@caelo-cms/provisioning 0.10.50 → 0.10.51

package/src/gateway-env-isolation.test.ts

@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Issue #635 guardrail (c): on EVERY adapter, the API gateway's service
+ * env holds no cms_admin credential of any role, AND its identity cannot
+ * read a secret that unlocks one (CLAUDE.md §2: the public side has no path
+ * to cms_admin). Env strings alone are not enough: a role that may read
+ * admin_role's password is a path even when no env var names it.
+ *
+ *   gcp, gcp-firebase  the env contract (stack-contract.ts), every IAM
+ *                      binding the gateway SA gets (contract + stack source)
+ *   aws                the gateway's own ECS task role and the secrets its
+ *                      policy covers (aws-task-roles.ts + stack source)
+ *   azure              the gateway container app's env, and no identity or
+ *                      Key Vault access for any container app
+ *   self-hosted        the generated compose gateway service: env, secrets,
+ *                      mounts
+ *
+ * The gateway itself refuses to boot on such an env
+ * (apps/api-gateway `adminDatabaseAccessInEnv`); this catches it at review
+ * time, before a release can ship it.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { AWS_SERVICE_SECRETS, secretsReadPolicy } from "./aws-task-roles.js";
+import { generateDockerCompose } from "./compose.js";
+import {
+  databaseUrls,
+  gatewayEnvContract,
+  RETIRED_IAM_BINDINGS,
+  RETIRED_SERVICE_ENV,
+  runtimeSecretBindings,
+  SERVICE_SECRET_ENV,
+  stackIamInvariants,
+} from "./stack-contract.js";
+
+/** Anything in a gateway env value or name that reaches the authoring database. */
+const ADMIN_ACCESS = /cms_admin|admin_role|gateway_role|ADMIN_DATABASE|GATEWAY_DATABASE/;
+
+/** Secrets that unlock a cms_admin login. */
+const ADMIN_SECRETS = ["postgres-password", "gateway-role-password"];
+
+/** The secrets the gateway reads on GCP: its own login and the staging gate key. */
+const GCP_GATEWAY_SECRETS = ["public-role-password", "staging-gate-secret"];
+
+/** The source of a stack program. */
+function stack(provider: "aws" | "azure" | "gcp" | "gcp-firebase"): string {
+  return readFileSync(resolve(import.meta.dir, "..", "stacks", provider, "index.ts"), "utf8");
+}
+
+describe("gcp + gcp-firebase: the gateway env contract (#635)", () => {
+  const env = gatewayEnvContract({
+    provider: "gcp",
+    projectId: "acme",
+    env: "production",
+    domain: "example.com",
+    region: "europe-west1",
+    stagingHost: "staging.example.com",
+    databaseUrls: databaseUrls("10.20.0.3"),
+  });
+
+  it("carries no cms_admin URL, role or credential name", () => {
+    for (const v of env) {
+      expect(v.name).not.toMatch(ADMIN_ACCESS);
+      if ("value" in v && typeof v.value === "string") expect(v.value).not.toMatch(ADMIN_ACCESS);
+    }
+    expect(env.find((v) => v.name === "PUBLIC_DATABASE_URL")).toEqual({
+      name: "PUBLIC_DATABASE_URL",
+      value: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
+    });
+  });
+
+  it("references no secret that unlocks a cms_admin login", () => {
+    for (const secret of Object.values(SERVICE_SECRET_ENV.gateway)) {
+      expect(ADMIN_SECRETS).not.toContain(secret);
+    }
+    const gatewayBindings = runtimeSecretBindings().filter((b) => b.service === "gateway");
+    for (const b of gatewayBindings) expect(ADMIN_SECRETS).not.toContain(b.secret);
+  });
+
+  for (const provider of ["gcp", "gcp-firebase"] as const) {
+    it(`${provider}: the gateway SA's IAM bindings reach no cms_admin secret (review finding)`, () => {
+      const gateway = stackIamInvariants(provider).filter((b) => b.member === "gateway-sa");
+      for (const b of gateway) {
+        if (b.role === "roles/secretmanager.secretAccessor") {
+          // Per secret, never project-wide (that would cover every secret).
+          expect(b.target.kind).toBe("secret");
+          if (b.target.kind === "secret") expect(GCP_GATEWAY_SECRETS).toContain(b.target.name);
+        } else {
+          expect(["roles/logging.logWriter", "roles/monitoring.metricWriter"]).toContain(b.role);
+        }
+      }
+      // The stack declares no other binding for the gateway SA: the secret
+      // bindings go through runtimeSecretBindings, the two telemetry ones
+      // name it directly.
+      const direct = stack(provider).match(/serviceAccount:\$\{gatewaySa\.email\}/g) ?? [];
+      expect(direct).toHaveLength(2);
+      expect(stack(provider)).toContain("for (const binding of runtimeSecretBindings())");
+    });
+  }
+
+  it("upgrade strips the old credentials and the gateway SA's access to them", () => {
