Login: Fix redirect_to handling for WordPress.com subdomains

[lancewillett]

Proposed Changes

• Allow *.wordpress.com subdomains in the login redirect URL allowlist
• Fall back to the original redirect_to URL parameter when the API doesn't return one

Why are these changes being made?

See P2HQ-55

When users visit a private P2 site while logged out, P2 correctly sets redirect_to to the original URL. After logging in, two issues prevent the redirect from working:

1. isExternalUrl() in redirect-logged-in treats *.wordpress.com subdomains (e.g., myteamp2.wordpress.com) as external URLs because the allowlist only matches exact hostnames. The redirect_to is silently dropped.

2. rebootAfterLogin relies solely on the API-sanitized redirect_to. If the API doesn't echo it back, the original URL parameter from the login page is ignored entirely, defaulting to /.

Users end up at wordpress.com/p2/ instead of the P2 they were trying to visit.

Testing Instructions

1. Open an incognito/private browser window (must be logged out of WordPress.com)
2. Navigate to a private P2 URL, e.g., cAFMY-p2
3. Click "Log in" on the private landing page
4. Verify the login URL contains redirect_to=https%3A%2F%2Fmyteamp2.wordpress.com%2F
5. Complete the login flow (enter credentials)
6. Expected: Redirected back to myteamp2.wordpress.com
7. Before fix: Redirected to wordpress.com/p2/

Also test the "already logged in" path:

1. While logged in, navigate to https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fmyteamp2.wordpress.com%2F
2. Click "Continue"
3. Expected: Redirected to myteamp2.wordpress.com

Pre-merge Checklist

• Has the general commit checklist been followed? (PCYsg-hS-p2)
• Have you written new tests for your changes?
• Have you tested the feature in Simple (P9HQHe-k8-p2), Atomic (P9HQHe-jW-p2), and self-hosted Jetpack sites (PCYsg-g6b-p2)?
• Have you checked for TypeScript, React or other console errors?
• Have you tested accessibility for your changes? Ensure the feature remains usable with various user agents (e.g., browsers), interfaces (e.g., keyboard navigation), and assistive technologies (e.g., screen readers) (PCYsg-S3g-p2).
• Have you used memoizing on expensive computations? More info in Memoizing with create-selector and Using memoizing selectors and Our Approach to Data
• Have we added the "[Status] String Freeze" label as soon as any new strings were ready for translation (p4TIVU-5Jq-p2)?
  • For UI changes, have we tested the change in various languages (for example, ES, PT, FR, or DE)? The length of text and words vary significantly between languages.
• For changes affecting Jetpack: Have we added the "[Status] Needs Privacy Updates" label if this pull request changes what data or activity we track or use (p4TIVU-aUh-p2)?

[github-actions]

Calypso Live (direct link)

https://calypso.live?image=registry.a8c.com/calypso/app:build-174668

Jetpack Cloud Live (direct link)

https://calypso.live?image=registry.a8c.com/calypso/app:build-174668&env=jetpack

Automattic for Agencies Live (direct link)

https://calypso.live?image=registry.a8c.com/calypso/app:build-174668&env=a8c-for-agencies

Dashboard Live (dotcom) (direct link)

https://calypso.live?image=registry.a8c.com/calypso/app:build-174668&env=dashboard

Dashboard Live (CIAB) (direct link)

https://calypso.live?image=registry.a8c.com/calypso/app:build-174668&env=dashboard-ciab

[matticbot]

This PR modifies the release build for the following Calypso Apps:

For info about this notification, see here: PCYsg-OT6-p2

• notifications
• odyssey-stats
• wpcom-block-editor

To test WordPress.com changes, run install-plugin.sh $pluginSlug fix/p2-login-redirect-to on your sandbox.