@caelo-cms/provisioning 0.10.50 → 0.10.51

package/stacks/aws/index.ts

@@ -32,6 +32,12 @@ import * as aws from "@pulumi/aws";
 import * as awsx from "@pulumi/awsx";
 import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
+import {
+  AWS_SERVICE_SECRETS,
+  type AwsSecret,
+  type AwsTaskService,
+  secretsReadPolicy,
+} from "../../dist/aws-task-roles.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
 import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB } from "../../dist/stack-contract.js";
 
@@ -89,9 +95,11 @@ function randomHex(bytes: number): string {
 }
 
 const postgresPassword = pulumi.secret(randomHex(32));
-// #613 — one password per database role, so the gateway (public_role +
-// gateway_role) never holds admin_role's. bootstrap.sh creates the roles
-// with these (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD).
+// #613 — one password per database role, so the gateway (public_role only,
+// #635) never holds admin_role's. bootstrap.sh creates the roles with these
+// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
+// any service's login; its password stays until the contract release that
+// drops the role (#635).
 const publicRolePassword = pulumi.secret(randomHex(32));
 const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
@@ -163,13 +171,6 @@ const publicDatabaseUrl = pulumi
     ([host, port, pw]) =>
       `postgresql://public_role:${pw}@${host}:${port}/cms_public?sslmode=require`,
   );
-// The gateway's cms_admin login (#613): grants from migration 0248 only.
-const gatewayDatabaseUrl = pulumi
-  .all([db.address, db.port, gatewayRolePassword])
-  .apply(
-    ([host, port, pw]) =>
-      `postgresql://gateway_role:${pw}@${host}:${port}/cms_admin?sslmode=require`,
-  );
 
 // === 4. S3 buckets ===
 const mediaBucket = new aws.s3.BucketV2(`${namePrefix}-media`, {
@@ -349,38 +350,48 @@ const cluster = new aws.ecs.Cluster(`${namePrefix}-ecs`, {
   settings: [{ name: "containerInsights", value: "enabled" }],
 });
 
-const taskRole = new aws.iam.Role(`${namePrefix}-task-role`, {
-  assumeRolePolicy: JSON.stringify({
-    Version: "2012-10-17",
-    Statement: [
-      {
-        Effect: "Allow",
-        Principal: { Service: "ecs-tasks.amazonaws.com" },
-        Action: "sts:AssumeRole",
-      },
-    ],
-  }),
-});
+// One task role per service (#635): the gateway's may read only the
+// public_role password, never a secret that unlocks a cms_admin login
+// (src/aws-task-roles.ts AWS_SERVICE_SECRETS, asserted by
+// gateway-env-isolation.test.ts). The admin keeps the logical names the
+// former shared role had, so upgrading replaces nothing on its side.
+const secretArns: Record<AwsSecret, pulumi.Output<string>> = {
+  "postgres-password": pgSecret.arn,
+  "public-role-password": publicRoleSecret.arn,
+  "gateway-role-password": gatewayRoleSecret.arn,
+  "csrf-secret": csrfSecretRes.arn,
+  "cookie-secret": cookieSecretRes.arn,
+  "anthropic-api-key": anthropicSecretRes.arn,
+  "resend-api-key": resendSecretRes.arn,
+};
 
-new aws.iam.RolePolicy(`${namePrefix}-task-secrets`, {
-  role: taskRole.id,
-  policy: pulumi
-    .all([
-      pgSecret.arn,
-      publicRoleSecret.arn,
-      gatewayRoleSecret.arn,
-      csrfSecretRes.arn,
-      cookieSecretRes.arn,
-      anthropicSecretRes.arn,
-      resendSecretRes.arn,
-    ])
-    .apply((arns) =>
-      JSON.stringify({
-        Version: "2012-10-17",
-        Statement: [{ Effect: "Allow", Action: "secretsmanager:GetSecretValue", Resource: arns }],
-      }),
-    ),
-});
+function taskRole(service: AwsTaskService): aws.iam.Role {
+  const prefix = service === "admin" ? namePrefix : `${namePrefix}-${service}`;
+  const role = new aws.iam.Role(`${prefix}-task-role`, {
+    assumeRolePolicy: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Principal: { Service: "ecs-tasks.amazonaws.com" },
+          Action: "sts:AssumeRole",
+        },
+      ],
+    }),
+  });
+  new aws.iam.RolePolicy(`${prefix}-task-secrets`, {
+    role: role.id,
+    policy: pulumi
+      .all(AWS_SERVICE_SECRETS[service].map((name) => secretArns[name]))
+      .apply(secretsReadPolicy),
+  });
+  return role;
+}
+
+const taskRoles: Record<AwsTaskService, aws.iam.Role> = {
+  admin: taskRole("admin"),
+  gateway: taskRole("gateway"),
+};
 
 const execRole = new aws.iam.Role(`${namePrefix}-exec-role`, {
   assumeRolePolicy: JSON.stringify({
@@ -421,7 +432,6 @@ const dnsRecordsRequired: DnsRecord[] = [
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
-  gatewayDatabaseUrl: gatewayDatabaseUrl as unknown as string,
   mediaStorageUrl: pulumi.interpolate`s3://${mediaBucket.bucket}` as unknown as string,
   mediaCdnBaseUrl:
     pulumi.interpolate`https://${distribution.domainName}/media` as unknown as string,
@@ -436,7 +446,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;
@@ -448,6 +457,9 @@ export const cloudfrontDomainOut = distribution.domainName;
 export const redirectKvsArnOut = redirectKvs.arn;
 export const ecsClusterArnOut = cluster.arn;
 export const rdsAddressOut = db.address;
+// The task roles the admin-side and gateway task definitions run as.
+export const adminTaskRoleArnOut = taskRoles.admin.arn;
+export const gatewayTaskRoleArnOut = taskRoles.gateway.arn;
 
