santifer/career-ops · warning · Error

comeet: URL must use HTTPS: ${redactToken(url)}

Error message

comeet: URL must use HTTPS: ${redactToken(url)}

What it means

Thrown by comeet's assertComeetUrl when the URL parses but its protocol is not https. Like the other assertComeetUrl branches it is defense-in-depth: resolveApiUrl's isComeetApiUrl already enforces protocol === 'https:' and returns null (→ error 165) for any non-https input, so the normal fetch() path pre-empts this with error 165 instead. Reachable when assertComeetUrl is invoked directly on an http URL.

Source

Thrown at providers/comeet.mjs:36

  if (typeof raw !== 'string' || !raw) return false;
  let parsed;
  try {
    parsed = new URL(raw);
  } catch {
    return false;
  }
  return parsed.protocol === 'https:' && parsed.hostname === COMEET_API_HOST && parsed.pathname.startsWith('/careers-api/');
}

/** @param {string} url */
function assertComeetUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`comeet: invalid URL: ${redactToken(url)}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`comeet: URL must use HTTPS: ${redactToken(url)}`);
  if (parsed.hostname !== COMEET_API_HOST)
    throw new Error(`comeet: untrusted hostname "${parsed.hostname}" — must be ${COMEET_API_HOST}`);
  if (!parsed.pathname.startsWith('/careers-api/'))
    throw new Error(`comeet: URL path must be the careers-api endpoint: ${redactToken(url)}`);
  return url;
}

// Redact the per-tenant ?token= so neither the (informational, possibly-logged)
// DetectHit url nor a thrown validation error carries the secret. Best-effort:
// falls back to a regex strip when the value can't be parsed as a URL.
function redactToken(url) {
  try {
    const parsed = new URL(url);
    if (parsed.searchParams.has('token')) parsed.searchParams.set('token', 'REDACTED');
    return parsed.href;
  } catch {
    return typeof url === 'string' ? url.replace(/([?&]token=)[^&#]*/gi, '$1REDACTED') : url;
  }

View on GitHub (pinned to 9b17a8ac97)

Solutions

  1. For direct assertComeetUrl calls, ensure the value is an https URL before passing it.
  2. For fetch() use, change the entry URL to https://www.comeet.co/careers-api/... (this surfaces as error 165, not 162, but the fix is the same).
  3. Treat 162 in production logs as a signal that resolveApiUrl and assertComeetUrl have diverged.

Example fix

// before
assertComeetUrl('http://www.comeet.co/careers-api/2.0/company/abc/positions?token=x');

// after
assertComeetUrl('https://www.comeet.co/careers-api/2.0/company/abc/positions?token=x');
Defensive patterns

Strategy: validation

Validate before calling

function isHttpsUrl(u) {
  try { return new URL(u).protocol === 'https:'; } catch { return false; }
}
if (!isHttpsUrl(maybeUrl)) { /* skip or upgrade to https before calling assertComeetUrl */ }

Type guard

function isHttpsComeetCandidate(u) {
  if (typeof u !== 'string' || !u) return false;
  try { return new URL(u).protocol === 'https:'; } catch { return false; }
}

Try / catch

try { assertComeetUrl(url); }
catch (e) {
  if (/^comeet: URL must use HTTPS/.test(e.message)) { /* upgrade url to https and retry, or skip */ }
  else throw e;
}

Prevention

When it happens

Trigger: assertComeetUrl is called (directly, outside fetch()) with a well-formed http:// URL. Through fetch(), an http entry.api/entry.careers_url fails isComeetApiUrl first and surfaces as error 165.

Common situations: A test or custom integration passing an http careers-api URL; an entry whose URL was upgraded to https on the Comeet side but the config still holds the old http form (which fetch() reports as 165, not here).

Related errors

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/69aedb9b0ea042a9. Report an issue: GitHub.