fix: prefer Site URL over origin-only Referer for email redirects

[rohanpatel2002]

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

When sending a signup confirmation email, Auth chooses the post-confirm redirect with GetReferrer() in this order:

1. Explicit redirect_to (query/header)
2. Referer header
3. Configured Site URL

For apps hosted on a path-based origin (for example GitHub Pages at https://user.github.io/repo/), a browser POST to *.supabase.co is cross-origin. With a typical Referrer-Policy such as strict-origin-when-cross-origin, the browser often sends an origin-only Referer (https://user.github.io/), with the /repo/ path removed.

Because that origin still matches the Site URL hostname, Auth treats it as valid and prefers it over a Site URL that includes the project path. The confirmation link then contains:

.../auth/v1/verify?...&redirect_to=https://user.github.io/

instead of the intended:

...&redirect_to=https://user.github.io/repo/

In addition, POST /signup did not read redirect_to / email_redirect_to from the JSON body (SignupParams had no such fields). Clients that only sent the redirect in the body therefore fell through to the Referer / Site URL logic above.

Relevant issue: #2634

What is the new behavior?

• GetReferrer: if the fallback candidate is an origin-only Referer (empty path or /) and Site URL has a non-root path, prefer Site URL. An explicit redirect_to still takes precedence. Referers that already include a path are unchanged.
• Signup: SignupParams accepts redirect_to and email_redirect_to from the JSON body and, when allow-listed, uses that value for the confirmation email.

Unit coverage was added for the origin-only Referer vs path-based Site URL case.

Additional context

This is aimed at path-based deployments (GitHub Pages project sites and similar). Password recovery already behaved correctly when redirect_to was supplied as a query parameter; this change mainly fixes signup confirmation when Auth would otherwise trust a stripped Referer, and when the redirect is only present in the signup JSON body.

Happy to adjust naming, tests, or scope if maintainers prefer a narrower change. Thank you for reviewing.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.