From 313f2ba8b0c02af3813c7b9eb9a4b72d98cb502b Mon Sep 17 00:00:00 2001 From: Stefanie Jane Date: Tue, 15 Sep 2026 16:01:21 -0700 Subject: [PATCH 1/2] fix(ui): load Satoshi from a CDN that actually serves it index.html asked Bunny Fonts for Satoshi alongside JetBrains Mono and Sora. Bunny does not carry Satoshi, so the returned stylesheet had no faces for it and every --font-sans and --font-display stack fell through to Inter or the system sans. The design system names Satoshi as the interface typeface; the shipped app has never rendered in it. Satoshi now loads from Fontshare at the cuts it ships (400/500/700/900; there is no 600, so those requests resolve to 700). The other two families stay on Bunny. Both Tauri CSPs allow api.fontshare.com for the stylesheet and cdn.fontshare.com for the files, the packaging test asserts the new allowlist, and the docs site template makes the same swap so it matches the app. The design system records the two sources. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_017QqD4e2C7kLCBtZBEfJyTx --- crates/hypercolor-app/tauri.conf.json | 2 +- crates/hypercolor-app/tauri.macos.conf.json | 2 +- crates/hypercolor-app/tests/packaging_tests.rs | 14 ++++++++++++-- crates/hypercolor-ui/index.html | 4 +++- docs/DESIGN-SYSTEM.md | 15 +++++++++------ docs/content/theme/_index.md | 12 +++++++----- docs/templates/base.html | 6 ++++-- 7 files changed, 37 insertions(+), 18 deletions(-) diff --git a/crates/hypercolor-app/tauri.conf.json b/crates/hypercolor-app/tauri.conf.json index 5236f7fd9..21ea5a273 100644 --- a/crates/hypercolor-app/tauri.conf.json +++ b/crates/hypercolor-app/tauri.conf.json @@ -9,7 +9,7 @@ "windows": [], "withGlobalTauri": true, "security": { - "csp": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; connect-src 'self' ipc: http://ipc.localhost http: https: ws: wss:; img-src 'self' data: blob: http: https:; media-src 'self' data: blob: http: https:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' https://fonts.bunny.net; font-src 'self' data: https://fonts.bunny.net; object-src 'none'; base-uri 'none'; frame-src 'none'; frame-ancestors 'none'; form-action 'none'" + "csp": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; connect-src 'self' ipc: http://ipc.localhost http: https: ws: wss:; img-src 'self' data: blob: http: https:; media-src 'self' data: blob: http: https:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' https://fonts.bunny.net https://api.fontshare.com; font-src 'self' data: https://fonts.bunny.net https://cdn.fontshare.com; object-src 'none'; base-uri 'none'; frame-src 'none'; frame-ancestors 'none'; form-action 'none'" } }, "bundle": { diff --git a/crates/hypercolor-app/tauri.macos.conf.json b/crates/hypercolor-app/tauri.macos.conf.json index a4fb6dc02..bf35becd8 100644 --- a/crates/hypercolor-app/tauri.macos.conf.json +++ b/crates/hypercolor-app/tauri.macos.conf.json @@ -1,7 +1,7 @@ { "app": { "security": { - "csp": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; connect-src 'self' ipc: http://ipc.localhost http://127.0.0.1:* http://localhost:* http://[::1]:* https://127.0.0.1:* https://localhost:* https://[::1]:* ws://127.0.0.1:* ws://localhost:* ws://[::1]:* wss://127.0.0.1:* wss://localhost:* wss://[::1]:*; img-src 'self' data: blob: http://127.0.0.1:* http://localhost:* http://[::1]:* https://127.0.0.1:* https://localhost:* https://[::1]:*; media-src 'self' data: blob: http://127.0.0.1:* http://localhost:* http://[::1]:* https://127.0.0.1:* https://localhost:* https://[::1]:*; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' https://fonts.bunny.net; font-src 'self' data: https://fonts.bunny.net; object-src 'none'; base-uri 'none'; frame-src 'none'; frame-ancestors 'none'; form-action 'none'" + "csp": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; connect-src 'self' ipc: http://ipc.localhost http://127.0.0.1:* http://localhost:* http://[::1]:* https://127.0.0.1:* https://localhost:* https://[::1]:* ws://127.0.0.1:* ws://localhost:* ws://[::1]:* wss://127.0.0.1:* wss://localhost:* wss://[::1]:*; img-src 'self' data: blob: http://127.0.0.1:* http://localhost:* http://[::1]:* https://127.0.0.1:* https://localhost:* https://[::1]:*; media-src 'self' data: blob: http://127.0.0.1:* http://localhost:* http://[::1]:* https://127.0.0.1:* https://localhost:* https://[::1]:*; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' https://fonts.bunny.net https://api.fontshare.com; font-src 'self' data: https://fonts.bunny.net https://cdn.fontshare.com; object-src 'none'; base-uri 'none'; frame-src 'none'; frame-ancestors 'none'; form-action 'none'" } } } diff --git a/crates/hypercolor-app/tests/packaging_tests.rs b/crates/hypercolor-app/tests/packaging_tests.rs index b138f56cf..0f6391696 100644 --- a/crates/hypercolor-app/tests/packaging_tests.rs +++ b/crates/hypercolor-app/tests/packaging_tests.rs @@ -236,11 +236,21 @@ fn bundled_origin_csp_is_exact_and_macos_network_access_is_loopback_only() { assert_eq!(directives["worker-src"], csp_sources(&["'self'", "blob:"])); assert_eq!( directives["style-src"], - csp_sources(&["'self'", "'unsafe-inline'", "https://fonts.bunny.net"]) + csp_sources(&[ + "'self'", + "'unsafe-inline'", + "https://fonts.bunny.net", + "https://api.fontshare.com" + ]) ); assert_eq!( directives["font-src"], - csp_sources(&["'self'", "data:", "https://fonts.bunny.net"]) + csp_sources(&[ + "'self'", + "data:", + "https://fonts.bunny.net", + "https://cdn.fontshare.com" + ]) ); for denied in [ "object-src", diff --git a/crates/hypercolor-ui/index.html b/crates/hypercolor-ui/index.html index 04692b06d..d94dffd99 100644 --- a/crates/hypercolor-ui/index.html +++ b/crates/hypercolor-ui/index.html @@ -30,7 +30,9 @@ - + + +