fix(shared): scope portless redirect fallback to glob entries only

Exact string entries in allowedRedirectOrigins (e.g. https://www.clerk.com)
were also matching ports they never declared because the portless-origin
test ran against all patterns. Port is part of the browser origin, so an
exact entry must remain port-sensitive.

The portless fallback now only applies when the original entry is a glob
(contains '*'), which covers the satellite-app use case where the pattern
is https://*.example.net and the dev server runs on :5173.

Author: FrancoKaddour

packages/shared/src/internal/clerk-js/__tests__/url.test.ts

@@ -580,10 +580,13 @@ describe('isAllowedRedirect', () => {
     ['//evil.com', [/https:\/\/www\.clerk\.com/], false],
     ['..//evil.com', ['https://www.clerk.com'], false],
     // non-default ports — satellite apps in local dev (e.g. Vite on :5173)
-    ['https://www.clerk.com:3000', ['https://www.clerk.com'], true],
-    ['https://www.clerk.com:3000/path?q=1', ['https://www.clerk.com'], true],
+    // wildcard glob entries accept any port on the matching host
     ['https://app.example.net:5173', ['https://*.example.net'], true],
     ['https://app.example.net:5176', ['https://*.example.net'], true],
+    ['https://www.clerk.com:3000', ['https://*.clerk.com'], true],
+    // exact string entries remain port-sensitive (port is part of the origin)
+    ['https://www.clerk.com:3000', ['https://www.clerk.com'], false],
+    ['https://www.clerk.com:3000/path?q=1', ['https://www.clerk.com'], false],
     // non-default port must not bypass domain validation
     ['https://evil.com:5173', ['https://*.clerk.com'], false],
     ['https://evil.clerk.com.evil.com:5173', ['https://*.clerk.com'], false],

packages/shared/src/internal/clerk-js/url.ts

@@ -436,24 +436,22 @@ export const isAllowedRedirect =
 
     const isSameOrigin = currentOrigin === url.origin;
 
-    const patterns = allowedRedirectOrigins.map(origin =>
-      typeof origin === 'string' ? globs.toRegexp(trimTrailingSlash(origin)) : origin,
-    );
-
     // When the redirect URL includes a non-default port (common in local dev, e.g. :5173),
-    // url.origin includes the port (https://app.example.net:5173) while allowedRedirectOrigins
-    // patterns are typically port-less (https://*.example.net). Test both forms so that satellite
-    // apps running on custom ports are not incorrectly rejected.
+    // url.origin includes the port (https://app.example.net:5173) while glob entries like
+    // https://*.example.net have none. For wildcard/glob entries only, also test the
+    // port-stripped origin so satellite apps on custom ports are not rejected.
+    // Exact string entries (no wildcard) remain port-sensitive to preserve the security boundary.
     const portlessOrigin = url.port !== '' ? `${url.protocol}//${url.hostname}` : null;
 
     const isAllowed =
       !isProblematicUrl(url) &&
       (isSameOrigin ||
-        patterns.some(
-          pattern =>
-            pattern.test(trimTrailingSlash(url.origin)) ||
-            (portlessOrigin !== null && pattern.test(portlessOrigin)),
-        ));
+        allowedRedirectOrigins.some(origin => {
+          const pattern = typeof origin === 'string' ? globs.toRegexp(trimTrailingSlash(origin)) : origin;
+          if (pattern.test(trimTrailingSlash(url.origin))) return true;
+          const isGlobEntry = typeof origin === 'string' && origin.includes('*');
+          return isGlobEntry && portlessOrigin !== null && pattern.test(portlessOrigin);
+        }));
 
     if (!isAllowed) {
       logger.warnOnce(