Fix TLS for GitLab feedback integration after v19 upgrade

The feedback route had a typo: rejectAuthorized (no-op) instead of
rejectUnauthorized. With GitLab now on HTTPS with a self-signed cert,
this caused issue creation and screenshot uploads to fail.

- Fix rejectAuthorized → rejectUnauthorized in both request blocks
- Update GITLAB_URL default from http:// to https:// in .env.example,
  configure.js, README, and reference manual

README.md

@@ -560,7 +560,7 @@ All configuration lives in `backend/.env`. Copy `backend/.env.example` as a star
 | `CARD_API_USER` | CARD OAuth username | — |
 | `CARD_API_PASS` | CARD OAuth password | — |
 | `CARD_SKIP_TLS` | Skip CARD TLS verification | `false` |
-| `GITLAB_URL` | GitLab instance URL for feedback integration | `http://steam-gitlab.charterlab.com` |
+| `GITLAB_URL` | GitLab instance URL for feedback integration | `https://steam-gitlab.charterlab.com` |
 | `GITLAB_PROJECT_ID` | GitLab project numeric ID | — |
 | `GITLAB_PAT` | GitLab project access token (api scope) | — |
 | `GITLAB_WEBHOOK_SECRET` | Shared secret for webhook validation | — |

backend/.env.example

@@ -55,7 +55,8 @@ JIRA_ISSUE_TYPE=Task
 # Set to true if behind Charter's SSL inspection proxy
 JIRA_SKIP_TLS=false
 
-# CARD Asset Ownership API (card.charter.com / card.caas.stage.charterlab.com)
+# CARD Asset Ownership API (nidl.charter.com — long-term endpoint)
+# Previously card.charter.com — both resolve to the same backend but nidl is the canonical URL going forward.
 # OAuth Bearer token auth — service account must be onboarded with the CARD team.
 # Tokens are acquired automatically via Basic Auth and cached for 1 hour.
 CARD_API_URL=
@@ -79,7 +80,7 @@ DATABASE_URL=postgresql://steam:<password>@localhost:5433/cve_dashboard
 
 # GitLab Feedback Integration (bug reports and feature requests from the dashboard)
 # PAT needs 'api' scope. Project ID is the numeric ID from GitLab project settings.
-GITLAB_URL=http://steam-gitlab.charterlab.com
+GITLAB_URL=https://steam-gitlab.charterlab.com
 GITLAB_PROJECT_ID=
 GITLAB_PAT=
 

backend/routes/feedback.js

@@ -89,7 +89,7 @@ function createFeedbackRouter() {
                         'PRIVATE-TOKEN': GITLAB_PAT,
                         'Content-Length': body.length,
                     },
-                    rejectAuthorized: false,
+                    rejectUnauthorized: false,
                 };
 
                 const apiReq = transport.request(reqOpts, (apiRes) => {
@@ -140,6 +140,22 @@ function createFeedbackRouter() {
         }
     }
 
+    /**
+     * POST /
+     *
+     * Submit a bug report or feature request. Creates a GitLab issue in the
+     * configured project with optional screenshot attachments.
+     *
+     * @body {string} type - Feedback type: "bug" or "feature" (required)
+     * @body {string} title - Issue title (required)
+     * @body {string} description - Issue description / body (required)
+     * @body {string} [page] - Page name where the feedback originated
+     * @files screenshots - Up to 3 image files (PNG, JPG, GIF, WebP; max 5MB each)
+     * @response 200 - { success: true, issue: { id: number, url: string, title: string } }
+     * @response 400 - { error: string } — missing or invalid fields
+     * @response 502 - { error: string } — GitLab API unreachable or returned an error
+     * @response 503 - { error: string } — feedback integration not configured
+     */
     router.post('/', requireAuth(), screenshotUpload.array('screenshots', 3), async (req, res) => {
         const uploadedFiles = req.files || [];
 
@@ -218,7 +234,7 @@ function createFeedbackRouter() {
                         'PRIVATE-TOKEN': GITLAB_PAT,
                         'Content-Length': Buffer.byteLength(postData),
                     },
-                    rejectAuthorized: false,
+                    rejectUnauthorized: false,
                 };
 
                 const apiReq = transport.request(reqOpts, (apiRes) => {

configure.js

@@ -451,7 +451,7 @@ const VARIABLE_DESCRIPTORS = [
     group: 'GitLab Integration',
     target: 'backend',
     required: false,
-    default: 'http://steam-gitlab.charterlab.com',
+    default: 'https://steam-gitlab.charterlab.com',
     description: 'Base URL for the GitLab instance',
     docUrl: 'Generate at GitLab > Settings > Access Tokens',
     sensitive: false,

docs/guides/full-reference-manual.md

@@ -234,7 +234,7 @@ JIRA_SKIP_TLS=false
 # CARD Asset Ownership API (required for CARD integration)
 # OAuth Bearer token auth — service account must be onboarded with the CARD team.
 # Tokens are acquired automatically via Basic Auth and cached for 1 hour.
-CARD_API_URL=https://card.charter.com
+CARD_API_URL=https://nidl.charter.com
 CARD_API_USER=your-card-user
 CARD_API_PASS=your-card-password
 # Set to true if behind Charter's SSL inspection proxy
@@ -242,7 +242,7 @@ CARD_SKIP_TLS=false
 
 # GitLab Feedback Integration (bug reports and feature requests from the dashboard)
 # PAT needs 'api' scope. Project ID is the numeric ID from GitLab project settings.
-GITLAB_URL=http://steam-gitlab.charterlab.com
+GITLAB_URL=https://steam-gitlab.charterlab.com
 GITLAB_PROJECT_ID=13
 GITLAB_PAT=glpat-xxxxxxxxxxxxx
 # Webhook secret — shared secret for validating incoming webhook requests.