@caelo-cms/provisioning 0.10.49 → 0.10.51

package/src/owner-reset.test.ts

@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #769 — `owner-reset` asks the admin for a reset link through IAP (as
+ * caelo-mcp) with the internal token for scope `auth.owner_reset`, and builds
+ * the link on the admin URL the operator can open.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import { describeOwnerReset, OWNER_RESET_SCOPE, requestOwnerReset } from "./owner-reset.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+const ADMIN = "https://caelo-production-admin-abc-ew.a.run.app";
+const target = { projectId: "proj", region: "europe-west1" };
+
+function fakeGcloud(
+  overrides: Record<string, GcloudResult> = {},
+): (args: string[]) => Promise<GcloudResult> {
+  const answers: Record<string, GcloudResult> = {
+    "auth list": ok("operator@example.com\n"),
+    "run services list": ok("caelo-production-admin-abc\n"),
+    "run services describe": ok(`${ADMIN}\n`),
+    "secrets versions access": ok("s".repeat(40)),
+    "auth print-access-token": ok("ya29.operator\n"),
+    "services enable iamcredentials.googleapis.com": ok(),
+    ...overrides,
+  };
+  return async (args) => {
+    const key = Object.keys(answers).find((k) => args.join(" ").startsWith(k));
+    return (key && answers[key]) || fail(`unexpected gcloud ${args.join(" ")}`);
+  };
+}
+
+interface Seen {
+  url: string;
+  headers: Record<string, string>;
+  body: unknown;
+}
+
+function fakeFetch(admin: () => Response) {
+  const seen: Seen[] = [];
+  const doFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = String(input);
+    seen.push({
+      url,
+      headers: Object.fromEntries(new Headers(init?.headers).entries()),
+      body: init?.body ? JSON.parse(String(init.body)) : null,
+    });
+    if (url.startsWith("https://iamcredentials.googleapis.com/")) {
+      return Response.json({ signedJwt: "iap.jwt.signed" });
+    }
+    return admin();
+  }) as typeof fetch;
+  return { doFetch, seen };
+}
+
+const ISSUED = {
+  ok: true,
+  email: "owner@example.com",
+  token: "tok/with+chars",
+  expiresAt: "2026-10-15T12:52:56.000Z",
+};
+
+describe("requestOwnerReset", () => {
+  it("calls the endpoint with the owner_reset scope and builds the link on the admin URL", async () => {
+    const { doFetch, seen } = fakeFetch(() => Response.json(ISSUED));
+    const r = await requestOwnerReset(target, {}, { run: fakeGcloud(), fetch: doFetch });
+    expect(r).toEqual({
+      ok: true,
+      value: {
+        email: "owner@example.com",
+        resetUrl: `${ADMIN}/reset?token=tok%2Fwith%2Bchars`,
+        expiresAt: "2026-10-15T12:52:56.000Z",
+      },
+    });
+    const call = seen[1];
+    expect(call?.url).toBe(`${ADMIN}/api/internal/owner-reset`);
+    expect(call?.headers.authorization).toBe("Bearer iap.jwt.signed");
+    expect(call?.body).toEqual({ requestedBy: "operator@example.com" });
+    const [message] = (call?.headers["x-caelo-internal-token"] ?? "").split(".");
+    expect(Buffer.from(message ?? "", "base64url").toString()).toEndWith(`:${OWNER_RESET_SCOPE}`);
+  });
+
+  it("forwards --email so the operator can pick among several Owners", async () => {
+    const { doFetch, seen } = fakeFetch(() => Response.json(ISSUED));
+    await requestOwnerReset(
+      target,
+      { email: "owner@example.com" },
+      { run: fakeGcloud(), fetch: doFetch },
+    );
+    expect(seen[1]?.body).toEqual({
+      email: "owner@example.com",
+      requestedBy: "operator@example.com",
+    });
+  });
+
+  it("refuses to run without an active gcloud account to name in the audit row", async () => {
+    const { doFetch, seen } = fakeFetch(() => Response.json(ISSUED));
+    for (const answer of [
+      ok(""),
+      fail("ERROR: no credentialed accounts"),
+      ok("a@x.com\nb@x.com"),
+    ]) {
+      const r = await requestOwnerReset(
+        target,
+        {},
+        { run: fakeGcloud({ "auth list": answer }), fetch: doFetch },
+      );
+      expect(r.ok ? "" : r.error).toContain("gcloud auth login");
+    }
+    expect(seen).toHaveLength(0);
+  });
+
+  it("passes the admin's refusal through and names the upgrade for an older admin", async () => {
+    const refused = await requestOwnerReset(
+      target,
+      {},
+      {
+        run: fakeGcloud(),
+        fetch: fakeFetch(() =>
+          Response.json(
+            { ok: false, error: "This install has 2 Owners (a@x.com, b@x.com). Name the one" },
+            { status: 422 },
+          ),
+        ).doFetch,
+      },
+    );
+    expect(refused.ok ? "" : refused.error).toContain("2 Owners (a@x.com, b@x.com)");
+
+    const old = await requestOwnerReset(
+      target,
+      {},
+      { run: fakeGcloud(), fetch: fakeFetch(() => new Response("nf", { status: 404 })).doFetch },
+    );
+    expect(old.ok ? "" : old.error).toContain("before #769");
+    expect(old.ok ? "" : old.error).toContain("cms-provision upgrade");
+  });
+
+  it("refuses an answer without a token instead of printing a broken link", async () => {
+    const r = await requestOwnerReset(
+      target,
+      {},
+      {
+        run: fakeGcloud(),
+        fetch: fakeFetch(() => Response.json({ ok: true, email: "owner@example.com" })).doFetch,
+      },
+    );
+    expect(r.ok).toBe(false);
+  });
+});
+
+describe("describeOwnerReset", () => {
+  it("prints the account, the link and when it stops working", () => {
+    const text = describeOwnerReset({
+      email: "owner@example.com",
+      resetUrl: `${ADMIN}/reset?token=abc`,
+      expiresAt: "2026-10-15T12:52:56.000Z",
+    }).join("\n");
+    expect(text).toContain("owner@example.com");
+    expect(text).toContain(`  ${ADMIN}/reset?token=abc`);
+    expect(text).toContain("2026-10-15T12:52:56.000Z");
+  });
+});

