@caelo-cms/provisioning 0.10.50 → 0.10.52

package/src/cli.ts

@@ -1120,6 +1120,7 @@ const handlers: Record<string, () => Promise<void>> = {
   truncate: lifecycleTruncate,
   "admin-domain": adminDomain,
   "staging-domain": stagingDomain,
+  "owner-reset": ownerReset,
   // #696 — Pulumi state in the install's own project.
   state: async () => (await import("./state-command.js")).stateCommand(process.argv),
   attach: async () => (await import("./state-command.js")).attachCommand(process.argv),
@@ -1196,6 +1197,45 @@ async function lifecycleTruncate(): Promise<void> {
   await truncateCommand();
 }
 
+/**
+ * #769 `owner-reset [--install <id>] [--email <addr>]` — print a one-time
+ * reset link for a locked-out Owner, for installs whose admin cannot email
+ * one (see owner-reset.ts for why the operator's cloud identity may).
+ */
+async function ownerReset(): Promise<void> {
+  const { installFlag, listInstalls, selectInstall } = await import("./install-state.js");
+  const selected = selectInstall(listInstalls(), installFlag(process.argv));
+  if (!selected.ok) {
+    console.error(selected.message);
+    process.exit(1);
+  }
+  const meta = selected.meta;
+  if (meta.provider !== "gcp-firebase") {
+    console.error(
+      `owner-reset works on gcp-firebase installs so far; this one is ${meta.provider} (issue #770). ` +
+        "Until then, another Owner can set a new password under Settings -> Users, or set up email under Settings -> Email so /forgot can send the link.",
+    );
+    process.exit(1);
+  }
+  if (!meta.projectId || !meta.region) {
+    console.error(
+      `install ${meta.installId} has no project or region recorded in install.json; re-run the wizard to record it.`,
+    );
+    process.exit(1);
+  }
+  const email = arg("email");
+  const { describeOwnerReset, requestOwnerReset } = await import("./owner-reset.js");
+  const r = await requestOwnerReset(
+    { projectId: meta.projectId, region: meta.region },
+    email ? { email } : {},
+  );
+  if (!r.ok) {
+    console.error(`owner-reset: ${r.error}`);
+    process.exit(1);
+  }
+  for (const line of describeOwnerReset(r.value)) console.log(line);
+}
+
 /**
  * `admin-domain enable` — bind admin.<domain> to a gcp-firebase admin
  * (see admin-domain.ts for why this runs as the operator, not Pulumi).
@@ -1495,7 +1535,7 @@ if (route.kind === "handler" || route.kind === "wizard") {
   }
 } else {
   console.log(
-    "Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] [--local|--install-job] | <init|up|migrate|status|upgrade|backup|restore|rotate-secret|truncate|destroy|regenerate-caddy|admin-domain|staging-domain|state migrate|attach|pulumi-output-sync|version> [options]\n" +
+    "Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] [--local|--install-job] | <init|up|migrate|status|upgrade|backup|restore|rotate-secret|truncate|destroy|regenerate-caddy|admin-domain|staging-domain|owner-reset|state migrate|attach|pulumi-output-sync|version> [options]\n" +
       "With several installs on this machine, pick one with --install <install-id or domain> (status, upgrade and backup also take --install all); in a terminal you are asked otherwise.\n" +
       "Pass --no-wizard with no sub-command to print this usage instead of the wizard.",
   );

package/src/compose.ts

@@ -388,8 +388,8 @@ ${serviceRuntime(spec.images, "gateway", "bun run apps/api-gateway/src/server.ts
     depends_on:
       postgres: { condition: service_healthy }
     environment:
-      # Its own two logins only — no authoring credential (#613, CLAUDE.md §2).
-      GATEWAY_DATABASE_URL: "${dbUrl("gateway_role", spec.rolePasswords.gateway, "cms_admin")}"
+      # public_role on cms_public is its only database login (#613, #635,
+      # CLAUDE.md §2: the public side has no path to the authoring database).
       PUBLIC_DATABASE_URL: "${dbUrl("public_role", spec.rolePasswords.public, "cms_public")}"
       GATEWAY_PORT: "${COMPOSE_GATEWAY_PORT}"
       NODE_ENV: production`;

