diff --git a/infrastructure/authorization-manager/stage/README.md b/infrastructure/authorization-manager/stage/README.md index 3291457..3d49587 100644 --- a/infrastructure/authorization-manager/stage/README.md +++ b/infrastructure/authorization-manager/stage/README.md @@ -29,14 +29,18 @@ Policies are currently assigned based on groups from the Cognito User Pool. The ### Permissions -| Description | Curators | Bioinfo | -| ------------------------------------------------------------------------------------------------- | ------------------ | ------------------ | -| Allow rerun workflows in the WORKFLOW microservice | :white_check_mark: | :white_check_mark: | -| Allow to sync external metadata in the METADATA microservice | :x: | :white_check_mark: | -| Allow to link external entities to a case in the CASE microservice | :white_check_mark: | :white_check_mark: | -| Allow to unlink external entities from a case in the CASE microservice | :white_check_mark: | :white_check_mark: | - -`Admin` group will have a wildcard to allow all actions. +| Description | Admin | Curators | Bioinfo | +| ------------------------------------------------------------------------------------------------- | ------------------ | ------------------ | ------------------ | +| Allow rerun workflows in the WORKFLOW microservice | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Allow marking workflow runs as deprecated in the WORKFLOW microservice | :white_check_mark: | :white_check_mark: | :x: | +| Allow marking workflow runs as resolved in the WORKFLOW microservice | :white_check_mark: | :x: | :x: | +| Allow to sync external metadata in the METADATA microservice | :white_check_mark: | :x: | :white_check_mark: | +| Allow to link external entities to a case in the CASE microservice | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Allow to unlink external entities from a case in the CASE microservice | :white_check_mark: | :white_check_mark: | :white_check_mark: | + +The `Admin` group receives these permissions through its wildcard policy. The unrestricted +`POST /api/v1/workflowrun/state/cancel/` endpoint does not use this authorizer and therefore is not +represented in the Cedar schema or group policies. NOTE: Please update this table if `GROUP_POLICIES` in `stack.ts` is modified. diff --git a/infrastructure/authorization-manager/stage/cedarSchema.json b/infrastructure/authorization-manager/stage/cedarSchema.json index a1c3655..97c01dc 100644 --- a/infrastructure/authorization-manager/stage/cedarSchema.json +++ b/infrastructure/authorization-manager/stage/cedarSchema.json @@ -7,6 +7,18 @@ "resourceTypes": ["Microservice"] } }, + "POST /api/v1/workflowrun/state/deprecate/{PROXY+}": { + "appliesTo": { + "principalTypes": ["User", "CognitoUserGroup"], + "resourceTypes": ["Microservice"] + } + }, + "POST /api/v1/workflowrun/state/resolve/{PROXY+}": { + "appliesTo": { + "principalTypes": ["User", "CognitoUserGroup"], + "resourceTypes": ["Microservice"] + } + }, "POST /api/v1/sync/presigned-csv/{PROXY+}": { "appliesTo": { "principalTypes": ["User", "CognitoUserGroup"], diff --git a/infrastructure/authorization-manager/stage/stack.ts b/infrastructure/authorization-manager/stage/stack.ts index 8cdc456..d5a20b8 100644 --- a/infrastructure/authorization-manager/stage/stack.ts +++ b/infrastructure/authorization-manager/stage/stack.ts @@ -46,6 +46,13 @@ const GROUP_POLICIES: CedarGroupPolicy[] = [ actions: ['POST /api/v1/workflowrun/{orcabusId}/rerun/{proxy+}'], resource: 'WORKFLOW', }, + { + id: 'CognitoWorkflowDeprecatePolicy', + groups: ['curators'], + description: 'Permissions to mark a workflowrun as deprecated in WORKFLOW microservice', + actions: ['POST /api/v1/workflowrun/state/deprecate/{PROXY+}'], + resource: 'WORKFLOW', + }, // METADATA resource { id: 'CognitoBioinfoMetadataModifyPolicy', diff --git a/package.json b/package.json index 6b05c3a..cd6ff24 100644 --- a/package.json +++ b/package.json @@ -27,24 +27,24 @@ "devDependencies": { "@eslint/js": "^10.0.1", "@types/jest": "^30.0.0", - "@types/node": "^25.9.1", - "aws-cdk": "^2.1124.1", + "@types/node": "^25.9.3", + "aws-cdk": "^2.1135.0", "cdk-nag": "^2.38.2", - "eslint": "^10.4.0", - "globals": "^17.6.0", + "eslint": "^10.8.1", + "globals": "^17.9.0", "jest": "^30.4.2", - "prettier": "^3.8.3", + "prettier": "^3.9.6", "source-map-support": "^0.5.21", "test-js": "^0.0.4", - "ts-jest": "^29.4.10", + "ts-jest": "^29.4.12", "ts-node": "^10.9.2", "typescript": "^6.0.3", - "typescript-eslint": "^8.59.4" + "typescript-eslint": "^8.66.0" }, "dependencies": { - "@aws-cdk/aws-lambda-python-alpha": "2.256.1-alpha.0", - "@orcabus/platform-cdk-constructs": "1.4.0", - "aws-cdk-lib": "^2.256.1", - "constructs": "^10.6.0" + "@aws-cdk/aws-lambda-python-alpha": "2.263.0-alpha.0", + "@orcabus/platform-cdk-constructs": "1.8.0", + "aws-cdk-lib": "^2.263.0", + "constructs": "^10.8.1" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 862d827..e2719b3 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,54 +4,50 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false -overrides: - diff@<4.0.4: '>=4.0.4' - js-yaml@<=4.1.1: ^4.1.2 - importers: .: dependencies: '@aws-cdk/aws-lambda-python-alpha': - specifier: 