@caelo-cms/provisioning 0.10.47 → 0.10.48

package/src/mcp-iap-stacks.test.ts

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Issue #37 — new installs must get MCP-through-IAP from Pulumi alone, with the
+ * same names `cms-provision upgrade` uses for older installs (mcp-iap.ts).
+ * Pure-string checks on the stack programs, like the other stack tests.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { mcpIapServiceAccountEmail } from "./gcp-names.js";
+import { adminEnvContract, databaseUrls } from "./stack-contract.js";
+
+const stack = (provider: string) =>
+  readFileSync(resolve(import.meta.dir, `../stacks/${provider}/index.ts`), "utf8");
+
+describe.each(["gcp", "gcp-firebase"])("%s stack — MCP through IAP", (provider) => {
+  const src = stack(provider);
+
+  it("creates the MCP service account under the id upgrade uses, tolerating one upgrade created", () => {
+    expect(src).toContain("accountId: MCP_IAP_SERVICE_ACCOUNT_ID,");
+    expect(src).toContain("createIgnoreAlreadyExists: true");
+  });
+
+  it("lets every IAP-allowlisted principal sign as it", () => {
+    expect(src).toMatch(
+      /for \(const principal of iapAllowlist\) \{[\s\S]*?serviceaccount\.IAMMember\([\s\S]*?roles\/iam\.serviceAccountTokenCreator/,
+    );
+  });
+
+  it("allowlists the service account on the admin's IAP resource", () => {
+    const iapType =
+      provider === "gcp" ? "WebBackendServiceIamMember" : "WebCloudRunServiceIamMember";
+    expect(src).toMatch(
+      new RegExp(
+        `${iapType}\\(\\s*\`\\$\\{namePrefix\\}-admin-iap-mcp\`[\\s\\S]*?roles/iap\\.httpsResourceAccessor`,
+      ),
+    );
+  });
+
+  it("hands the email to the admin for the /settings/mcp command (via the env contract)", () => {
+    // The stack builds the admin env from adminEnvContract (parity test);
+    // the contract carries the SA upgrade ensures.
+    const env = adminEnvContract({
+      provider: "gcp",
+      projectId: "p",
+      env: "production",
+      domain: "d.com",
+      region: "r",
+      databaseUrls: databaseUrls("10.0.0.3"),
+    });
+    expect(env).toContainEqual({
+      name: "CAELO_MCP_IAP_SERVICE_ACCOUNT",
+      value: mcpIapServiceAccountEmail("p"),
+    });
+  });
+});

package/src/mcp-iap.test.ts

@@ -0,0 +1,149 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import { mcpIapServiceAccountEmail } from "./gcp-names.js";
+import { ensureMcpIapAccess, iapOperators } from "./mcp-iap.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+
+const POLICY = JSON.stringify({
+  bindings: [
+    {
+      role: "roles/iap.httpsResourceAccessor",
+      members: [
+        "user:owner@example.com",
+        "group:editors@example.com",
+        "serviceAccount:caelo-mcp@p.iam.gserviceaccount.com",
+      ],
+    },
+    { role: "roles/iap.admin", members: ["user:admin@example.com"] },
+  ],
+});
+
+/** Fake gcloud answering by command prefix; records every call. */
+function fakeGcloud(answers: Record<string, GcloudResult[]>) {
+  const calls: string[][] = [];
+  const run = async (args: string[]) => {
+    calls.push(args);
+    const key = Object.keys(answers).find((k) => args.join(" ").startsWith(k));
+    return (key && answers[key]?.shift()) || ok();
+  };
+  return { run, calls };
+}
+
+const cloudRun = {
+  kind: "cloud-run",
+  service: "caelo-production-admin-abc",
+  region: "europe-west1",
+} as const;
+
+describe("iapOperators", () => {
+  it("takes users and groups with IAP access, not service accounts or other roles", () => {
+    expect(iapOperators(POLICY)).toEqual(["user:owner@example.com", "group:editors@example.com"]);
+  });
+
+  it("ignores conditional bindings and empty policies", () => {
+    expect(
+      iapOperators(
+        JSON.stringify({
+          bindings: [
+            {
+              role: "roles/iap.httpsResourceAccessor",
+              members: ["user:x@y"],
+              condition: { title: "t" },
+            },
+          ],
+        }),
+      ),