package/src/deployed-release.test.ts

@@ -93,6 +93,21 @@ describe("checkDeployedRuntimeEnv", () => {
   });
 
   it("passes once both services read the password from Secret Manager", async () => {
+    const { run } = fakeGcloud({
+      ...lists(),
+      "describe caelo-production-admin-abc": [
+        svc([secret("ADMIN_DATABASE_PASSWORD"), secret("PUBLIC_ADMIN_DATABASE_PASSWORD")]),
+      ],
+      "describe caelo-production-gateway-def": [
+        svc([secret("PUBLIC_DATABASE_PASSWORD", "public-role-password")]),
+      ],
+    });
+    expect(await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run })).toEqual({
+      ok: true,
+    });
+  });
+
+  it("stops a wizard re-run on a gateway from before #635 (it needs its gateway_role pool)", async () => {
     const { run } = fakeGcloud({
       ...lists(),
       "describe caelo-production-admin-abc": [
@@ -105,9 +120,12 @@ describe("checkDeployedRuntimeEnv", () => {
         ]),
       ],
     });
-    expect(await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run })).toEqual({
-      ok: true,
-    });
+    const r = await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.error).toContain("GATEWAY_DATABASE_PASSWORD");
+      expect(r.error).toContain("Run `upgrade` first");
+    }
   });
 
   it("stops a wizard re-run on a gateway from before #613 (it needs the admin_role pool)", async () => {
@@ -123,7 +141,7 @@ describe("checkDeployedRuntimeEnv", () => {
     const r = await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run });
     expect(r.ok).toBe(false);
     if (!r.ok) {
-      expect(r.error).toContain("GATEWAY_DATABASE_PASSWORD");
+      expect(r.error).toContain("ADMIN_DATABASE_PASSWORD");
       expect(r.error).toContain("Run `upgrade` first");
     }
   });

package/src/deployed-release.ts

@@ -15,7 +15,7 @@ import { gcloud as defaultGcloud } from "./gcloud.js";
 import type { GcloudRunner } from "./gcloud-retry.js";
 import { GCP_STACK_ENV, gcpNamePrefix } from "./gcp-names.js";
 import type { ImageDigests } from "./install-state.js";
-import { type CloudRunSlug, SERVICE_SECRET_ENV } from "./stack-contract.js";
+import { type CloudRunSlug, RETIRED_SERVICE_ENV, SERVICE_SECRET_ENV } from "./stack-contract.js";
 import { liveContainerEnv } from "./stack-converge.js";
 
 /** The `sha256:…` digest an image reference pins, or null for a tag reference. */
@@ -61,8 +61,9 @@ async function findDeployedService(
  * reads the password from the URL). The wizard keeps the release an install
  * runs, so re-running it on an install `upgrade` hasn't moved over yet would
  * pair the old release with env it can't connect with. The same holds for a
- * gateway from before #613: its release needs the admin_role pool the
- * current contract no longer gives it (no GATEWAY_DATABASE_PASSWORD yet).
+ * gateway from before #613 or #635: its release needs a cms_admin pool
+ * (admin_role, then gateway_role) the current contract no longer gives it —
+ * it still carries the retired database vars.
  * Such an install has to go through `upgrade` first, which moves the image
  * and the env in one revision.
  */
@@ -88,13 +89,19 @@ export async function checkDeployedRuntimeEnv(opts: {
       return { ok: false, error: `describe ${found.name}: ${describe.stderr.trim()}` };
     }
     const env = liveContainerEnv(describe.stdout);
-    const missing = Object.keys(SERVICE_SECRET_ENV[slug]).filter(
-      (name) => name.endsWith("_PASSWORD") && env.get(name)?.kind !== "secret",
-    );
+    const missing = [
+      ...Object.keys(SERVICE_SECRET_ENV[slug]).filter(
+        (name) => name.endsWith("_PASSWORD") && env.get(name)?.kind !== "secret",
+      ),
+      // A database var the contract retired (the gateway's ADMIN_* before
+      // #613, its GATEWAY_* before #635) means the running release still
+      // needs that login.
+      ...RETIRED_SERVICE_ENV[slug].filter((name) => /DATABASE/.test(name) && env.has(name)),
+    ];
     if (missing.length > 0) {
       return {
         ok: false,
-        error: `${found.name} does not read ${missing.join(", ")} from Secret Manager — its release predates the current database env (Secret Manager runtime secrets; for the gateway, its own database logins, #613). Run \`upgrade\` first: it moves the release and its env over together. Re-running the installer now would give the running release a database env it can't connect with.`,
+        error: `${found.name} does not match the current database env (${missing.join(", ")}) — its release predates it (Secret Manager runtime secrets; for the gateway, its own database login, #613/#635). Run \`upgrade\` first: it moves the release and its env over together. Re-running the installer now would give the running release a database env it can't connect with.`,
       };
     }
   }

