@caelo-cms/provisioning 0.10.50 → 0.10.51

package/src/stack-contract.test.ts

@@ -49,12 +49,11 @@ const ADMIN_SECRETS = {
 };
 
 describe("databaseUrls", () => {
-  it("builds password-less URLs for the four role/database pairs", () => {
+  it("builds password-less URLs for the three role/database pairs", () => {
     expect(databaseUrls("10.20.0.3")).toEqual({
       admin: "postgresql://admin_role@10.20.0.3:5432/cms_admin?sslmode=require",
       publicAdmin: "postgresql://admin_role@10.20.0.3:5432/cms_public?sslmode=require",
       public: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
-      gateway: "postgresql://gateway_role@10.20.0.3:5432/cms_admin?sslmode=require",
     });
   });
 });
@@ -154,15 +153,13 @@ describe.each([
 describe("gatewayEnvContract", () => {
   const gateway = gatewayEnvContract({ ...base, provider: "gcp" });
 
-  it("carries its two own logins and none of the admin's database or app secrets", () => {
+  it("carries its one own login and none of the admin's database or app secrets (#635)", () => {
     expect(asRecord(gateway)).toEqual({
       CAELO_PROVIDER: "gcp",
       CAELO_ENV: "production",
       MEDIA_STORAGE_URL: "gs://acme-caelo-production-media",
       PUBLIC_DATABASE_URL: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
-      GATEWAY_DATABASE_URL: "postgresql://gateway_role@10.20.0.3:5432/cms_admin?sslmode=require",
       PUBLIC_DATABASE_PASSWORD: "secret:caelo-production-public-role-password:latest",
-      GATEWAY_DATABASE_PASSWORD: "secret:caelo-production-gateway-role-password:latest",
       CAELO_STAGING_GATE_SECRET: "secret:caelo-production-staging-gate-secret:latest",
     });
   });
@@ -188,11 +185,7 @@ describe("gatewayEnvContract", () => {
   });
 
   it("the gateway's run SA reads no admin-only secret (admin password, KEK, internal, tool approval)", () => {
-    expect(serviceSecrets("gateway")).toEqual([
-      "gateway-role-password",
-      "public-role-password",
-      "staging-gate-secret",
-    ]);
+    expect(serviceSecrets("gateway")).toEqual(["public-role-password", "staging-gate-secret"]);
     for (const v of gateway) {
       expect(v.name).not.toMatch(/KEK|INTERNAL|TOOL_APPROVAL|PUBLIC_ADMIN/);
     }
@@ -280,11 +273,6 @@ describe("runtime secrets", () => {
         secret: "staging-gate-secret",
         stackResource: "staging-gate-secret-binding",
       },
-      {
-        service: "gateway",
-        secret: "gateway-role-password",
-        stackResource: "gateway-gateway-role-password-binding",
-      },
       {
         service: "gateway",
         secret: "public-role-password",
@@ -299,7 +287,11 @@ describe("runtime secrets", () => {
   });
 
   it("every CLI-generated secret is read by some service", () => {
-    for (const s of CLI_GENERATED_SECRETS) {
+    // gateway-role-password is read by no service since #635: it only keeps
+    // the legacy gateway_role's password set until the contract release
+    // drops the role (the previous release's gateway logs in with it while
+    // an upgrade rolls).
+    for (const s of CLI_GENERATED_SECRETS.filter((x) => x !== "gateway-role-password")) {
       expect([...serviceSecrets("admin"), ...serviceSecrets("gateway")]).toContain(s);
     }
   });
@@ -351,13 +343,12 @@ describe("stackIamInvariants", () => {
     }
   });
 