+    ).toEqual([]);
+    expect(iapOperators("{}")).toEqual([]);
+  });
+});
+
+describe("ensureMcpIapAccess", () => {
+  it("creates the SA, allowlists it on IAP and lets every IAP operator sign as it", async () => {
+    const { run, calls } = fakeGcloud({
+      "iam service-accounts describe": [fail("NOT_FOUND")],
+      "iap web get-iam-policy": [ok(POLICY)],
+    });
+    const r = await ensureMcpIapAccess({
+      projectId: "p",
+      resource: cloudRun,
+      run,
+      sleep: async () => {},
+    });
+
+    expect(r).toEqual({
+      ok: true,
+      serviceAccount: mcpIapServiceAccountEmail("p"),
+      operators: ["user:owner@example.com", "group:editors@example.com"],
+    });
+    const lines = calls.map((c) => c.join(" "));
+    expect(lines.some((l) => l.startsWith("iam service-accounts create caelo-mcp"))).toBe(true);
+    expect(lines).toContainEqual(
+      "iap web add-iam-policy-binding --resource-type=cloud-run --service=caelo-production-admin-abc --region=europe-west1 --member=serviceAccount:caelo-mcp@p.iam.gserviceaccount.com --role=roles/iap.httpsResourceAccessor --condition=None --project=p --quiet",
+    );
+    for (const m of ["user:owner@example.com", "group:editors@example.com"]) {
+      expect(lines).toContainEqual(
+        `iam service-accounts add-iam-policy-binding caelo-mcp@p.iam.gserviceaccount.com --member=${m} --role=roles/iam.serviceAccountTokenCreator --condition=None --project=p --quiet`,
+      );
+    }
+  });
+
+  it("is a no-op re-run when the SA exists (no create)", async () => {
+    const { run, calls } = fakeGcloud({ "iap web get-iam-policy": [ok(POLICY)] });
+    const r = await ensureMcpIapAccess({ projectId: "p", resource: cloudRun, run });
+    expect(r.ok).toBe(true);
+    expect(calls.some((c) => c.join(" ").startsWith("iam service-accounts create"))).toBe(false);
+  });
+
+  it("addresses the LB backend service on the gcp provider", async () => {
+    const { run, calls } = fakeGcloud({ "iap web get-iam-policy": [ok(POLICY)] });
+    await ensureMcpIapAccess({
+      projectId: "p",
+      resource: { kind: "backend-services", service: "caelo-production-admin-backend-1a2b" },
+      run,
+    });
+    const iapCalls = calls.filter((c) => c[0] === "iap");
+    for (const c of iapCalls) {
+      expect(c).toContain("--resource-type=backend-services");
+      expect(c).toContain("--service=caelo-production-admin-backend-1a2b");
+      expect(c.some((a) => a.startsWith("--region"))).toBe(false);
+    }
+  });
+
+  it("retries bindings while a new SA propagates", async () => {
+    const { run, calls } = fakeGcloud({
+      "iam service-accounts describe": [fail("NOT_FOUND")],
+      "iap web get-iam-policy": [ok(POLICY)],
+      "iap web add-iam-policy-binding": [fail("Service account caelo-mcp@p does not exist.")],
+    });
+    const slept: number[] = [];
+    const r = await ensureMcpIapAccess({
+      projectId: "p",
+      resource: cloudRun,
+      run,
+      sleep: async (ms) => {
+        slept.push(ms);
+      },
+    });
+    expect(r.ok).toBe(true);
+    expect(
+      calls.filter((c) => c.join(" ").startsWith("iap web add-iam-policy-binding")),
+    ).toHaveLength(2);
+    expect(slept).toEqual([2_000]);
+  });
+
+  it("reports a failure instead of half-configuring silently", async () => {
+    const { run } = fakeGcloud({
+      "iap web get-iam-policy": [fail("PERMISSION_DENIED: iap.web.getIamPolicy")],
+    });
+    const r = await ensureMcpIapAccess({ projectId: "p", resource: cloudRun, run });
+    expect(r).toEqual({
+      ok: false,
+      error: "read IAP policy: PERMISSION_DENIED: iap.web.getIamPolicy",
+    });
+  });
+});

package/src/mcp-iap.ts

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * MCP access through IAP (issue #37), for installs that exist already.
+ *
+ * External MCP clients reach the IAP-protected admin with a JWT signed by a
+ * dedicated service account (see packages/mcp-server/src/ingress-auth.ts).
