test: cover direct send origin guard

Author: ScriptedAlchemy

README.md

@@ -24,7 +24,7 @@ Every installed plugin gets the same treatment, not only pstack.
 
 ![Cursor Team Kit](screens/07-cursor-team-kit.png)
 
-Marketplace listings show catalog copy and offer an install path.
+Marketplace listings show catalog copy and can be sent to a bot.
 
 ![Marketplace](screens/08-marketplace.png)
 

test/server.test.js

@@ -108,6 +108,11 @@ test("/api/send messages gbot directly and the Applier API is gone", async () =>
     headers: { "content-type": "text/plain", origin: "https://attacker.example", "sec-fetch-site": "cross-site" },
     body: "{}",
   }), 403);
+  assert.equal(await status("/api/send", {
+    method: "POST",
+    headers: { "content-type": "application/json", origin: "https://attacker.example" },
+    body: "{}",
+  }), 403);
   assert.equal(await status("/api/send", {
     method: "POST",
     headers: { "content-type": "application/json" },