d7d6f6ff38
The Поддержка tab opens an assistant that answers how-to questions from the handbook. The chat is a sandboxed iframe on the assistant's own origin and is only loaded after an explicit click, so Help and its search stay local and no third-party script runs inside the app. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
34 lines
1.7 KiB
Markdown
34 lines
1.7 KiB
Markdown
# AI support assistant in Help
|
|
|
|
The Help dialog's "Поддержка" tab can now open an AI assistant that answers
|
|
"how do I..." questions from the Caterium handbook (the same articles as the
|
|
"Руководство" tab).
|
|
|
|
Privacy and isolation:
|
|
|
|
- Nothing is requested from the assistant service until the user presses
|
|
"Задать вопрос помощнику". Opening Help, searching the handbook and switching
|
|
tabs stay fully local, exactly as before.
|
|
- The chat runs in an `<iframe>` served from the assistant's own origin
|
|
(`sandbox`, `referrerpolicy="no-referrer"`). It cannot read orders, clients,
|
|
local storage or the Supabase session of Caterium, and no third-party script
|
|
is added to the app page.
|
|
- The assistant page sets `frame-ancestors` to `https://app.caterium.ru`, so no
|
|
other site can embed it.
|
|
- The assistant has no access to company data and cannot change anything in
|
|
Caterium. The tab tells users not to type passwords, confirmation codes or
|
|
customer data because their question is processed by an external service.
|
|
|
|
Assistant configuration (agent, instructions, knowledge base and rate limits)
|
|
lives in the assistant service, not in this repository. The client only needs
|
|
`BOT.origin` and `BOT.agent` in `public/core/help-center.js`.
|
|
|
|
If the assistant service is unreachable, only the chat area is affected (it
|
|
shows the browser's or the assistant's own error page); the handbook and its
|
|
search keep working.
|
|
|
|
Regression coverage: `tests/help-center.spec.mjs` asserts that no external
|
|
request is made before the click, and that the iframe uses the expected
|
|
`src`, `referrerpolicy` and a restrictive `sandbox` (no top navigation, forms
|
|
or modals). No database, migration or permission change.
|