2.256.1-alpha.0 - version: 2.256.1-alpha.0(aws-cdk-lib@2.256.1(constructs@10.6.0))(constructs@10.6.0) + specifier: 2.263.0-alpha.0 + version: 2.263.0-alpha.0(aws-cdk-lib@2.263.0(constructs@10.8.1))(constructs@10.8.1) '@orcabus/platform-cdk-constructs': - specifier: 1.4.0 - version: 1.4.0(@aws-cdk/aws-lambda-python-alpha@2.256.1-alpha.0(aws-cdk-lib@2.256.1(constructs@10.6.0))(constructs@10.6.0))(aws-cdk-lib@2.256.1(constructs@10.6.0))(constructs@10.6.0) + specifier: 1.8.0 + version: 1.8.0(@aws-cdk/aws-lambda-python-alpha@2.263.0-alpha.0(aws-cdk-lib@2.263.0(constructs@10.8.1))(constructs@10.8.1))(aws-cdk-lib@2.263.0(constructs@10.8.1))(constructs@10.8.1) aws-cdk-lib: - specifier: ^2.256.1 - version: 2.256.1(constructs@10.6.0) + specifier: ^2.263.0 + version: 2.263.0(constructs@10.8.1) constructs: - specifier: ^10.6.0 - version: 10.6.0 + specifier: ^10.8.1 + version: 10.8.1 devDependencies: '@eslint/js': specifier: ^10.0.1 - version: 10.0.1(eslint@10.4.0) + version: 10.0.1(eslint@10.8.1) '@types/jest': specifier: ^30.0.0 version: 30.0.0 '@types/node': - specifier: ^25.9.1 - version: 25.9.1 + specifier: ^25.9.3 + version: 25.9.5 aws-cdk: - specifier: ^2.1124.1 - version: 2.1124.1 + specifier: ^2.1135.0 + version: 2.1135.1 cdk-nag: specifier: ^2.38.2 - version: 2.38.2(aws-cdk-lib@2.256.1(constructs@10.6.0))(constructs@10.6.0) + version: 2.38.2(aws-cdk-lib@2.263.0(constructs@10.8.1))(constructs@10.8.1) eslint: - specifier: ^10.4.0 - version: 10.4.0 + specifier: ^10.8.1 + version: 10.8.1 globals: - specifier: ^17.6.0 - version: 17.6.0 + specifier: ^17.9.0 + version: 17.9.0 jest: specifier: ^30.4.2 - version: 30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)) + version: 30.4.2(@types/node@25.9.5)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)) prettier: - specifier: ^3.8.3 - version: 3.8.3 + specifier: ^3.9.6 + version: 3.9.6 source-map-support: specifier: ^0.5.21 version: 0.5.21 @@ -59,35 +55,35 @@ importers: specifier: ^0.0.4 version: 0.0.4 ts-jest: - specifier: ^29.4.10 - version: 29.4.10(@babel/core@7.29.7)(@jest/transform@30.4.1)(@jest/types@30.4.1)(babel-jest@30.4.1(@babel/core@7.29.7))(jest-util@30.4.1)(jest@30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)))(typescript@6.0.3) + specifier: ^29.4.12 + version: 29.4.12(@babel/core@7.29.7)(@jest/transform@30.4.1)(@jest/types@30.4.1)(babel-jest@30.4.1(@babel/core@7.29.7))(jest-util@30.4.1)(jest@30.4.2(@types/node@25.9.5)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)))(typescript@6.0.3) ts-node: specifier: ^10.9.2 - version: 10.9.2(@types/node@25.9.1)(typescript@6.0.3) + version: 10.9.2(@types/node@25.9.5)(typescript@6.0.3) typescript: specifier: ^6.0.3 version: 6.0.3 typescript-eslint: - specifier: ^8.59.4 - version: 8.59.4(eslint@10.4.0)(typescript@6.0.3) + specifier: ^8.66.0 + version: 8.66.0(eslint@10.8.1)(typescript@6.0.3) packages: - '@aws-cdk/asset-awscli-v1@2.2.273': - resolution: {integrity: sha512-X57HYUtHt9BQrlrzUNcMyRsDUCoakYNnY6qh5lNwRCHPtQoTfXmuISkfLk0AjLkcbS5lw1LLTQFiQhTDXfiTvg==} + '@aws-cdk/asset-awscli-v1@2.2.282': + resolution: {integrity: sha512-7hKMi5tTxDcKGIMIOq14PnY0GBcugW33Uh/2YHDZiEwSxLeFOCYBwhR+BFXONb/EJeVI3RETFgailNZbkcKF6g==} '@aws-cdk/asset-node-proxy-agent-v6@2.1.2': resolution: {integrity: sha512-pDiuqH+qY3zM9lhhLjbKJ1tnKOHzQ2V4Wr/3qsxyKeKAkuPMI/BVGvZG1PbrikUw949cGVTfVEt4ETKKYnrj0Q==} - '@aws-cdk/aws-lambda-python-alpha@2.256.1-alpha.0': - resolution: {integrity: sha512-nOsH+oVpWJ1HEaCGx9VejITq8y2wVr9ii9Wca/h3Ve2MXSWCCFhSJz5Sz4z8asrqIgSCq2jSyzq1PHCLVWLQ4Q==} + '@aws-cdk/aws-lambda-python-alpha@2.263.0-alpha.0': + resolution: {integrity: sha512-1OgLG7TGGH5/Wt7firHTOFyxU6ymZNaANELq62h1yNfTBOSNsNhdzkWLYxhoXDPBvNndEsmUnKVCij7U+dXsqQ==} engines: {node: '>= 20.0.0'} peerDependencies: - aws-cdk-lib: ^2.256.1 + aws-cdk-lib: ^2.263.0 constructs: ^10.5.0 - '@aws-cdk/cloud-assembly-schema@53.27.0': - resolution: {integrity: sha512-OTxe/L2Vc60r2nYih7kFaFpn93sa7shJu9T0tQZsryeDE3HHOAuazKNmS6tLInOjJjVx/dvM5XGyUA+lZAiKxA==} + '@aws-cdk/cloud-assembly-schema@54.17.0': + resolution: {integrity: sha512-wV1GmMM5AvDkiJIenb9aJcBiGTa5KwX/C/mIjFZCsWsB5b1rEMLnwMageqrOpL2mWKicpxqS8ofF/Yte4Lm3Dg==} engines: {node: '>= 18.0.0'} bundledDependencies: - jsonschema @@ -310,8 +306,8 @@ packages: resolution: {integrity: sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA==} engines: {node: ^20.19.0 || ^22.13.0 || >=24} - '@eslint/config-helpers@0.6.0': - resolution: {integrity: sha512-ii6Bw9jJ2zi2cWA2Z+9/QZ/+3DX6kwaV5Q986D/CdP3Lap3w/pgQZ373FV7byY/i7L4IRH/G43I5dz1ClsCbpA==} + '@eslint/config-helpers@0.7.0': + resolution: {integrity: sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==} engines: {node: ^20.19.0 || ^22.13.0 || >=24} '@eslint/core@1.2.1': @@ -331,8 +327,8 @@ packages: resolution: {integrity: sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==} engines: {node: ^20.19.0 || ^22.13.0 || >=24} - '@eslint/plugin-kit@0.7.1': - resolution: {integrity: sha512-rZAP3aVgB9ds9KOeUSL+zZ21hPmo8dh6fnIFwRQj5EAZl9gzR7wxYbYXYysAM8CTqGmUGyp2S4kUdV17MnGuWQ==} + '@eslint/plugin-kit@0.7.2': + resolution: {integrity: sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==} engines: {node: ^20.19.0 || ^22.13.0 || >=24} '@humanfs/core@0.19.2': @@ -474,8 +470,8 @@ packages: '@emnapi/core': ^1.7.1 '@emnapi/runtime': ^1.7.1 - '@orcabus/platform-cdk-constructs@1.4.0': - resolution: {integrity: sha512-rMJh1ZH9HoYJJvlyOjogEn4XyS97bFR1Ta6grp0Sk2WOwDxX0Rn47Bh4uYUjRrLjjS6CX2C/PM4pvO6lEMfFrQ==} + '@orcabus/platform-cdk-constructs@1.8.0': + resolution: {integrity: sha512-hSwpr/KJKJGKzJ3j0IJ96pHuwLJ6+u6DmCiVvvvUWCTvPmOiIZv15yGRJZP1qK4tXvescVw9ke0iqoAUKrkn5A==} peerDependencies: '@aws-cdk/aws-lambda-python-alpha': ^2.244.0-alpha.0 aws-cdk-lib: ^2.244.0 @@ -549,6 +545,9 @@ packages: '@types/node@25.9.1': resolution: {integrity: sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==} + '@types/node@25.9.5': + resolution: {integrity: sha512-OScDchr2fwuUmWdf4kZ9h7PcJiYDVInhJizG/biAq3cAvqwYktuy/TYGGdZNMtNTFUP7rnb0NU4TUdm82kt4Rg==} + '@types/stack-utils@2.0.3': resolution: {integrity: sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==} @@ -558,63 +557,63 @@ packages: '@types/yargs@17.0.35': resolution: {integrity: sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==} - '@typescript-eslint/eslint-plugin@8.59.4': - resolution: {integrity: sha512-PegsU+XfyJJNjd4+u/k6f9yTyp0lEXXiPopUNobZcIAUJFGICFLN+sP0Rb3JehVmiij1Ph0dFGYqODoRo/2+6A==} + '@typescript-eslint/eslint-plugin@8.66.0': + resolution: {integrity: sha512-p088eaGrzYz1s+7cov0aMOCkNGTJlVxF4jgubf28c8L0Cv9Rloj8YBHnv4hXLq6IIEE1AsjNWavO+k+8kP2Y0A==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: - '@typescript-eslint/parser': ^8.59.4 + '@typescript-eslint/parser': ^8.66.0 eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/parser@8.59.4': - resolution: {integrity: sha512-zORHqO/tuhxY1zWuTvMUqddRxpiFJ72xVfcNoWpqdLjs6lfPbuQBJuW4pk+49/uBMy7Ssr4bzgjiKmmDB1UbZQ==} + '@typescript-eslint/parser@8.66.0': + resolution: {integrity: sha512-X6ypGChaWYk6PBtUg2BwuTZEFFcHJAtGTVJ9/lCTOufhZ4i9fNolQNnktq+kkMCwMj7V8Svsq7+TxSDslmhE0g==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/project-service@8.59.4': - resolution: {integrity: sha512-Ly00Vu4oAacfDeHp2Zg85ioNG6l8HG+tN1D7J+xTHSxu9y0awYKJ2zH1rFBn8ZSfuGK+7FxK3Cgl3uAz0aZZLg==} + '@typescript-eslint/project-service@8.66.0': + resolution: {integrity: sha512-7MthGPTt4BP69lSryqpqq8HQqxuzynssckL/jyDyk3+TNMQ3y2jFWkptCrktWvBrP+EH787Nl5N5Qpw7WZg+5g==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/scope-manager@8.59.4': - resolution: {integrity: sha512-mUeR/3H1WrTAddJrwut8OoPjfauaztMQmRwV5fQTUyNVJCLiUXXe4lGEyYIL2oFDpP7UtgbGJXCt72wT0z2S3Q==} + '@typescript-eslint/scope-manager@8.66.0': + resolution: {integrity: sha512-8TGcH25j9zqJ/IULB/ppyhRvxA8QYfFEZ7nfbg6/BN9spDgb8fPWQXlE5l8TWBL50EtUx007uZ1o9VOwrq2/9g==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@typescript-eslint/tsconfig-utils@8.59.4': - resolution: {integrity: sha512-DLCpnKgD4alVxTBSKulK+gU1KCqOgUXfDRDXh2mZgzokQKa/70ax93I2uVO3m/LLvIAtWZIFoiifudmIqAxpMA==} + '@typescript-eslint/tsconfig-utils@8.66.0': + resolution: {integrity: sha512-9D5gLYZG4rOjcoag8MQ/fWI8WqA9wcPDyOGyWtWFhvM1lHRbliqUSPIY5J3zqCU1tvSwzXxnnjhQhz5Ne7mJ4g==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/type-utils@8.59.4': - resolution: {integrity: sha512-uonTuPAAKr9XaBGqJ3LjYTh72zy5DyGesljO9gtmk/eFW0W1fRHjnwVYKB35Lm8d5Q5CluEW3gPHjTvZTmgrfA==} + '@typescript-eslint/type-utils@8.66.0': + resolution: {integrity: sha512-LG2dWfjZQQp0ADtAu/EWJVayefGL2UEZ3CDeI44D9v3rXB/WYUqE/jpO28KrEKul5AySrmI+Zh1v6v+xW2U9+g==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/types@8.59.4': - resolution: {integrity: sha512-F1o7WJcCq+bc8dwcO/YsSEOudAH8RDtaOhM6wcAQhcUsFhnWQl81JKy48q1hoxAU0qrzM89+31GYh1515Zde3Q==} + '@typescript-eslint/types@8.66.0': + resolution: {integrity: sha512-H6gcYaSDOyvL3AD/jHUtUFo2jqGgn/F6nuyuZSu0QTesxL+cP4dQoIMrODRofuJC09g64+WgZ6tE19Y1N2YIFQ==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@typescript-eslint/typescript-estree@8.59.4': - resolution: {integrity: sha512-F+RuOmcDXo4+TPdfd/TCLS3m2nw8gE9XXyZLrA3JBfaA5tz9TtdkyD3YJFmPxulyc2cKbEok/CvFE3MgSLWnag==} + '@typescript-eslint/typescript-estree@8.66.0': + resolution: {integrity: sha512-8/x4INiiQb10jGgXYD7116/zQ+OL84ZIFn0za68wwFHCanT/VLbBEroWht8RV8fn0/ZCAoazHLQgwUC0UQcDfg==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/utils@8.59.4': - resolution: {integrity: sha512-cYXeNAUsG4lJo5dbc1FcKm+JwIWrj1/UpTORsC6tGMjEZ81DYcvIr9/ueikhMa/Y/gDQYGp+YX9/xQrXje5BJw==} + '@typescript-eslint/utils@8.66.0': + resolution: {integrity: sha512-jasearZPolBw5NJNYGMwxzHMF83niVWmMU1VdHzG1CyfI2VS7f7nZltnKtHcg20hW+7Uo5GfK4MeDPoU3qI8EA==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/visitor-keys@8.59.4': - resolution: {integrity: sha512-U3gxVaDVnuZKhSspW/MzMxE1kq7zOdc072FcSNoqA1I9p8HyKbBFfEHoWckBAMgNMph4MamwS5iTVzFmrnt8TQ==} + '@typescript-eslint/visitor-keys@8.66.0': + resolution: {integrity: sha512-dkKR8q+lKciskj1Y3vthHktl+3cMLWGyVUP23bRiPZ5O9BRT++4EqDDV+TVeIKBL1VXVEqrJlz8MYbcnvJcAlg==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} '@ungap/structured-clone@1.3.1': @@ -788,15 +787,16 @@ packages: arg@4.1.3: resolution: {integrity: sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==} - argparse@2.0.1: - resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==} + argparse@1.0.10: + resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==} - aws-cdk-lib@2.256.1: - resolution: {integrity: sha512-18xLE+iqzjvpYGGKJy+9zyvF8loUSXjpVV2MtVLPQ/hPgeWHQiVsqLOWNsBemd3pU7o0L9wXfRY+xqG80vlZFw==} + aws-cdk-lib@2.263.0: + resolution: {integrity: sha512-cXC9wnOr+LknMee9x0kYwofgVs8aN8eBKsbzcE90sDUtpLTgWG2Bd+9koqxBKPeIU8kig/GGBFwJ69Wr+hLKDg==} engines: {node: '>= 20.0.0'} peerDependencies: constructs: ^10.5.0 bundledDependencies: + - '@aws/cloudformation-validate' - '@balena/dockerignore' - '@aws-cdk/cloud-assembly-api' - case @@ -806,12 +806,11 @@ packages: - minimatch - punycode - semver - - table - yaml - mime-types - aws-cdk@2.1124.1: - resolution: {integrity: sha512-sRYdPMdkX+02EHaT946AFV0w0CMfbHKWpLZPv525xTCkaVu1eYu6DzHFuTdimxdSN0uGQ2D4LHrD1sr94tRhow==} + aws-cdk@2.1135.1: + resolution: {integrity: sha512-g1jcMfWlyYtGamFJ/kPBOCuchl3NfwTF2UwOLTIDN0nJbGm84EAO+c8DlYnaemM8UmKFkdoq4BGdmiNL5nHWwA==} engines: {node: '>= 18.0.0'} hasBin: true @@ -852,15 +851,15 @@ packages: engines: {node: '>=6.0.0'} hasBin: true - brace-expansion@1.1.14: - resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==} + brace-expansion@1.1.18: + resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - brace-expansion@2.1.0: - resolution: {integrity: sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} - brace-expansion@5.0.6: - resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.9: + resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + engines: {node: 20 || >=22} browserslist@4.28.4: resolution: {integrity: sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==} @@ -935,8 +934,8 @@ packages: concat-map@0.0.1: resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} - constructs@10.6.0: - resolution: {integrity: sha512-TxHOnBO5zMo/G76ykzGF/wMpEHu257TbWiIxP9K0Yv/+t70UzgBQiTqjkAsWOPC6jW91DzJI0+ehQV6xDRNBuQ==} + constructs@10.8.1: + resolution: {integrity: sha512-98yGXYyhePqPYh3cYu8nzBERmAhC0DONe3UD03okK0nehZ7hYP4wgZuf02a04+uOWxnTJ5Rpp5m0GRNpwyLGGA==} convert-source-map@2.0.0: resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==} @@ -1023,8 +1022,8 @@ packages: resolution: {integrity: sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==} engines: {node: ^20.19.0 || ^22.13.0 || >=24} - eslint@10.4.0: - resolution: {integrity: sha512-loXy6bWOoP3EP6JA7jo6p5jMpBJmHmsNZM5SFRHLdh1MGOPurMnNBj4ZlAbaqUAaQWbCr7jHV4P7gzAyryZWkQ==} + eslint@10.8.1: + resolution: {integrity: sha512-wqA7W2jbsC/BnV9Iv1UZpKVFkO1AdNoSmYW8NWG4HNOBbkAMvIqDZ27pI2f07dqn583NcIC44ckjAcOXDL1QbQ==} engines: {node: ^20.19.0 || ^22.13.0 || >=24} hasBin: true peerDependencies: @@ -1037,6 +1036,11 @@ packages: resolution: {integrity: sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw==} engines: {node: ^20.19.0 || ^22.13.0 || >=24} + esprima@4.0.1: + resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==} + engines: {node: '>=4'} + hasBin: true + esquery@1.7.0: resolution: {integrity: sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==} engines: {node: '>=0.10'} @@ -1146,8 +1150,8 @@ packages: resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==} deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me - globals@17.6.0: - resolution: {integrity: sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==} + globals@17.9.0: + resolution: {integrity: sha512-m/MvAW61QVU5VDNF1Vj8axt016h8w7L5TU1e9zlab7XIttAT2YAlCwl75K1fOqvMM9apmD7lbCIRhpfkhmxhCg==} engines: {node: '>=18'} graceful-fs@4.2.11: @@ -1373,8 +1377,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@4.2.0: - resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==} + js-yaml@3.15.1: + resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} hasBin: true jsesc@3.1.0: @@ -1571,8 +1575,8 @@ packages: resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==} engines: {node: '>= 0.8.0'} - prettier@3.8.3: - resolution: {integrity: sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==} + prettier@3.9.6: + resolution: {integrity: sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==} engines: {node: '>=14'} hasBin: true @@ -1614,6 +1618,11 @@ packages: engines: {node: '>=10'} hasBin: true + semver@7.8.5: + resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==} + engines: {node: '>=10'} + hasBin: true + shebang-command@2.0.0: resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==} engines: {node: '>=8'} @@ -1643,6 +1652,9 @@ packages: resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==} engines: {node: '>=0.10.0'} + sprintf-js@1.0.3: + resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==} + stack-utils@2.0.6: resolution: {integrity: sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==} engines: {node: '>=10'} @@ -1711,8 +1723,8 @@ packages: peerDependencies: typescript: '>=4.8.4' - ts-jest@29.4.10: - resolution: {integrity: sha512-vMTlTTtvz5aKZgzOoc7DQ5TzAL2fCzl8JnG1+ZpwjQa/g0xLlwE44yQ+1Cao9ZP1xVv9y5g34IFXEiqGOGFBUA==} + ts-jest@29.4.12: + resolution: {integrity: sha512-Ov6ClY53Fflh6BGAnY2DlTq1hYDrTycz2PVTXBWFW2CU+9zrEqAp9fWdGXl42EXO5RLSFAcAZ2JFKbP+zBTFfw==} engines: {node: ^14.15.0 || ^16.10.0 || ^18.0.0 || >=20.0.0} hasBin: true peerDependencies: @@ -1771,8 +1783,8 @@ packages: resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==} engines: {node: '>=16'} - typescript-eslint@8.59.4: - resolution: {integrity: sha512-Rw6+44QNFaXtgHSjPy+Kw8hrJniMYzR85E9yLmOLcfZ91/rz+JXQbDTCmc6ccxMPY6K6PgAq26f0JCBfR7LIPQ==} + typescript-eslint@8.66.0: + resolution: {integrity: sha512-QlEbBPz/RuJ1XUHj29nm3t0F/O/cSlEnntozqPOYHnnTGAXFamnMBu5i9Vn6vhUPHGAjR+Vl+5J8vPN/BMUrJw==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 @@ -1865,16 +1877,16 @@ packages: snapshots: - '@aws-cdk/asset-awscli-v1@2.2.273': {} + '@aws-cdk/asset-awscli-v1@2.2.282': {} '@aws-cdk/asset-node-proxy-agent-v6@2.1.2': {} - '@aws-cdk/aws-lambda-python-alpha@2.256.1-alpha.0(aws-cdk-lib@2.256.1(constructs@10.6.0))(constructs@10.6.0)': + '@aws-cdk/aws-lambda-python-alpha@2.263.0-alpha.0(aws-cdk-lib@2.263.0(constructs@10.8.1))(constructs@10.8.1)': dependencies: - aws-cdk-lib: 2.256.1(constructs@10.6.0) - constructs: 10.6.0 + aws-cdk-lib: 2.263.0(constructs@10.8.1) + constructs: 10.8.1 - '@aws-cdk/cloud-assembly-schema@53.27.0': {} + '@aws-cdk/cloud-assembly-schema@54.17.0': {} '@babel/code-frame@7.29.0': dependencies: @@ -2112,9 +2124,9 @@ snapshots: tslib: 2.8.1 optional: true - '@eslint-community/eslint-utils@4.9.1(eslint@10.4.0)': + '@eslint-community/eslint-utils@4.9.1(eslint@10.8.1)': dependencies: - eslint: 10.4.0 + eslint: 10.8.1 eslint-visitor-keys: 3.4.3 '@eslint-community/regexpp@4.12.2': {} @@ -2127,7 +2139,7 @@ snapshots: transitivePeerDependencies: - supports-color - '@eslint/config-helpers@0.6.0': + '@eslint/config-helpers@0.7.0': dependencies: '@eslint/core': 1.2.1 @@ -2135,13 +2147,13 @@ snapshots: dependencies: '@types/json-schema': 7.0.15 - '@eslint/js@10.0.1(eslint@10.4.0)': + '@eslint/js@10.0.1(eslint@10.8.1)': optionalDependencies: - eslint: 10.4.0 + eslint: 10.8.1 '@eslint/object-schema@3.0.5': {} - '@eslint/plugin-kit@0.7.1': + '@eslint/plugin-kit@0.7.2': dependencies: '@eslint/core': 1.2.1 levn: 0.4.1 @@ -2176,7 +2188,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 4.2.0 + js-yaml: 3.15.1 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.6': {} @@ -2190,7 +2202,7 @@ snapshots: jest-util: 30.4.1 slash: 3.0.0 - '@jest/core@30.4.2(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3))': + '@jest/core@30.4.2(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3))': dependencies: '@jest/console': 30.4.1 '@jest/pattern': 30.4.0 @@ -2206,7 +2218,7 @@ snapshots: fast-json-stable-stringify: 2.1.0 graceful-fs: 4.2.11 jest-changed-files: 30.4.1 - jest-config: 30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)) + jest-config: 30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)) jest-haste-map: 30.4.1 jest-message-util: 30.4.1 jest-regex-util: 30.4.0 @@ -2390,11 +2402,11 @@ snapshots: '@tybys/wasm-util': 0.10.2 optional: true - '@orcabus/platform-cdk-constructs@1.4.0(@aws-cdk/aws-lambda-python-alpha@2.256.1-alpha.0(aws-cdk-lib@2.256.1(constructs@10.6.0))(constructs@10.6.0))(aws-cdk-lib@2.256.1(constructs@10.6.0))(constructs@10.6.0)': + '@orcabus/platform-cdk-constructs@1.8.0(@aws-cdk/aws-lambda-python-alpha@2.263.0-alpha.0(aws-cdk-lib@2.263.0(constructs@10.8.1))(constructs@10.8.1))(aws-cdk-lib@2.263.0(constructs@10.8.1))(constructs@10.8.1)': dependencies: - '@aws-cdk/aws-lambda-python-alpha': 2.256.1-alpha.0(aws-cdk-lib@2.256.1(constructs@10.6.0))(constructs@10.6.0) - aws-cdk-lib: 2.256.1(constructs@10.6.0) - constructs: 10.6.0 + '@aws-cdk/aws-lambda-python-alpha': 2.263.0-alpha.0(aws-cdk-lib@2.263.0(constructs@10.8.1))(constructs@10.8.1) + aws-cdk-lib: 2.263.0(constructs@10.8.1) + constructs: 10.8.1 '@pkgjs/parseargs@0.11.0': optional: true @@ -2470,6 +2482,10 @@ snapshots: dependencies: undici-types: 7.24.6 + '@types/node@25.9.5': + dependencies: + undici-types: 7.24.6 + '@types/stack-utils@2.0.3': {} '@types/yargs-parser@21.0.3': {} @@ -2478,15 +2494,15 @@ snapshots: dependencies: '@types/yargs-parser': 21.0.3 - '@typescript-eslint/eslint-plugin@8.59.4(@typescript-eslint/parser@8.59.4(eslint@10.4.0)(typescript@6.0.3))(eslint@10.4.0)(typescript@6.0.3)': + '@typescript-eslint/eslint-plugin@8.66.0(@typescript-eslint/parser@8.66.0(eslint@10.8.1)(typescript@6.0.3))(eslint@10.8.1)(typescript@6.0.3)': dependencies: '@eslint-community/regexpp': 4.12.2 - '@typescript-eslint/parser': 8.59.4(eslint@10.4.0)(typescript@6.0.3) - '@typescript-eslint/scope-manager': 8.59.4 - '@typescript-eslint/type-utils': 8.59.4(eslint@10.4.0)(typescript@6.0.3) - '@typescript-eslint/utils': 8.59.4(eslint@10.4.0)(typescript@6.0.3) - '@typescript-eslint/visitor-keys': 8.59.4 - eslint: 10.4.0 + '@typescript-eslint/parser': 8.66.0(eslint@10.8.1)(typescript@6.0.3) + '@typescript-eslint/scope-manager': 8.66.0 + '@typescript-eslint/type-utils': 8.66.0(eslint@10.8.1)(typescript@6.0.3) + '@typescript-eslint/utils': 8.66.0(eslint@10.8.1)(typescript@6.0.3) + '@typescript-eslint/visitor-keys': 8.66.0 + eslint: 10.8.1 ignore: 7.0.5 natural-compare: 1.4.0 ts-api-utils: 2.5.0(typescript@6.0.3) @@ -2494,56 +2510,56 @@ snapshots: transitivePeerDependencies: - supports-color - '@typescript-eslint/parser@8.59.4(eslint@10.4.0)(typescript@6.0.3)': + '@typescript-eslint/parser@8.66.0(eslint@10.8.1)(typescript@6.0.3)': dependencies: - '@typescript-eslint/scope-manager': 8.59.4 - '@typescript-eslint/types': 8.59.4 - '@typescript-eslint/typescript-estree': 8.59.4(typescript@6.0.3) - '@typescript-eslint/visitor-keys': 