@caelo-cms/provisioning 0.10.49 → 0.10.51

package/src/url-map-redirects-access.test.ts

@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #587 — `cms-provision upgrade` gives older `gcp` installs the admin's
+ * URL-map redirects role: create or update the custom role, undelete a
+ * soft-deleted one, bind it to the admin's run SA.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import { ensureUrlMapRedirectsAccess } from "./url-map-redirects-access.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+
+/** The gcloud verb of a call (`projects add-iam-policy-binding` has it second). */
+const verb = (c: string[]) => (c[0] === "projects" ? c[1] : c[2]);
+
+function runner(answer: (args: string[]) => GcloudResult) {
+  const calls: string[][] = [];
+  return {
+    calls,
+    run: async (args: string[]) => {
+      calls.push(args);
+      return answer(args);
+    },
+  };
+}
+
+const PERMS =
+  "--permissions=compute.urlMaps.list,compute.urlMaps.get,compute.urlMaps.update,compute.backendBuckets.use,compute.backendServices.use,compute.globalOperations.get";
+const BIND = [
+  "projects",
+  "add-iam-policy-binding",
+  "p1",
+  "--member=serviceAccount:caelo-production-run-sa@p1.iam.gserviceaccount.com",
+  "--role=projects/p1/roles/caelo_production_urlMapRedirects",
+  "--condition=None",
+  "--quiet",
+  "--format=none",
+];
+
+describe("ensureUrlMapRedirectsAccess", () => {
+  it("creates the role when missing, then binds it", async () => {
+    const r = runner((a) => (a[2] === "describe" ? fail("NOT_FOUND") : ok()));
+    const out = await ensureUrlMapRedirectsAccess({
+      projectId: "p1",
+      env: "production",
+      run: r.run,
+    });
+    expect(out).toEqual({ ok: true, role: "projects/p1/roles/caelo_production_urlMapRedirects" });
+    expect(r.calls[1]?.slice(0, 5)).toEqual([
+      "iam",
+      "roles",
+      "create",
+      "caelo_production_urlMapRedirects",
+      "--project=p1",
+    ]);
+    expect(r.calls[1]).toContain(PERMS);
+    expect(r.calls[2]).toEqual(BIND);
+  });
+
+  it("updates an existing role to the current permissions (no drift)", async () => {
+    const r = runner((a) => (a[2] === "describe" ? ok('{"name":"x"}') : ok()));
+    await ensureUrlMapRedirectsAccess({ projectId: "p1", env: "production", run: r.run });
+    expect(r.calls.map(verb)).toEqual(["describe", "update", "add-iam-policy-binding"]);
+    expect(r.calls[1]).toContain(PERMS);
+  });
+
+  it("undeletes a soft-deleted role first", async () => {
+    const r = runner((a) => (a[2] === "describe" ? ok('{"deleted":true}') : ok()));
+    await ensureUrlMapRedirectsAccess({ projectId: "p1", env: "production", run: r.run });
+    expect(r.calls.map(verb)).toEqual(["describe", "undelete", "update", "add-iam-policy-binding"]);
+  });
+
+  it("reports a failure instead of throwing", async () => {
+    const r = runner((a) =>
+      a[2] === "describe" ? fail("NOT_FOUND") : fail("PERMISSION_DENIED: iam.roles.create"),
+    );
+    expect(
+      await ensureUrlMapRedirectsAccess({ projectId: "p1", env: "production", run: r.run }),
+    ).toEqual({
+      ok: false,
+      error:
+        "create projects/p1/roles/caelo_production_urlMapRedirects: PERMISSION_DENIED: iam.roles.create",
+    });
+  });
+});

