fix: drop a csp meta the pipeline would have moved to a header

src/render/compose.js

@@ -33,6 +33,19 @@ function injectAEMHtmlHeadEntries(daCtx, headNode, headHtmlStr) {
   const { org, site, orgSiteInPath } = daCtx;
   const aemHeadHtmlTree = fromHtml(headHtmlStr, { fragment: true });
 
+  // the pipeline moves this meta to a response header and rewrites the placeholder
+  // nonce; drop both.
+  aemHeadHtmlTree.children = aemHeadHtmlTree.children.filter(
+    (node) => !(node.type === 'element'
+      && node.tagName === 'meta'
+      && node.properties?.['move-to-http-header'] !== undefined
+      && typeof node.properties?.content === 'string'
+      && node.properties.content.includes("'nonce-aem'")),
+  );
+  selectAll('[nonce=aem]', aemHeadHtmlTree).forEach((n) => {
+    delete n.properties.nonce;
+  });
+
   // TODO: reuse fixUrlsWhenLocalDev from aemCtx.js instead of duplicating.
   if (orgSiteInPath) {
     const headScriptsAndLinks = selectAll(

test/render/compose.test.js

@@ -66,4 +66,28 @@ describe('render compose', () => {
     assert.ok(!html.includes('urn:adobe:aue'));
     assert.ok(!html.includes('universal-editor-service'));
   });
+  it('drops a CSP meta the pipeline would have moved to a header', async () => {
+    const cspHead = '<meta http-equiv="Content-Security-Policy"'
+      + ' content="script-src \'nonce-aem\' \'strict-dynamic\';"'
+      + ' move-to-http-header="true" />'
+      + '<script nonce="aem" src="/scripts/aem.js" type="module"></script>';
+
+    const tree = await composeHtml(daCtx, aemCtx, '<div><p>content</p></div>', cspHead);
+    const html = serializeHtml(tree);
+
+    assert.ok(!html.includes('Content-Security-Policy'));
+    assert.ok(!html.includes('move-to-http-header'));
+    assert.ok(!html.includes('nonce="aem"'));
+    // the rest of head.html is untouched
+    assert.ok(html.includes('src="/scripts/aem.js"'));
+  });
+
+  it('keeps a CSP meta the pipeline would have left in place', async () => {
+    const cspHead = '<meta http-equiv="Content-Security-Policy" content="object-src \'none\';" />';
+
+    const tree = await composeHtml(daCtx, aemCtx, '<div><p>content</p></div>', cspHead);
+    const html = serializeHtml(tree);
+
+    assert.ok(html.includes('Content-Security-Policy'));
+  });
 });