+ * New installs get that SA from the Pulumi stacks; `cms-provision upgrade`
+ * calls {@link ensureMcpIapAccess} so installs provisioned before it get the
+ * same setup on their next upgrade, with no operator config:
+ *
+ *   1. service account `caelo-mcp@<project>` (created if missing)
+ *   2. `roles/iap.httpsResourceAccessor` for that SA on the admin's IAP
+ *      resource (Cloud Run service on gcp-firebase, LB backend on gcp)
+ *   3. `roles/iam.serviceAccountTokenCreator` on that SA for every user /
+ *      group the IAP policy already lets in — exactly the people who can
+ *      open the admin in a browser can also drive it over MCP
+ *
+ * Every step is an additive IAM binding or a create-if-missing, so re-running
+ * is a no-op. The caller puts the returned email into the admin's
+ * `CAELO_MCP_IAP_SERVICE_ACCOUNT` env var, which /settings/mcp shows in the
+ * `claude mcp add` command.
+ */
+
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
+import { MCP_IAP_SERVICE_ACCOUNT_ID, mcpIapServiceAccountEmail } from "./gcp-names.js";
+
+/** The admin's IAP resource, as `gcloud iap web` addresses it. */
+export type IapResource =
+  | { readonly kind: "cloud-run"; readonly service: string; readonly region: string }
+  | { readonly kind: "backend-services"; readonly service: string };
+
+/** `gcloud iap web …` flags addressing {@link IapResource}. */
+export function iapResourceArgs(resource: IapResource): string[] {
+  return resource.kind === "cloud-run"
+    ? ["--resource-type=cloud-run", `--service=${resource.service}`, `--region=${resource.region}`]
+    : ["--resource-type=backend-services", `--service=${resource.service}`];
+}
+
+/** Users and groups IAP lets into the admin (service accounts excluded). */
+export function iapOperators(policyJson: string): string[] {
+  const policy = JSON.parse(policyJson) as {
+    bindings?: { role: string; members?: string[]; condition?: unknown }[];
+  };
+  const members = (policy.bindings ?? [])
+    .filter((b) => b.role === "roles/iap.httpsResourceAccessor" && !b.condition)
+    .flatMap((b) => b.members ?? []);
+  return [...new Set(members.filter((m) => m.startsWith("user:") || m.startsWith("group:")))];
+}
+
+export async function ensureMcpIapAccess(opts: {
+  projectId: string;
+  resource: IapResource;
+  run?: GcloudRunner;
+  sleep?: Sleep;
+}): Promise<
+  { ok: true; serviceAccount: string; operators: string[] } | { ok: false; error: string }
+> {
+  const run = opts.run ?? defaultGcloud;
+  const sleep = opts.sleep ?? realSleep;
+  const project = `--project=${opts.projectId}`;
+  const sa = mcpIapServiceAccountEmail(opts.projectId);
+
+  // A freshly created SA takes a few seconds to become bindable.
+  const withRetry = (args: string[]) => runWithRetry(run, sleep, args);
+
+  const describe = await run([
+    "iam",
+    "service-accounts",
+    "describe",
+    sa,
+    project,
+    "--format=value(email)",
+  ]);
+  if (!describe.ok) {
+    const create = await run([
+      "iam",
+      "service-accounts",
+      "create",
+      MCP_IAP_SERVICE_ACCOUNT_ID,
+      "--display-name=Caelo MCP (IAP ingress)",
+      "--description=Signs the IAP credential external MCP clients use to reach the admin (issue #37).",
+      project,
+    ]);
+    if (!create.ok && !/already exists/i.test(create.stderr)) {
+      return { ok: false, error: `create ${sa}: ${create.stderr.trim()}` };
+    }
+  }
+
+  const policy = await run([
+    "iap",
+    "web",
+    "get-iam-policy",
+    ...iapResourceArgs(opts.resource),
+    project,
+    "--format=json",
+  ]);
+  if (!policy.ok) return { ok: false, error: `read IAP policy: ${policy.stderr.trim()}` };
+  const operators = iapOperators(policy.stdout);
+
+  const allow = await withRetry([
+    "iap",
+    "web",
+    "add-iam-policy-binding",
+    ...iapResourceArgs(opts.resource),
+    `--member=serviceAccount:${sa}`,
+    "--role=roles/iap.httpsResourceAccessor",
+    "--condition=None",
+    project,
+    "--quiet",
+  ]);
+  if (!allow.ok) return { ok: false, error: `allow ${sa} on IAP: ${allow.stderr.trim()}` };
+
+  for (const member of operators) {
+    const grant = await withRetry([
+      "iam",
+      "service-accounts",
+      "add-iam-policy-binding",
+      sa,
+      `--member=${member}`,
+      "--role=roles/iam.serviceAccountTokenCreator",
+      "--condition=None",
+      project,
+      "--quiet",
+    ]);
+    if (!grant.ok)
+      return { ok: false, error: `let ${member} sign as ${sa}: ${grant.stderr.trim()}` };
+  }
+  return { ok: true, serviceAccount: sa, operators };
+}

package/src/media-volume.test.ts

@@ -0,0 +1,296 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The admin's media volume: upgrade gives existing GCP installs the media
+ * bucket as a Cloud Storage volume, the same shape the stacks deploy, and
+ * adds only what a service is missing. Regression for media living on the
+ * Cloud Run container's in-memory filesystem (lost on every new revision and
+ * scale-to-zero; Stage then failed with "storage object missing").