package/src/url-map-redirects-access.ts

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The admin's URL-map redirects role (#587) on `gcp` installs. The installer
+ * (wizards/gcp.ts) and `cms-provision upgrade` both call
+ * {@link ensureUrlMapRedirectsAccess}, so new and older installs get the same
+ * custom role + binding. The stack does not declare it: a role id exists once
+ * per project, so a stack-created role would collide with one upgrade made.
+ *
+ *   1. project custom role {@link urlMapRedirectsRoleId} with exactly
+ *      {@link URL_MAP_REDIRECTS_PERMISSIONS} (created, or updated to that
+ *      permission set; undeleted first if it was soft-deleted)
+ *   2. that role for the admin's run SA on the project
+ *
+ * Both steps are idempotent. Without them Confirm-publish fails with a 403
+ * when it writes the redirects into the URL map.
+ */
+
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
+import {
+  runServiceAccountEmail,
+  URL_MAP_REDIRECTS_PERMISSIONS,
+  urlMapRedirectsRoleId,
+} from "./gcp-names.js";
+
+/** Ensure the custom role and the admin's binding; never throws for gcloud. */
+export async function ensureUrlMapRedirectsAccess(opts: {
+  readonly projectId: string;
+  readonly env: string;
+  readonly run?: GcloudRunner;
+  readonly sleep?: Sleep;
+}): Promise<{ ok: true; role: string } | { ok: false; error: string }> {
+  const run = opts.run ?? defaultGcloud;
+  const sleep = opts.sleep ?? realSleep;
+  const project = `--project=${opts.projectId}`;
+  const roleId = urlMapRedirectsRoleId(opts.env);
+  const role = `projects/${opts.projectId}/roles/${roleId}`;
+  const permissions = `--permissions=${URL_MAP_REDIRECTS_PERMISSIONS.join(",")}`;
+
+  const describe = await run(["iam", "roles", "describe", roleId, project, "--format=json"]);
+  if (describe.ok) {
+    const live = JSON.parse(describe.stdout) as { deleted?: boolean };
+    if (live.deleted) {
+      const undelete = await run(["iam", "roles", "undelete", roleId, project, "--quiet"]);
+      if (!undelete.ok) return { ok: false, error: `undelete ${role}: ${undelete.stderr.trim()}` };
+    }
+    const update = await run([
+      "iam",
+      "roles",
+      "update",
+      roleId,
+      project,
+      permissions,
+      "--quiet",
+      "--format=none",
+    ]);
+    if (!update.ok) return { ok: false, error: `update ${role}: ${update.stderr.trim()}` };
+  } else {
+    const create = await run([
+      "iam",
+      "roles",
+      "create",
+      roleId,
+      project,
+      "--title=Caelo admin: URL-map redirects",
+      "--description=Lets the Caelo admin write the redirects table into the site's URL map (#587).",
+      permissions,
+      "--stage=GA",
+      "--quiet",
+      "--format=none",
+    ]);
+    if (!create.ok) return { ok: false, error: `create ${role}: ${create.stderr.trim()}` };
+  }
+
+  // A just-created role takes a few seconds to become bindable.
+  const bind = await runWithRetry(run, sleep, [
+    "projects",
+    "add-iam-policy-binding",
+    opts.projectId,
+    `--member=serviceAccount:${runServiceAccountEmail(opts.projectId, opts.env)}`,
+    `--role=${role}`,
+    "--condition=None",
+    "--quiet",
+    "--format=none",
+  ]);
+  if (!bind.ok) return { ok: false, error: `grant ${role}: ${bind.stderr.trim()}` };
+  return { ok: true, role };
+}

package/src/wizard.ts

@@ -222,8 +222,10 @@ export async function runWizard(opts: WizardOptions = {}): Promise<void> {
       });
       break;
     case "self-hosted":
+      // The self-hosted install runs on the Docker host itself, from the
+      // directory that should hold `.caelo/` — not from this wizard.
       cancel(
-        `Self-hosted wizard is the existing \`cms-provision init\` flow. Run \`${selfCommand("init", "--domain", "...", "--owner-email", "...")}\` for now; wizard polish lands in a follow-up commit.`,
+        `Run this on the Docker host, in the directory that should hold the install:\n  ${selfCommand("--provider", "self-hosted", "--domain", domain, "--owner-email", ownerEmail)}`,
       );
       process.exit(0);
       break;