package/src/error-pages-stacks.test.ts

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #802 — every provider answers an unknown URL with the site's own
+ * `/404.html` (written by the static generator from the designated 404
+ * page) and status 404. Firebase Hosting does this by convention for a
+ * root `/404.html`; the other stacks must wire it. Source-level checks:
+ * the Pulumi programs cannot run in a unit test.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const stack = (provider: string): string =>
+  readFileSync(resolve(import.meta.dir, "..", "stacks", provider, "index.ts"), "utf8");
+
+describe("#802 site 404 page wiring per provider", () => {
+  it("gcp: the static bucket's website serves 404.html for unknown objects", () => {
+    expect(stack("gcp")).toContain('notFoundPage: "404.html"');
+  });
+
+  it("aws: CloudFront maps both 404 and the OAI origin's 403 to /404.html with status 404", () => {
+    const src = stack("aws");
+    expect(src).toContain(
+      '{ errorCode: 404, responseCode: 404, responsePagePath: "/404.html", errorCachingMinTtl: 60 }',
+    );
+    // S3 behind an OAI without s3:ListBucket answers a missing key with
+    // 403 — without this entry visitors get S3's AccessDenied XML.
+    expect(src).toContain(
+      '{ errorCode: 403, responseCode: 404, responsePagePath: "/404.html", errorCachingMinTtl: 60 }',
+    );
+  });
+
+  it("azure: the static website's error document is 404.html", () => {
+    expect(stack("azure")).toContain('error404Document: "404.html"');
+  });
+});

package/src/gateway-credentials.ts

@@ -2,9 +2,12 @@
 
 /**
  * Moving an existing install's API gateway off admin_role (issue #613),
- * as `cms-provision upgrade` does it. The env side — GATEWAY_DATABASE_URL
- * and the per-role password secrets in, ADMIN_DATABASE_* out — rides the
- * gateway's roll (stack-contract.ts). The database side is ordered around
+ * as `cms-provision upgrade` does it. The env side — the per-role password
+ * secrets in, ADMIN_DATABASE_* out (and, since #635, GATEWAY_DATABASE_* out
+ * too: the gateway has no cms_admin login at all) — rides the gateway's
+ * roll (stack-contract.ts). gateway_role keeps getting its password until
+ * the contract release drops the role, because the previous release's
+ * gateway logs in with it until it is rolled. The database side is ordered around
  * that roll so /api/* keeps working:
  *
  *   1. after migrations (which create `gateway_role` without a password):