+ *
+ * The service JSON below is what `gcloud run services describe --format=json`
+ * returns (Knative serving.knative.dev/v1), i.e. the fake gcloud's describe
+ * output for each install state.
+ */
+
+import { describe, expect, it } from "bun:test";
+import {
+  adminEnvContract,
+  adminMediaVolume,
+  adminMediaVolumeTemplate,
+  databaseUrls,
+  MEDIA_MOUNT_PATH,
+} from "./stack-contract.js";
+import { liveVolumes, planMediaVolume, serviceRollArgs } from "./stack-converge.js";
+
+const BUCKET = "acme-caelo-production-media";
+const desired = adminMediaVolume("acme", "production");
+
+/** A described admin service with the given template parts. */
+function describedAdmin(parts: {
+  executionEnvironment?: string;
+  volumes?: unknown[];
+  mounts?: unknown[];
+}): string {
+  return JSON.stringify({
+    apiVersion: "serving.knative.dev/v1",
+    kind: "Service",
+    metadata: { name: "caelo-production-admin-aaa" },
+    spec: {
+      template: {
+        metadata: {
+          annotations: {
+            "autoscaling.knative.dev/maxScale": "3",
+            ...(parts.executionEnvironment
+              ? { "run.googleapis.com/execution-environment": parts.executionEnvironment }
+              : {}),
+          },
+        },
+        spec: {
+          serviceAccountName: "caelo-production-run-sa@acme.iam.gserviceaccount.com",
+          containers: [
+            {
+              image: "img@sha256:1",
+              env: [{ name: "CAELO_PROVIDER", value: "gcp-firebase" }],
+              ...(parts.mounts ? { volumeMounts: parts.mounts } : {}),
+            },
+          ],
+          ...(parts.volumes ? { volumes: parts.volumes } : {}),
+        },
+      },
+    },
+  });
+}
+
+const gcsVolume = (bucket: string, extra: Record<string, unknown> = {}) => ({
+  name: "media",
+  csi: {
+    driver: "gcsfuse.run.googleapis.com",
+    volumeAttributes: { bucketName: bucket },
+    ...extra,
+  },
+});
+const mediaMount = { name: "media", mountPath: MEDIA_MOUNT_PATH };
+
+/**
+ * A fake `gcloud run services update` for the volume flags: applies them to
+ * a described service the way Cloud Run does, and fails like gcloud on a
+ * duplicate volume name or mount path.
+ */
+function fakeGcloudServicesUpdate(serviceJson: string, argv: readonly string[]): string {
+  const svc = JSON.parse(serviceJson);
+  const template = svc.spec.template;
+  const container = template.spec.containers[0];
+  const kv = (v: string) =>
+    Object.fromEntries(v.split(",").map((p) => p.split("=") as [string, string]));
+  // Accept both `--flag=value` and `--flag value`.
