Ragnaroos opened a new pull request, #4025: URL: https://github.com/apache/doris-website/pull/4025
## What changed - add a `/profile-analysis` page for uploading an Apache Doris Query Profile and choosing the response language - submit analyses through the asynchronous job API and show queued, running, completed, and failed states - persist only recovery identifiers in `sessionStorage` so a refresh can resume the same job - recover ambiguous create requests by `clientRequestId` without replaying the Profile upload - add explicit privacy consent, prohibited-content guidance, third-party AI disclosure, and deletion timing - render model output as untrusted Markdown with an element allowlist, safe-link policy, no remote images, and a client-side answer-size limit - require hCaptcha before submission and send the one-time `hcaptchaToken` in the multipart request - use `https://agent.velodb.io` as the default API origin while retaining build-time environment overrides ## Why This provides a public, refresh-safe workflow for AI-assisted Doris Query Profile diagnosis while keeping uploads, model output, and recovery state inside explicit security and privacy boundaries. The hCaptcha token is reset after the single create attempt. If that POST has an ambiguous network outcome, the client uses the read-only recovery endpoint instead of replaying a potentially consumed token or creating another logical job. ## Validation - `node --test src/components/profile-analysis/*.test.js` — 42 tests passed - targeted TypeScript check for all Profile Analysis modules passed - `git diff --check upstream/master...HEAD` passed - simulated and then performed a clean rebase onto the latest `apache/doris-website:master` - exercised the public HTTPS API with a 692 KiB Profile: `QUEUED -> RUNNING -> COMPLETED` - verified browser CORS preflight for multipart POST and `Idempotency-Key` ## Deployment notes - `PROFILE_ANALYSIS_API_BASE_URL` can override the public API origin at build time. - `PROFILE_ANALYSIS_HCAPTCHA_SITE_KEY` is a public browser configuration value. The matching hCaptcha secret remains backend-only and is not included in this repository. - The backend must enable hCaptcha verification before production enforcement is considered complete. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
