From f337d630e37b5e80b4b7dc68898c73e99d694260 Mon Sep 17 00:00:00 2001 From: Tanish Manku Date: Fri, 3 Apr 2026 14:46:32 -0700 Subject: [PATCH] Fix: Allow asset.localhost in CSP for Windows drag-drop (#1298) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Windows production builds, convertFileSrc() generates https://asset.localhost/... URLs. The connect-src CSP only had "asset:" (covering asset:// on macOS/Linux) but not https://asset.localhost, causing the fetch() in GlobalFileDropHandler to be silently blocked — overlay appeared but no modal opened on drop. --- crates/desktop/artcraft/tauri-mac.conf.json | 1 + crates/desktop/artcraft/tauri.conf.json | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/crates/desktop/artcraft/tauri-mac.conf.json b/crates/desktop/artcraft/tauri-mac.conf.json index 5b52751c0d..ee2a62e9f2 100644 --- a/crates/desktop/artcraft/tauri-mac.conf.json +++ b/crates/desktop/artcraft/tauri-mac.conf.json @@ -37,6 +37,7 @@ "'unsafe-eval'", "'unsafe-inline'", "asset:", + "https://asset.localhost", "blob:", "data:", "http://ipc.localhost", diff --git a/crates/desktop/artcraft/tauri.conf.json b/crates/desktop/artcraft/tauri.conf.json index 5b52751c0d..d80c0b2d1b 100644 --- a/crates/desktop/artcraft/tauri.conf.json +++ b/crates/desktop/artcraft/tauri.conf.json @@ -7,12 +7,11 @@ "frontendDist": "../../../frontend/apps/artcraft/dist", "devUrl": "http://localhost:5173", "beforeDevCommand": "nx run artcraft:dev", - "beforeBuildCommand": "nx run artcraft:build" + "beforeBuildCommand": "npx run artcraft:build" }, "app": { "withGlobalTauri": true, - "windows": [ - ], + "windows": [], "security": { "assetProtocol": { "enable": true, @@ -37,6 +36,7 @@ "'unsafe-eval'", "'unsafe-inline'", "asset:", + "https://asset.localhost", "blob:", "data:", "http://ipc.localhost",