@caelo-cms/provisioning 0.10.48 → 0.10.50

package/src/index.test.ts

@@ -8,12 +8,6 @@ import { generateBootstrapToken } from "./bootstrap-token.js";
 import { generateCaddyfile } from "./caddy.js";
 import { loadCdnCopyAdapter, selfHostedCdnCopy } from "./cdn-copy.js";
 import { generateDockerCompose } from "./compose.js";
-import {
-  emitRedirectsAzureFrontDoor,
-  emitRedirectsCloudFront,
-  emitRedirectsCloudflare,
-  type RedirectRow,
-} from "./redirects-emit.js";
 
 describe("Caddyfile generator", () => {
   it("emits a vhost per domain + email block", () => {
@@ -21,8 +15,9 @@ describe("Caddyfile generator", () => {
       ownerEmail: "owner@example.com",
       publicSiteRoot: "/srv/caelo/output/production/current",
       stagingSiteRoot: "/srv/caelo/output/staging/current",
-      adminPort: 5173,
-      gatewayPort: 8090,
+      tls: "acme",
+      adminUpstream: "caelo-admin:5173",
+      gatewayUpstream: "caelo-gateway:8090",
       domains: [
         { hostname: "example.com", kind: "public", env: "production" },
         { hostname: "staging.example.com", kind: "public", env: "staging" },
@@ -47,12 +42,13 @@ describe("Caddyfile generator", () => {
       ownerEmail: "x@y.z",
       publicSiteRoot: "/srv/caelo/output/production/current",
       stagingSiteRoot: "/srv/caelo/output/staging/current",
-      adminPort: 5173,
-      gatewayPort: 8090,
+      tls: "acme",
+      adminUpstream: "caelo-admin:5173",
+      gatewayUpstream: "caelo-gateway:8090",
       domains: [],
     });
     expect(out).toContain(":8081 {");
-    expect(out).toContain("reverse_proxy localhost:5173");
+    expect(out).toContain("reverse_proxy caelo-admin:5173");
   });
 });
 
@@ -61,8 +57,9 @@ describe("Caddy cache policy for content-hashed assets", () => {
     ownerEmail: "owner@example.com",
     publicSiteRoot: "/srv/caelo/output/production/current",
     stagingSiteRoot: "/srv/caelo/output/staging/current",
-    adminPort: 5173,
-    gatewayPort: 8090,
+    tls: "acme",
+    adminUpstream: "caelo-admin:5173",
+    gatewayUpstream: "caelo-gateway:8090",
     domains: [
       { hostname: "example.com", kind: "public", env: "production" },
       { hostname: "admin.example.com", kind: "admin", env: "production" },
@@ -119,19 +116,18 @@ describe("docker-compose generator", () => {
       domain: "example.com",
       postgresPassword: "supersecret",
       rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
-      minioRootUser: "caelo",
-      minioRootPassword: "miniopass",
       caeloSecretKek: "0".repeat(64),
       anthropicApiKey: "sk-ant-…",
       diskSize: "20Gi",
       images: RELEASE_IMAGES,
+      ports: { http: 80, https: 443 },
+      project: "caelo-example-com",
     });
-    expect(out).toContain("caelo-postgres");
-    expect(out).toContain("caelo-caddy");
+    expect(out).toContain("  postgres:\n");
+    expect(out).toContain("  caddy:\n");
     expect(out).toContain("caelo-admin");
     expect(out).toContain("caelo-gateway");
     expect(out).toContain("supersecret");
-    expect(out).toContain("miniopass");
     expect(out).toContain("ANTHROPIC_API_KEY");
     expect(out).toContain("CAELO_SECRET_KEK");
   });
@@ -141,11 +137,11 @@ describe("docker-compose generator", () => {
       domain: "example.com",
       postgresPassword: "supersecret",
       rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
-      minioRootUser: "caelo",
-      minioRootPassword: "miniopass",
       caeloSecretKek: "0".repeat(64),
       diskSize: "20Gi",
       images: RELEASE_IMAGES,
+      ports: { http: 80, https: 443 },
+      project: "caelo-example-com",
     });
     const gateway = out.slice(out.indexOf("caelo-gateway:"), out.indexOf("\nvolumes:"));
     expect(gateway).toContain(
@@ -164,11 +160,11 @@ describe("docker-compose generator", () => {
       domain: "example.com",
       postgresPassword: 'pa"ss',
       rolePasswords: { admin: "a", public: "b", gateway: "g" },
-      minioRootUser: "caelo",
-      minioRootPassword: "x",
       caeloSecretKek: "0".repeat(64),
       diskSize: "1Gi",
       images: RELEASE_IMAGES,
+      ports: { http: 80, https: 443 },
+      project: "caelo-example-com",
     });
     expect(out).toContain('pa\\"ss');
   });
@@ -190,130 +186,6 @@ describe("bootstrap token generator", () => {
   });
 });
 