-  it("grants the gateway SA only its two role passwords, the staging gate key + telemetry roles", () => {
+  it("grants the gateway SA only its own role password, the staging gate key + telemetry roles", () => {
     for (const provider of ["gcp", "gcp-firebase"] as const) {
       const gateway = stackIamInvariants(provider).filter((i) => i.member === "gateway-sa");
       expect(gateway.map((i) => `${i.role} ${JSON.stringify(i.target)}`).sort()).toEqual([
         'roles/logging.logWriter {"kind":"project"}',
         'roles/monitoring.metricWriter {"kind":"project"}',
-        'roles/secretmanager.secretAccessor {"kind":"secret","name":"gateway-role-password"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"public-role-password"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"staging-gate-secret"}',
       ]);

package/src/stack-contract.ts

@@ -86,14 +86,12 @@ export interface DatabaseUrls<V = string> {
   readonly admin: V;
   /** admin_role on cms_public — the admin's second pool (DDL, migrations). */
   readonly publicAdmin: V;
-  /** public_role on cms_public — the gateway's visitor-write pool. */
-  readonly public: V;
   /**
-   * gateway_role on cms_admin — the gateway's narrow pool (#613): its
-   * settings, rate limits, captcha, request log, plugin op audit and the
-   * plugin registry, read-mostly (migration 0248).
+   * public_role on cms_public — the gateway's only pool. The gateway has no
+   * cms_admin login (#635, CLAUDE.md §2): what it needs from authoring
+   * state the admin publishes into cms_public.
    */
-  readonly gateway: V;
+  readonly public: V;
 }
 
 /** Port Cloud SQL Postgres listens on (private IP). */
@@ -111,7 +109,6 @@ export function databaseUrls(host: string): DatabaseUrls {
     admin: url("admin_role", "cms_admin"),
     publicAdmin: url("admin_role", "cms_public"),
     public: url("public_role", "cms_public"),
-    gateway: url("gateway_role", "cms_admin"),
   };
 }
 
@@ -251,8 +248,8 @@ export type DatabaseRole = "admin_role" | "public_role" | "gateway_role";
 
 /**
  * Each database role's password secret — one per role (#613), so the
- * gateway's SA, which reads only the public_role and gateway_role
- * passwords, can never read admin_role's. `postgres-password` keeps its
+ * gateway's SA, which reads only the public_role password, can never read
+ * admin_role's (or, since #635, gateway_role's). `postgres-password` keeps its
  * name: it has always been admin_role's (and, before #613, shared with
  * public_role). `rotate-secret` changes exactly the role(s) listed here.
  */
@@ -306,9 +303,8 @@ export const SERVICE_SECRET_ENV: Readonly<
     CAELO_STAGING_GATE_SECRET: "staging-gate-secret",
   },
   gateway: {
-    // CLAUDE.md §2: never an admin_role credential (#613). gateway_role on
-    // cms_admin + public_role on cms_public, each with its own password.
-    GATEWAY_DATABASE_PASSWORD: "gateway-role-password",
+    // CLAUDE.md §2: no cms_admin credential of any role (#613, #635).
+    // public_role on cms_public is the gateway's only login.
     PUBLIC_DATABASE_PASSWORD: "public-role-password",
     // #650 — verifies staging-host requests (api-gateway staging-proxy.ts).
     CAELO_STAGING_GATE_SECRET: "staging-gate-secret",
@@ -323,12 +319,20 @@ export function serviceSecrets(service: CloudRunSlug): RuntimeSecret[] {
 /**
  * Env vars an older stack set that the contract no longer gives a service;
  * upgrade removes them. The gateway never used the KEK, and its run SA
- * cannot read it. Its admin_role pool went with #613 — the gateway refuses
- * to boot while either var is set (apps/api-gateway `gatewayDatabaseUrls`).
+ * cannot read it. Its admin_role pool went with #613 and its gateway_role
+ * pool with #635 — the gateway refuses to boot while any cms_admin
+ * credential is in its env (apps/api-gateway `adminDatabaseAccessInEnv`).
  */
 export const RETIRED_SERVICE_ENV: Readonly<Record<CloudRunSlug, readonly string[]>> = {
   admin: [],
-  gateway: ["CAELO_SECRET_KEK", "ADMIN_DATABASE_URL", "ADMIN_DATABASE_PASSWORD"],
+  gateway: [
+    "CAELO_SECRET_KEK",
+    "ADMIN_DATABASE_URL",
+    "ADMIN_DATABASE_PASSWORD",
+    // #635 — its gateway_role login on cms_admin is gone too.
+    "GATEWAY_DATABASE_URL",
+    "GATEWAY_DATABASE_PASSWORD",
+  ],
 };
 