+    for (const name of [
+      "ADMIN_DATABASE_URL",
+      "ADMIN_DATABASE_PASSWORD",
+      "GATEWAY_DATABASE_URL",
+      "GATEWAY_DATABASE_PASSWORD",
+    ]) {
+      expect(RETIRED_SERVICE_ENV.gateway).toContain(name);
+    }
+    for (const secret of ADMIN_SECRETS) {
+      expect(
+        RETIRED_IAM_BINDINGS.some(
+          (b) =>
+            b.member === "gateway-sa" && b.target.kind === "secret" && b.target.name === secret,
+        ),
+      ).toBe(true);
+    }
+  });
+});
+
+describe("self-hosted: the generated compose gateway service (#635)", () => {
+  it("holds public_role on cms_public and nothing else", () => {
+    const out = generateDockerCompose({
+      domain: "example.com",
+      postgresPassword: "superpw",
+      rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+      caeloSecretKek: "0".repeat(64),
+      diskSize: "20Gi",
+      images: {
+        mode: "release" as const,
+        admin: `ghcr.io/caelo-cms/admin@sha256:${"a".repeat(64)}`,
+        gateway: `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`,
+      },
+      ports: { http: 80, https: 443 },
+      project: "caelo-example-com",
+    });
+    const start = out.indexOf("  caelo-gateway:");
+    const end = out.indexOf("\n  caelo-", start + 1);
+    const gateway = out.slice(start, end === -1 ? undefined : end);
+    expect(gateway).toContain("PUBLIC_DATABASE_URL:");
+    expect(gateway).not.toMatch(ADMIN_ACCESS);
+    expect(gateway).not.toMatch(/superpw|adminpw|gatewaypw/);
+    // No other way in: no Compose secrets, no env file, no mounts (a
+    // mounted file is read by no env check), and exactly its own env.
+    expect(gateway).not.toMatch(/^ {4}(secrets|env_file|volumes):/m);
+    const env = gateway.slice(gateway.indexOf("    environment:"));
+    const keys = [...env.matchAll(/^ {6}([A-Z_][A-Z0-9_]*):/gm)].map((m) => m[1]);
+    expect(keys.sort()).toEqual(["GATEWAY_PORT", "NODE_ENV", "PUBLIC_DATABASE_URL"]);
+    expect(out).not.toMatch(/^secrets:/m);
+  });
+});
+
+describe("azure: the gateway container app (#635)", () => {
+  it("gets PUBLIC_DATABASE_URL only", () => {
+    const src = stack("azure");
+    const start = src.indexOf('serviceName: "gateway"');
+    expect(start).toBeGreaterThan(-1);
+    const block = src.slice(start, src.indexOf("});", start));
+    expect(block).toContain('{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }');
+    expect(block).not.toMatch(/adminDatabase|gatewayDatabase|ADMIN_DATABASE|GATEWAY_DATABASE/);
+  });
+
+  it("builds no cms_admin URL for any role but the admin's", () => {
+    expect(stack("azure")).not.toMatch(/gateway_role:\$\{/);
+  });
+
+  it("gives no container app an identity or Key Vault access (review finding)", () => {
+    // The vault uses RBAC authorisation: without a role assignment or a
+    // managed identity no container app can read any vault secret, so the
+    // gateway's only credential is the public_role URL in its env.
+    const src = stack("azure");
+    expect(src).toContain("enableRbacAuthorization: true");
+    expect(src).not.toMatch(/RoleAssignment|accessPolicies|identity\s*:|keyVaultUrl|secretRef/);
+  });
+});
+
+describe("aws: the stack (#635)", () => {
+  it("builds no gateway_role URL and exports no gateway cms_admin DSN", () => {
+    const src = stack("aws");
+    expect(src).not.toMatch(/gateway_role:\$\{/);
+    expect(src).not.toMatch(/gatewayDatabaseUrl/);
+  });
+
+  it("the gateway's task role reads only the public_role password (review finding)", () => {
+    expect(AWS_SERVICE_SECRETS.gateway).toEqual(["public-role-password"]);
+    for (const secret of ADMIN_SECRETS) expect(AWS_SERVICE_SECRETS.gateway).not.toContain(secret);
+  });
+
+  it("each service gets its own task role whose policy is built from that table", () => {
+    const src = stack("aws");
+    expect(src).toContain('gateway: taskRole("gateway")');
+    expect(src).toContain('admin: taskRole("admin")');
+    // One RolePolicy, inside taskRole, scoped by AWS_SERVICE_SECRETS[service]:
+    // no policy anywhere lists secret ARNs by hand.
+    expect(src.match(/new aws\.iam\.RolePolicy\(/g)).toHaveLength(1);
+    expect(src).toContain(".all(AWS_SERVICE_SECRETS[service].map((name) => secretArns[name]))");
+    expect(src).not.toMatch(/GetSecretValue/);
+  });
+
+  it("secretsReadPolicy grants GetSecretValue on exactly the given ARNs", () => {
+    expect(JSON.parse(secretsReadPolicy(["arn:a", "arn:b"]))).toEqual({
+      Version: "2012-10-17",
+      Statement: [
+        { Effect: "Allow", Action: "secretsmanager:GetSecretValue", Resource: ["arn:a", "arn:b"] },
+      ],
+    });
+    expect(() => secretsReadPolicy([])).toThrow();
+  });
+});

