From 98f7f3c9e36d1ba762d0e9e11aedf4f943daad4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Balv=C3=ADn?= <opensource@petrbalvin.org>
Date: Mon, 27 Jul 2026 09:03:44 +0200
Subject: [PATCH] fix: add missing CSP style-src nonce and include static SVGs
 in wheel

---
 CHANGELOG.md       | 7 +++++++
 pyproject.toml     | 5 ++++-
 src/volumen/app.py | 8 +++++++-
 uv.lock            | 2 +-
 4 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 16aab50..1897914 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [development]
 
+## [0.4.1] — 2026-07-27
+
+### Fixed
+
+- **CSP nonce chybí pro `style-src` v admin routách** — přidán `style-src 'self' 'nonce-{nonce}'` do CSP hlavičky pro `/admin` routy. Bez nonce prohlížeč blokoval všechny inline `<style>` tagy v admin šablonách.
+- **`web/static/` SVG soubory chybí v distribučním kole** — přidána sekce `[tool.setuptools.package-data]` do `pyproject.toml`, aby `volumen-icon.svg` a `volumen-logo.svg` byly součástí instalovaného wheelu. Admin panel dříve vracel 500 na `/admin/icon.svg` a `/admin/logo.svg`.
+
 ## [0.4.0] — 2026-07-26
 
 ### Added
diff --git a/pyproject.toml b/pyproject.toml
index 21dc7b0..ba6a5b0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "volumen"
-version = "0.4.0"
+version = "0.4.1"
 description = "A small, file-based Markdown blog engine with a built-in admin."
 readme = "README.md"
 keywords = ["blog", "markdown", "fastapi", "cms", "static-blog", "toml", "rss", "json-feed", "engine"]
@@ -61,6 +61,9 @@ dev = [
 [tool.setuptools.packages.find]
 where = ["src"]
 
+[tool.setuptools.package-data]
+volumen = ["web/static/*"]
+
 
 [tool.ruff]
 line-length = 100
diff --git a/src/volumen/app.py b/src/volumen/app.py
index 97220e2..d60ff0a 100644
--- a/src/volumen/app.py
+++ b/src/volumen/app.py
@@ -165,7 +165,13 @@ class GlobalSecurityHeadersMiddleware(BaseHTTPMiddleware):
         if request.url.path.startswith("/admin"):
             nonce = secrets.token_urlsafe(18)
             request.state.csp_nonce = nonce
-            csp = "; ".join(_BASE_CSP_DIRECTIVES + (f"script-src 'self' 'nonce-{nonce}'",))
+            csp = "; ".join(
+                _BASE_CSP_DIRECTIVES
+                + (
+                    f"script-src 'self' 'nonce-{nonce}'",
+                    f"style-src 'self' 'nonce-{nonce}'",
+                )
+            )
             response.headers["Content-Security-Policy"] = csp
 
         if self._cookie_secure:
diff --git a/uv.lock b/uv.lock
index 9f8391b..f47d936 100644
--- a/uv.lock
+++ b/uv.lock
@@ -897,7 +897,7 @@ wheels = [
 
 [[package]]
 name = "volumen"
-version = "0.4.0"
+version = "0.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "fastapi", extra = ["standard"] },