Ragnaroos opened a new pull request, #4025:
URL: https://github.com/apache/doris-website/pull/4025

   ## What changed
   
   - add a `/profile-analysis` page for uploading an Apache Doris Query Profile 
and choosing the response language
   - submit analyses through the asynchronous job API and show queued, running, 
completed, and failed states
   - persist only recovery identifiers in `sessionStorage` so a refresh can 
resume the same job
   - recover ambiguous create requests by `clientRequestId` without replaying 
the Profile upload
   - add explicit privacy consent, prohibited-content guidance, third-party AI 
disclosure, and deletion timing
   - render model output as untrusted Markdown with an element allowlist, 
safe-link policy, no remote images, and a client-side answer-size limit
   - require hCaptcha before submission and send the one-time `hcaptchaToken` 
in the multipart request
   - use `https://agent.velodb.io` as the default API origin while retaining 
build-time environment overrides
   
   ## Why
   
   This provides a public, refresh-safe workflow for AI-assisted Doris Query 
Profile diagnosis while keeping uploads, model output, and recovery state 
inside explicit security and privacy boundaries.
   
   The hCaptcha token is reset after the single create attempt. If that POST 
has an ambiguous network outcome, the client uses the read-only recovery 
endpoint instead of replaying a potentially consumed token or creating another 
logical job.
   
   ## Validation
   
   - `node --test src/components/profile-analysis/*.test.js` — 42 tests passed
   - targeted TypeScript check for all Profile Analysis modules passed
   - `git diff --check upstream/master...HEAD` passed
   - simulated and then performed a clean rebase onto the latest 
`apache/doris-website:master`
   - exercised the public HTTPS API with a 692 KiB Profile: `QUEUED -> RUNNING 
-> COMPLETED`
   - verified browser CORS preflight for multipart POST and `Idempotency-Key`
   
   ## Deployment notes
   
   - `PROFILE_ANALYSIS_API_BASE_URL` can override the public API origin at 
build time.
   - `PROFILE_ANALYSIS_HCAPTCHA_SITE_KEY` is a public browser configuration 
value. The matching hCaptcha secret remains backend-only and is not included in 
this repository.
   - The backend must enable hCaptcha verification before production 
enforcement is considered complete.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to