-describe("redirects-emit", () => {
-  const rows: RedirectRow[] = [
-    { fromPath: "/old", toPath: "/new", statusCode: 301 },
-    { fromPath: "/blog/2024", toPath: "/blog", statusCode: 302 },
-    { fromPath: "/legacy", toPath: "/modern", statusCode: 308 },
-  ];
-
-  describe("emitRedirectsCloudflare", () => {
-    it("emits one line per row in `<from> <to> <status>` format", () => {
-      const out = emitRedirectsCloudflare(rows);
-      expect(out).toContain("/old /new 301\n");
-      expect(out).toContain("/blog/2024 /blog 302\n");
-      expect(out).toContain("/legacy /modern 308\n");
-      expect(out.startsWith("# Generated by @caelo-cms/provisioning")).toBe(true);
-    });
-
-    it("empty rows → header only, no trailing newline noise", () => {
-      const out = emitRedirectsCloudflare([]);
-      expect(out).toBe("# Generated by @caelo-cms/provisioning — do not edit by hand.\n");
-    });
-
-    it("is byte-identical for the same input (deterministic)", () => {
-      expect(emitRedirectsCloudflare(rows)).toBe(emitRedirectsCloudflare([...rows]));
-    });
-  });
-
-  describe("emitRedirectsCloudFront", () => {
-    it("returns parseable JSON config + a Lambda source that consumes it", () => {
-      const out = emitRedirectsCloudFront(rows);
-      const parsed = JSON.parse(out.jsonConfig) as {
-        redirects: Array<{ from: string; to: string; status: number }>;
-      };
-      expect(parsed.redirects).toHaveLength(3);
-      expect(parsed.redirects[0]).toEqual({ from: "/old", to: "/new", status: 301 });
-      expect(out.lambdaSource).toContain("exports.handler");
-      expect(out.lambdaSource).toContain('require("./redirects.json")');
-    });
-
-    it("preserves status codes verbatim (301/302/307/308)", () => {
-      const allStatuses: RedirectRow[] = [
-        { fromPath: "/a", toPath: "/x", statusCode: 301 },
-        { fromPath: "/b", toPath: "/x", statusCode: 302 },
-        { fromPath: "/c", toPath: "/x", statusCode: 307 },
-        { fromPath: "/d", toPath: "/x", statusCode: 308 },
-      ];
-      const out = emitRedirectsCloudFront(allStatuses);
-      const parsed = JSON.parse(out.jsonConfig) as {
-        redirects: Array<{ status: number }>;
-      };
-      expect(parsed.redirects.map((r) => r.status)).toEqual([301, 302, 307, 308]);
-    });
-  });
-
-  describe("emitRedirectsAzureFrontDoor", () => {
-    it("emits one rule per row with monotonically-increasing order", () => {
-      const out = emitRedirectsAzureFrontDoor(rows);
-      expect(out).toHaveLength(3);
-      expect(out[0]?.name).toBe("redirect-1");
-      expect(out[0]?.order).toBe(1);
-      expect(out[2]?.order).toBe(3);
-    });
-
-    it("maps status codes to Front Door redirectType vocabulary", () => {
