From 510df11e8347657c3db0080140a246856f581f32 Mon Sep 17 00:00:00 2001
From: Ajay Ghanwat <ghanwat.ajay@workroot.in>
Date: Mon, 3 Aug 2026 00:23:56 +0530
Subject: [PATCH] fix: allow production font fetches through CSP

---
 wrnexus.config.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/wrnexus.config.ts b/wrnexus.config.ts
index 28795aa2..67948027 100644
--- a/wrnexus.config.ts
+++ b/wrnexus.config.ts
@@ -40,9 +40,11 @@ const config: AppConfig = {
       directives: {
         "default-src": ["'self'"],
         "img-src": ["'self'", "data:", "https:"],
-        "font-src": ["'self'", "https://fonts.gstatic.com"],
+        "font-src": ["'self'", "data:", "https://fonts.gstatic.com"],
         "style-src": ["'self'", "https://fonts.googleapis.com"],
-        "connect-src": ["'self'"],
+        // The service worker fetches and caches the configured Google Font.
+        // Service-worker fetch() is governed by connect-src as well as font-src.
+        "connect-src": ["'self'", "https://fonts.gstatic.com"],
       },
     },
   },