package/src/owner-reset.ts

@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #769 — `cms-provision owner-reset` — get an Owner back into a locked-out admin
+ * when the install cannot email a reset link (no email transport set up).
+ *
+ * The root of trust is the operator's cloud identity: whoever may read the
+ * install's internal secret and pass the admin's IAP already controls its
+ * database and deploys, so issuing them a reset link grants nothing new. The
+ * admin issues the one-hour, single-use token (`auth.issue_owner_reset`,
+ * audited) and hands it back over the admin-internal.ts channel; the CLI
+ * prints the link once. It is never logged, so it does not land in the
+ * project's Cloud Logging the way a "log the link" fallback would.
+ *
+ * The request carries the operator's gcloud account so the admin's audit row
+ * names who asked. That account is self-asserted (the admin sees the shared
+ * `caelo-mcp` identity and the shared internal secret), and labelled so; the
+ * authoritative record is Google's Data Access audit log for the IAM
+ * Credentials and Secret Manager calls this command makes as the operator.
+ */
+
+import {
+  type AdminInternalDeps,
+  type AdminInternalResult,
+  type AdminInternalTarget,
+  callAdminInternal,
+} from "./admin-internal.js";
+import { activeAccount, gcloud as defaultGcloud } from "./gcloud.js";
+
+/** Token scope the admin endpoint checks (apps/admin …/api/internal/owner-reset). */
+export const OWNER_RESET_SCOPE = "auth.owner_reset";
+const ENDPOINT = "/api/internal/owner-reset";
+
+/** What the admin issued: whose account, the link to open, and until when it works. */
+export interface OwnerReset {
+  readonly email: string;
+  readonly resetUrl: string;
+  readonly expiresAt: string;
+}
+
+/**
+ * Ask the admin for a reset link for the install's Owner (or the Owner named
+ * by `email` when there are several).
+ */
+export async function requestOwnerReset(
+  target: AdminInternalTarget,
+  request: { readonly email?: string },
+  deps: AdminInternalDeps = {},
+): Promise<AdminInternalResult<OwnerReset>> {
+  const account = await readGcloudAccount(deps.run ?? defaultGcloud);
+  if (!account.ok) return account;
+  const r = await callAdminInternal<{ email: string; token: string; expiresAt: string }>(
+    target,
+    {
+      endpoint: ENDPOINT,
+      scope: OWNER_RESET_SCOPE,
+      body: {
+        ...(request.email !== undefined ? { email: request.email } : {}),
+        requestedBy: account.value,
+      },
+      introducedBy: "#769",
+    },
+    deps,
+  );
+  if (!r.ok) return r;
+  const { answer, adminUrl } = r.value;
+  const { email, token, expiresAt } = answer;
+  if (!email || !token || !expiresAt) {
+    return { ok: false, error: "the admin answered without an email, token or expiry" };
+  }
+  const resetUrl = new URL(`/reset?token=${encodeURIComponent(token)}`, adminUrl).toString();
+  return { ok: true, value: { email, resetUrl, expiresAt } };
+}
+
+/**
+ * The gcloud account this command runs as, for the admin's audit row. Without
+ * one there is nobody to name, and the IAP step after this would fail anyway.
+ */
+async function readGcloudAccount(
+  run: NonNullable<AdminInternalDeps["run"]>,
+): Promise<AdminInternalResult<string>> {
+  // `auth list --filter=status:ACTIVE`, not `config get-value account`: the
+  // latter prints the sentinel `(unset)` and exits 0 when no account is set.
+  const account = await activeAccount(run);
+  if (!account || /\s/.test(account)) {
+    return {
+      ok: false,
+      error:
+        "read the active gcloud account: none is signed in. Run `gcloud auth login` with the account you provisioned with.",
+    };
+  }
+  return { ok: true, value: account };
+}
+
+/** The lines the command prints. Pure — the CLI prints them and stores nothing. */
+export function describeOwnerReset(r: OwnerReset): string[] {
+  return [
+    `Reset link for ${r.email} — open it to set a new password:`,
+    "",
+    `  ${r.resetUrl}`,
+    "",
+    `It works once and expires at ${r.expiresAt}. Setting the password signs out every`,
+    "other session of this account. The link is not saved anywhere; run the command",
+    "again for a new one.",
+  ];
+}

