From 3e03213ed05cd6d642fafb9cd767a2e16dcdd762 Mon Sep 17 00:00:00 2001
From: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Date: Mon, 29 Jun 2026 18:03:22 -0700
Subject: [PATCH] fix post-merge ci regressions (#5467)

---
 Dockerfile                                              | 2 +-
 src/app/api/providers/health-autopilot/actions/route.ts | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 28568268db..01f54c1bd1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -39,7 +39,7 @@ COPY package*.json ./
 # Workspace package manifests MUST be present before `npm ci` so npm materializes
 # the workspace and installs its *workspace-only* deps (e.g. safe-regex,
 # @toon-format/toon — declared in open-sse/package.json, not hoisted to root).
-# Without this, `npm ci` skips them and `npm run build` fails with "Module not
+# Without this, `npm ci` skips them and the application build fails with "Module not
 # found" (root cause of the v3.8.39 Docker build break). workspaces = ["open-sse"].
 COPY open-sse/package.json ./open-sse/package.json
 COPY scripts/build/postinstall.mjs ./scripts/build/postinstall.mjs
diff --git a/src/app/api/providers/health-autopilot/actions/route.ts b/src/app/api/providers/health-autopilot/actions/route.ts
index 4bff91fcd8..1cc58e5bae 100644
--- a/src/app/api/providers/health-autopilot/actions/route.ts
+++ b/src/app/api/providers/health-autopilot/actions/route.ts
@@ -3,6 +3,7 @@ import { z } from "zod";
 
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { executeProviderHealthAutopilotAction } from "@/lib/monitoring/providerHealthAutopilot";
+import { validateBrowserMutationOrigin } from "@/server/origin/publicOrigin";
 import { validateBody } from "@/shared/validation/helpers";
 
 const actionSchema = z.object({
@@ -28,6 +29,11 @@ export async function POST(request: Request) {
   const authError = await requireManagementAuth(request);
   if (authError) return authError;
 
+  const originVerdict = validateBrowserMutationOrigin(request);
+  if (!originVerdict.ok) {
+    return NextResponse.json({ error: { message: "Invalid request origin" } }, { status: 403 });
+  }
+
   try {
     let rawBody: unknown;
     try {