From f70be64381ef88d68200eedeaf1bafeeefaa8a84 Mon Sep 17 00:00:00 2001
From: Lyon <88232613+pikasTech@users.noreply.github.com>
Date: Thu, 25 Jun 2026 13:12:52 +0800
Subject: [PATCH] fix: proxy web caserun write routes (#2119)

---
 internal/dev-entrypoint/cloud-web-routes.mjs  |  8 +++++++
 .../dev-entrypoint/cloud-web-routes.test.mjs  | 21 +++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/internal/dev-entrypoint/cloud-web-routes.mjs b/internal/dev-entrypoint/cloud-web-routes.mjs
index 16a231a8..a5b77f8e 100644
--- a/internal/dev-entrypoint/cloud-web-routes.mjs
+++ b/internal/dev-entrypoint/cloud-web-routes.mjs
@@ -51,6 +51,7 @@ export function isCloudApiProxyRoute(method, pathname) {
   }
   if (normalizedMethod === "POST") {
     return POST_PROXY_ROUTES.has(normalizedPath) ||
+      isCaseRunWriteProxyRoute(normalizedMethod, normalizedPath) ||
       isAdminAccessWriteProxyRoute(normalizedMethod, normalizedPath) ||
       isProviderProfileManagementProxyRoute(normalizedMethod, normalizedPath) ||
       isApiKeyWriteProxyRoute(normalizedMethod, normalizedPath) ||
@@ -72,6 +73,13 @@ export function isCloudApiProxyRoute(method, pathname) {
   return false;
 }
 
+function isCaseRunWriteProxyRoute(method, pathname) {
+  if (method !== "POST") return false;
+  if (pathname === "/v1/caserun/runs") return true;
+  const parts = pathname.split("/").filter(Boolean);
+  return parts.length === 5 && parts[0] === "v1" && parts[1] === "caserun" && parts[2] === "runs" && parts[4] === "cancel";
+}
+
 function isAdminAccessWriteProxyRoute(method, pathname) {
   if (method === "POST" && pathname === "/v1/admin/access/check") return true;
 
diff --git a/internal/dev-entrypoint/cloud-web-routes.test.mjs b/internal/dev-entrypoint/cloud-web-routes.test.mjs
index 6815fb48..5986e4d8 100644
--- a/internal/dev-entrypoint/cloud-web-routes.test.mjs
+++ b/internal/dev-entrypoint/cloud-web-routes.test.mjs
@@ -54,6 +54,27 @@ test("cloud web proxies public WebUI performance telemetry to cloud-api", () =>
   });
 });
 
+test("cloud web proxies authenticated CaseRun write routes to cloud-api", () => {
+  assert.deepEqual(cloudWebProxyRoutePolicy("GET", "/v1/caserun/cases"), {
+    proxy: true,
+    authRequired: true,
+    publicRoute: false,
+    routeKey: "GET /v1/caserun/cases"
+  });
+  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/caserun/runs"), {
+    proxy: true,
+    authRequired: true,
+    publicRoute: false,
+    routeKey: "POST /v1/caserun/runs"
+  });
+  assert.deepEqual(cloudWebProxyRoutePolicy("POST", "/v1/caserun/runs/web-d601/cancel"), {
+    proxy: true,
+    authRequired: true,
+    publicRoute: false,
+    routeKey: "POST /v1/caserun/runs/web-d601/cancel"
+  });
+});
+
 test("cloud web exposes auth bootstrap as a public auth route", () => {
   assert.deepEqual(cloudWebProxyRoutePolicy("GET", "/auth/bootstrap"), {
     proxy: true,