8.59.4 + '@typescript-eslint/scope-manager': 8.66.0 + '@typescript-eslint/types': 8.66.0 + '@typescript-eslint/typescript-estree': 8.66.0(typescript@6.0.3) + '@typescript-eslint/visitor-keys': 8.66.0 debug: 4.4.3 - eslint: 10.4.0 + eslint: 10.8.1 typescript: 6.0.3 transitivePeerDependencies: - supports-color - '@typescript-eslint/project-service@8.59.4(typescript@6.0.3)': + '@typescript-eslint/project-service@8.66.0(typescript@6.0.3)': dependencies: - '@typescript-eslint/tsconfig-utils': 8.59.4(typescript@6.0.3) - '@typescript-eslint/types': 8.59.4 + '@typescript-eslint/tsconfig-utils': 8.66.0(typescript@6.0.3) + '@typescript-eslint/types': 8.66.0 debug: 4.4.3 typescript: 6.0.3 transitivePeerDependencies: - supports-color - '@typescript-eslint/scope-manager@8.59.4': + '@typescript-eslint/scope-manager@8.66.0': dependencies: - '@typescript-eslint/types': 8.59.4 - '@typescript-eslint/visitor-keys': 8.59.4 + '@typescript-eslint/types': 8.66.0 + '@typescript-eslint/visitor-keys': 8.66.0 - '@typescript-eslint/tsconfig-utils@8.59.4(typescript@6.0.3)': + '@typescript-eslint/tsconfig-utils@8.66.0(typescript@6.0.3)': dependencies: typescript: 6.0.3 - '@typescript-eslint/type-utils@8.59.4(eslint@10.4.0)(typescript@6.0.3)': + '@typescript-eslint/type-utils@8.66.0(eslint@10.8.1)(typescript@6.0.3)': dependencies: - '@typescript-eslint/types': 8.59.4 - '@typescript-eslint/typescript-estree': 8.59.4(typescript@6.0.3) - '@typescript-eslint/utils': 8.59.4(eslint@10.4.0)(typescript@6.0.3) + '@typescript-eslint/types': 8.66.0 + '@typescript-eslint/typescript-estree': 8.66.0(typescript@6.0.3) + '@typescript-eslint/utils': 8.66.0(eslint@10.8.1)(typescript@6.0.3) debug: 4.4.3 - eslint: 10.4.0 + eslint: 10.8.1 ts-api-utils: 2.5.0(typescript@6.0.3) typescript: 6.0.3 transitivePeerDependencies: - supports-color - '@typescript-eslint/types@8.59.4': {} + '@typescript-eslint/types@8.66.0': {} - '@typescript-eslint/typescript-estree@8.59.4(typescript@6.0.3)': + '@typescript-eslint/typescript-estree@8.66.0(typescript@6.0.3)': dependencies: - '@typescript-eslint/project-service': 8.59.4(typescript@6.0.3) - '@typescript-eslint/tsconfig-utils': 8.59.4(typescript@6.0.3) - '@typescript-eslint/types': 8.59.4 - '@typescript-eslint/visitor-keys': 8.59.4 + '@typescript-eslint/project-service': 8.66.0(typescript@6.0.3) + '@typescript-eslint/tsconfig-utils': 8.66.0(typescript@6.0.3) + '@typescript-eslint/types': 8.66.0 + '@typescript-eslint/visitor-keys': 8.66.0 debug: 4.4.3 minimatch: 10.2.5 semver: 7.8.0 @@ -2553,20 +2569,20 @@ snapshots: transitivePeerDependencies: - supports-color - '@typescript-eslint/utils@8.59.4(eslint@10.4.0)(typescript@6.0.3)': + '@typescript-eslint/utils@8.66.0(eslint@10.8.1)(typescript@6.0.3)': dependencies: - '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0) - '@typescript-eslint/scope-manager': 8.59.4 - '@typescript-eslint/types': 8.59.4 - '@typescript-eslint/typescript-estree': 8.59.4(typescript@6.0.3) - eslint: 10.4.0 + '@eslint-community/eslint-utils': 4.9.1(eslint@10.8.1) + '@typescript-eslint/scope-manager': 8.66.0 + '@typescript-eslint/types': 8.66.0 + '@typescript-eslint/typescript-estree': 8.66.0(typescript@6.0.3) + eslint: 10.8.1 typescript: 6.0.3 transitivePeerDependencies: - supports-color - '@typescript-eslint/visitor-keys@8.59.4': + '@typescript-eslint/visitor-keys@8.66.0': dependencies: - '@typescript-eslint/types': 8.59.4 + '@typescript-eslint/types': 8.66.0 eslint-visitor-keys: 5.0.1 '@ungap/structured-clone@1.3.1': {} @@ -2681,16 +2697,18 @@ snapshots: arg@4.1.3: {} - argparse@2.0.1: {} + argparse@1.0.10: + dependencies: + sprintf-js: 1.0.3 - aws-cdk-lib@2.256.1(constructs@10.6.0): + aws-cdk-lib@2.263.0(constructs@10.8.1): dependencies: - '@aws-cdk/asset-awscli-v1': 2.2.273 + '@aws-cdk/asset-awscli-v1': 2.2.282 '@aws-cdk/asset-node-proxy-agent-v6': 2.1.2 - '@aws-cdk/cloud-assembly-schema': 53.27.0 - constructs: 10.6.0 + '@aws-cdk/cloud-assembly-schema': 54.17.0 + constructs: 10.8.1 - aws-cdk@2.1124.1: {} + aws-cdk@2.1135.1: {} babel-jest@30.4.1(@babel/core@7.29.7): dependencies: @@ -2750,16 +2768,16 @@ snapshots: baseline-browser-mapping@2.10.38: {} - brace-expansion@1.1.14: + brace-expansion@1.1.18: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.0: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.6: + brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 @@ -2789,10 +2807,10 @@ snapshots: caniuse-lite@1.0.30001799: {} - cdk-nag@2.38.2(aws-cdk-lib@2.256.1(constructs@10.6.0))(constructs@10.6.0): + cdk-nag@2.38.2(aws-cdk-lib@2.263.0(constructs@10.8.1))(constructs@10.8.1): dependencies: - aws-cdk-lib: 2.256.1(constructs@10.6.0) - constructs: 10.6.0 + aws-cdk-lib: 2.263.0(constructs@10.8.1) + constructs: 10.8.1 chalk@4.1.2: dependencies: @@ -2823,7 +2841,7 @@ snapshots: concat-map@0.0.1: {} - constructs@10.6.0: {} + constructs@10.8.1: {} convert-source-map@2.0.0: {} @@ -2880,14 +2898,14 @@ snapshots: eslint-visitor-keys@5.0.1: {} - eslint@10.4.0: + eslint@10.8.1: dependencies: - '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0) + '@eslint-community/eslint-utils': 4.9.1(eslint@10.8.1) '@eslint-community/regexpp': 4.12.2 '@eslint/config-array': 0.23.5 - '@eslint/config-helpers': 