Add deprecate and resolve workflow run policy

infrastructure/authorization-manager/stage/README.md

@@ -29,14 +29,18 @@ Policies are currently assigned based on groups from the Cognito User Pool. The
 
 ### Permissions
 
-| Description                                                                                       | Curators           | Bioinfo            |
-| ------------------------------------------------------------------------------------------------- | ------------------ | ------------------ |
-| Allow rerun workflows in the WORKFLOW microservice                                                | :white_check_mark: | :white_check_mark: |
-| Allow to sync external metadata in the METADATA microservice                                      | :x:                | :white_check_mark: |
-| Allow to link external entities to a case in the CASE microservice                                | :white_check_mark: | :white_check_mark: |
-| Allow to unlink external entities from a case in the CASE microservice                            | :white_check_mark: | :white_check_mark: |
-
-`Admin` group will have a wildcard to allow all actions.
+| Description                                                                                       | Admin              | Curators           | Bioinfo            |
+| ------------------------------------------------------------------------------------------------- | ------------------ | ------------------ | ------------------ |
+| Allow rerun workflows in the WORKFLOW microservice                                                | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+| Allow marking workflow runs as deprecated in the WORKFLOW microservice                            | :white_check_mark: | :white_check_mark: | :x:                |
+| Allow marking workflow runs as resolved in the WORKFLOW microservice                              | :white_check_mark: | :x:                | :x:                |
+| Allow to sync external metadata in the METADATA microservice                                      | :white_check_mark: | :x:                | :white_check_mark: |
+| Allow to link external entities to a case in the CASE microservice                                | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+| Allow to unlink external entities from a case in the CASE microservice                            | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+
+The `Admin` group receives these permissions through its wildcard policy. The unrestricted
+`POST /api/v1/workflowrun/state/cancel` endpoint does not use this authorizer and therefore is not
+represented in the Cedar schema or group policies.
 
 NOTE: Please update this table if `GROUP_POLICIES` in `stack.ts` is modified.
 

infrastructure/authorization-manager/stage/cedarSchema.json

@@ -7,6 +7,18 @@
           "resourceTypes": ["Microservice"]
         }
       },
+      "POST /api/v1/workflowrun/state/deprecate": {
+        "appliesTo": {
+          "principalTypes": ["User", "CognitoUserGroup"],
+          "resourceTypes": ["Microservice"]
+        }
+      },
+      "POST /api/v1/workflowrun/state/resolve": {
+        "appliesTo": {
+          "principalTypes": ["User", "CognitoUserGroup"],
+          "resourceTypes": ["Microservice"]
+        }
+      },
       "POST /api/v1/sync/presigned-csv/{PROXY+}": {
         "appliesTo": {
           "principalTypes": ["User", "CognitoUserGroup"],

infrastructure/authorization-manager/stage/stack.ts

@@ -46,6 +46,13 @@ const GROUP_POLICIES: CedarGroupPolicy[] = [
     actions: ['POST /api/v1/workflowrun/{orcabusId}/rerun/{proxy+}'],
     resource: 'WORKFLOW',
   },
+  {
+    id: 'CognitoWorkflowDeprecatePolicy',
+    groups: ['curators'],
+    description: 'Permissions to mark a workflowrun as deprecated in WORKFLOW microservice',
+    actions: ['POST /api/v1/workflowrun/state/deprecate'],
+    resource: 'WORKFLOW',
+  },
   // METADATA resource
   {
     id: 'CognitoBioinfoMetadataModifyPolicy',

package.json

@@ -27,24 +27,24 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.9.1",
-    "aws-cdk": "^2.1124.1",
+    "@types/node": "^25.9.3",
+    "aws-cdk": "^2.1135.0",
     "cdk-nag": "^2.38.2",
-    "eslint": "^10.4.0",
-    "globals": "^17.6.0",
+    "eslint": "^10.8.1",
+    "globals": "^17.9.0",
     "jest": "^30.4.2",
-    "prettier": "^3.8.3",
+    "prettier": "^3.9.6",
     "source-map-support": "^0.5.21",
     "test-js": "^0.0.4",
-    "ts-jest": "^29.4.10",
+    "ts-jest": "^29.4.12",
     "ts-node": "^10.9.2",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.4"
+    "typescript-eslint": "^8.66.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-lambda-python-alpha": "2.256.1-alpha.0",
-    "@orcabus/platform-cdk-constructs": "1.4.0",
-    "aws-cdk-lib": "^2.256.1",
-    "constructs": "^10.6.0"
+    "@aws-cdk/aws-lambda-python-alpha": "2.263.0-alpha.0",
+    "@orcabus/platform-cdk-constructs": "1.8.0",
+    "aws-cdk-lib": "^2.263.0",
+    "constructs": "^10.8.1"
   }
 }