 function secretEnv(service: CloudRunSlug, env: string): CloudRunEnvVar[] {
@@ -362,7 +366,6 @@ export function gatewayEnvContract<V>(inputs: RuntimeEnvInputs<V>): CloudRunEnvV
   return [
     ...commonEnv(inputs),
     { name: "PUBLIC_DATABASE_URL", value: inputs.databaseUrls.public },
-    { name: "GATEWAY_DATABASE_URL", value: inputs.databaseUrls.gateway },
     ...secretEnv("gateway", inputs.env),
   ];
 }
@@ -679,6 +682,12 @@ export const RETIRED_IAM_BINDINGS: readonly RetiredIamBinding[] = [
     target: { kind: "secret", name: "postgres-password" },
     why: "the gateway no longer logs in as admin_role and must not be able to read its password (CLAUDE.md §2)",
   },
+  {
+    role: SECRET_ACCESSOR,
+    member: "gateway-sa",
+    target: { kind: "secret", name: "gateway-role-password" },
+    why: "the gateway has no cms_admin login at all and must not be able to read gateway_role's password (CLAUDE.md §2, #635)",
+  },
 ];
 
 /** Every IAM binding upgrade ensures on an install of `provider`. */

package/src/stack-converge-secrets.test.ts

@@ -38,12 +38,14 @@ const SECRET_VALUES: Record<string, string> = {
   "caelo-production-gateway-role-password": "g".repeat(64),
 };
 
-/** Env vars that would hand the gateway an admin_role credential (apps/api-gateway ADMIN_CREDENTIAL_ENV). */
+/** Env vars that would hand the gateway a cms_admin credential (a subset of what apps/api-gateway adminDatabaseAccessInEnv refuses). */
 const ADMIN_CREDENTIAL_ENV = [
   "ADMIN_DATABASE_URL",
   "ADMIN_DATABASE_PASSWORD",
   "PUBLIC_ADMIN_DATABASE_URL",
   "PUBLIC_ADMIN_DATABASE_PASSWORD",
+  "GATEWAY_DATABASE_URL",
+  "GATEWAY_DATABASE_PASSWORD",
 ];
 
 /** Split a gcloud list flag value, honouring the `^<delim>^` escape. */
@@ -122,16 +124,15 @@ function credentials(url: string | undefined): string {
 }
 
 /**
- * The gateway's process env after the upgrade: gateway_role on cms_admin and
- * public_role on cms_public, each with its own secret, and no admin_role
- * credential at all (the gateway refuses to boot with one).
+ * The gateway's process env after the upgrade: public_role on cms_public
+ * with its own secret, and no cms_admin credential of any role at all
+ * (#613, #635 — the gateway refuses to boot with one).
  */
 function expectGatewayOnItsOwnLogins(env: Record<string, string>): void {
   for (const name of ADMIN_CREDENTIAL_ENV) expect(Object.keys(env)).not.toContain(name);
   expect(Object.values(env).join("\n")).not.toContain(PW);
-  expect(credentials(databaseUrlFromEnv(["GATEWAY_DATABASE_URL"], env))).toBe(
-    `gateway_role:${"g".repeat(64)}@${HOST}:5432/cms_admin?sslmode=require`,
-  );
+  expect(Object.values(env).join("\n")).not.toContain("g".repeat(64));
+  expect(Object.values(env).join("\n")).not.toContain("cms_admin");
   expect(credentials(databaseUrlFromEnv(["PUBLIC_DATABASE_URL"], env))).toBe(
     `public_role:${"p".repeat(64)}@${HOST}:5432/cms_public?sslmode=require`,
   );
@@ -331,7 +332,7 @@ function v01035Install() {
 }
 
 describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", () => {
-  it("drops the admin_role credential and adds the gateway's own logins in one revision", () => {
+  it("drops the admin_role credential and adds the gateway's own login in one revision", () => {
     const services = v01035Install();
     const plan = upgrade(services);
     expect(services.gateway.revisions).toHaveLength(2);
@@ -343,8 +344,6 @@ describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", (
       "ADMIN_DATABASE_URL",
       // #650 — the staging gate key arrives in the same roll.
       "CAELO_STAGING_GATE_SECRET",
-      "GATEWAY_DATABASE_PASSWORD",
-      "GATEWAY_DATABASE_URL",
       "PUBLIC_DATABASE_PASSWORD",
     ]);
   });
@@ -374,6 +373,42 @@ describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", (
   });
 });
 
