Fix login redirects

[brianlovin]

Status

• WIP
• Ready for review
• Needs testing

Deploy after merge (delete what needn't be deployed)

• api

@mxstbr this closes #4571

The reason we initially did .endsWith('spectrum.chat') was to ensure logins came from our app. Before joining GitHub we changed this to .endsWith('.spectrum.chat') to prevent any malicious auth requests from from something like hackerdomainspectrum.chat

Unfortunately this broke redirects from community views. The problem is that we switched to getting the hostname from new URL(url) which will only ever return a hostname like spectrum.chat or alpha.spectrum.chat, therefore the endsWith was always missing the first period, and isSpectrumUrl returned false every time.

The fix here is to just not use endsWith at all - it's unnecessary since new URL will return the correct hostname from any given url. So we can just match that to prod or alpha and return true.

Can you give this a second eye and make sure there's no security implications here? I've deployed this to alpha and confirmed that it fixes login redirects.

[mxstbr]

Makes sense, looks good to me security-wise! Thanks for digging into this 🙏