package/src/gcloud.ts

@@ -75,10 +75,12 @@ export async function gcloud(
 
 /**
  * Active gcloud account. Returns `null` when no account is logged in
- * — caller prompts `gcloud auth login`.
+ * — caller prompts `gcloud auth login`. `run` is injectable for tests.
  */
-export async function activeAccount(): Promise<string | null> {
-  const r = await gcloud(["auth", "list", "--format=value(account)", "--filter=status:ACTIVE"]);
+export async function activeAccount(
+  run: (args: string[]) => Promise<GcloudResult> = gcloud,
+): Promise<string | null> {
+  const r = await run(["auth", "list", "--format=value(account)", "--filter=status:ACTIVE"]);
   if (!r.ok) return null;
   const value = r.stdout.trim();
   return value.length > 0 ? value : null;

package/src/index.test.ts

@@ -132,7 +132,7 @@ describe("docker-compose generator", () => {
     expect(out).toContain("CAELO_SECRET_KEK");
   });
 
-  it("gives the gateway gateway_role + public_role and no admin credential (#613)", () => {
+  it("gives the gateway public_role only and no cms_admin credential (#613, #635)", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "supersecret",
@@ -144,14 +144,14 @@ describe("docker-compose generator", () => {
       project: "caelo-example-com",
     });
     const gateway = out.slice(out.indexOf("caelo-gateway:"), out.indexOf("\nvolumes:"));
-    expect(gateway).toContain(
-      'GATEWAY_DATABASE_URL: "postgres://gateway_role:gatewaypw@postgres:5432/cms_admin"',
-    );
     expect(gateway).toContain(
       'PUBLIC_DATABASE_URL: "postgres://public_role:publicpw@postgres:5432/cms_public"',
     );
-    expect(gateway).not.toMatch(/ADMIN_DATABASE|admin_role|adminpw|supersecret|CAELO_SECRET_KEK/);
-    // bootstrap.sh creates the three roles from these.
+    expect(gateway).not.toMatch(
+      /ADMIN_DATABASE|GATEWAY_DATABASE|cms_admin|admin_role|gateway_role|adminpw|gatewaypw|supersecret|CAELO_SECRET_KEK/,
+    );
+    // bootstrap.sh still creates the three roles from these (gateway_role
+    // until the contract release drops it).
     expect(out).toContain('GATEWAY_ROLE_PASSWORD: "gatewaypw"');
   });
 