+/**
+ * A v0.10.50 install (#613, before #635): the gateway on gateway_role's
+ * cms_admin pool next to public_role's.
+ */
+function v01050Install() {
+  const services = v01035Install();
+  upgrade(services);
+  const env = new Map(services.gateway.env);
+  env.set("GATEWAY_DATABASE_URL", {
+    kind: "value",
+    value: `postgresql://gateway_role@${HOST}:5432/cms_admin?sslmode=require`,
+  });
+  env.set("GATEWAY_DATABASE_PASSWORD", {
+    kind: "secret",
+    secret: "caelo-production-gateway-role-password",
+    version: "latest",
+  });
+  services.gateway = new FakeService(env, SERVICE_ACCOUNTS.gateway);
+  return services;
+}
+
+describe("upgrading a v0.10.50 install: the gateway leaves cms_admin entirely (#635)", () => {
+  it("removes the gateway_role login in one revision and keeps the public pool", () => {
+    const services = v01050Install();
+    const plan = upgrade(services);
+    expect(plan.ok && plan.services.gateway.changes.map((c) => c.name).sort()).toEqual([
+      "GATEWAY_DATABASE_PASSWORD",
+      "GATEWAY_DATABASE_URL",
+    ]);
+    expectGatewayOnItsOwnLogins(containerEnv(services.gateway.env));
+    for (const revision of services.gateway.revisions) {
+      expect(revision.has("PUBLIC_DATABASE_URL")).toBe(true);
+    }
+  });
+});
+
 describe("plain → Secret Manager migration of an existing var", () => {
   it("never leaves a revision without the var", () => {
     // An operator set CAELO_INTERNAL_SECRET by hand as a plain value.

package/src/stack-converge.test.ts

@@ -268,12 +268,7 @@ const CONVERGED_GATEWAY_DB = [
     name: "PUBLIC_DATABASE_URL",
     value: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
   },
-  {
-    name: "GATEWAY_DATABASE_URL",
-    value: "postgresql://gateway_role@10.20.0.3:5432/cms_admin?sslmode=require",
-  },
   secretRef("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
-  secretRef("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
 ];
 
 describe("planContractEnv", () => {
@@ -776,10 +771,10 @@ describe("ensureStackInvariants", () => {
       const gatewayGrants = calls.filter(
         (c) => c.startsWith("secrets add-iam-policy-binding") && c.includes(GW_SA),
       );
-      // #613 — never admin_role's postgres-password. #650 — the staging
-      // gate key is the one secret the gateway shares with the admin.
+      // #613 — never admin_role's postgres-password; #635 — nor
+      // gateway_role's. #650 — the staging gate key is the one secret the
+      // gateway shares with the admin.
       expect(gatewayGrants).toEqual([
-        `secrets add-iam-policy-binding caelo-production-gateway-role-password --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
         `secrets add-iam-policy-binding caelo-production-public-role-password --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
         `secrets add-iam-policy-binding caelo-production-staging-gate-secret --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
       ]);
@@ -802,7 +797,8 @@ describe("removeRetiredIamBindings (#613)", () => {
       ],
     });
     const outcomes = await removeRetiredIamBindings(gcp, { run, sleep: async () => {} });
-    expect(outcomes.map((o) => o.status)).toEqual(["removed"]);
+    // postgres-password removed; gateway-role-password (#635) already clean.
+    expect(outcomes.map((o) => o.status)).toEqual(["removed", "absent"]);
     expect(calls).toContain(REMOVE);
     // The admin's own binding on the same secret is never touched.
     expect(calls.some((c) => c.includes("remove") && c.includes(RUN_SA))).toBe(false);
@@ -815,10 +811,23 @@ describe("removeRetiredIamBindings (#613)", () => {
       ],
     });
     const outcomes = await removeRetiredIamBindings(firebase, { run, sleep: async () => {} });
-    expect(outcomes.map((o) => o.status)).toEqual(["absent"]);
+    expect(outcomes.map((o) => o.status)).toEqual(["absent", "absent"]);
     expect(calls.filter((c) => c.includes("remove-iam-policy-binding"))).toEqual([]);
   });
 
