends a message to a Slack channel",
     icon_url="/static/services/slack.png",
     category=["Customer Success"],
     hog="""

posthog/models/integration.py

@@ -243,15 +243,15 @@ def redirect_uri(cls, kind: str) -> str:
         return f"{settings.SITE_URL.replace('http://', 'https://')}/integrations/{kind}/callback"
 
     @classmethod
-    def authorize_url(cls, kind: str, next="") -> str:
+    def authorize_url(cls, kind: str, token: str, next="") -> str:
         oauth_config = cls.oauth_config_for_kind(kind)
 
         query_params = {
             "client_id": oauth_config.client_id,
             "scope": oauth_config.scope,
             "redirect_uri": cls.redirect_uri(kind),
             "response_type": "code",
-            "state": urlencode({"next": next}),
+            "state": urlencode({"next": next, "token": token}),
             **(oauth_config.additional_authorize_params or {}),
         }