package/src/infra-contract.test.ts

@@ -20,10 +20,11 @@ describe("infrastructure contract steps", () => {
     );
   });
 
-  it("is at 4: the public_role revoke (3) and the URL-map redirects role (4) are separate", () => {
-    expect(INFRA_CONTRACT_VERSION).toBe(4);
+  it("is at 5: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5)", () => {
+    expect(INFRA_CONTRACT_VERSION).toBe(5);
     expect(INFRA_CONTRACT_STEPS[3]).toContain("#633");
     expect(INFRA_CONTRACT_STEPS[4]).toContain("#587");
+    expect(INFRA_CONTRACT_STEPS[5]).toContain("#635");
   });
 
   it("lists the pending steps oldest first", () => {
@@ -34,6 +35,6 @@ describe("infrastructure contract steps", () => {
   });
 
   it("names a version a newer release added by number", () => {
-    expect(infraStepsText(4, 5)).toBe("infrastructure step 5 (see that release's notes)");
+    expect(infraStepsText(5, 6)).toBe("infrastructure step 6 (see that release's notes)");
   });
 });

package/src/infra-contract.ts

@@ -22,7 +22,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 4;
+export const INFRA_CONTRACT_VERSION = 5;
 
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
@@ -36,6 +36,10 @@ export const INFRA_CONTRACT_VERSION = 4;
 //       first.
 //   4 — #587: on `gcp`, the admin's custom role for writing the redirects
 //       table into the URL map (url-map-redirects-access.ts).
+//   5 — #635: the gateway has no cms_admin login. Its GATEWAY_DATABASE_URL /
+//       GATEWAY_DATABASE_PASSWORD go, and its SA loses access to the
+//       gateway-role-password secret (a retired IAM binding, removed after
+//       the roll — the in-cloud upgrader cannot change IAM).
 
 /**
  * What each contract version adds, in operator terms — the upgrader's
@@ -47,6 +51,7 @@ export const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>> = {
   2: "the in-cloud upgrader job and its scoped permissions",
   3: "public_role out of the Cloud SQL superuser group (#633)",
   4: "the admin's permission to serve redirects from the load balancer (#587)",
+  5: "the gateway's cms_admin login removed from its env and IAM (#635)",
 };
 