package/src/gateway-env-isolation.test.ts

@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Issue #635 guardrail (c): on EVERY adapter, the API gateway's service
+ * env holds no cms_admin credential of any role, AND its identity cannot
+ * read a secret that unlocks one (CLAUDE.md §2: the public side has no path
+ * to cms_admin). Env strings alone are not enough: a role that may read
+ * admin_role's password is a path even when no env var names it.
+ *
+ *   gcp, gcp-firebase  the env contract (stack-contract.ts), every IAM
+ *                      binding the gateway SA gets (contract + stack source)
+ *   aws                the gateway's own ECS task role and the secrets its
+ *                      policy covers (aws-task-roles.ts + stack source)
+ *   azure              the gateway container app's env, and no identity or
+ *                      Key Vault access for any container app
+ *   self-hosted        the generated compose gateway service: env, secrets,
+ *                      mounts
+ *
+ * The gateway itself refuses to boot on such an env
+ * (apps/api-gateway `adminDatabaseAccessInEnv`); this catches it at review
+ * time, before a release can ship it.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { AWS_SERVICE_SECRETS, secretsReadPolicy } from "./aws-task-roles.js";
+import { generateDockerCompose } from "./compose.js";
+import {
+  databaseUrls,
+  gatewayEnvContract,
+  RETIRED_IAM_BINDINGS,
+  RETIRED_SERVICE_ENV,
+  runtimeSecretBindings,
+  SERVICE_SECRET_ENV,
+  stackIamInvariants,
+} from "./stack-contract.js";
+
+/** Anything in a gateway env value or name that reaches the authoring database. */
+const ADMIN_ACCESS = /cms_admin|admin_role|gateway_role|ADMIN_DATABASE|GATEWAY_DATABASE/;
+
+/** Secrets that unlock a cms_admin login. */
+const ADMIN_SECRETS = ["postgres-password", "gateway-role-password"];
+
+/** The secrets the gateway reads on GCP: its own login and the staging gate key. */
+const GCP_GATEWAY_SECRETS = ["public-role-password", "staging-gate-secret"];
+
+/** The source of a stack program. */
+function stack(provider: "aws" | "azure" | "gcp" | "gcp-firebase"): string {
+  return readFileSync(resolve(import.meta.dir, "..", "stacks", provider, "index.ts"), "utf8");
+}
+
+describe("gcp + gcp-firebase: the gateway env contract (#635)", () => {
+  const env = gatewayEnvContract({
+    provider: "gcp",
+    projectId: "acme",
+    env: "production",
+    domain: "example.com",
+    region: "europe-west1",
+    stagingHost: "staging.example.com",
+    databaseUrls: databaseUrls("10.20.0.3"),
+  });
+
+  it("carries no cms_admin URL, role or credential name", () => {
+    for (const v of env) {
+      expect(v.name).not.toMatch(ADMIN_ACCESS);
+      if ("value" in v && typeof v.value === "string") expect(v.value).not.toMatch(ADMIN_ACCESS);
+    }
+    expect(env.find((v) => v.name === "PUBLIC_DATABASE_URL")).toEqual({
+      name: "PUBLIC_DATABASE_URL",
+      value: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
+    });
+  });
+
+  it("references no secret that unlocks a cms_admin login", () => {
+    for (const secret of Object.values(SERVICE_SECRET_ENV.gateway)) {
+      expect(ADMIN_SECRETS).not.toContain(secret);
+    }
+    const gatewayBindings = runtimeSecretBindings().filter((b) => b.service === "gateway");
+    for (const b of gatewayBindings) expect(ADMIN_SECRETS).not.toContain(b.secret);
+  });
+
+  for (const provider of ["gcp", "gcp-firebase"] as const) {
+    it(`${provider}: the gateway SA's IAM bindings reach no cms_admin secret (review finding)`, () => {
+      const gateway = stackIamInvariants(provider).filter((b) => b.member === "gateway-sa");
+      for (const b of gateway) {
+        if (b.role === "roles/secretmanager.secretAccessor") {
+          // Per secret, never project-wide (that would cover every secret).
+          expect(b.target.kind).toBe("secret");
+          if (b.target.kind === "secret") expect(GCP_GATEWAY_SECRETS).toContain(b.target.name);
+        } else {
+          expect(["roles/logging.logWriter", "roles/monitoring.metricWriter"]).toContain(b.role);
+        }
+      }
+      // The stack declares no other binding for the gateway SA: the secret
+      // bindings go through runtimeSecretBindings, the two telemetry ones
+      // name it directly.
+      const direct = stack(provider).match(/serviceAccount:\$\{gatewaySa\.email\}/g) ?? [];
+      expect(direct).toHaveLength(2);
+      expect(stack(provider)).toContain("for (const binding of runtimeSecretBindings())");
+    });
+  }
+
+  it("upgrade strips the old credentials and the gateway SA's access to them", () => {
+    for (const name of [