-      const out = emitRedirectsAzureFrontDoor([
-        { fromPath: "/a", toPath: "/x", statusCode: 301 },
-        { fromPath: "/b", toPath: "/x", statusCode: 302 },
-        { fromPath: "/c", toPath: "/x", statusCode: 307 },
-        { fromPath: "/d", toPath: "/x", statusCode: 308 },
-      ]);
-      expect(out.map((r) => r.actions[0]?.parameters.redirectType)).toEqual([
-        "Moved",
-        "Found",
-        "TemporaryRedirect",
-        "PermanentRedirect",
-      ]);
-    });
-
-    it("RequestUri condition matches the from path exactly", () => {
-      const out = emitRedirectsAzureFrontDoor(rows);
-      expect(out[1]?.conditions[0]?.parameters.matchValues).toEqual(["/blog/2024"]);
-      expect(out[1]?.actions[0]?.parameters.destinationPath).toBe("/blog");
-    });
-  });
-
-  describe("path-validation guard (review-pass #9)", () => {
-    it("Cloudflare emitter rejects fromPath with whitespace", () => {
-      expect(() =>
-        emitRedirectsCloudflare([{ fromPath: "/old path", toPath: "/new", statusCode: 301 }]),
-      ).toThrow(/contains whitespace/);
-    });
-
-    it("CloudFront emitter rejects toPath with newline", () => {
-      expect(() =>
-        emitRedirectsCloudFront([{ fromPath: "/old", toPath: "/new\nlies", statusCode: 301 }]),
-      ).toThrow(/contains whitespace/);
-    });
-
-    it("every emitter rejects an off-site or URL-embedding toPath (#657)", () => {
-      for (const toPath of ["//evil.example/x", "/https://example.com/x"]) {
-        const rows = [{ fromPath: "/old", toPath, statusCode: 301 as const }];
-        expect(() => emitRedirectsCloudflare(rows)).toThrow(/redirects-emit: toPath/);
-        expect(() => emitRedirectsCloudFront(rows)).toThrow(/redirects-emit: toPath/);
-        expect(() => emitRedirectsAzureFrontDoor(rows)).toThrow(/redirects-emit: toPath/);
-      }
-    });
-
-    it("Azure emitter rejects tab in path", () => {
-      expect(() =>
-        emitRedirectsAzureFrontDoor([{ fromPath: "/old\there", toPath: "/x", statusCode: 301 }]),
-      ).toThrow(/contains whitespace/);
-    });
-
-    it("hyphens, dots, slashes, unicode in path segments are accepted", () => {
-      // Regression guard for the original buggy regex `[\s -]` which
-      // rejected hyphens.
-      expect(() =>
-        emitRedirectsCloudflare([
-          { fromPath: "/blog/spring-launch", toPath: "/blog/sommer-2026", statusCode: 301 },
-        ]),
-      ).not.toThrow();
-    });
-  });
-});
-
 describe("cdn-copy adapter loader", () => {
   it("returns the no-op self-hosted adapter when provider is unset/empty/self-hosted", async () => {
     expect(await loadCdnCopyAdapter(undefined)).toBe(selfHostedCdnCopy);

