Allow assets to be consumed in publication resources

CHANGELOG.md

@@ -4,7 +4,13 @@ All notable changes to this project will be documented in this file. Take a look
 
 **Warning:** Features marked as *experimental* may change or be removed in a future release without notice. Use with caution.
 
-<!-- ## [Unreleased] -->
+## [Unreleased]
+
+### Fixed
+
+#### Navigator
+
+* Fixed usage of assets, including fonts in publication resources.
 
 ## [3.2.0] - 2026-05-13
 

readium/navigator/src/main/java/org/readium/r2/navigator/epub/WebViewServer.kt

@@ -113,6 +113,7 @@ internal class WebViewServer(
                 if (isServedAsset(path.removePrefix("/"))) {
                     // Request is for a known asset.
                     assetsLoader.shouldInterceptRequest(request.url)
+                        ?.apply { allowCors() }
                 } else {
                     val error = ReadError.Decoding(
                         "Attempted to load an unknown asset from $requestUrl"
@@ -253,6 +254,15 @@ internal class WebViewServer(
             }
         }
 
+    /**
+     * Allow the response to be consumed by publication documents served
+     * from any origin, including the package domain.
+     */
+    private fun WebResourceResponse.allowCors() {
+        responseHeaders = responseHeaders ?: mutableMapOf()
+        responseHeaders["Access-Control-Allow-Origin"] = "*"
+    }
+
     private fun serveErrorResponse(): WebResourceResponse {
         return serveResource(errorResource(), null, MediaType.XHTML)
     }

readium/navigators/web/internals/src/main/kotlin/org/readium/navigator/web/internals/server/WebViewServer.kt

@@ -107,6 +107,7 @@ public class WebViewServer(
                 if (isServedAsset(path.removePrefix("/"))) {
                     // Request is for a known asset.
                     assetsLoader.shouldInterceptRequest(request.url)
+                        ?.apply { allowCors() }
                 } else {
                     val error = ReadError.Decoding(
                         "Attempted to load an unknown asset from $requestUrl"
@@ -219,6 +220,15 @@ public class WebViewServer(
         }
     }
 
+    /**
+     * Allow the response to be consumed by publication documents served
+     * from any origin, including the package domain.
+     */
+    private fun WebResourceResponse.allowCors() {
+        responseHeaders = responseHeaders ?: mutableMapOf()
+        responseHeaders["Access-Control-Allow-Origin"] = "*"
+    }
+
     private fun errorResource(): Resource =
         StringResource {
             withContext(Dispatchers.IO) {