From 0d73cb5dfb3ab37e993b51d49d8b5d14cd479ef5 Mon Sep 17 00:00:00 2001
From: Shuki Vaknin <shukivaknin@gmail.com>
Date: Tue, 30 Jun 2026 18:41:34 +0300
Subject: [PATCH] fix(csp): allow external/data fonts so email webfonts render

The page CSP set font-src 'self', which blocked fonts referenced by
rendered email CSS (brand webfonts loaded over https). Allow https:/data:
for font-src. Email bodies render inside the sandboxed iframe, which keeps
its own stricter blocking-mode font-src for privacy.
---
 proxy.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/proxy.ts b/proxy.ts
index c108e2f9..f0905645 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -112,7 +112,7 @@ export async function proxy(request: NextRequest) {
     `script-src ${scriptSrc}`,
     `style-src 'self' 'unsafe-inline'`,
     `img-src 'self' data: blob: https:`,
-    `font-src 'self'`,
+    `font-src 'self' https: data:`,
     `connect-src ${connectSrc}`,
     frameSrc,
     `object-src 'self' blob:`,