Font related improvements

apps/server-rust/Cargo.lock

@@ -956,6 +956,7 @@ checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 [[package]]
 name = "libilibili"
 version = "0.1.0"
+source = "git+http://gitea.home.arpa/felis/libilibili.git#3cb2a902d4d9387c5581a1827cc19248b6000ae2"
 dependencies = [
  "base64",
  "brotli",

apps/server-rust/Cargo.toml

@@ -7,20 +7,30 @@ edition = "2024"
 axum = { version = "0.8", features = ["ws", "json"] }
 async-trait = "0.1"
 base64 = "0.22"
-chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
+chrono = { version = "0.4", default-features = false, features = [
+    "clock",
+    "serde",
+] }
 chacha20poly1305 = "0.10"
 deadpool-postgres = "0.14"
 # Kept as a sibling checkout during development. Docker Compose supplies the
 # same directory as a named BuildKit context at `/libilibili`.
-libilibili = { path = "../../../libilibili" }
+libilibili = { git = "http://gitea.home.arpa/felis/libilibili.git" }
 rand = "0.9"
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+reqwest = { version = "0.12", default-features = false, features = [
+    "json",
+    "rustls-tls",
+] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
 subtle = "2"
 tokio = { version = "1", features = ["full"] }
-tokio-postgres = { version = "0.7", features = ["with-serde_json-1", "with-uuid-1", "with-chrono-0_4"] }
+tokio-postgres = { version = "0.7", features = [
+    "with-serde_json-1",
+    "with-uuid-1",
+    "with-chrono-0_4",
+] }
 tokio-util = "0.7"
 toml = "0.8"
 totp-rs = { version = "5.7", features = ["gen_secret", "qr", "zeroize"] }

apps/server-rust/src/typography.rs

@@ -1,8 +1,8 @@
 //! Shared, validated typography settings for all built-in OBS components.
 //!
-//! Font IDs map to fixed frontend font stacks rather than accepting arbitrary
-//! CSS. This keeps settings portable between OBS hosts and prevents untrusted
-//! component settings from becoming a CSS injection boundary.
+//! Font IDs map to fixed, same-origin WOFF2 assets in the frontend rather than
+//! accepting arbitrary CSS. This keeps settings portable between OBS hosts and
+//! prevents untrusted component settings from becoming a CSS injection boundary.
 
 use serde::{Deserialize, Serialize};
 
@@ -13,6 +13,7 @@ pub enum FontFamilyId {
     #[default]
     FangSong,
     Kai,
+    LiyuShoushu,
 }
 
 pub const fn default_font_brightness() -> u16 {
@@ -35,5 +36,9 @@ mod tests {
         );
         assert_eq!(sanitize_font_brightness(1), 70);
         assert_eq!(sanitize_font_brightness(u16::MAX), 180);
+        assert_eq!(
+            serde_json::to_string(&FontFamilyId::LiyuShoushu).unwrap(),
+            "\"liyu-shoushu\""
+        );
     }
 }