From 868c768805fd5f95754af844fa67c938e2e0b65b Mon Sep 17 00:00:00 2001 From: Ajay Ghanwat Date: Mon, 3 Aug 2026 00:31:34 +0530 Subject: [PATCH] fix: allow WRNexus reactive inline styles --- app/docs.test.ts | 3 +++ wrnexus.config.ts | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/app/docs.test.ts b/app/docs.test.ts index 38635c27..4bc28d49 100644 --- a/app/docs.test.ts +++ b/app/docs.test.ts @@ -132,6 +132,9 @@ test("site includes core guides and production configuration", () => { expect(config).toContain("contentSecurityPolicy:"); expect(config).not.toMatch(/^\s*csp:\s*\{/m); expect(config).toContain('"connect-src": ["\'self\'", "https://fonts.gstatic.com"]'); + expect(config).toContain( + '"style-src": ["\'self\'", "\'unsafe-inline\'", "https://fonts.googleapis.com"]', + ); }); test("language reference covers directives, events, loops, and conditionals", () => { diff --git a/wrnexus.config.ts b/wrnexus.config.ts index 6717d3b7..8fa28d3e 100644 --- a/wrnexus.config.ts +++ b/wrnexus.config.ts @@ -41,7 +41,10 @@ const config: AppConfig = { "default-src": ["'self'"], "img-src": ["'self'", "data:", "https:"], "font-src": ["'self'", "data:", "https://fonts.gstatic.com"], - "style-src": ["'self'", "https://fonts.googleapis.com"], + // WRNexus 0.8 components and the reactive runtime use style attributes + // for initial visibility and state changes. CSP nonces do not authorize + // style attributes, so unsafe-inline remains required for this release. + "style-src": ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"], // The service worker fetches and caches the configured Google Font. // Service-worker fetch() is governed by connect-src as well as font-src. "connect-src": ["'self'", "https://fonts.gstatic.com"],