fix: proxy web caserun write routes (#2119)

internal/dev-entrypoint/cloud-web-routes.mjs

@@ -51,6 +51,7 @@ export function isCloudApiProxyRoute(method, pathname) {
   }
   if (normalizedMethod === "POST") {
     return POST_PROXY_ROUTES.has(normalizedPath) ||
+      isCaseRunWriteProxyRoute(normalizedMethod, normalizedPath) ||
       isAdminAccessWriteProxyRoute(normalizedMethod, normalizedPath) ||
       isProviderProfileManagementProxyRoute(normalizedMethod, normalizedPath) ||
       isApiKeyWriteProxyRoute(normalizedMethod, normalizedPath) ||
@@ -72,6 +73,13 @@ export function isCloudApiProxyRoute(method, pathname) {
   return false;
 }
 
+function isCaseRunWriteProxyRoute(method, pathname) {
+  if (method !== "POST") return false;
+  if (pathname === "/v1/caserun/runs") return true;
+  const parts = pathname.split("/").filter(Boolean);
+  return parts.length === 5 && parts[0] === "v1" && parts[1] === "caserun" && parts[2] === "runs" && parts[4] === "cancel";
+}
+
 function isAdminAccessWriteProxyRoute(method, pathname) {
   if (method === "POST" && pathname === "/v1/admin/access/check") return true;
 

internal/dev-entrypoint/cloud-web-routes.test.mjs

@@ -54,6 +54,27 @@ test("cloud web proxies public WebUI performance telemetry to cloud-api", () =>
   });
 });
 
+test("cloud web proxies authenticated CaseRun write routes to cloud-api", () => {
+  assert.deepEqual(cloudWebProxyRoutePolicy("GET", "/v1/caserun/cases"), {
+    proxy: true,
+    authRequired: true,
+    publicRoute: false,
+    routeKey: "GET /v1/caserun/cases"
+  });
+  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/caserun/runs"), {
+    proxy: true,
+    authRequired: true,
+    publicRoute: false,
+    routeKey: "POST /v1/caserun/runs"
+  });
+  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/caserun/runs/web-d601/cancel"), {
+    proxy: true,
+    authRequired: true,
+    publicRoute: false,
+    routeKey: "POST /v1/caserun/runs/web-d601/cancel"
+  });
+});
+
 test("cloud web exposes auth bootstrap as a public auth route", () => {
   assert.deepEqual(cloudWebProxyRoutePolicy("GET", "/auth/bootstrap"), {
     proxy: true,