+  it("takes the gateway SA off gateway_role's password (#635)", async () => {
+    const { run, calls } = fakeGcloud({
+      "secrets get-iam-policy caelo-production-gateway-role-password": [
+        policy([{ role: "roles/secretmanager.secretAccessor", members: [GW_SA] }]),
+      ],
+    });
+    const outcomes = await removeRetiredIamBindings(gcp, { run, sleep: async () => {} });
+    expect(outcomes.map((o) => o.status)).toEqual(["absent", "removed"]);
+    expect(calls).toContain(
+      `secrets remove-iam-policy-binding caelo-production-gateway-role-password --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
+    );
+  });
+
   it("reports a failed removal instead of throwing", async () => {
     const { run } = fakeGcloud({
       "secrets get-iam-policy caelo-production-postgres-password": [

package/src/staging-admin.ts

@@ -3,51 +3,25 @@
 /**
  * #678 — `staging-domain enable` tells the admin itself what the operator
  * decided, instead of printing "now set the same host in the admin".
- *
- * Why an HTTP call to the admin (and not a one-shot Cloud Run job like the
- * migrations): the call must hand a result BACK — above all the generated
- * basic-auth password, which the CLI prints once. A job can only report
- * through Cloud Logging, which would put the password into the project's
- * logs. The admin endpoint (`POST /api/internal/staging/provision`) answers
- * over TLS straight to this process, and the password is never written
- * anywhere (CLAUDE.md §7, #659).
- *
- * Getting there, as the operator's own gcloud identity — the same path the
- * Power-MCP shim takes (packages/mcp-server/src/ingress-auth.ts):
- *
- *   1. the admin Cloud Run service and its URL;
- *   2. the install's internal secret from Secret Manager (in memory only),
- *      which signs a 5-minute token for scope `staging.provision`;
- *   3. a JWT signed as `caelo-mcp@<project>` through the IAM Credentials
- *      API — the admin's IAP lets that service account in, and every
- *      IAP-allowlisted operator may sign as it (`cms-provision upgrade`
- *      grants it) — so the request passes IAP first, then Caelo's token.
+ * It calls `POST /api/internal/staging/provision` through admin-internal.ts
+ * (IAP as caelo-mcp + the internal token, scope `staging.provision`), because
+ * the answer carries the generated basic-auth password back to the CLI, which
+ * prints it once and never stores it.
  */
 
-import { findService } from "./admin-domain.js";
-import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
-import { GCP_STACK_ENV, gcpSecretId, mcpIapServiceAccountEmail } from "./gcp-names.js";
-import { mintInternalToken } from "./internal-token.js";
-
-type Run = (args: string[]) => Promise<GcloudResult>;
+import {
+  type AdminInternalDeps,
+  type AdminInternalResult,
+  type AdminInternalTarget,
+  callAdminInternal,
+} from "./admin-internal.js";
 
 /** Token scope the admin endpoint checks (apps/admin …/api/internal/staging/provision). */
 export const STAGING_PROVISION_SCOPE = "staging.provision";
 const ENDPOINT = "/api/internal/staging/provision";
-/** Signed JWTs live at most 1 hour; one call needs a few seconds. */
-const IAP_JWT_LIFETIME_S = 600;
 
-export interface StagingAdminTarget {
-  readonly projectId: string;
-  readonly region: string;
-}
-
-export interface StagingAdminDeps {
-  readonly run?: Run;
-  readonly fetch?: typeof fetch;
-  /** Seconds since epoch (IAP JWT); tests pin it. */
-  readonly now?: () => number;
-}
+export type StagingAdminTarget = AdminInternalTarget;
+export type StagingAdminDeps = AdminInternalDeps;
 