+      "ADMIN_DATABASE_URL",
+      "ADMIN_DATABASE_PASSWORD",
+      "GATEWAY_DATABASE_URL",
+      "GATEWAY_DATABASE_PASSWORD",
+    ]) {
+      expect(RETIRED_SERVICE_ENV.gateway).toContain(name);
+    }
+    for (const secret of ADMIN_SECRETS) {
+      expect(
+        RETIRED_IAM_BINDINGS.some(
+          (b) =>
+            b.member === "gateway-sa" && b.target.kind === "secret" && b.target.name === secret,
+        ),
+      ).toBe(true);
+    }
+  });
+});
+
+describe("self-hosted: the generated compose gateway service (#635)", () => {
+  it("holds public_role on cms_public and nothing else", () => {
+    const out = generateDockerCompose({
+      domain: "example.com",
+      postgresPassword: "superpw",
+      rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+      caeloSecretKek: "0".repeat(64),
+      diskSize: "20Gi",
+      images: {
+        mode: "release" as const,
+        admin: `ghcr.io/caelo-cms/admin@sha256:${"a".repeat(64)}`,
+        gateway: `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`,
+      },
+      ports: { http: 80, https: 443 },
+      project: "caelo-example-com",
+    });
+    const start = out.indexOf("  caelo-gateway:");
+    const end = out.indexOf("\n  caelo-", start + 1);
+    const gateway = out.slice(start, end === -1 ? undefined : end);
+    expect(gateway).toContain("PUBLIC_DATABASE_URL:");
+    expect(gateway).not.toMatch(ADMIN_ACCESS);
+    expect(gateway).not.toMatch(/superpw|adminpw|gatewaypw/);
+    // No other way in: no Compose secrets, no env file, no mounts (a
+    // mounted file is read by no env check), and exactly its own env.
+    expect(gateway).not.toMatch(/^ {4}(secrets|env_file|volumes):/m);
+    const env = gateway.slice(gateway.indexOf("    environment:"));
+    const keys = [...env.matchAll(/^ {6}([A-Z_][A-Z0-9_]*):/gm)].map((m) => m[1]);
+    expect(keys.sort()).toEqual(["GATEWAY_PORT", "NODE_ENV", "PUBLIC_DATABASE_URL"]);
+    expect(out).not.toMatch(/^secrets:/m);
+  });
+});
+
+describe("azure: the gateway container app (#635)", () => {
+  it("gets PUBLIC_DATABASE_URL only", () => {
+    const src = stack("azure");
+    const start = src.indexOf('serviceName: "gateway"');
+    expect(start).toBeGreaterThan(-1);
+    const block = src.slice(start, src.indexOf("});", start));
+    expect(block).toContain('{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }');
+    expect(block).not.toMatch(/adminDatabase|gatewayDatabase|ADMIN_DATABASE|GATEWAY_DATABASE/);
+  });
+
+  it("builds no cms_admin URL for any role but the admin's", () => {
+    expect(stack("azure")).not.toMatch(/gateway_role:\$\{/);
+  });
+
+  it("gives no container app an identity or Key Vault access (review finding)", () => {
+    // The vault uses RBAC authorisation: without a role assignment or a
+    // managed identity no container app can read any vault secret, so the
+    // gateway's only credential is the public_role URL in its env.
+    const src = stack("azure");
+    expect(src).toContain("enableRbacAuthorization: true");
+    expect(src).not.toMatch(/RoleAssignment|accessPolicies|identity\s*:|keyVaultUrl|secretRef/);
+  });
+});
+
+describe("aws: the stack (#635)", () => {
+  it("builds no gateway_role URL and exports no gateway cms_admin DSN", () => {
+    const src = stack("aws");
+    expect(src).not.toMatch(/gateway_role:\$\{/);
+    expect(src).not.toMatch(/gatewayDatabaseUrl/);
+  });
+
+  it("the gateway's task role reads only the public_role password (review finding)", () => {
+    expect(AWS_SERVICE_SECRETS.gateway).toEqual(["public-role-password"]);
+    for (const secret of ADMIN_SECRETS) expect(AWS_SERVICE_SECRETS.gateway).not.toContain(secret);
+  });
+
+  it("each service gets its own task role whose policy is built from that table", () => {
+    const src = stack("aws");
+    expect(src).toContain('gateway: taskRole("gateway")');
+    expect(src).toContain('admin: taskRole("admin")');
+    // One RolePolicy, inside taskRole, scoped by AWS_SERVICE_SECRETS[service]:
+    // no policy anywhere lists secret ARNs by hand.
+    expect(src.match(/new aws\.iam\.RolePolicy\(/g)).toHaveLength(1);
+    expect(src).toContain(".all(AWS_SERVICE_SECRETS[service].map((name) => secretArns[name]))");
+    expect(src).not.toMatch(/GetSecretValue/);
+  });
+
+  it("secretsReadPolicy grants GetSecretValue on exactly the given ARNs", () => {
+    expect(JSON.parse(secretsReadPolicy(["arn:a", "arn:b"]))).toEqual({
+      Version: "2012-10-17",
+      Statement: [
+        { Effect: "Allow", Action: "secretsmanager:GetSecretValue", Resource: ["arn:a", "arn:b"] },
+      ],
+    });
+    expect(() => secretsReadPolicy([])).toThrow();
+  });
+});