 /**

package/src/owner-reset.test.ts

@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #769 — `owner-reset` asks the admin for a reset link through IAP (as
+ * caelo-mcp) with the internal token for scope `auth.owner_reset`, and builds
+ * the link on the admin URL the operator can open.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import { describeOwnerReset, OWNER_RESET_SCOPE, requestOwnerReset } from "./owner-reset.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+const ADMIN = "https://caelo-production-admin-abc-ew.a.run.app";
+const target = { projectId: "proj", region: "europe-west1" };
+
+function fakeGcloud(
+  overrides: Record<string, GcloudResult> = {},
+): (args: string[]) => Promise<GcloudResult> {
+  const answers: Record<string, GcloudResult> = {
+    "auth list": ok("operator@example.com\n"),
+    "run services list": ok("caelo-production-admin-abc\n"),
+    "run services describe": ok(`${ADMIN}\n`),
+    "secrets versions access": ok("s".repeat(40)),
+    "auth print-access-token": ok("ya29.operator\n"),
+    "services enable iamcredentials.googleapis.com": ok(),
+    ...overrides,
+  };
+  return async (args) => {
+    const key = Object.keys(answers).find((k) => args.join(" ").startsWith(k));
+    return (key && answers[key]) || fail(`unexpected gcloud ${args.join(" ")}`);
+  };
+}
+
+interface Seen {
+  url: string;
+  headers: Record<string, string>;
+  body: unknown;
+}
+
+function fakeFetch(admin: () => Response) {
+  const seen: Seen[] = [];
+  const doFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = String(input);
+    seen.push({
+      url,
+      headers: Object.fromEntries(new Headers(init?.headers).entries()),
+      body: init?.body ? JSON.parse(String(init.body)) : null,
+    });
+    if (url.startsWith("https://iamcredentials.googleapis.com/")) {
+      return Response.json({ signedJwt: "iap.jwt.signed" });
+    }
+    return admin();
+  }) as typeof fetch;
+  return { doFetch, seen };
+}
+
+const ISSUED = {
+  ok: true,
+  email: "owner@example.com",
+  token: "tok/with+chars",
+  expiresAt: "2026-10-15T12:52:56.000Z",
+};
+
+describe("requestOwnerReset", () => {
+  it("calls the endpoint with the owner_reset scope and builds the link on the admin URL", async () => {
+    const { doFetch, seen } = fakeFetch(() => Response.json(ISSUED));
+    const r = await requestOwnerReset(target, {}, { run: fakeGcloud(), fetch: doFetch });
+    expect(r).toEqual({
+      ok: true,
+      value: {
+        email: "owner@example.com",
+        resetUrl: `${ADMIN}/reset?token=tok%2Fwith%2Bchars`,
+        expiresAt: "2026-10-15T12:52:56.000Z",
+      },
+    });
+    const call = seen[1];
+    expect(call?.url).toBe(`${ADMIN}/api/internal/owner-reset`);
+    expect(call?.headers.authorization).toBe("Bearer iap.jwt.signed");
+    expect(call?.body).toEqual({ requestedBy: "operator@example.com" });
+    const [message] = (call?.headers["x-caelo-internal-token"] ?? "").split(".");
+    expect(Buffer.from(message ?? "", "base64url").toString()).toEndWith(`:${OWNER_RESET_SCOPE}`);
+  });
+
+  it("forwards --email so the operator can pick among several Owners", async () => {
+    const { doFetch, seen } = fakeFetch(() => Response.json(ISSUED));
+    await requestOwnerReset(
+      target,
+      { email: "owner@example.com" },
+      { run: fakeGcloud(), fetch: doFetch },
+    );
+    expect(seen[1]?.body).toEqual({
+      email: "owner@example.com",
+      requestedBy: "operator@example.com",
+    });
+  });
+
+  it("refuses to run without an active gcloud account to name in the audit row", async () => {
+    const { doFetch, seen } = fakeFetch(() => Response.json(ISSUED));
+    for (const answer of [
+      ok(""),
+      fail("ERROR: no credentialed accounts"),
+      ok("a@x.com\nb@x.com"),
+    ]) {
+      const r = await requestOwnerReset(
+        target,
+        {},
+        { run: fakeGcloud({ "auth list": answer }), fetch: doFetch },
+      );
+      expect(r.ok ? "" : r.error).toContain("gcloud auth login");
+    }
+    expect(seen).toHaveLength(0);
+  });
+
+  it("passes the admin's refusal through and names the upgrade for an older admin", async () => {
+    const refused = await requestOwnerReset(
+      target,
+      {},
+      {
+        run: fakeGcloud(),
+        fetch: fakeFetch(() =>
+          Response.json(
+            { ok: false, error: "This install has 2 Owners (a@x.com, b@x.com). Name the one" },
+            { status: 422 },
+          ),
+        ).doFetch,
+      },
+    );
+    expect(refused.ok ? "" : refused.error).toContain("2 Owners (a@x.com, b@x.com)");
+
+    const old = await requestOwnerReset(
+      target,
+      {},
+      { run: fakeGcloud(), fetch: fakeFetch(() => new Response("nf", { status: 404 })).doFetch },
+    );
+    expect(old.ok ? "" : old.error).toContain("before #769");
+    expect(old.ok ? "" : old.error).toContain("cms-provision upgrade");
+  });
+
+  it("refuses an answer without a token instead of printing a broken link", async () => {
+    const r = await requestOwnerReset(
+      target,
+      {},
+      {
+        run: fakeGcloud(),
+        fetch: fakeFetch(() => Response.json({ ok: true, email: "owner@example.com" })).doFetch,
+      },
+    );
+    expect(r.ok).toBe(false);
+  });
+});
+
+describe("describeOwnerReset", () => {
+  it("prints the account, the link and when it stops working", () => {
+    const text = describeOwnerReset({
+      email: "owner@example.com",
+      resetUrl: `${ADMIN}/reset?token=abc`,
+      expiresAt: "2026-10-15T12:52:56.000Z",
+    }).join("\n");
+    expect(text).toContain("owner@example.com");
+    expect(text).toContain(`  ${ADMIN}/reset?token=abc`);
+    expect(text).toContain("2026-10-15T12:52:56.000Z");
+  });
+});