 /** Main's draft pages, as the admin reports them. */
 export interface DraftPages {
@@ -80,7 +54,7 @@ export interface StagingApply {
   readonly draftPages: DraftPages;
 }
 
-export type StagingAdminResult<T> = { ok: true; value: T } | { ok: false; error: string };
+export type StagingAdminResult<T> = AdminInternalResult<T>;
 
 export interface ApplyRequest {
   readonly host?: string;
@@ -110,149 +84,12 @@ async function callStagingAdmin<T>(
   body: Record<string, unknown>,
   deps: StagingAdminDeps,
 ): Promise<StagingAdminResult<T>> {
-  const run = deps.run ?? defaultGcloud;
-  const doFetch = deps.fetch ?? fetch;
-  const scope = [`--region=${target.region}`, `--project=${target.projectId}`];
-
-  const found = await findService(run, scope, "admin");
-  if (!found.ok) return { ok: false, error: found.error };
-  const url = await run([
-    "run",
-    "services",
-    "describe",
-    found.service,
-    ...scope,
-    "--format=value(status.url)",
-  ]);
-  const adminUrl = url.stdout.trim();
-  if (!url.ok || !adminUrl) {
-    return { ok: false, error: `read the admin's URL: ${url.stderr.trim() || "empty"}` };
-  }
-
-  const secretId = gcpSecretId(GCP_STACK_ENV, "internal-secret");
-  const secret = await run([
-    "secrets",
-    "versions",
-    "access",
-    "latest",
-    `--secret=${secretId}`,
-    `--project=${target.projectId}`,
-  ]);
-  const internalSecret = secret.stdout.trim();
-  if (!secret.ok || internalSecret.length < 32) {
-    return {
-      ok: false,
-      error: `read the install's internal secret (${secretId}) from Secret Manager: ${secret.stderr.trim() || "missing or too short"}. Your gcloud account needs secretmanager.versions.access on the project.`,
-    };
-  }
-
-  // Installs from before #678 may not have the IAM Credentials API on;
-  // enabling an enabled API is a no-op (codex review on #681).
-  const api = await run([
-    "services",
-    "enable",
-    "iamcredentials.googleapis.com",
-    `--project=${target.projectId}`,
-  ]);
-  if (!api.ok) {
-    return {
-      ok: false,
-      error: `enable the IAM Credentials API (iamcredentials.googleapis.com), needed to pass the admin's IAP: ${api.stderr.trim()}`,
-    };
-  }
-  const iap = await signIapJwt(run, doFetch, target.projectId, adminUrl, deps.now);
-  if (!iap.ok) return iap;
-
-  const token = await mintInternalToken(internalSecret, STAGING_PROVISION_SCOPE);
-  let res: Response;
-  try {
-    res = await doFetch(`${adminUrl}${ENDPOINT}`, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${iap.value}`,
-        "x-caelo-internal-token": token,
-        "content-type": "application/json",
-      },
-      body: JSON.stringify(body),
-    });
-  } catch (e) {
-    return { ok: false, error: `reach the admin at ${adminUrl}: ${String(e)}` };
-  }
-  const text = await res.text();
-  if (res.headers.get("x-goog-iap-generated-response") === "true") {
-    return {
-      ok: false,
-      error: `Google IAP refused the request (HTTP ${res.status}: ${text.trim().slice(0, 200)}) — ${mcpIapServiceAccountEmail(target.projectId)} is not allowed on the admin's IAP yet. Run \`cms-provision upgrade\` (it allowlists that service account), then run this command again.`,
-    };
-  }
-  if (res.status === 404) {
-    return {
-      ok: false,
-      error: `the admin has no ${ENDPOINT} yet (it runs a release from before #678). Run \`cms-provision upgrade\`, then run this command again.`,
-    };
-  }
-  let parsed: { ok?: boolean; error?: string } & Record<string, unknown>;
-  try {
-    parsed = JSON.parse(text) as typeof parsed;
-  } catch {
-    return {
-      ok: false,
-      error: `the admin answered HTTP ${res.status} with a non-JSON body: ${text.slice(0, 200)}`,
-    };
-  }
-  if (!res.ok || parsed.ok !== true) {
-    return {
-      ok: false,
-      error: `the admin refused (HTTP ${res.status}): ${parsed.error ?? text.slice(0, 300)}`,
-    };
-  }
-  return { ok: true, value: parsed as unknown as T };
-}
-
-/** A JWT signed as the install's MCP service account, for the admin's IAP. */
-async function signIapJwt(
-  run: Run,
-  doFetch: typeof fetch,
-  projectId: string,
-  adminUrl: string,
-  now: (() => number) | undefined,
-): Promise<StagingAdminResult<string>> {
-  const access = await run(["auth", "print-access-token"]);
-  const accessToken = access.stdout.trim();
-  if (!access.ok || !accessToken) {
-    return {
-      ok: false,
-      error: `get an access token from gcloud: ${access.stderr.trim() || "empty"}. Run \`gcloud auth login\` with the account you provisioned with.`,
-    };
-  }
-  const serviceAccount = mcpIapServiceAccountEmail(projectId);
-  const iat = now ? now() : Math.floor(Date.now() / 1000);
-  const res = await doFetch(
-    `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(serviceAccount)}:signJwt`,
-    {
-      method: "POST",
-      headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
-      body: JSON.stringify({
-        payload: JSON.stringify({
-          iss: serviceAccount,
-          sub: serviceAccount,
-          aud: `${new URL(adminUrl).origin}/*`,
-          iat,
-          exp: iat + IAP_JWT_LIFETIME_S,
-        }),
-      }),
-    },
+  const r = await callAdminInternal<T>(
+    target,
+    { endpoint: ENDPOINT, scope: STAGING_PROVISION_SCOPE, body, introducedBy: "#678" },
+    deps,
   );
-  if (!res.ok) {
-    const detail = (await res.text().catch(() => "")).slice(0, 300);
-    return {
-      ok: false,
-      error: `sign an IAP token as ${serviceAccount} (HTTP ${res.status}): ${detail} — your account needs roles/iam.serviceAccountTokenCreator on it; \`cms-provision upgrade\` grants it to everyone the admin's IAP lets in.`,
-    };
-  }
-  const { signedJwt } = (await res.json()) as { signedJwt?: string };
-  if (!signedJwt) return { ok: false, error: "IAM signJwt answered without a signedJwt" };
-  return { ok: true, value: signedJwt };
+  return r.ok ? { ok: true, value: r.value.answer } : r;
 }
 