 // Note: the bootstrap token (and other secrets like postgres-password,
 // CSRF/cookie secrets, Anthropic key) are stored in Pulumi's encrypted

package/stacks/azure/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on Azure managed services. Implements the shared
 | Blob storage | Storage Account with a private `media` container and static-website hosting (`$web`) |
 | CDN / Edge | Azure Front Door Standard: the primary domain serves the static website as files, with a Front Door managed certificate; no edge compute on the request path |
 | Container runtime | Four Container Apps (admin / gateway / orchestrator / runner) in one managed environment |
-| Secret store | Key Vault (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `GATEWAY_DATABASE_URL` + `PUBLIC_DATABASE_URL`, never an admin credential (#613). |
+| Secret store | Key Vault (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `PUBLIC_DATABASE_URL` only, never a cms_admin credential of any role (#613, #635). |
 | Edge-log sink | Log Analytics workspace receives Container Apps logs (queryable by P12A analytics plugin via Azure Monitor) |
 
 The Caelo runtime never knows it's on Azure — every Container App consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.

package/stacks/azure/index.ts

@@ -81,9 +81,11 @@ function randomHex(bytes: number): string {
 }
 
 const postgresPassword = pulumi.secret(randomHex(32));
-// #613 — one password per database role, so the gateway (public_role +
-// gateway_role) never holds admin_role's. bootstrap.sh creates the roles
-// with these (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD).
+// #613 — one password per database role, so the gateway (public_role only,
+// #635) never holds admin_role's. bootstrap.sh creates the roles with these
+// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
+// any service's login; its password stays until the contract release that
+// drops the role (#635).
 const publicRolePassword = pulumi.secret(randomHex(32));
 const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
@@ -162,14 +164,11 @@ const adminDatabaseUrl = pulumi
 const publicAdminDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, postgresPassword])
   .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public?sslmode=require`);
-// The gateway's two logins (#613): public_role on cms_public and
-// gateway_role on cms_admin, each with its own password.
+// The gateway's only login (#613, #635): public_role on cms_public. It has
+// no cms_admin login at all (CLAUDE.md §2).
 const publicDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, publicRolePassword])
   .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?sslmode=require`);
-const gatewayDatabaseUrl = pulumi
-  .all([pgServer.fullyQualifiedDomainName, gatewayRolePassword])
-  .apply(([host, pw]) => `postgresql://gateway_role:${pw}@${host}:5432/cms_admin?sslmode=require`);
 
 // === 4. Storage account + containers ===
 const storage = new azure.storage.StorageAccount(`${namePrefix}-st`, {
@@ -419,10 +418,7 @@ const adminApp = containerApp({
 });
 const _gatewayApp = containerApp({
   serviceName: "gateway",
-  databaseEnv: [
-    { name: "GATEWAY_DATABASE_URL", value: gatewayDatabaseUrl },
-    { name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl },
-  ],
+  databaseEnv: [{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }],
 });
 const _orchestratorApp = containerApp({
   serviceName: "orchestrator",
@@ -446,7 +442,6 @@ const dnsRecordsRequired = pulumi
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
-  gatewayDatabaseUrl: gatewayDatabaseUrl as unknown as string,
   mediaStorageUrl:
     pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
@@ -460,7 +455,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | Blob storage | Two GCS buckets (`<project>-caelo-<env>-media`, `<project>-caelo-<env>-static`) with uniform bucket-level access |
 | CDN | Global HTTPS load balancer + Cloud CDN backend bucket: `<domain>` serves the static bucket as files, `/api/*` goes to the gateway, `admin.<domain>` to the IAP-gated admin |
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
-| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only the two gateway role passwords (#613); `gateway_role` itself is created by migration 0248 and gets its password from the CLI after migrations. |
+| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login); `gateway_role`, created by migration 0248, is no service's login any more. |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.

package/stacks/gcp/index.ts

@@ -662,7 +662,6 @@ const envContractInputs = {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
     public: dbUrls.public,
-    gateway: dbUrls.gateway,
   },
 } as const;
 
@@ -753,8 +752,8 @@ const gatewaySvc = cloudRunService({
   minInstances: gatewayMinInstances,
   maxInstances: 100,
   memory: "512Mi",
-  // public_role on cms_public + gateway_role on cms_admin, each with its
-  // own password; never admin_role (#613, CLAUDE.md §2).
+  // public_role on cms_public only: no cms_admin login of any role
+  // (#613, #635, CLAUDE.md §2).
   contractEnv: gatewayEnvContract(envContractInputs),
 });
 
@@ -1158,7 +1157,6 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
-  gatewayDatabaseUrl: dbUrls.gateway as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
   bootstrapUrl:
@@ -1172,7 +1170,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp-firebase/index.ts

@@ -606,7 +606,6 @@ const envContractInputs = {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
     public: dbUrls.public,
-    gateway: dbUrls.gateway,
   },
 } as const;
 
@@ -988,7 +987,6 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
-  gatewayDatabaseUrl: dbUrls.gateway as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   // Firebase Hosting serves media via its own CDN; we proxy through
   // the Firebase site's apex domain for canonical URLs.
@@ -1005,7 +1003,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;