CDM-350 Add external URL redirect whitelist for nextRequest

[dauglyon]

Summary

• Adds support for nextRequest to redirect to external URLs on whitelisted domains after login
• Enables cross-subdomain redirects (e.g., from narrative.kbase.us to hub.berdl.kbase.us)
• Maintains security by validating URLs against a configurable whitelist

How to Whitelist URLs for Redirect

1. Configure the whitelist in config.json

Add a redirect_whitelist array to any environment that needs external redirects:

{
  "environments": {
    "production": {
      "domain": "narrative.kbase.us",
      ...
      "redirect_whitelist": ["*.berdl.kbase.us"]
    }
  }
}

2. Wildcard patterns

• *.berdl.kbase.us - Matches hub.berdl.kbase.us, hub.dev.berdl.kbase.us, etc.
• *.kbase.us - Matches any *.kbase.us subdomain
• hub.berdl.kbase.us - Matches exact domain only
• TLD-only wildcards like *.com are rejected for security

3. Usage

Pass the full external URL as the nextRequest parameter:

/login?nextRequest=https://hub.berdl.kbase.us/somepath

After successful login, the user will be redirected to the external URL.

Security

• Only HTTPS URLs are allowed
• URLs not matching the whitelist are blocked with a toast notification
• Blocked redirects fall back to /narratives
• Wildcard patterns must have at least 2 domain parts after the wildcard

Test plan

• Verify external redirect works with whitelisted domain
• Verify non-whitelisted external URLs are blocked with toast
• Verify internal nextRequest (JSON-encoded paths) still works
• Verify HTTP URLs are blocked