fix(transport): allow passwordless resource reads

apps/api/src/infrastructure/transport/safe-upstream-gateway.test.ts

@@ -81,6 +81,23 @@ describe('SafeUpstreamGateway', () => {
     ).rejects.toThrow('UPSTREAM_INSECURE_AUTH');
   });
 
+  it('allows audited resource GETs without a cookie for passwordless instances', async () => {
+    const get = vi.fn(async () => ({ status: 200, headers: {}, body: '{}' }));
+    const gateway = new SafeUpstreamGateway({
+      transport: { get, post: async () => ({ status: 200, headers: {}, body: '' }) },
+    });
+    await expect(
+      gateway.request({
+        url: 'http://192.168.1.20:8080/api/stats',
+        method: 'GET',
+        headers: { accept: 'application/json' },
+      }),
+    ).resolves.toMatchObject({ status: 200 });
+    expect(get).toHaveBeenCalledWith('http://192.168.1.20:8080/api/stats', {
+      accept: 'application/json',
+    });
+  });
+
   it('does not allow a supplied redacted body marker to become a network request body', async () => {
     const gateway = new SafeUpstreamGateway({
       transport: {

apps/api/src/infrastructure/transport/safe-upstream-gateway.ts

@@ -55,8 +55,9 @@ export class SafeUpstreamGateway {
         url.hash ||
         url.username ||
         url.password ||
-        typeof request.headers.cookie !== 'string' ||
+        (request.headers.cookie !== undefined &&
-        !/^simadmin_session=[^;\s,]+$/.test(request.headers.cookie)
+          (typeof request.headers.cookie !== 'string' ||
+            !/^simadmin_session=[^;\s,]+$/.test(request.headers.cookie)))
       )
         throw new UpstreamError('UPSTREAM_REQUEST_INVALID');
       return this.options.transport.get(request.url, request.headers);