package/src/index.ts

@@ -47,15 +47,6 @@ export {
 } from "./cdn-copy.js";
 export { type ComposeSpec, generateDockerCompose, type RolePasswords } from "./compose.js";
 export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
-export {
-  type CloudFrontRedirectArtifact,
-  emitRedirectsAzureFrontDoor,
-  emitRedirectsCloudFront,
-  emitRedirectsCloudflare,
-  type FrontDoorRule,
-  type RedirectRow,
-  type RedirectStatusCode,
-} from "./redirects-emit.js";
 export {
   INFRA_CONTRACT_PATHS,
   isInfraContractPath,

package/src/infra-contract.test.ts

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Every infrastructure contract version names the step it adds, so the
+ * upgrader's refusal tells the Owner what the Cloud Shell run will change.
+ */
+
+import { describe, expect, it } from "bun:test";
+import {
+  INFRA_CONTRACT_STEPS,
+  INFRA_CONTRACT_VERSION,
+  infraStepsText,
+  pendingInfraSteps,
+} from "./infra-contract.js";
+
+describe("infrastructure contract steps", () => {
+  it("describes every version up to the current one, and no other", () => {
+    expect(Object.keys(INFRA_CONTRACT_STEPS).map(Number)).toEqual(
+      Array.from({ length: INFRA_CONTRACT_VERSION }, (_, i) => i + 1),
+    );
+  });
+
+  it("is at 4: the public_role revoke (3) and the URL-map redirects role (4) are separate", () => {
+    expect(INFRA_CONTRACT_VERSION).toBe(4);
+    expect(INFRA_CONTRACT_STEPS[3]).toContain("#633");
+    expect(INFRA_CONTRACT_STEPS[4]).toContain("#587");
+  });
+
+  it("lists the pending steps oldest first", () => {
+    expect(pendingInfraSteps(2, 4)).toEqual([INFRA_CONTRACT_STEPS[3], INFRA_CONTRACT_STEPS[4]]);
+    expect(pendingInfraSteps(3, 4)).toEqual([INFRA_CONTRACT_STEPS[4]]);
+    expect(pendingInfraSteps(4, 4)).toEqual([]);
+    expect(pendingInfraSteps(0, 1)).toEqual([INFRA_CONTRACT_STEPS[1]]);
+  });
+
+  it("names a version a newer release added by number", () => {
+    expect(infraStepsText(4, 5)).toBe("infrastructure step 5 (see that release's notes)");
+  });
+});

package/src/infra-contract.ts

@@ -22,7 +22,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 2;
+export const INFRA_CONTRACT_VERSION = 4;
 
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
@@ -30,3 +30,44 @@ export const INFRA_CONTRACT_VERSION = 2;
 //   2 — the upgrader job (#696 Phase 2): its service account + scoped
 //       grants, the Cloud SQL backup role, its IAM database user, the job,
 //       the admin's run-only grant and CAELO_UPGRADER_JOB on the admin.
+//   3 — public_role out of cloudsqlsuperuser (#633): the Admin API revoke
+//       runs as the operator; migration 0278's role audit refuses an install
+//       that has not had it, so the in-cloud upgrader must not get there
+//       first.
+//   4 — #587: on `gcp`, the admin's custom role for writing the redirects
+//       table into the URL map (url-map-redirects-access.ts).
+
+/**
+ * What each contract version adds, in operator terms — the upgrader's
+ * refusal names the steps an install is missing. Keep one entry per version
+ * (the history above says why each bump happened).
+ */
+export const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>> = {
+  1: "the converge/app-roll split",
+  2: "the in-cloud upgrader job and its scoped permissions",
+  3: "public_role out of the Cloud SQL superuser group (#633)",
+  4: "the admin's permission to serve redirects from the load balancer (#587)",
+};
+
+/**
+ * The steps an install at contract `installed` lacks for `target`, oldest
+ * first. A release newer than this code can carry versions it does not know
+ * (the upgrader reads the NEW release's manifest); those are named by number.
+ *
+ * @example
+ *   pendingInfraSteps(2, 4)
+ *   // → ["public_role out of the Cloud SQL superuser group (#633)",
+ *   //    "the admin's permission to serve redirects from the load balancer (#587)"]
+ */
+export function pendingInfraSteps(installed: number, target: number): string[] {
+  const steps: string[] = [];
+  for (let v = Math.max(installed, 0) + 1; v <= target; v += 1) {
+    steps.push(INFRA_CONTRACT_STEPS[v] ?? `infrastructure step ${v} (see that release's notes)`);
+  }
+  return steps;
+}
+
+/** {@link pendingInfraSteps} as one sentence fragment for messages. */
+export function infraStepsText(installed: number, target: number): string {
+  return pendingInfraSteps(installed, target).join("; ");
+}