package/src/public-role-isolation.test.ts

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import type { GcloudRunner } from "./gcloud-retry.js";
+import {
+  revokePublicRoleMemberships,
+  revokePublicRoleMembershipsArgs,
+} from "./public-role-isolation.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+const noSleep = async () => {};
+
+function fake(answers: (line: string) => GcloudResult) {
+  const calls: string[] = [];
+  const run: GcloudRunner = async (args) => {
+    const line = args.join(" ");
+    calls.push(line);
+    return answers(line);
+  };
+  return { run, calls };
+}
+
+describe("revokePublicRoleMembershipsArgs (#633)", () => {
+  it("revokes every database role of the built-in public_role user", () => {
+    expect(
+      revokePublicRoleMembershipsArgs({ projectId: "acme", sqlInstance: "caelo-production-pg-1" }),
+    ).toEqual([
+      "sql",
+      "users",
+      "assign-roles",
+      "public_role",
+      "--instance=caelo-production-pg-1",
+      "--type=BUILT_IN",
+      "--revoke-existing-roles",
+      "--project=acme",
+      "--quiet",
+    ]);
+  });
+
+  it("grants nothing in exchange (no --database-roles)", () => {
+    const args = revokePublicRoleMembershipsArgs({ projectId: "p", sqlInstance: "i" });
+    expect(args.some((a) => a.startsWith("--database-roles"))).toBe(false);
+  });
+});
+
+describe("revokePublicRoleMemberships", () => {
+  const install = { projectId: "acme", env: "production" };
+
+  it("finds the instance, then revokes", async () => {
+    const { run, calls } = fake((l) => (l.startsWith("sql instances list") ? ok("pg-1\n") : ok()));
+    const r = await revokePublicRoleMemberships(install, { run, sleep: noSleep });
+    expect(r).toEqual({
+      id: "public_role database role memberships",
+      status: "applied",
+      detail: "no database roles left on pg-1",
+    });
+    expect(calls[1]).toBe(
+      "sql users assign-roles public_role --instance=pg-1 --type=BUILT_IN --revoke-existing-roles --project=acme --quiet",
+    );
+  });
+
+  it("is idempotent: a second run issues the same revoke and succeeds", async () => {
+    const { run, calls } = fake((l) => (l.startsWith("sql instances list") ? ok("pg-1\n") : ok()));
+    await revokePublicRoleMemberships(install, { run, sleep: noSleep });
+    const again = await revokePublicRoleMemberships(install, { run, sleep: noSleep });
+    expect(again.status).toBe("applied");
+    expect(calls[1]).toBe(calls[3] as string);
+  });
+
+  it("fails without an instance and never calls the revoke", async () => {
+    const { run, calls } = fake(() => ok(""));
+    const r = await revokePublicRoleMemberships(install, { run, sleep: noSleep });
+    expect(r.status).toBe("failed");
+    expect(r.error).toBe("the Cloud SQL instance was not found");
+    expect(calls).toHaveLength(1);
+  });
+
+  it("reports a refused revoke with the permission it needs", async () => {
+    const { run } = fake((l) =>
+      l.startsWith("sql instances list") ? ok("pg-1\n") : fail("PERMISSION_DENIED: nope"),
+    );
+    const r = await revokePublicRoleMemberships(install, { run, sleep: noSleep });
+    expect(r.status).toBe("failed");
+    expect(r.error).toContain("PERMISSION_DENIED: nope");
+    expect(r.error).toContain("cloudsql.users.update");
+  });
+});

