santifer/career-ops · error · Error

torre: URL must use HTTPS: ${url}

Error message

torre: URL must use HTTPS: ${url}

What it means

assertTorreUrl requires the https: protocol for every URL it validates; this error is thrown for syntactically valid URLs using another scheme (http:, ftp:, etc.). Enforcing HTTPS prevents credentials/job payloads from being sent in cleartext and blocks downgrade tricks before any fetch happens.

Source

Thrown at providers/torre.mjs:92

// same result set, so the default is arbitrary among them.
const EXPERIENCE_LEVELS = new Set([
  'potential-to-develop',
  '1-plus-year',
  '2-plus-years',
  '3-plus-years',
  '5-plus-years',
]);
const DEFAULT_EXPERIENCE = '1-plus-year';

/** @param {string} url */
function assertTorreUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`torre: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`torre: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_API_HOST) {
    throw new Error(`torre: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_API_HOST}`);
  }
  return url;
}

/**
 * Build the search body from the portal entry. Only filters proven to affect
 * `total` are emitted — see the header note. Exported for tests.
 *
 * @param {any} entry
 * @returns {object}
 */
export function buildTorreQuery(entry) {
  /** @type {Record<string, unknown>} */
  const body = {};

  const search = typeof entry?.search === 'string' ? entry.search.trim() : '';

View on GitHub (pinned to 1696bec4d0)

Solutions

1. Change the URL scheme to https:// (confirm the target actually serves TLS).
2. If it's an internal test endpoint, use a test seam/mocking rather than pointing the provider at non-HTTPS URLs.
3. If the target host genuinely has no HTTPS, it is not a valid Torre API endpoint — find the official HTTPS endpoint.

Example fix

// before
assertTorreUrl('http://torre.ai/api/search');
// Error: torre: URL must use HTTPS: http://torre.ai/api/search
// after
assertTorreUrl('https://torre.ai/api/search');

function isHttpsUrl(url) {
  try { return new URL(url).protocol === 'https:'; } catch { return false; }
}
if (!isHttpsUrl(url)) url = url.replace(/^http:/, 'https:');

function isHttps(v) {
  if (typeof v !== 'string') return false;
  try { return new URL(v).protocol === 'https:'; } catch { return false; }
}

try {
  assertTorreUrl(url);
} catch (err) {
  if (String(err.message).startsWith('torre: URL must use HTTPS')) {
    console.error('Upgrade the configured endpoint to https://');
  } else throw err;
}

When it happens

Trigger: Calling assertTorreUrl with 'http://torre.ai/...' or another non-HTTPS scheme — typically a config entry written with http://, an internal proxy URL, or a URL harvested from a page that linked insecurely.

Common situations: Legacy bookmarks using http://; local/staging test URLs (http://localhost:3000); a reverse-proxy config with TLS terminated upstream; copy-pasting from an old document.

Related errors

• breezy: URL must use HTTPS: ${url}
• careerviet: URL must use HTTPS: ${url}
• getonbrd: URL must use HTTPS: ${url}
• glints: URL must use HTTPS: ${url}
• jobbankca: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@1696bec4d0 (2026-09-01). Data as JSON: /api/errors/65904d93d3f1a9eb. Report an issue: GitHub.