package/src/wizards/gcp-cost.ts

@@ -104,7 +104,7 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
       name: "Quality checks (Lighthouse on the admin)",
       monthlyUsd: 1,
       notes:
-        "~1-2 min of admin CPU per audited Stage (up to 5 pages x 3 runs); ~$1/mo at a few Stages a day",
+        "~2-4 min of admin CPU per audited Stage (up to 5 pages x 5 runs); ~$1/mo at a few Stages a day",
     },
     {
       name: "Cloud Run gateway",

package/src/wizards/gcp.ts

@@ -99,6 +99,7 @@ import {
   PROVISIONER_ACCOUNT_ID,
   provisionerServiceAccountEmail,
 } from "../provisioner-identity.js";
+import { revokePublicRoleMemberships } from "../public-role-isolation.js";
 import { decideRegion, detectCliRegion, installableRegions, suggestRegion } from "../regions.js";
 import type { RunMode } from "../run-mode.js";
 import { selfCommand } from "../self-command.js";
@@ -120,6 +121,7 @@ import {
   verifyCosignAll,
 } from "../upgrade/release-images.js";
 import { ensureUpgraderJob, resolveUpgraderTarget } from "../upgrader-setup.js";
+import { ensureUrlMapRedirectsAccess } from "../url-map-redirects-access.js";
 import { estimateGcpCost } from "./gcp-cost.js";
 import { promptProjectId } from "./gcp-prompts.js";
 import { GCP_STACK_KNOB_DEFAULTS, pulumiUpGcp, readStackOutput } from "./gcp-pulumi.js";
@@ -430,6 +432,17 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // P21 ship 3 — shared with `cms-provision upgrade`. Aborts the
   // wizard with a clear error if migrations fail (vs. silently
   // continuing with a half-migrated DB).
+  // === 10.9. public_role out of cloudsqlsuperuser (#633) ===
+  // The stack creates public_role through the Cloud SQL Admin API, which
+  // makes it a member of cloudsqlsuperuser. Revoked before migrations: the
+  // migration job's role audit verifies it and fails the install otherwise.
+  await stepPublicRoleIsolation(projectId);
+
+  // === 10.95. The admin may write redirects into the URL map (#587) ===
+  // Confirm-publish writes the redirects table into the load balancer's URL
+  // map; the custom role is the CLI's, not the stack's (url-map-redirects-access.ts).
+  if (provider === "gcp") await stepUrlMapRedirectsAccess(projectId);
+
   phase("Applying database migrations");
   {
     const { runMigrationsViaCloudRunJob } = await import("../migration-runner.js");
@@ -886,6 +899,41 @@ async function stepGrantBaseRoles(
   markStepDone(installId, stepName, { granted });
 }
 
+/**
+ * Revoke the database roles the Cloud SQL Admin API gave `public_role`
+ * (cloudsqlsuperuser, #633). Idempotent, so it runs on every wizard pass;
+ * the migration job's role audit verifies the result.
+ */
+async function stepPublicRoleIsolation(projectId: string): Promise<void> {
+  const s = spinner();
+  s.start("Removing public_role from the Cloud SQL superuser group...");
+  const r = await revokePublicRoleMemberships({ projectId, env: GCP_STACK_ENV });
+  if (r.status === "failed") {
+    s.stop(red(`Failed: ${r.error ?? ""}`));
+    log.error("Re-run the wizard once the cause is fixed (this step is idempotent).");
+    cancel("Aborted.");
+    process.exit(1);
+  }
+  s.stop(green("public_role holds no database roles"));
+}
+
+/**
+ * The admin's custom role for writing the redirects table into the URL map
+ * (#587). Idempotent, so it runs on every wizard pass.
+ */
+async function stepUrlMapRedirectsAccess(projectId: string): Promise<void> {
+  const s = spinner();
+  s.start("Letting the admin serve redirects from the load balancer...");
+  const r = await ensureUrlMapRedirectsAccess({ projectId, env: GCP_STACK_ENV });
+  if (!r.ok) {
+    s.stop(red(`Failed: ${r.error}`));
+    log.error("Re-run the wizard once the cause is fixed (this step is idempotent).");
+    cancel("Aborted.");
+    process.exit(1);
+  }
+  s.stop(green(`Redirects role ready (${r.role})`));
+}
+
 /**
  * Give `gateway_role` (created by migration 0248) its password from the
  * `gateway-role-password` secret (#613). public_role already has its own:

package/stacks/aws/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on AWS managed services. Implements the shared `
 | Blob storage | Two S3 buckets (`caelo-<env>-media` + `caelo-<env>-static`) |
 | CDN | CloudFront distribution with two origins (S3 static + S3 media); static files are served as files, no edge compute on the request path |
 | Container runtime | ECS Fargate cluster + four services (admin / gateway / orchestrator / runner) |
-| Secret store | AWS Secrets Manager (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `gatewayDatabaseUrlOut` + `publicDatabaseUrlOut`, never the admin URL (#613). |
+| Secret store | AWS Secrets Manager (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `publicDatabaseUrlOut` only, never a cms_admin URL of any role (#613, #635). |
 | DNS + cert | ACM cert (us-east-1, DNS-validated, supports `*.<domain>`) |
 | Edge-log sink | CloudFront access logs delivered to the CloudWatch log group `/caelo/<env>/cloudfront` in us-east-1 (queryable by P12A analytics plugin) |
 

package/stacks/aws/index.ts

@@ -11,8 +11,9 @@
  *     - Bootstrap script runs as a one-shot ECS task post-create.
  *  3. S3 buckets: caelo-media + caelo-static (per env).
  *  4. CloudFront distribution with two origins (S3 static + ALB-fronted ECS).
- *     Static files are served as files — no edge compute on the request
- *     path (CLAUDE.md §11.B Tier 1).
+ *     Static files are served as files (CLAUDE.md §11.B Tier 1); the only
+ *     edge code is the redirects table's CloudFront Function, a KeyValueStore
+ *     lookup that runs before the origin (#587).
  *  5. ECS Fargate cluster + four services (admin, gateway, orchestrator, runner).
  *  6. Secrets Manager entries (postgres-password, anthropic-api-key, ...).
  *  7. Route 53 hosted zone + ACM certs per (domain, locale).
@@ -26,10 +27,17 @@
  * is to wire those env vars to AWS-native resources.
  */
 
+import { cloudFrontRedirectFunctionCode } from "@caelo-cms/shared";
 import * as aws from "@pulumi/aws";
 import * as awsx from "@pulumi/awsx";
 import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
+import {
+  AWS_SERVICE_SECRETS,
+  type AwsSecret,
+  type AwsTaskService,
+  secretsReadPolicy,
+} from "../../dist/aws-task-roles.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
 import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB } from "../../dist/stack-contract.js";
 
@@ -87,9 +95,11 @@ function randomHex(bytes: number): string {
 }
 
 const postgresPassword = pulumi.secret(randomHex(32));
-// #613 — one password per database role, so the gateway (public_role +
-// gateway_role) never holds admin_role's. bootstrap.sh creates the roles
-// with these (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD).
+// #613 — one password per database role, so the gateway (public_role only,
+// #635) never holds admin_role's. bootstrap.sh creates the roles with these
+// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
+// any service's login; its password stays until the contract release that
+// drops the role (#635).
 const publicRolePassword = pulumi.secret(randomHex(32));
 const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
@@ -161,13 +171,6 @@ const publicDatabaseUrl = pulumi
     ([host, port, pw]) =>
       `postgresql://public_role:${pw}@${host}:${port}/cms_public?sslmode=require`,
   );
-// The gateway's cms_admin login (#613): grants from migration 0248 only.
-const gatewayDatabaseUrl = pulumi
-  .all([db.address, db.port, gatewayRolePassword])
-  .apply(
-    ([host, port, pw]) =>
-      `postgresql://gateway_role:${pw}@${host}:${port}/cms_admin?sslmode=require`,
-  );
 
