add questionnaire to onboarding

[michellescripts]

This PR adds the questionnaire survey to the onboarding flow. On save, the full survey results are sent to Sales Center, Resources are saved to cluster state (user preferences) and a Posthog event is triggered.

This does not include:

• final design
• showing partial surveys (full is hardcoded as true)
• showing the survey after login if registered before the release of this feature

blocked by: https://github.com/gravitational/teleport.e/pull/1713
supports: https://github.com/gravitational/cloud/issues/4802

[michellescripts]

I would love thoughts on this change. Are we still secure if leveraging WithAuthCookieAndCSRF?

We set a bearer token on redirect to /web at the end of the registration. Until then, there is no bearer token to check.

[kimlisa]

tbh, i'm not sure either... i would love to know a definite answer though, because i have questions, like why not all protected endpoints use that too then? (perhaps these endpoints where it's used, the consequence aren't as high?) and also why didn't we pass the access token instead of the csrf token in the form? (this form is located where user was already authenticated)

but i took a look at WithAuthCookieAndCSRF and it's intended for non-ajax request (forms) so I would generally stay away from it.

i wonder if we can use local storage to temporarily store the user preference, then on init, we can update user preference there, and then delete that storage key?

[michellescripts]

Follow up PR

[kimlisa]

shoot... idk how strict we want to be with enterprise endpoints not being in enterprise config

if you already got an ok from someone to do it like this, i'm okay with it. Otherwise, we might need to create an enterprise version of Welcome and move questionaire comps into enterprise (this would've been the direction I would've taken).

though tbh, this feature is mostly a data collection for us, so i'm inclined to say it's okay to be in OS? but i'd get a third opinion

[michellescripts]

There is a plan to add this survey to the OSS onboarding flow as well; we wouldn't submit OSS responses to Sales Center... but that's why I built it out in Teleport vs. Teleport.e. We could duplicate this down to E, and have essentially duplicate onboarding flows with the exception of one making an additional call... but I don't like the maintenance of keeping them in sync.

I'm thinking about this; I don't have a solid answer yet. I'm going to brainstorm a bit more.

[kimlisa]

tbh, i'm not sure either... i would love to know a definite answer though, because i have questions, like why not all protected endpoints use that too then? (perhaps these endpoints where it's used, the consequence aren't as high?) and also why didn't we pass the access token instead of the csrf token in the form? (this form is located where user was already authenticated)

but i took a look at WithAuthCookieAndCSRF and it's intended for non-ajax request (forms) so I would generally stay away from it.

i wonder if we can use local storage to temporarily store the user preference, then on init, we can update user preference there, and then delete that storage key?

[michellescripts]

Closing this PR, moving survey to E.