package/src/public-role-isolation.test.ts

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import type { GcloudRunner } from "./gcloud-retry.js";
+import {
+  revokePublicRoleMemberships,
+  revokePublicRoleMembershipsArgs,
+} from "./public-role-isolation.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+const noSleep = async () => {};
+
+function fake(answers: (line: string) => GcloudResult) {
+  const calls: string[] = [];
+  const run: GcloudRunner = async (args) => {
+    const line = args.join(" ");
+    calls.push(line);
+    return answers(line);
+  };
+  return { run, calls };
+}
+
+describe("revokePublicRoleMembershipsArgs (#633)", () => {
+  it("revokes every database role of the built-in public_role user", () => {
+    expect(
+      revokePublicRoleMembershipsArgs({ projectId: "acme", sqlInstance: "caelo-production-pg-1" }),
+    ).toEqual([
+      "sql",
+      "users",
+      "assign-roles",
+      "public_role",
+      "--instance=caelo-production-pg-1",
+      "--type=BUILT_IN",
+      "--revoke-existing-roles",
+      "--project=acme",
+      "--quiet",
+    ]);
+  });
+
+  it("grants nothing in exchange (no --database-roles)", () => {
+    const args = revokePublicRoleMembershipsArgs({ projectId: "p", sqlInstance: "i" });
+    expect(args.some((a) => a.startsWith("--database-roles"))).toBe(false);
+  });
+});
+
+describe("revokePublicRoleMemberships", () => {
+  const install = { projectId: "acme", env: "production" };
+
+  it("finds the instance, then revokes", async () => {
+    const { run, calls } = fake((l) => (l.startsWith("sql instances list") ? ok("pg-1\n") : ok()));
+    const r = await revokePublicRoleMemberships(install, { run, sleep: noSleep });
+    expect(r).toEqual({
+      id: "public_role database role memberships",
+      status: "applied",
+      detail: "no database roles left on pg-1",
+    });
+    expect(calls[1]).toBe(
+      "sql users assign-roles public_role --instance=pg-1 --type=BUILT_IN --revoke-existing-roles --project=acme --quiet",
+    );
+  });
+
+  it("is idempotent: a second run issues the same revoke and succeeds", async () => {
+    const { run, calls } = fake((l) => (l.startsWith("sql instances list") ? ok("pg-1\n") : ok()));
+    await revokePublicRoleMemberships(install, { run, sleep: noSleep });
+    const again = await revokePublicRoleMemberships(install, { run, sleep: noSleep });
+    expect(again.status).toBe("applied");
+    expect(calls[1]).toBe(calls[3] as string);
+  });
+
+  it("fails without an instance and never calls the revoke", async () => {
+    const { run, calls } = fake(() => ok(""));
+    const r = await revokePublicRoleMemberships(install, { run, sleep: noSleep });
+    expect(r.status).toBe("failed");
+    expect(r.error).toBe("the Cloud SQL instance was not found");
+    expect(calls).toHaveLength(1);
+  });
+
+  it("reports a refused revoke with the permission it needs", async () => {
+    const { run } = fake((l) =>
+      l.startsWith("sql instances list") ? ok("pg-1\n") : fail("PERMISSION_DENIED: nope"),
+    );
+    const r = await revokePublicRoleMemberships(install, { run, sleep: noSleep });
+    expect(r.status).toBe("failed");
+    expect(r.error).toContain("PERMISSION_DENIED: nope");
+    expect(r.error).toContain("cloudsql.users.update");
+  });
+});

