Fix CSP violations blocking jQuery, fonts, and search on production site

assets/scss/_variables_project.scss

@@ -4,4 +4,7 @@ Add styles or override variables from the theme here.
 
 */
 
-$primary: #56a4ed
+$primary: #56a4ed;
+
+// Disable Google Fonts to comply with apache.org Content Security Policy
+$td-enable-google-fonts: false;

hugo.toml

@@ -103,18 +103,15 @@ github_branch = "production"
 # gcs_engine_id = "7e3f91e3eadecceaa"
 
 # Enable Lunr.js offline search
-offlineSearch = false
+offlineSearch = true
+offlineSearchMaxResults = 25
+offlineSearchSummaryLength = 200
 
 # Enable syntax highlighting and copy buttons on code blocks with Prism
 prism_syntax_highlighting = false
 
 # User interface configuration
 
-[params.search.algolia]
-appId = '399WOPSE6Q'
-apiKey = '437a8e172549357b6ca768248caecff9'
-indexName = 'parquet-apache'
-
 [params.ui]
 #  Set to true to disable breadcrumb navigation.
 breadcrumb_disable = false

layouts/partials/head.html

@@ -0,0 +1,55 @@
+{{/*
+  Project-level override of Docsy's layouts/_partials/head.html
+
+  Why this file exists:
+  Apache's Content Security Policy (CSP) blocks resources from external CDNs.
+  The upstream Docsy theme loads jQuery from code.jquery.com and Lunr from
+  unpkg.com, both of which are blocked on parquet.apache.org. This override
+  loads vendored copies from static/js/ instead. It also removes the Algolia
+  DocSearch CSS block since we use Lunr offline search.
+
+  See: https://github.com/apache/parquet-site/issues/163
+*/ -}}
+{{/* cSpell:ignore docsearch opengraph outputformat */ -}}
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+{{ range .AlternativeOutputFormats -}}
+<link rel="{{ .Rel }}" type="{{ .MediaType.Type }}" href="{{ .Permalink | safeURL }}">
+{{ end -}}
+
+{{ $outputFormat := partial "outputformat.html" . -}}
+{{ if and hugo.IsProduction (ne $outputFormat "print") -}}
+<meta name="robots" content="index, follow">
+{{ else -}}
+<meta name="robots" content="noindex, nofollow">
+{{ end -}}
+
+{{ partialCached "favicons.html" . }}
+<title>
+  {{- if .IsHome -}}
+    {{ .Site.Title -}}
+  {{ else -}}
+    {{ with .Title }}{{ . }} | {{ end -}}
+    {{ .Site.Title -}}
+  {{ end -}}
+</title>
+<meta name="description" content="{{ partial "page-description.html" . }}">
+{{ partial "opengraph.html" . -}}
+{{ partial "schema.html" . -}}
+{{ partial "twitter_cards.html" . -}}
+{{ partialCached "head-css.html" . "head-css-cache-key" -}}
+<script src="{{ "js/jquery-3.7.1.min.js" | relURL }}"></script>
+{{ if .Site.Params.offlineSearch -}}
+<script defer src="{{ "js/lunr-2.3.9.min.js" | relURL }}"></script>
+{{ end -}}
+
+{{ if .Site.Params.prism_syntax_highlighting -}}
+<link rel="stylesheet" href="{{ "css/prism.css" | relURL }}"/>
+{{ end -}}
+
+{{ partial "hooks/head-end.html" . -}}
+
+{{/* To comply with GDPR, cookie consent scripts places in head-end must execute before Google Analytics is enabled */ -}}
+{{ if hugo.IsProduction -}}
+  {{ partial "google_analytics.html" . -}}
+{{ end -}}

layouts/partials/hooks/body-end.html

@@ -1,10 +0,0 @@
-{{ with .Site.Params.algolia_docsearch }}
-<script src="https://cdn.jsdelivr.net/npm/@docsearch/js@3"></script>
-
-<script type="text/javascript">
-  docsearch({
-    container: '#search_box',
-    debug: false // Set debug to true if you want to inspect the modal
-  });
-</script>
-{{ end }}