 // === 4. S3 buckets ===
 const mediaBucket = new aws.s3.BucketV2(`${namePrefix}-media`, {
@@ -225,6 +228,27 @@ const cert = new aws.acm.Certificate(
   { provider: usEast1Provider },
 );
 
+// === 6b. Redirects at the edge (#587) ===
+// The redirects table: a CloudFront Function on viewer-request answers each
+// redirected path from a KeyValueStore before the S3 origin is asked
+// (redirect-emit-cloudfront.ts in @caelo-cms/shared). The deploy writes
+// the store, so redirects change without republishing the function.
+// FIXME(issue #749): the S3 static publisher is still a stub (#5); until
+// it writes the store, the function finds no keys and every request passes
+// through to the origin.
+const redirectKvs = new aws.cloudfront.KeyValueStore(`${namePrefix}-redirects`, {
+  name: `${namePrefix}-redirects`,
+  comment: `Caelo ${env} redirects table (#587)`,
+});
+const redirectFunction = new aws.cloudfront.Function(`${namePrefix}-redirects`, {
+  name: `${namePrefix}-redirects`,
+  runtime: "cloudfront-js-2.0",
+  comment: `Caelo ${env}: answer the redirects table at the edge (#587)`,
+  publish: true,
+  code: redirectKvs.arn.apply((arn) => cloudFrontRedirectFunctionCode(kvsIdFromArn(arn))),
+  keyValueStoreAssociations: [redirectKvs.arn],
+});
+
 // === 7. CloudFront distribution ===
 const distribution = new aws.cloudfront.Distribution(`${namePrefix}-cdn`, {
   enabled: true,
@@ -252,6 +276,7 @@ const distribution = new aws.cloudfront.Distribution(`${namePrefix}-cdn`, {
     minTtl: 0,
     defaultTtl: 60,
     maxTtl: 86400,
+    functionAssociations: [{ eventType: "viewer-request", functionArn: redirectFunction.arn }],
   },
   orderedCacheBehaviors: [
     {
@@ -325,38 +350,48 @@ const cluster = new aws.ecs.Cluster(`${namePrefix}-ecs`, {
   settings: [{ name: "containerInsights", value: "enabled" }],
 });
 
-const taskRole = new aws.iam.Role(`${namePrefix}-task-role`, {
-  assumeRolePolicy: JSON.stringify({
-    Version: "2012-10-17",
-    Statement: [
-      {
-        Effect: "Allow",
-        Principal: { Service: "ecs-tasks.amazonaws.com" },
-        Action: "sts:AssumeRole",
-      },
-    ],
-  }),
-});
+// One task role per service (#635): the gateway's may read only the
+// public_role password, never a secret that unlocks a cms_admin login
+// (src/aws-task-roles.ts AWS_SERVICE_SECRETS, asserted by
+// gateway-env-isolation.test.ts). The admin keeps the logical names the
+// former shared role had, so upgrading replaces nothing on its side.
+const secretArns: Record<AwsSecret, pulumi.Output<string>> = {
+  "postgres-password": pgSecret.arn,
+  "public-role-password": publicRoleSecret.arn,
+  "gateway-role-password": gatewayRoleSecret.arn,
+  "csrf-secret": csrfSecretRes.arn,
+  "cookie-secret": cookieSecretRes.arn,
+  "anthropic-api-key": anthropicSecretRes.arn,
+  "resend-api-key": resendSecretRes.arn,
+};
 