package/src/public-role-isolation.ts

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Take `public_role` out of `cloudsqlsuperuser` (issue #633, CLAUDE.md §2).
+ *
+ * The stacks declare `public_role` as a Cloud SQL Admin API user
+ * (`gcp.sql.User`), and Cloud SQL makes every such user a member of
+ * `cloudsqlsuperuser` — the group that owns cms_admin and cms_public. That
+ * gave the API gateway's visitor-facing login the owner group's rights.
+ *
+ * Why the Admin API and not SQL: on PostgreSQL 16+ a role membership can
+ * only be revoked by the role that granted it (or a superuser), and here
+ * that is Cloud SQL's own administrator, not `admin_role` — a `REVOKE` from
+ * the migration job would leave the membership in place with a warning.
+ * `users.update` with `revokeExistingRoles` runs as that administrator. It
+ * is also the one path that works the same for a fresh install and for the
+ * installs out there, with no change to the Pulumi resource (re-creating the
+ * user in SQL would mean deleting a user the stacks' state owns, with
+ * dependent grants in both databases, while the gateway serves on it).
+ *
+ * Revoking every role leaves `public_role` with none, which is exactly its
+ * contract: its rights are object grants in cms_public, nothing else.
+ *
+ * The CLI cannot reach the private-IP database to check the result, so the
+ * check runs where SQL runs: the migration job's role audit
+ * (packages/migrations/src/role-audit.ts), which fails the migration — and
+ * with it the install or upgrade, before any traffic moves — while
+ * `public_role` is still a member of any role. This step therefore runs
+ * BEFORE migrations, on every install pass and every `upgrade`. Idempotent:
+ * revoking from a role that has none changes nothing.
+ */
+
+import { findSqlInstance } from "./gateway-credentials.js";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
+import type { EnsureOutcome } from "./runtime-secrets.js";
+
+/** The gcloud call that leaves `public_role` with no database roles. */
+export function revokePublicRoleMembershipsArgs(target: {
+  readonly projectId: string;
+  readonly sqlInstance: string;
+}): string[] {
+  return [
+    "sql",
+    "users",
+    "assign-roles",
+    "public_role",
+    `--instance=${target.sqlInstance}`,
+    "--type=BUILT_IN",
+    "--revoke-existing-roles",
+    `--project=${target.projectId}`,
+    "--quiet",
+  ];
+}
+
+/**
+ * Revoke every database role the Admin API gave `public_role`. Reports
+ * instead of throwing; `failed` names the next step.
+ */
+export async function revokePublicRoleMemberships(
+  install: { readonly projectId: string; readonly env: string },
+  deps: { readonly run?: GcloudRunner; readonly sleep?: Sleep } = {},
+): Promise<EnsureOutcome> {
+  const run = deps.run ?? defaultGcloud;
+  const id = "public_role database role memberships";
+  const sqlInstance = await findSqlInstance(install, { run });
+  if (!sqlInstance) {
+    return { id, status: "failed", error: "the Cloud SQL instance was not found" };
+  }
+  const r = await runWithRetry(
+    run,
+    deps.sleep ?? realSleep,
+    revokePublicRoleMembershipsArgs({ projectId: install.projectId, sqlInstance }),
+  );
+  if (!r.ok) {
+    return {
+      id,
+      status: "failed",
+      error: `gcloud sql users assign-roles public_role --revoke-existing-roles on ${sqlInstance}: ${r.stderr.trim()}. The account running this needs cloudsql.users.update on the project; re-run once it has.`,
+    };
+  }
+  return { id, status: "applied", detail: `no database roles left on ${sqlInstance}` };
+}

package/src/release-contract.ts

@@ -43,6 +43,9 @@ export const INFRA_CONTRACT_PATHS: readonly string[] = [
   "packages/provisioning/src/upgrade/converge.ts",
   "packages/provisioning/src/mcp-iap.ts",
   "packages/provisioning/src/default-firewall.ts",
+  // #587 — the admin's URL-map redirects role and the URL map's shape.
+  "packages/provisioning/src/url-map-redirects-access.ts",
+  "packages/provisioning/src/gcp-url-map.ts",
 ];
 