+  const flags: [string, string][] = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i] ?? "";
+    const eq = a.indexOf("=");
+    if (eq > 0) flags.push([a.slice(0, eq), a.slice(eq + 1)]);
+    else flags.push([a, argv[++i] ?? ""]);
+  }
+  for (const [flag, value] of flags) {
+    if (flag === "--execution-environment") {
+      template.metadata.annotations["run.googleapis.com/execution-environment"] = value;
+    } else if (flag === "--add-volume") {
+      const v = kv(value);
+      template.spec.volumes ??= [];
+      if (template.spec.volumes.some((x: { name: string }) => x.name === v.name)) {
+        throw new Error(`ERROR: (gcloud.run.services.update) volume ${v.name} already exists`);
+      }
+      expect(v.type).toBe("cloud-storage");
+      template.spec.volumes.push({
+        name: v.name,
+        csi: { driver: "gcsfuse.run.googleapis.com", volumeAttributes: { bucketName: v.bucket } },
+      });
+    } else if (flag === "--add-volume-mount") {
+      const m = kv(value);
+      container.volumeMounts ??= [];
+      if (
+        container.volumeMounts.some((x: { mountPath: string }) => x.mountPath === m["mount-path"])
+      ) {
+        throw new Error(`ERROR: (gcloud.run.services.update) mount path ${m["mount-path"]} in use`);
+      }
+      container.volumeMounts.push({ name: m.volume, mountPath: m["mount-path"] });
+    } else {
+      throw new Error(`fake gcloud: unexpected flag ${flag}`);
+    }
+  }
+  return JSON.stringify(svc);
+}
+
+/** What the operator's manual hotfix leaves on the service. */
+const HOTFIXED = describedAdmin({
+  executionEnvironment: "gen2",
+  volumes: [gcsVolume(BUCKET)],
+  mounts: [mediaMount],
+});
+
+describe("admin media volume contract", () => {
+  it("is the install's media bucket at the admin's default media root", () => {
+    expect(desired).toEqual({
+      volumeName: "media",
+      bucket: BUCKET,
+      mountPath: "/app/apps/admin/data/media",
+    });
+  });
+
+  it("the stacks deploy it gen2, read-write, mounted on the admin container", () => {
+    expect(adminMediaVolumeTemplate(desired)).toEqual({
+      executionEnvironment: "EXECUTION_ENVIRONMENT_GEN2",
+      volumes: [{ name: "media", gcs: { bucket: BUCKET, readOnly: false } }],
+      volumeMounts: [{ name: "media", mountPath: MEDIA_MOUNT_PATH }],
+    });
+  });
+
+  it("the admin env points MEDIA_ROOT_DIR at the mount", () => {
+    const env = adminEnvContract({
+      provider: "gcp",
+      projectId: "acme",
+      env: "production",
+      domain: "acme.com",
+      stagingHost: "staging.acme.com",
+      region: "europe-west1",
+      databaseUrls: databaseUrls("10.0.0.3"),
+    });
+    expect(env).toContainEqual({ name: "MEDIA_ROOT_DIR", value: MEDIA_MOUNT_PATH });
+  });
+});
+
+describe("planMediaVolume (upgrade)", () => {
+  it("regression: an install whose admin has no volume gets gen2 + the volume + the mount", () => {
+    const plan = planMediaVolume(liveVolumes(describedAdmin({})), desired);
+    expect(plan).toEqual({
+      ok: true,
+      flags: [
+        "--execution-environment=gen2",
+        `--add-volume=name=media,type=cloud-storage,bucket=${BUCKET}`,
+        `--add-volume-mount=volume=media,mount-path=${MEDIA_MOUNT_PATH}`,
+      ],
+      changes: expect.any(Array),
+    });
+  });
+
+  it("treats the operator's identical manual hotfix as converged (no flags, no new volume)", () => {
+    expect(planMediaVolume(liveVolumes(HOTFIXED), desired)).toEqual({
+      ok: true,
+      flags: [],
+      changes: [],
+    });
+  });
+
+  it("is idempotent: once the fake gcloud applied the roll, the next upgrade adds nothing", () => {
+    const first = planMediaVolume(liveVolumes(describedAdmin({})), desired);
+    if (!first.ok) throw new Error(first.error);
+    const rolled = fakeGcloudServicesUpdate(describedAdmin({}), first.flags);
+    expect(planMediaVolume(liveVolumes(rolled), desired)).toEqual({
+      ok: true,
+      flags: [],
+      changes: [],
+    });
+    // The upgrade flags and the operator's manual hotfix produce the same service.