-new aws.iam.RolePolicy(`${namePrefix}-task-secrets`, {
-  role: taskRole.id,
-  policy: pulumi
-    .all([
-      pgSecret.arn,
-      publicRoleSecret.arn,
-      gatewayRoleSecret.arn,
-      csrfSecretRes.arn,
-      cookieSecretRes.arn,
-      anthropicSecretRes.arn,
-      resendSecretRes.arn,
-    ])
-    .apply((arns) =>
-      JSON.stringify({
-        Version: "2012-10-17",
-        Statement: [{ Effect: "Allow", Action: "secretsmanager:GetSecretValue", Resource: arns }],
-      }),
-    ),
-});
+function taskRole(service: AwsTaskService): aws.iam.Role {
+  const prefix = service === "admin" ? namePrefix : `${namePrefix}-${service}`;
+  const role = new aws.iam.Role(`${prefix}-task-role`, {
+    assumeRolePolicy: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Principal: { Service: "ecs-tasks.amazonaws.com" },
+          Action: "sts:AssumeRole",
+        },
+      ],
+    }),
+  });
+  new aws.iam.RolePolicy(`${prefix}-task-secrets`, {
+    role: role.id,
+    policy: pulumi
+      .all(AWS_SERVICE_SECRETS[service].map((name) => secretArns[name]))
+      .apply(secretsReadPolicy),
+  });
+  return role;
+}
+
+const taskRoles: Record<AwsTaskService, aws.iam.Role> = {
+  admin: taskRole("admin"),
+  gateway: taskRole("gateway"),
+};
 
 const execRole = new aws.iam.Role(`${namePrefix}-exec-role`, {
   assumeRolePolicy: JSON.stringify({
@@ -397,7 +432,6 @@ const dnsRecordsRequired: DnsRecord[] = [
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
-  gatewayDatabaseUrl: gatewayDatabaseUrl as unknown as string,
   mediaStorageUrl: pulumi.interpolate`s3://${mediaBucket.bucket}` as unknown as string,
   mediaCdnBaseUrl:
     pulumi.interpolate`https://${distribution.domainName}/media` as unknown as string,
@@ -412,7 +446,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;
@@ -421,11 +454,22 @@ export const edgeLogSinkUrlOut = out.edgeLogSinkUrl;
 export const providerOut = out.provider;
 export const environmentOut = out.environment;
 export const cloudfrontDomainOut = distribution.domainName;
+export const redirectKvsArnOut = redirectKvs.arn;
 export const ecsClusterArnOut = cluster.arn;
 export const rdsAddressOut = db.address;
+// The task roles the admin-side and gateway task definitions run as.
+export const adminTaskRoleArnOut = taskRoles.admin.arn;
+export const gatewayTaskRoleArnOut = taskRoles.gateway.arn;
 
 // Note: the bootstrap token (and other secrets like postgres-password,
 // CSRF/cookie secrets, Anthropic key) are stored in Pulumi's encrypted
 // state via `pulumi.secret(...)`. Operators retrieve via
 // `pulumi stack output --show-secrets`.
 export const bootstrapTokenExpiresAtOut = tokenInfo.expiresAt;
+
+/** A KeyValueStore's id: the last segment of its ARN. */
+function kvsIdFromArn(arn: string): string {
+  const id = arn.slice(arn.lastIndexOf("/") + 1);
+  if (!id || id === arn) throw new Error(`not a CloudFront KeyValueStore ARN: ${arn}`);
+  return id;
+}

package/stacks/azure/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on Azure managed services. Implements the shared
 | Blob storage | Storage Account with a private `media` container and static-website hosting (`$web`) |
 | CDN / Edge | Azure Front Door Standard: the primary domain serves the static website as files, with a Front Door managed certificate; no edge compute on the request path |
 | Container runtime | Four Container Apps (admin / gateway / orchestrator / runner) in one managed environment |
-| Secret store | Key Vault (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `GATEWAY_DATABASE_URL` + `PUBLIC_DATABASE_URL`, never an admin credential (#613). |
+| Secret store | Key Vault (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `PUBLIC_DATABASE_URL` only, never a cms_admin credential of any role (#613, #635). |
 | Edge-log sink | Log Analytics workspace receives Container Apps logs (queryable by P12A analytics plugin via Azure Monitor) |
 
 The Caelo runtime never knows it's on Azure — every Container App consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.