package/src/public-role-isolation.ts

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Take `public_role` out of `cloudsqlsuperuser` (issue #633, CLAUDE.md §2).
+ *
+ * The stacks declare `public_role` as a Cloud SQL Admin API user
+ * (`gcp.sql.User`), and Cloud SQL makes every such user a member of
+ * `cloudsqlsuperuser` — the group that owns cms_admin and cms_public. That
+ * gave the API gateway's visitor-facing login the owner group's rights.
+ *
+ * Why the Admin API and not SQL: on PostgreSQL 16+ a role membership can
+ * only be revoked by the role that granted it (or a superuser), and here
+ * that is Cloud SQL's own administrator, not `admin_role` — a `REVOKE` from
+ * the migration job would leave the membership in place with a warning.
+ * `users.update` with `revokeExistingRoles` runs as that administrator. It
+ * is also the one path that works the same for a fresh install and for the
+ * installs out there, with no change to the Pulumi resource (re-creating the
+ * user in SQL would mean deleting a user the stacks' state owns, with
+ * dependent grants in both databases, while the gateway serves on it).
+ *
+ * Revoking every role leaves `public_role` with none, which is exactly its
+ * contract: its rights are object grants in cms_public, nothing else.
+ *
+ * The CLI cannot reach the private-IP database to check the result, so the
+ * check runs where SQL runs: the migration job's role audit
+ * (packages/migrations/src/role-audit.ts), which fails the migration — and
+ * with it the install or upgrade, before any traffic moves — while
+ * `public_role` is still a member of any role. This step therefore runs
+ * BEFORE migrations, on every install pass and every `upgrade`. Idempotent:
+ * revoking from a role that has none changes nothing.
+ */
+
+import { findSqlInstance } from "./gateway-credentials.js";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
+import type { EnsureOutcome } from "./runtime-secrets.js";
+
+/** The gcloud call that leaves `public_role` with no database roles. */
+export function revokePublicRoleMembershipsArgs(target: {
+  readonly projectId: string;
+  readonly sqlInstance: string;
+}): string[] {
+  return [
+    "sql",
+    "users",
+    "assign-roles",
+    "public_role",
+    `--instance=${target.sqlInstance}`,
+    "--type=BUILT_IN",
+    "--revoke-existing-roles",
+    `--project=${target.projectId}`,
+    "--quiet",
+  ];
+}
+
+/**
+ * Revoke every database role the Admin API gave `public_role`. Reports
+ * instead of throwing; `failed` names the next step.
+ */
+export async function revokePublicRoleMemberships(
+  install: { readonly projectId: string; readonly env: string },
+  deps: { readonly run?: GcloudRunner; readonly sleep?: Sleep } = {},
+): Promise<EnsureOutcome> {
+  const run = deps.run ?? defaultGcloud;
+  const id = "public_role database role memberships";
+  const sqlInstance = await findSqlInstance(install, { run });
+  if (!sqlInstance) {
+    return { id, status: "failed", error: "the Cloud SQL instance was not found" };
+  }
+  const r = await runWithRetry(
+    run,
+    deps.sleep ?? realSleep,
+    revokePublicRoleMembershipsArgs({ projectId: install.projectId, sqlInstance }),
+  );
+  if (!r.ok) {
+    return {
+      id,
+      status: "failed",
+      error: `gcloud sql users assign-roles public_role --revoke-existing-roles on ${sqlInstance}: ${r.stderr.trim()}. The account running this needs cloudsql.users.update on the project; re-run once it has.`,
+    };
+  }
+  return { id, status: "applied", detail: `no database roles left on ${sqlInstance}` };
+}

package/src/release-contract.ts

@@ -43,6 +43,9 @@ export const INFRA_CONTRACT_PATHS: readonly string[] = [
   "packages/provisioning/src/upgrade/converge.ts",
   "packages/provisioning/src/mcp-iap.ts",
   "packages/provisioning/src/default-firewall.ts",
+  // #587 — the admin's URL-map redirects role and the URL map's shape.
+  "packages/provisioning/src/url-map-redirects-access.ts",
+  "packages/provisioning/src/gcp-url-map.ts",
 ];
 
 /**

package/src/release-manifest.test.ts

@@ -214,7 +214,14 @@ describe("assessAutoInstall", () => {
       kind: "normal",
       reasons: [],
     });
-    expect(assessAutoInstall({ ...MANIFEST, security: true }, installed).kind).toBe("security");
+    const advisories = ["GHSA-abcd-efgh-jkmp"];
+    expect(assessAutoInstall({ ...MANIFEST, security: true, advisories }, installed).kind).toBe(
+      "security",
+    );
+  });
+
+  it("counts security only with a published advisory behind it (#696 decision 2)", () => {
+    expect(assessAutoInstall({ ...MANIFEST, security: true }, installed).kind).toBe("normal");
   });
 
   it("downgrades a security release with contract migrations to manual", () => {
@@ -246,6 +253,18 @@ describe("assessAutoInstall", () => {
     );
     expect(a.mode).toBe("manual");
     expect(a.reasons[0]).toContain("1 → 3");
+    expect(a.reasons[0]).toContain("public_role out of the Cloud SQL superuser group (#633)");
+  });
+
+  it("names both pending infrastructure steps for a 2 → 4 bump (#633, #587)", () => {
+    const a = assessAutoInstall(
+      { ...MANIFEST, infraContractVersion: 4 },
+      { ...installed, infraContractVersion: 2 },
+    );
+    expect(a.mode).toBe("manual");
+    expect(a.reasons[0]).toContain(
+      "2 → 4: public_role out of the Cloud SQL superuser group (#633); the admin's permission to serve redirects from the load balancer (#587)",
+    );
   });
 
   it("refuses downgrades, re-installs and versions below minFromVersion", () => {