fix(analytics): parse signup links without URL.canParse

shared/signup-analytics.ts

@@ -27,9 +27,14 @@ export function signupEntry(action: string, returnTo: string): SignupEntry {
 
 /** Classify a clicked sign-in link without recording its path or parameters. */
 export function signupClickEvent(href: string, origin: string): Extract<SignupBrowserEvent, { stage: 'oauth' }> | null {
-  if (!URL.canParse(href, origin))
+  let url: URL
+  try {
+    url = new URL(href, origin)
+  }
+  catch {
+    // Invalid links are outside the sign-in action.
     return null
-  const url = new URL(href, origin)
+  }
   if (url.origin !== origin || url.pathname !== '/auth/github')
     return null
   return {

test/unit/signup-analytics.test.ts

@@ -19,6 +19,23 @@ it.each(['/login', 'https://other.example/auth/github', 'javascript:alert(1)', '
   expect(signupClickEvent(href, 'https://skilld.dev')).toBeNull()
 })
 
+it('classifies sign-in links when URL.canParse is unavailable', () => {
+  const descriptor = Object.getOwnPropertyDescriptor(URL, 'canParse')
+  Reflect.deleteProperty(URL, 'canParse')
+  try {
+    expect(signupClickEvent('/auth/github', 'https://skilld.dev')).toEqual({
+      stage: 'oauth',
+      outcome: 'clicked',
+      entry: 'direct',
+    })
+    expect(signupClickEvent('http://[', 'https://skilld.dev')).toBeNull()
+  }
+  finally {
+    if (descriptor)
+      Object.defineProperty(URL, 'canParse', descriptor)
+  }
+})
+
 it('classifies CLI sign-in without storing its authorization parameters', () => {
   expect(signupEntry('', '/cli/authorize?user_code=SECRET')).toBe('cli')
   expect(signupEntry('like-skill', '/gh/owner/repo/skill')).toBe('like-skill')