feat(fleet): show instance resource metrics

apps/api/src/infrastructure/transport/safe-upstream-gateway.ts

@@ -7,7 +7,7 @@ import { UpstreamError } from './upstream-error.js';
 import { OperationNotDispatchedError } from '../../application/operations/secure-operation-execution.js';
 
 export interface SafeUpstreamTransport {
-  get(url: string): Promise<TransportResponse>;
+  get(url: string, headers?: Readonly<Record<string, string>>): Promise<TransportResponse>;
   post(
     url: string,
     headers: Readonly<Record<string, string>>,
@@ -46,6 +46,21 @@ export class SafeUpstreamGateway {
   }
   async request(request: UpstreamRequest): Promise<UpstreamResponse> {
     const url = new URL(request.url);
+    if (request.method === 'GET') {
+      if (
+        request.secret !== undefined ||
+        request.body !== undefined ||
+        (url.pathname !== '/api/stats' && url.pathname !== '/api/sim') ||
+        url.search ||
+        url.hash ||
+        url.username ||
+        url.password ||
+        typeof request.headers.cookie !== 'string' ||
+        !/^simadmin_session=[^;\s,]+$/.test(request.headers.cookie)
+      )
+        throw new UpstreamError('UPSTREAM_REQUEST_INVALID');
+      return this.options.transport.get(request.url, request.headers);
+    }
     if (url.protocol !== 'https:') throw new UpstreamError('UPSTREAM_INSECURE_AUTH');
     if (request.method !== 'POST') throw new UpstreamError('UPSTREAM_REQUEST_INVALID');
     if (request.url.endsWith('/api/auth/login')) {