fix: add missing Origin header in POST tests blocked by CSRF middleware

[Copilot]

Four POST tests in emailAuth.test.ts were returning 403 instead of expected status codes because the globally-applied csrf() middleware rejects requests without a valid Origin header.

Changes

• hono/routes/emailAuth.test.ts: Added headers: { Origin: "http://localhost" } to the four POST test cases that omitted it:
  • POST /auth/login — expected 401 (wrong password) and 302 (successful login)
  • POST /auth/register — expected 409 (email exists) and 302 (successful registration)

const response = await app.request("/auth/login", {
  method: "POST",
  body: formData,
+ headers: { Origin: "http://localhost" },
});

The other tests in the same file that correctly tested CSRF rejection already included Origin: "http://evil.example.com", and passing tests already used Origin: "http://localhost" — the failing ones simply missed it.

Original prompt

Fix the failing GitHub Actions workflow test
Analyze the workflow logs, identify the root cause of the failure, and implement a fix.
Job ID: 68530461488
Job URL: https://github.com/mahata/mlack/actions/runs/23541624034/job/68530461488

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.