fix(tests): http_input integration tests after CORS wildcard refusal (SECURITY_AUDIT.md M1)

Author: symbibot

crates/runtime/tests/http_input_integration_tests.rs

@@ -34,7 +34,9 @@ fn create_test_config(port: u16) -> HttpInputConfig {
         routing_rules: None,
         response_control: None,
         forward_headers: vec![],
-        cors_origins: vec!["*".to_string()],
+        // Explicit origin (wildcard "*" is now refused at startup — see
+        // SECURITY_AUDIT.md M1). Use the loopback origin the test clients hit.
+        cors_origins: vec![format!("http://127.0.0.1:{}", port)],
         audit_enabled: true,
         webhook_verify: None,
     }
@@ -310,15 +312,19 @@ async fn test_agent_interaction_and_invocation() {
 #[cfg(feature = "http-input")]
 #[tokio::test]
 async fn test_cors_headers_when_enabled() {
-    let (_handle, base_url, _port) = start_test_server().await;
+    let (_handle, base_url, port) = start_test_server().await;
     let client = reqwest::Client::new();
 
-    // Send an OPTIONS request to check CORS headers
+    // Send an OPTIONS request from the configured allowed origin (the loopback
+    // URL the test fixture seeds into cors_origins). Wildcard "*" is no longer
+    // accepted (SECURITY_AUDIT.md M1) so the request Origin must match the
+    // allowlist for the response to carry Access-Control-Allow-Origin.
+    let allowed_origin = format!("http://127.0.0.1:{}", port);
     let response = timeout(
         Duration::from_secs(5),
         client
             .request(reqwest::Method::OPTIONS, format!("{}/webhook", base_url))
-            .header("Origin", "https://example.com")
+            .header("Origin", &allowed_origin)
             .header("Access-Control-Request-Method", "POST")
             .send(),
     )