From 405f63cbfcb3e463b72b3581e3f5a98dd7353059 Mon Sep 17 00:00:00 2001 From: Jordan Ramos Date: Mon, 10 Aug 2026 09:41:40 -0600 Subject: [PATCH] Fix TLS for GitLab feedback integration after v19 upgrade MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The feedback route had a typo: rejectAuthorized (no-op) instead of rejectUnauthorized. With GitLab now on HTTPS with a self-signed cert, this caused issue creation and screenshot uploads to fail. - Fix rejectAuthorized → rejectUnauthorized in both request blocks - Update GITLAB_URL default from http:// to https:// in .env.example, configure.js, README, and reference manual --- README.md | 2 +- backend/.env.example | 5 +++-- backend/routes/feedback.js | 20 ++++++++++++++++++-- configure.js | 2 +- docs/guides/full-reference-manual.md | 4 ++-- 5 files changed, 25 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 797a029..fb93936 100644 --- a/README.md +++ b/README.md @@ -560,7 +560,7 @@ All configuration lives in `backend/.env`. Copy `backend/.env.example` as a star | `CARD_API_USER` | CARD OAuth username | — | | `CARD_API_PASS` | CARD OAuth password | — | | `CARD_SKIP_TLS` | Skip CARD TLS verification | `false` | -| `GITLAB_URL` | GitLab instance URL for feedback integration | `http://steam-gitlab.charterlab.com` | +| `GITLAB_URL` | GitLab instance URL for feedback integration | `https://steam-gitlab.charterlab.com` | | `GITLAB_PROJECT_ID` | GitLab project numeric ID | — | | `GITLAB_PAT` | GitLab project access token (api scope) | — | | `GITLAB_WEBHOOK_SECRET` | Shared secret for webhook validation | — | diff --git a/backend/.env.example b/backend/.env.example index 89b2a27..fef3fe4 100644 --- a/backend/.env.example +++ b/backend/.env.example @@ -55,7 +55,8 @@ JIRA_ISSUE_TYPE=Task # Set to true if behind Charter's SSL inspection proxy JIRA_SKIP_TLS=false -# CARD Asset Ownership API (card.charter.com / card.caas.stage.charterlab.com) +# CARD Asset Ownership API (nidl.charter.com — long-term endpoint) +# Previously card.charter.com — both resolve to the same backend but nidl is the canonical URL going forward. # OAuth Bearer token auth — service account must be onboarded with the CARD team. # Tokens are acquired automatically via Basic Auth and cached for 1 hour. CARD_API_URL= @@ -79,7 +80,7 @@ DATABASE_URL=postgresql://steam:@localhost:5433/cve_dashboard # GitLab Feedback Integration (bug reports and feature requests from the dashboard) # PAT needs 'api' scope. Project ID is the numeric ID from GitLab project settings. -GITLAB_URL=http://steam-gitlab.charterlab.com +GITLAB_URL=https://steam-gitlab.charterlab.com GITLAB_PROJECT_ID= GITLAB_PAT= diff --git a/backend/routes/feedback.js b/backend/routes/feedback.js index bb97795..2a0a061 100644 --- a/backend/routes/feedback.js +++ b/backend/routes/feedback.js @@ -89,7 +89,7 @@ function createFeedbackRouter() { 'PRIVATE-TOKEN': GITLAB_PAT, 'Content-Length': body.length, }, - rejectAuthorized: false, + rejectUnauthorized: false, }; const apiReq = transport.request(reqOpts, (apiRes) => { @@ -140,6 +140,22 @@ function createFeedbackRouter() { } } + /** + * POST / + * + * Submit a bug report or feature request. Creates a GitLab issue in the + * configured project with optional screenshot attachments. + * + * @body {string} type - Feedback type: "bug" or "feature" (required) + * @body {string} title - Issue title (required) + * @body {string} description - Issue description / body (required) + * @body {string} [page] - Page name where the feedback originated + * @files screenshots - Up to 3 image files (PNG, JPG, GIF, WebP; max 5MB each) + * @response 200 - { success: true, issue: { id: number, url: string, title: string } } + * @response 400 - { error: string } — missing or invalid fields + * @response 502 - { error: string } — GitLab API unreachable or returned an error + * @response 503 - { error: string } — feedback integration not configured + */ router.post('/', requireAuth(), screenshotUpload.array('screenshots', 3), async (req, res) => { const uploadedFiles = req.files || []; @@ -218,7 +234,7 @@ function createFeedbackRouter() { 'PRIVATE-TOKEN': GITLAB_PAT, 'Content-Length': Buffer.byteLength(postData), }, - rejectAuthorized: false, + rejectUnauthorized: false, }; const apiReq = transport.request(reqOpts, (apiRes) => { diff --git a/configure.js b/configure.js index 1afb3f1..d7e7d35 100644 --- a/configure.js +++ b/configure.js @@ -451,7 +451,7 @@ const VARIABLE_DESCRIPTORS = [ group: 'GitLab Integration', target: 'backend', required: false, - default: 'http://steam-gitlab.charterlab.com', + default: 'https://steam-gitlab.charterlab.com', description: 'Base URL for the GitLab instance', docUrl: 'Generate at GitLab > Settings > Access Tokens', sensitive: false, diff --git a/docs/guides/full-reference-manual.md b/docs/guides/full-reference-manual.md index 6928a16..cc82063 100644 --- a/docs/guides/full-reference-manual.md +++ b/docs/guides/full-reference-manual.md @@ -234,7 +234,7 @@ JIRA_SKIP_TLS=false # CARD Asset Ownership API (required for CARD integration) # OAuth Bearer token auth — service account must be onboarded with the CARD team. # Tokens are acquired automatically via Basic Auth and cached for 1 hour. -CARD_API_URL=https://card.charter.com +CARD_API_URL=https://nidl.charter.com CARD_API_USER=your-card-user CARD_API_PASS=your-card-password # Set to true if behind Charter's SSL inspection proxy @@ -242,7 +242,7 @@ CARD_SKIP_TLS=false # GitLab Feedback Integration (bug reports and feature requests from the dashboard) # PAT needs 'api' scope. Project ID is the numeric ID from GitLab project settings. -GITLAB_URL=http://steam-gitlab.charterlab.com +GITLAB_URL=https://steam-gitlab.charterlab.com GITLAB_PROJECT_ID=13 GITLAB_PAT=glpat-xxxxxxxxxxxxx # Webhook secret — shared secret for validating incoming webhook requests.