 /**

package/src/wizards/gcp-cost.ts

@@ -104,7 +104,7 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
       name: "Quality checks (Lighthouse on the admin)",
       monthlyUsd: 1,
       notes:
-        "~1-2 min of admin CPU per audited Stage (up to 5 pages x 3 runs); ~$1/mo at a few Stages a day",
+        "~2-4 min of admin CPU per audited Stage (up to 5 pages x 5 runs); ~$1/mo at a few Stages a day",
     },
     {
       name: "Cloud Run gateway",

package/stacks/aws/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on AWS managed services. Implements the shared `
 | Blob storage | Two S3 buckets (`caelo-<env>-media` + `caelo-<env>-static`) |
 | CDN | CloudFront distribution with two origins (S3 static + S3 media); static files are served as files, no edge compute on the request path |
 | Container runtime | ECS Fargate cluster + four services (admin / gateway / orchestrator / runner) |
-| Secret store | AWS Secrets Manager (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `gatewayDatabaseUrlOut` + `publicDatabaseUrlOut`, never the admin URL (#613). |
+| Secret store | AWS Secrets Manager (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `publicDatabaseUrlOut` only, never a cms_admin URL of any role (#613, #635). |
 | DNS + cert | ACM cert (us-east-1, DNS-validated, supports `*.<domain>`) |
 | Edge-log sink | CloudFront access logs delivered to the CloudWatch log group `/caelo/<env>/cloudfront` in us-east-1 (queryable by P12A analytics plugin) |