package/src/owner-reset.ts

@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #769 — `cms-provision owner-reset` — get an Owner back into a locked-out admin
+ * when the install cannot email a reset link (no email transport set up).
+ *
+ * The root of trust is the operator's cloud identity: whoever may read the
+ * install's internal secret and pass the admin's IAP already controls its
+ * database and deploys, so issuing them a reset link grants nothing new. The
+ * admin issues the one-hour, single-use token (`auth.issue_owner_reset`,
+ * audited) and hands it back over the admin-internal.ts channel; the CLI
+ * prints the link once. It is never logged, so it does not land in the
+ * project's Cloud Logging the way a "log the link" fallback would.
+ *
+ * The request carries the operator's gcloud account so the admin's audit row
+ * names who asked. That account is self-asserted (the admin sees the shared
+ * `caelo-mcp` identity and the shared internal secret), and labelled so; the
+ * authoritative record is Google's Data Access audit log for the IAM
+ * Credentials and Secret Manager calls this command makes as the operator.
+ */
+
+import {
+  type AdminInternalDeps,
+  type AdminInternalResult,
+  type AdminInternalTarget,
+  callAdminInternal,
+} from "./admin-internal.js";
+import { activeAccount, gcloud as defaultGcloud } from "./gcloud.js";
+
+/** Token scope the admin endpoint checks (apps/admin …/api/internal/owner-reset). */
+export const OWNER_RESET_SCOPE = "auth.owner_reset";
+const ENDPOINT = "/api/internal/owner-reset";
+
+/** What the admin issued: whose account, the link to open, and until when it works. */
+export interface OwnerReset {
+  readonly email: string;
+  readonly resetUrl: string;
+  readonly expiresAt: string;
+}
+
+/**
+ * Ask the admin for a reset link for the install's Owner (or the Owner named
+ * by `email` when there are several).
+ */
+export async function requestOwnerReset(
+  target: AdminInternalTarget,
+  request: { readonly email?: string },
+  deps: AdminInternalDeps = {},
+): Promise<AdminInternalResult<OwnerReset>> {
+  const account = await readGcloudAccount(deps.run ?? defaultGcloud);
+  if (!account.ok) return account;
+  const r = await callAdminInternal<{ email: string; token: string; expiresAt: string }>(
+    target,
+    {
+      endpoint: ENDPOINT,
+      scope: OWNER_RESET_SCOPE,
+      body: {
+        ...(request.email !== undefined ? { email: request.email } : {}),
+        requestedBy: account.value,
+      },
+      introducedBy: "#769",
+    },
+    deps,
+  );
+  if (!r.ok) return r;
+  const { answer, adminUrl } = r.value;
+  const { email, token, expiresAt } = answer;
+  if (!email || !token || !expiresAt) {
+    return { ok: false, error: "the admin answered without an email, token or expiry" };
+  }
+  const resetUrl = new URL(`/reset?token=${encodeURIComponent(token)}`, adminUrl).toString();
+  return { ok: true, value: { email, resetUrl, expiresAt } };
+}
+
+/**
+ * The gcloud account this command runs as, for the admin's audit row. Without
+ * one there is nobody to name, and the IAP step after this would fail anyway.
+ */
+async function readGcloudAccount(
+  run: NonNullable<AdminInternalDeps["run"]>,
+): Promise<AdminInternalResult<string>> {
+  // `auth list --filter=status:ACTIVE`, not `config get-value account`: the
+  // latter prints the sentinel `(unset)` and exits 0 when no account is set.
+  const account = await activeAccount(run);
+  if (!account || /\s/.test(account)) {
+    return {
+      ok: false,
+      error:
+        "read the active gcloud account: none is signed in. Run `gcloud auth login` with the account you provisioned with.",
+    };
+  }
+  return { ok: true, value: account };
+}
+
+/** The lines the command prints. Pure — the CLI prints them and stores nothing. */
+export function describeOwnerReset(r: OwnerReset): string[] {
+  return [
+    `Reset link for ${r.email} — open it to set a new password:`,
+    "",
+    `  ${r.resetUrl}`,
+    "",
+    `It works once and expires at ${r.expiresAt}. Setting the password signs out every`,
+    "other session of this account. The link is not saved anywhere; run the command",
+    "again for a new one.",
+  ];
+}

