imbajin opened a new pull request, #827:
URL: https://github.com/apache/hugegraph-toolchain/pull/827

   ## Purpose of the PR
   
   Opening Hubble through an ordinary HTTP hostname or node IP can show a blank 
page before login. The 3D graph dependency loads Three.js WebGPU modules during 
startup, and the locked version reads an unavailable `GPUShaderStage.VERTEX` in 
an insecure context. HTTP localhost works because browsers treat loopback 
origins as trustworthy, which also hid the failure in existing browser smoke 
tests.
   
   ## Main Changes
   
   - Declare Three.js directly and lock both direct and graph-renderer 
dependencies to `0.183.2`, which includes the upstream missing-WebGPU-constant 
guard.
   - Add a real insecure-HTTP browser startup check to the existing UI 
acceptance flow. Loopback services are accessed through a temporary 
browser-resolved hostname; the check requires an insecure context, a mounted 
React root, and no uncaught browser errors.
   - Keep HTTPS-only targets explicitly marked as skipped for this check, 
including in the acceptance summary. Document the workaround and retain a real 
HTTP startup screenshot.
   
   ## Verifying these changes
   
   - [x] Need tests and can be verified as follows:
     - The new browser check fails against the original production bundle with 
the reported `VERTEX` exception and passes with rebuilt production assets 
served by the same Hubble backend.
     - Production frontend build, lint, i18n checks, focused route/3D utility 
tests, and browser-smoke helper tests pass.
     - The real Canvas3D component renders nodes and edges through WebGL2 over 
insecure HTTP; resize and zoom also work. This is component compatibility 
validation, separate from backend graph queries.
   
   Rebuilt production assets over ordinary HTTP:
   
   ![Hubble over ordinary 
HTTP](https://github.com/apache/hugegraph-toolchain/blob/fix/hubble-insecure-http/hugegraph-hubble/docs/images/showcase/http-startup.png?raw=true)
   
   ## Does this PR potentially affect the following parts?
   
   - [x] Dependencies (Three.js remains MIT; its notice is retained in the 
generated bundle.)
   - [ ] Modify configurations
   - [ ] The public API
   - [ ] Other affects
   
   ## Documentation Status
   
   - [x] `Doc - Done`
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to