From 3ebfa642fafcbe2ba85ccbee6a0e4341e8c9e012 Mon Sep 17 00:00:00 2001
From: lucaronin <luca.rossi.917@gmail.com>
Date: Sat, 25 Apr 2026 16:06:17 +0200
Subject: [PATCH] fix: allow runtime stylesheet injection

---
 src-tauri/tauri.conf.json       |  2 +-
 src/hooks/useCodeMirror.test.ts | 10 +---------
 src/hooks/useCodeMirror.ts      |  3 ---
 src/utils/tauriCsp.test.ts      | 11 +++++++++++
 4 files changed, 13 insertions(+), 13 deletions(-)
 create mode 100644 src/utils/tauriCsp.test.ts

diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index cbeaf11b..de1d0e21 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -32,7 +32,7 @@
         "script-src": "'self' https://us.i.posthog.com https://eu.i.posthog.com https://us-assets.i.posthog.com https://eu-assets.i.posthog.com",
         "connect-src": "'self' ipc: http://ipc.localhost ws://localhost:9710 ws://127.0.0.1:9710 ws://localhost:9711 ws://127.0.0.1:9711 https:",
         "img-src": "'self' asset: http://asset.localhost data: blob: https:",
-        "style-src": "'self' 'unsafe-inline' 'nonce-tolaria-codemirror-style' https://fonts.googleapis.com",
+        "style-src": "'self' 'unsafe-inline' https://fonts.googleapis.com",
         "font-src": "'self' data: https://fonts.gstatic.com",
         "media-src": "'self' data: blob: https:",
         "object-src": "'none'"
diff --git a/src/hooks/useCodeMirror.test.ts b/src/hooks/useCodeMirror.test.ts
index 6a08dad3..7e9f8c51 100644
--- a/src/hooks/useCodeMirror.test.ts
+++ b/src/hooks/useCodeMirror.test.ts
@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { renderHook, act } from '@testing-library/react'
-import { CODEMIRROR_CSP_NONCE, useCodeMirror, type CodeMirrorCallbacks } from './useCodeMirror'
+import { useCodeMirror, type CodeMirrorCallbacks } from './useCodeMirror'
 
 const noop = () => {}
 const noopCallbacks: CodeMirrorCallbacks = {
@@ -31,14 +31,6 @@ describe('useCodeMirror', () => {
     expect(container.querySelector('.cm-editor')).toBeInTheDocument()
   })
 
-  it('mounts CodeMirror generated styles with the configured CSP nonce', () => {
-    const ref = { current: container }
-    renderHook(() => useCodeMirror(ref, 'hello', noopCallbacks))
-
-    const style = document.head.querySelector(`style[nonce="${CODEMIRROR_CSP_NONCE}"]`)
-    expect(style?.textContent).toContain('.cm-scroller')
-  })
-
   it('calls requestMeasure when laputa-zoom-change event fires', () => {
     const ref = { current: container }
     const { result } = renderHook(() =>
diff --git a/src/hooks/useCodeMirror.ts b/src/hooks/useCodeMirror.ts
index 2296036d..0495d8bd 100644
--- a/src/hooks/useCodeMirror.ts
+++ b/src/hooks/useCodeMirror.ts
@@ -16,8 +16,6 @@ const RAW_EDITOR_COLORS = {
   gutterBorder: 'var(--border-subtle)',
   gutterText: 'var(--text-muted)',
 }
-export const CODEMIRROR_CSP_NONCE = 'tolaria-codemirror-style'
-
 export interface CodeMirrorCallbacks {
   onDocChange: (doc: string) => void
   onCursorActivity: (view: EditorView) => void
@@ -145,7 +143,6 @@ export function useCodeMirror(
         buildArrowLigaturesExtension(),
         keymap.of([...defaultKeymap, ...historyKeymap]),
         buildSaveKeymap(callbacksRef),
-        EditorView.cspNonce.of(CODEMIRROR_CSP_NONCE),
         buildBaseTheme(),
         markdownLanguage(),
         frontmatterHighlightTheme(),
diff --git a/src/utils/tauriCsp.test.ts b/src/utils/tauriCsp.test.ts
new file mode 100644
index 00000000..9b440496
--- /dev/null
+++ b/src/utils/tauriCsp.test.ts
@@ -0,0 +1,11 @@
+import { readFileSync } from 'node:fs'
+
+describe('Tauri Content Security Policy', () => {
+  it('keeps broad inline styles available when runtime libraries inject style tags', () => {
+    const config = JSON.parse(readFileSync(`${process.cwd()}/src-tauri/tauri.conf.json`, 'utf8'))
+    const styleSrc = config.app.security.csp['style-src'] as string
+
+    expect(styleSrc).toContain("'unsafe-inline'")
+    expect(styleSrc).not.toMatch(/'nonce-|sha(256|384|512)-/)
+  })
+})