santifer/career-ops · error · Error

glints: URL must use HTTPS: ${url}

Error message

glints: URL must use HTTPS: ${url}

What it means

glints.mjs throws this in assertGlintsUrl() after the URL parses but its protocol is not 'https:'. It enforces TLS for the Glints GraphQL endpoint. Because Glints validates the operator-supplied entry.api (defaulting to DEFAULT_API), a live throw typically comes from an api: value using http:// in portals.yml.

Source

Thrown at providers/glints.mjs:77

        minAmount
        CurrencyCode
      }
      createdAt
    }
    expInfo
    hasMore
  }
}`;

/** @param {string} url */
function assertGlintsUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`glints: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`glints: URL must use HTTPS: ${url}`);
  if (!ALLOWED_GLINTS_HOSTS.has(parsed.hostname))
    throw new Error(`glints: untrusted hostname "${parsed.hostname}" — must be one of: ${[...ALLOWED_GLINTS_HOSTS].join(', ')}`);
  return url;
}

// NaN-safe Date.parse
function toEpochMs(value) {
  if (!value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

/**
 * Derive the job detail base URL from the API hostname.
 * @param {string} apiUrl
 * @returns {string}
 */
function deriveBaseUrl(apiUrl) {

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Set api to its https:// form or remove the field to use the shipped default.
2. For local interception, trust a proxy CA against the HTTPS endpoint instead of downgrading to http.
3. Remove tests that pass http URLs unless they assert this specific throw.

Example fix

# before
- name: Glints (ID)
  provider: glints
  api: http://glints.com/api/v2-alc/graphql

# after
- name: Glints (ID)
  provider: glints
  api: https://glints.com/api/v2-alc/graphql

// Reject non-HTTPS Glints api values before they reach the provider.
function glintsApiIsHttps(entry) {
  const api = entry.api || 'https://glints.com/api/v2-alc/graphql';
  try { return new URL(api).protocol === 'https:'; } catch { return false; }
}

When it happens

Trigger: entry.api is set to an http:// URL (e.g. for local proxying); a test calls assertGlintsUrl('http://glints.com/...'); a stale config predates the HTTPS-only guard.

Common situations: Local debugging through a non-TLS intercepting proxy; a copy-paste of an old http doc link; an env override downgraded the scheme.

Related errors

• glints: invalid URL: ${url}
• greenhouse: URL must use HTTPS: ${url}
• gem: URL must use HTTPS: ${url}
• getonbrd: URL must use HTTPS: ${url}
• glints: untrusted hostname "${parsed.hostname}" — must be on

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/3a3eb400836c04a9. Report an issue: GitHub.