fix: allow WRNexus reactive inline styles

2026-08-03 00:31:34 +05:30
parent d80cfe74f0
commit 868c768805
2 changed files with 7 additions and 1 deletions
@@ -41,7 +41,10 @@ const config: AppConfig = {
        "default-src": ["'self'"],
        "img-src": ["'self'", "data:", "https:"],
        "font-src": ["'self'", "data:", "https://fonts.gstatic.com"],
-        "style-src": ["'self'", "https://fonts.googleapis.com"],
+        // WRNexus 0.8 components and the reactive runtime use style attributes
+        // for initial visibility and state changes. CSP nonces do not authorize
+        // style attributes, so unsafe-inline remains required for this release.
+        "style-src": ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
        // The service worker fetches and caches the configured Google Font.
        // Service-worker fetch() is governed by connect-src as well as font-src.
        "connect-src": ["'self'", "https://fonts.gstatic.com"],