0.6.0 + '@eslint/config-helpers': 0.7.0 '@eslint/core': 1.2.1 - '@eslint/plugin-kit': 0.7.1 + '@eslint/plugin-kit': 0.7.2 '@humanfs/node': 0.16.8 '@humanwhocodes/module-importer': 1.0.1 '@humanwhocodes/retry': 0.4.3 @@ -2921,6 +2939,8 @@ snapshots: acorn-jsx: 5.3.2(acorn@8.16.0) eslint-visitor-keys: 5.0.1 + esprima@4.0.1: {} + esquery@1.7.0: dependencies: estraverse: 5.3.0 @@ -3031,7 +3051,7 @@ snapshots: once: 1.4.0 path-is-absolute: 1.0.1 - globals@17.6.0: {} + globals@17.9.0: {} graceful-fs@4.2.11: {} @@ -3153,15 +3173,15 @@ snapshots: - babel-plugin-macros - supports-color - jest-cli@30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)): + jest-cli@30.4.2(@types/node@25.9.5)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)): dependencies: - '@jest/core': 30.4.2(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)) + '@jest/core': 30.4.2(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)) '@jest/test-result': 30.4.1 '@jest/types': 30.4.1 chalk: 4.1.2 exit-x: 0.2.2 import-local: 3.2.0 - jest-config: 30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)) + jest-config: 30.4.2(@types/node@25.9.5)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)) jest-util: 30.4.1 jest-validate: 30.4.1 yargs: 17.7.2 @@ -3172,7 +3192,7 @@ snapshots: - supports-color - ts-node - jest-config@30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)): + jest-config@30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)): dependencies: '@babel/core': 7.29.7 '@jest/get-type': 30.1.0 @@ -3199,7 +3219,39 @@ snapshots: strip-json-comments: 3.1.1 optionalDependencies: '@types/node': 25.9.1 - ts-node: 10.9.2(@types/node@25.9.1)(typescript@6.0.3) + ts-node: 10.9.2(@types/node@25.9.5)(typescript@6.0.3) + transitivePeerDependencies: + - babel-plugin-macros + - supports-color + + jest-config@30.4.2(@types/node@25.9.5)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)): + dependencies: + '@babel/core': 7.29.7 + '@jest/get-type': 30.1.0 + '@jest/pattern': 30.4.0 + '@jest/test-sequencer': 30.4.1 + '@jest/types': 30.4.1 + babel-jest: 30.4.1(@babel/core@7.29.7) + chalk: 4.1.2 + ci-info: 4.4.0 + deepmerge: 4.3.1 + glob: 10.5.0 + graceful-fs: 4.2.11 + jest-circus: 30.4.2 + jest-docblock: 30.4.0 + jest-environment-node: 30.4.1 + jest-regex-util: 30.4.0 + jest-resolve: 30.4.1 + jest-runner: 30.4.2 + jest-util: 30.4.1 + jest-validate: 30.4.1 + parse-json: 5.2.0 + pretty-format: 30.4.1 + slash: 3.0.0 + strip-json-comments: 3.1.1 + optionalDependencies: + '@types/node': 25.9.5 + ts-node: 10.9.2(@types/node@25.9.5)(typescript@6.0.3) transitivePeerDependencies: - babel-plugin-macros - supports-color @@ -3420,12 +3472,12 @@ snapshots: merge-stream: 2.0.0 supports-color: 8.1.1 - jest@30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)): + jest@30.4.2(@types/node@25.9.5)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)): dependencies: - '@jest/core': 30.4.2(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)) + '@jest/core': 30.4.2(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)) '@jest/types': 30.4.1 import-local: 3.2.0 - jest-cli: 30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)) + jest-cli: 30.4.2(@types/node@25.9.5)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)) transitivePeerDependencies: - '@types/node' - babel-plugin-macros @@ -3435,9 +3487,10 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.2.0: + js-yaml@3.15.1: dependencies: - argparse: 2.0.1 + argparse: 1.0.10 + esprima: 4.0.1 jsesc@3.1.0: {} @@ -3496,15 +3549,15 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.9 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.14 + brace-expansion: 1.1.18 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.0 + brace-expansion: 2.1.4 minimist@1.2.8: {} @@ -3597,7 +3650,7 @@ snapshots: prelude-ls@1.2.1: {} - prettier@3.8.3: {} + prettier@3.9.6: {} pretty-format@30.4.1: dependencies: @@ -3626,6 +3679,8 @@ snapshots: semver@7.8.0: {} + semver@7.8.5: {} + shebang-command@2.0.0: dependencies: shebang-regex: 3.0.0 @@ -3650,6 +3705,8 @@ snapshots: source-map@0.6.1: {} + sprintf-js@1.0.3: {} + stack-utils@2.0.6: dependencies: escape-string-regexp: 2.0.0 @@ -3716,16 +3773,16 @@ snapshots: dependencies: typescript: 6.0.3 - ts-jest@29.4.10(@babel/core@7.29.7)(@jest/transform@30.4.1)(@jest/types@30.4.1)(babel-jest@30.4.1(@babel/core@7.29.7))(jest-util@30.4.1)(jest@30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)))(typescript@6.0.3): + ts-jest@29.4.12(@babel/core@7.29.7)(@jest/transform@30.4.1)(@jest/types@30.4.1)(babel-jest@30.4.1(@babel/core@7.29.7))(jest-util@30.4.1)(jest@30.4.2(@types/node@25.9.5)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)))(typescript@6.0.3): dependencies: bs-logger: 0.2.6 fast-json-stable-stringify: 2.1.0 handlebars: 4.7.9 - jest: 30.4.2(@types/node@25.9.1)(ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3)) + jest: 30.4.2(@types/node@25.9.5)(ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3)) json5: 2.2.3 lodash.memoize: 4.1.2 make-error: 1.3.6 - semver: 7.8.0 + semver: 7.8.5 type-fest: 4.41.0 typescript: 6.0.3 yargs-parser: 21.1.1 @@ -3736,14 +3793,14 @@ snapshots: babel-jest: 30.4.1(@babel/core@7.29.7) jest-util: 30.4.1 - ts-node@10.9.2(@types/node@25.9.1)(typescript@6.0.3): + ts-node@10.9.2(@types/node@25.9.5)(typescript@6.0.3): dependencies: '@cspotcode/source-map-support': 0.8.1 '@tsconfig/node10': 1.0.12 '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.4 - '@types/node': 25.9.1 + '@types/node': 25.9.5 acorn: 8.16.0 acorn-walk: 8.3.5 arg: 4.1.3 @@ -3767,13 +3824,13 @@ snapshots: type-fest@4.41.0: {} - typescript-eslint@8.59.4(eslint@10.4.0)(typescript@6.0.3): + typescript-eslint@8.66.0(eslint@10.8.1)(typescript@6.0.3): dependencies: - '@typescript-eslint/eslint-plugin': 8.59.4(@typescript-eslint/parser@8.59.4(eslint@10.4.0)(typescript@6.0.3))(eslint@10.4.0)(typescript@6.0.3) - '@typescript-eslint/parser': 8.59.4(eslint@10.4.0)(typescript@6.0.3) - '@typescript-eslint/typescript-estree': 8.59.4(typescript@6.0.3) - '@typescript-eslint/utils': 8.59.4(eslint@10.4.0)(typescript@6.0.3) - eslint: 10.4.0 + '@typescript-eslint/eslint-plugin': 8.66.0(@typescript-eslint/parser@8.66.0(eslint@10.8.1)(typescript@6.0.3))(eslint@10.8.1)(typescript@6.0.3) + '@typescript-eslint/parser': 8.66.0(eslint@10.8.1)(typescript@6.0.3) + '@typescript-eslint/typescript-estree': 8.66.0(typescript@6.0.3) + '@typescript-eslint/utils': 8.66.0(eslint@10.8.1)(typescript@6.0.3) + eslint: 10.8.1 typescript: 6.0.3 transitivePeerDependencies: - supports-color diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 5f19178..30d1c6d 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,8 +1,2 @@ allowBuilds: unrs-resolver: false -minimumReleaseAgeExclude: - - js-yaml@4.1.2 - - '@babel/core@7.29.1' -overrides: - diff@<4.0.4: '>=4.0.4' - js-yaml@<=4.1.1: ^4.1.2 diff --git a/test/authorization-manager.test.ts b/test/authorization-manager.test.ts index 2f4563e..085fdb5 100644 --- a/test/authorization-manager.test.ts +++ b/test/authorization-manager.test.ts @@ -1,9 +1,10 @@ import { App, Aspects, Stack } from 'aws-cdk-lib'; -import { Annotations, Match } from 'aws-cdk-lib/assertions'; +import { Annotations, Match, Template } from 'aws-cdk-lib/assertions'; import { SynthesisMessage } from 'aws-cdk-lib/cx-api'; import { AwsSolutionsChecks, NagSuppressions } from 'cdk-nag'; import { AuthorizationManagerStack } from '../infrastructure/authorization-manager/stage/stack'; import { getAuthorizationManagerStackProps } from '../infrastructure/authorization-manager/stage/config'; +import cedarSchemaJson from '../infrastructure/authorization-manager/stage/cedarSchema.json'; function synthesisMessageToString(sm: SynthesisMessage): string { return `${sm.entry.data} [${sm.id}]`; @@ -39,6 +40,74 @@ describe('cdk-nag-authorization-stack', () => { }); }); +describe('workflow state transition authorization', () => { + const workflowStateActions = { + cancel: 'POST /api/v1/workflowrun/state/cancel/{PROXY+}', + deprecate: 'POST /api/v1/workflowrun/state/deprecate/{PROXY+}', + resolve: 'POST /api/v1/workflowrun/state/resolve/{PROXY+}', + } as const; + + const app = new App({}); + const stack = new AuthorizationManagerStack(app, 'WorkflowAuthorizationTestStack', { + ...getAuthorizationManagerStackProps('PROD'), + env: { + account: '123456789', + region: 'ap-southeast-2', + }, + }); + const template = Template.fromStack(stack); + const policies = Object.values( + template.findResources('AWS::VerifiedPermissions::Policy') + ) as Record[]; + + const serializedPolicy = (description: string): string => { + const matchingPolicies = policies.filter((policy) => + JSON.stringify(policy).includes(`"Description":"${description}"`) + ); + + expect(matchingPolicies).toHaveLength(1); + return JSON.stringify(matchingPolicies[0]); + }; + + test('registers only protected workflow state transition actions in the strict Cedar schema', () => { + const actions = cedarSchemaJson.OrcaBus.actions; + + expect(actions).toHaveProperty(workflowStateActions.deprecate); + expect(actions).toHaveProperty(workflowStateActions.resolve); + expect(actions).not.toHaveProperty(workflowStateActions.cancel); + + for (const action of [workflowStateActions.deprecate, workflowStateActions.resolve]) { + const proxySuffix = '/{PROXY+}'; + const baseAction = action.slice(0, -proxySuffix.length); + + expect(action.endsWith(proxySuffix)).toBe(true); + expect(actions).not.toHaveProperty(baseAction); + expect(actions).not.toHaveProperty(`${baseAction}/`); + } + }); + + test('grants deprecation only to curators among non-admin groups', () => { + const policy = serializedPolicy( + 'Permissions to mark a workflowrun as deprecated in WORKFLOW microservice' + ); + + expect(policy).toContain('|curators'); + expect(policy).toContain(workflowStateActions.deprecate); + expect(policy).toContain('OrcaBus::Microservice::\\"WORKFLOW\\"'); + }); + + test('keeps resolution admin-only through the admin wildcard policy', () => { + const adminPolicy = serializedPolicy('Allow all actions on all resources'); + const nonAdminPolicies = policies.filter( + (policy) => !JSON.stringify(policy).includes('Allow all actions on all resources') + ); + + expect(adminPolicy).toContain('|admin'); + expect(adminPolicy).toContain('action,\\n resource'); + expect(JSON.stringify(nonAdminPolicies)).not.toContain(workflowStateActions.resolve); + }); +}); + /** * apply nag suppression * @param stack