package/stacks/azure/index.ts

@@ -81,9 +81,11 @@ function randomHex(bytes: number): string {
 }
 
 const postgresPassword = pulumi.secret(randomHex(32));
-// #613 — one password per database role, so the gateway (public_role +
-// gateway_role) never holds admin_role's. bootstrap.sh creates the roles
-// with these (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD).
+// #613 — one password per database role, so the gateway (public_role only,
+// #635) never holds admin_role's. bootstrap.sh creates the roles with these
+// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
+// any service's login; its password stays until the contract release that
+// drops the role (#635).
 const publicRolePassword = pulumi.secret(randomHex(32));
 const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
@@ -162,14 +164,11 @@ const adminDatabaseUrl = pulumi
 const publicAdminDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, postgresPassword])
   .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public?sslmode=require`);
-// The gateway's two logins (#613): public_role on cms_public and
-// gateway_role on cms_admin, each with its own password.
+// The gateway's only login (#613, #635): public_role on cms_public. It has
+// no cms_admin login at all (CLAUDE.md §2).
 const publicDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, publicRolePassword])
   .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?sslmode=require`);
-const gatewayDatabaseUrl = pulumi
-  .all([pgServer.fullyQualifiedDomainName, gatewayRolePassword])
-  .apply(([host, pw]) => `postgresql://gateway_role:${pw}@${host}:5432/cms_admin?sslmode=require`);
 
 // === 4. Storage account + containers ===
 const storage = new azure.storage.StorageAccount(`${namePrefix}-st`, {
@@ -269,6 +268,18 @@ const siteDomain = new azure.cdn.AFDCustomDomain(`${namePrefix}-fd-domain`, {
   tlsSettings: { certificateType: "ManagedCertificate", minimumTlsVersion: "TLS12" },
 });
 
+// #587 — the redirects table as rules-engine rules on the static route
+// (redirect-emit-front-door.ts in @caelo-cms/shared): Front Door answers
+// them at the edge before the Blob origin. The deploy owns the rules; the
+// stack only creates the rule set and attaches it.
+// FIXME(issue #750): the Blob static publisher is still a stub (#6); until
+// it writes the rules, the set stays empty and no redirect is served.
+const redirectRuleSet = new azure.cdn.RuleSet(`${namePrefix}-fd-redirects`, {
+  resourceGroupName: rg.name,
+  profileName: frontDoor.name,
+  ruleSetName: "caeloRedirects",
+});
+
 new azure.cdn.Route(
   `${namePrefix}-fd-route`,
   {
@@ -278,6 +289,7 @@ new azure.cdn.Route(
     routeName: "static",
     originGroup: { id: staticOriginGroup.id },
     customDomains: [{ id: siteDomain.id }],
+    ruleSets: [{ id: redirectRuleSet.id }],
     patternsToMatch: ["/*"],
     // Without a cache configuration Front Door does not cache the route at
     // all; static files are edge-cached per their Cache-Control (§11.B
@@ -406,10 +418,7 @@ const adminApp = containerApp({
 });
 const _gatewayApp = containerApp({
   serviceName: "gateway",
-  databaseEnv: [
-    { name: "GATEWAY_DATABASE_URL", value: gatewayDatabaseUrl },
-    { name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl },
-  ],
+  databaseEnv: [{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }],
 });
 const _orchestratorApp = containerApp({
   serviceName: "orchestrator",
@@ -433,7 +442,6 @@ const dnsRecordsRequired = pulumi
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
-  gatewayDatabaseUrl: gatewayDatabaseUrl as unknown as string,
   mediaStorageUrl:
     pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
@@ -447,7 +455,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | Blob storage | Two GCS buckets (`<project>-caelo-<env>-media`, `<project>-caelo-<env>-static`) with uniform bucket-level access |
 | CDN | Global HTTPS load balancer + Cloud CDN backend bucket: `<domain>` serves the static bucket as files, `/api/*` goes to the gateway, `admin.<domain>` to the IAP-gated admin |
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
-| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only the two gateway role passwords (#613); `gateway_role` itself is created by migration 0248 and gets its password from the CLI after migrations. |
+| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login); `gateway_role`, created by migration 0248, is no service's login any more. |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.