package/src/runtime-secrets.test.ts

@@ -340,10 +340,7 @@ describe("rotateRuntimeSecret", () => {
       ]),
     ],
     "run services describe gw-svc": [
-      service([
-        ref("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
-        ref("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
-      ]),
+      service([ref("PUBLIC_DATABASE_PASSWORD", "public-role-password")]),
     ],
     "auth print-access-token": [ok("tok\n")],
   });
@@ -414,7 +411,7 @@ describe("rotateRuntimeSecret", () => {
     ).toBe(true);
   });
 
-  it("gateway-role-password: changes gateway_role only and rolls the gateway only (#613)", async () => {
+  it("gateway-role-password: changes gateway_role only and rolls no service (#613, #635)", async () => {
     const { run, lines } = fakeGcloud({
       ...converged(),
       "secrets versions access": [ok("old-pw")],
@@ -428,9 +425,9 @@ describe("rotateRuntimeSecret", () => {
     });
     expect(report.ok).toBe(true);
     expect(sql.passwords()).toEqual(["gateway_role new-pw"]);
-    expect(lines().filter((l) => l.startsWith("run services update "))).toEqual([
-      expect.stringContaining("run services update gw-svc"),
-    ]);
+    // No service logs in as gateway_role any more: the gateway reads
+    // cms_public only (#635).
+    expect(lines().filter((l) => l.startsWith("run services update "))).toEqual([]);
     expect(lines()).toContain(
       "secrets versions access latest --secret=caelo-production-gateway-role-password --project=acme",
     );
@@ -477,6 +474,26 @@ describe("rotateRuntimeSecret", () => {
     expect(lines().every((l) => l.startsWith("run services describe"))).toBe(true);
   });
 
+  it("refuses gateway-role-password while the gateway still logs in with it (before #635)", async () => {
+    const answers = converged();
+    answers["run services describe gw-svc"] = [
+      service([
+        ref("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
+        ref("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
+      ]),
+    ];
+    const { run } = fakeGcloud(answers);
+    const sql = fakeSqlApi();
+    const report = await rotateRuntimeSecret(target, "gateway-role-password", {
+      run,
+      http: sql.http,
+      generate: () => "new-pw",
+    });
+    expect(report.ok).toBe(false);
+    expect(report.error).toContain("GATEWAY_DATABASE_PASSWORD");
+    expect(sql.requests).toHaveLength(0);
+  });
+
   it("refuses before changing anything on an install upgrade hasn't moved over", async () => {
     const { run, lines } = fakeGcloud({
       "run services describe adm-svc": [