 /**

package/src/release-manifest.test.ts

@@ -253,6 +253,18 @@ describe("assessAutoInstall", () => {
     );
     expect(a.mode).toBe("manual");
     expect(a.reasons[0]).toContain("1 → 3");
+    expect(a.reasons[0]).toContain("public_role out of the Cloud SQL superuser group (#633)");
+  });
+
+  it("names both pending infrastructure steps for a 2 → 4 bump (#633, #587)", () => {
+    const a = assessAutoInstall(
+      { ...MANIFEST, infraContractVersion: 4 },
+      { ...installed, infraContractVersion: 2 },
+    );
+    expect(a.mode).toBe("manual");
+    expect(a.reasons[0]).toContain(
+      "2 → 4: public_role out of the Cloud SQL superuser group (#633); the admin's permission to serve redirects from the load balancer (#587)",
+    );
   });
 
   it("refuses downgrades, re-installs and versions below minFromVersion", () => {

package/src/release-manifest.ts

@@ -34,6 +34,7 @@ import {
   type ReleaseImage,
   type ReleaseManifest,
 } from "@caelo-cms/shared";
+import { infraStepsText } from "./infra-contract.js";
 import { RELEASE_OIDC_ISSUER, RELEASE_WORKFLOWS_URL } from "./upgrade/release-images.js";
 
 // The manifest's shape and location live in @caelo-cms/shared (the admin's
@@ -292,7 +293,7 @@ export function assessAutoInstall(
   const manual: string[] = [];
   if (manifest.infraContractVersion > installed.infraContractVersion) {
     manual.push(
-      `the release changes the infrastructure contract (${installed.infraContractVersion} → ${manifest.infraContractVersion}); it must run with the operator's own identity`,
+      `the release changes the infrastructure contract (${installed.infraContractVersion} → ${manifest.infraContractVersion}: ${infraStepsText(installed.infraContractVersion, manifest.infraContractVersion)}); it must run with the operator's own identity`,
     );
   }
   const lastContract = manifest.migrations.lastContractVersion;

package/src/runtime-secrets.test.ts

@@ -340,10 +340,7 @@ describe("rotateRuntimeSecret", () => {
       ]),
     ],
     "run services describe gw-svc": [
-      service([
-        ref("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
-        ref("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
-      ]),
+      service([ref("PUBLIC_DATABASE_PASSWORD", "public-role-password")]),
     ],
     "auth print-access-token": [ok("tok\n")],
   });
@@ -414,7 +411,7 @@ describe("rotateRuntimeSecret", () => {
     ).toBe(true);
   });
 
-  it("gateway-role-password: changes gateway_role only and rolls the gateway only (#613)", async () => {
+  it("gateway-role-password: changes gateway_role only and rolls no service (#613, #635)", async () => {
     const { run, lines } = fakeGcloud({
       ...converged(),
       "secrets versions access": [ok("old-pw")],
@@ -428,9 +425,9 @@ describe("rotateRuntimeSecret", () => {
     });
     expect(report.ok).toBe(true);
     expect(sql.passwords()).toEqual(["gateway_role new-pw"]);
-    expect(lines().filter((l) => l.startsWith("run services update "))).toEqual([
-      expect.stringContaining("run services update gw-svc"),
-    ]);
+    // No service logs in as gateway_role any more: the gateway reads
+    // cms_public only (#635).
+    expect(lines().filter((l) => l.startsWith("run services update "))).toEqual([]);
     expect(lines()).toContain(
       "secrets versions access latest --secret=caelo-production-gateway-role-password --project=acme",
     );
@@ -477,6 +474,26 @@ describe("rotateRuntimeSecret", () => {
     expect(lines().every((l) => l.startsWith("run services describe"))).toBe(true);
   });
 
+  it("refuses gateway-role-password while the gateway still logs in with it (before #635)", async () => {
+    const answers = converged();
+    answers["run services describe gw-svc"] = [
+      service([
+        ref("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
+        ref("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
+      ]),
+    ];
+    const { run } = fakeGcloud(answers);
+    const sql = fakeSqlApi();
+    const report = await rotateRuntimeSecret(target, "gateway-role-password", {
+      run,
+      http: sql.http,
+      generate: () => "new-pw",
+    });
+    expect(report.ok).toBe(false);
+    expect(report.error).toContain("GATEWAY_DATABASE_PASSWORD");
+    expect(sql.requests).toHaveLength(0);
+  });
+
   it("refuses before changing anything on an install upgrade hasn't moved over", async () => {
     const { run, lines } = fakeGcloud({
       "run services describe adm-svc": [