GH-45720: [Docs] Kapa.ai widget not loading on the dev docs

[thisisnic]

Rationale for this change

Add the kapa.ai domain to the content security policy so that the AI bot we are trying out can load. Following the approach shown on apache/dubbo-website#2925 but being more restrictive on URLs.

What changes are included in this PR?

Updates to sphinx and pkgdown docs to fix this

Are these changes tested?

Nope - this wasn't an issue on the docs built in crossbow when I tested it on the PR, so I was thinking I just check it's working on the dev docs once they're built

Are there any user-facing changes?

Nope

• GitHub Issue: [Docs] Kapa.ai widget not loading on the dev docs #45720

[github-actions]

⚠️ GitHub issue #45720 has been automatically assigned in GitHub to PR creator.

[thisisnic]

Hmm, looking at the original error, I'm now wondering if I need to add the others back in to prevent blocking access to others?

Content-Security-Policy: The page’s settings blocked a script (script-src-elem) at https://widget.kapa.ai/kapa-widget.bundle.js from being executed because it violates the following directive: “script-src 'self' 'unsafe-inline' 'unsafe-eval' https://analytics.apache.org/ https://www.apachecon.com/”

[thisisnic]

I think this is wrong actually - I may need to open a ticket with infra...

[thisisnic]

Or just update the .htaccess file on the arrow-site repo...

[kou]

@ianmcook may know the Content-Security-Policy settings because Ian worked on it such as apache/arrow-site#603 recently.

[ianmcook]

I think this is wrong actually - I may need to open a ticket with infra...

AIUI, the only way to modify the CSP is to ask privacy@apache.org. See https://infra.apache.org/csp.html for details. I banged my head on the wall for several days trying to get the GitHub star count badge to work by modifying the CSP here using meta tags and then using .htaccess, but the ASF has the Apache web server configured to prevent those approaches from working. Ultimately I decided to just remove the star count from the badge. You can see PRs 595 through 603 in the arrow-site repo where I experimented with this with no success :)

[thisisnic]

Thanks both, I was going round in circles a bit there; I will drop them an email!

[ianmcook]

It sounds like they are setting a very high bar for adding any new sites to the CSP allowlist. May the odds be ever in your favor :)

[thisisnic]

I'm hopeful - it's one of the few things expressly allowed as kapa.ai has signed a DPA with the ASF, so it feels like it's just the technical details to resolve here 🤞