layouts/partials/hooks/head-end.html

@@ -1,3 +0,0 @@
-{{ with .Site.Params.algolia_docsearch }}
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@docsearch/css@3"/></pre></li>
-{{ end }}

layouts/partials/scripts.html

@@ -0,0 +1,58 @@
+{{/* Project-level override of Docsy's layouts/_partials/scripts.html Why this
+file exists: Removes the Algolia DocSearch JS block (cdn.jsdelivr.net) which is
+blocked by Apache's CSP. Also removes the markmap-autoloader CDN reference since
+markmap is not enabled on this site. See:
+https://github.com/apache/parquet-site/issues/163 */ -}} {{ $needKaTeX := or
+.Params.math .Site.Params.katex.enable .Params.chem .Site.Params.chem
+(.Page.Store.Get "hasKaTeX") (.Page.Store.Get "hasmhchem") -}} {{ $needmhchem :=
+or .Params.chem .Site.Params.katex.mhchem.enable (.Page.Store.Get "hasmhchem")
+-}} {{/* markmap block removed — it loads from cdn.jsdelivr.net which is blocked
+by Apache's CSP, and markmap is not enabled on this site anyway. */ -}} {{ if
+.Site.Params.plantuml.enable -}}
+<script src='{{ "js/deflate.js" | relURL }}'></script>
+{{ end -}} {{ if $needKaTeX -}} {{ partial "scripts/katex.html" (dict "mhchem"
+$needmhchem) -}} {{ end -}} {{ $jsBs := resources.Get
+"vendor/bootstrap/dist/js/bootstrap.bundle.js" -}} {{ $jsBase := resources.Get
+"js/base.js" -}} {{ $jsSearch := resources.Get "js/search.js" |
+resources.ExecuteAsTemplate "js/search.js" .Site.Home -}} {{ $jsMarkmap :=
+resources.Get "js/markmap.js" | resources.ExecuteAsTemplate "js/markmap.js" .
+-}} {{ $jsPlantuml := resources.Get "js/plantuml.js" |
+resources.ExecuteAsTemplate "js/plantuml.js" . -}} {{ $jsDrawio := resources.Get
+"js/drawio.js" | resources.ExecuteAsTemplate "js/drawio.js" . -}} {{ if
+.Site.Params.offlineSearch -}} {{ $jsSearch = resources.Get
+"js/offline-search.js" -}} {{ end -}} {{ $jsArray := slice $jsBs $jsBase
+$jsSearch $jsPlantuml $jsMarkmap $jsDrawio -}} {{ if .Page.Store.Get
+"hasmermaid" -}} {{- partial "scripts/mermaid.html" . -}} {{ end -}} {{ if
+.Site.Params.ui.showLightDarkModeMenu -}} {{ $jsArray = $jsArray | append
+(resources.Get "js/dark-mode.js") -}} {{ end -}} {{ $js := $jsArray |
+resources.Concat "js/main.js" -}} {{ if hugo.IsProduction -}} {{ $js := $js |
+minify | fingerprint -}}
+<script
+    src="{{ $js.RelPermalink }}"
+    integrity="{{ $js.Data.Integrity }}"
+    crossorigin="anonymous"
+></script>
+{{ else -}}
+<script src="{{ $js.RelPermalink }}"></script>
+{{ end -}} {{ if .Site.Params.prism_syntax_highlighting -}}
+<script src='{{ "js/prism.js" | relURL }}'></script>
+{{ else if ( not .Site.Params.disable_click2copy_chroma ) -}} {{ $c2cJS :=
+resources.Get "js/click-to-copy.js" -}} {{ if hugo.IsProduction -}} {{ $c2cJS =
+$c2cJS | minify | fingerprint -}} {{ end -}}
+<script
+    defer
+    src="{{ $c2cJS.RelPermalink }}"
+    {{
+    with
+    $c2cJS.Data.Integrity
+    -}}
+    integrity="{{ . }}"
+    {{
+    end
+    -}}
+    crossorigin="anonymous"
+></script>
+{{ end -}}
+
+<script src='{{ "js/tabpane-persist.js" | relURL }}'></script>
+{{ partial "hooks/body-end.html" . -}}