+    const hotfix = fakeGcloudServicesUpdate(describedAdmin({}), [
+      "--execution-environment",
+      "gen2",
+      "--add-volume",
+      `name=media,type=cloud-storage,bucket=${BUCKET}`,
+      "--add-volume-mount",
+      `volume=media,mount-path=${MEDIA_MOUNT_PATH}`,
+    ]);
+    expect(liveVolumes(rolled)).toEqual(liveVolumes(hotfix));
+  });
+
+  it("keeps operator mount options on an otherwise identical volume", () => {
+    const live = describedAdmin({
+      executionEnvironment: "gen2",
+      volumes: [
+        gcsVolume(BUCKET, {
+          volumeAttributes: { bucketName: BUCKET, mountOptions: "implicit-dirs" },
+        }),
+      ],
+      mounts: [mediaMount],
+    });
+    expect(planMediaVolume(liveVolumes(live), desired)).toEqual({
+      ok: true,
+      flags: [],
+      changes: [],
+    });
+  });
+
+  it("adds only what is missing", () => {
+    const gen1 = describedAdmin({
+      executionEnvironment: "gen1",
+      volumes: [gcsVolume(BUCKET)],
+      mounts: [mediaMount],
+    });
+    expect(planMediaVolume(liveVolumes(gen1), desired)).toMatchObject({
+      ok: true,
+      flags: ["--execution-environment=gen2"],
+    });
+    const noMount = describedAdmin({ executionEnvironment: "gen2", volumes: [gcsVolume(BUCKET)] });
+    expect(planMediaVolume(liveVolumes(noMount), desired)).toMatchObject({
+      ok: true,
+      flags: [`--add-volume-mount=volume=media,mount-path=${MEDIA_MOUNT_PATH}`],
+    });
+  });
+
+  it("refuses a media volume of another bucket instead of replacing it", () => {
+    const live = describedAdmin({
+      executionEnvironment: "gen2",
+      volumes: [gcsVolume("other-bucket")],
+      mounts: [mediaMount],
+    });
+    const plan = planMediaVolume(liveVolumes(live), desired);
+    expect(plan.ok).toBe(false);
+    expect(!plan.ok && plan.error).toContain("other-bucket");
+    expect(!plan.ok && plan.error).toContain(BUCKET);
+  });
+
+  it("refuses a read-only or non-Cloud-Storage media volume", () => {
+    for (const volume of [
+      gcsVolume(BUCKET, { readOnly: true }),
+      { name: "media", emptyDir: { medium: "Memory" } },
+    ]) {
+      const live = describedAdmin({
+        executionEnvironment: "gen2",
+        volumes: [volume],
+        mounts: [mediaMount],
+      });
+      expect(planMediaVolume(liveVolumes(live), desired).ok).toBe(false);
+    }
+  });
+
+  it("refuses another volume at the media path, and the media volume mounted elsewhere", () => {
+    const other = describedAdmin({
+      volumes: [{ name: "scratch", emptyDir: {} }],
+      mounts: [{ name: "scratch", mountPath: MEDIA_MOUNT_PATH }],
+    });
+    const otherPlan = planMediaVolume(liveVolumes(other), desired);
+    expect(!otherPlan.ok && otherPlan.error).toContain('volume "scratch"');
+    const elsewhere = describedAdmin({
+      executionEnvironment: "gen2",
+      volumes: [gcsVolume(BUCKET)],
+      mounts: [{ name: "media", mountPath: "/mnt/media" }],
+    });
+    const elsewherePlan = planMediaVolume(liveVolumes(elsewhere), desired);
+    expect(!elsewherePlan.ok && elsewherePlan.error).toContain("/mnt/media");
+  });
+
+  it("rides the image roll's single services update", () => {
+    const plan = planMediaVolume(liveVolumes(describedAdmin({})), desired);
+    if (!plan.ok) throw new Error(plan.error);
+    const args = serviceRollArgs({
+      serviceName: "caelo-production-admin-aaa",
+      region: "europe-west1",
+      projectId: "acme",
+      imageRef: "img@sha256:1",
+      serviceAccount: "caelo-production-run-sa@acme.iam.gserviceaccount.com",
+      envFlags: [`--update-env-vars=MEDIA_ROOT_DIR=${MEDIA_MOUNT_PATH}`],
+      volumeFlags: plan.flags,
+    });
+    expect(args.slice(0, 3)).toEqual(["run", "services", "update"]);
+    for (const f of plan.flags) expect(args).toContain(f);
+    expect(args.at(-1)).toBe("--quiet");
+  });
+});