package/src/gcloud.ts

@@ -75,10 +75,12 @@ export async function gcloud(
 
 /**
  * Active gcloud account. Returns `null` when no account is logged in
- * — caller prompts `gcloud auth login`.
+ * — caller prompts `gcloud auth login`. `run` is injectable for tests.
  */
-export async function activeAccount(): Promise<string | null> {
-  const r = await gcloud(["auth", "list", "--format=value(account)", "--filter=status:ACTIVE"]);
+export async function activeAccount(
+  run: (args: string[]) => Promise<GcloudResult> = gcloud,
+): Promise<string | null> {
+  const r = await run(["auth", "list", "--format=value(account)", "--filter=status:ACTIVE"]);
   if (!r.ok) return null;
   const value = r.stdout.trim();
   return value.length > 0 ? value : null;

package/src/index.test.ts

@@ -132,7 +132,7 @@ describe("docker-compose generator", () => {
     expect(out).toContain("CAELO_SECRET_KEK");
   });
 
-  it("gives the gateway gateway_role + public_role and no admin credential (#613)", () => {
+  it("gives the gateway public_role only and no cms_admin credential (#613, #635)", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "supersecret",
@@ -144,14 +144,14 @@ describe("docker-compose generator", () => {
       project: "caelo-example-com",
     });
     const gateway = out.slice(out.indexOf("caelo-gateway:"), out.indexOf("\nvolumes:"));
-    expect(gateway).toContain(
-      'GATEWAY_DATABASE_URL: "postgres://gateway_role:gatewaypw@postgres:5432/cms_admin"',
-    );
     expect(gateway).toContain(
       'PUBLIC_DATABASE_URL: "postgres://public_role:publicpw@postgres:5432/cms_public"',
     );
-    expect(gateway).not.toMatch(/ADMIN_DATABASE|admin_role|adminpw|supersecret|CAELO_SECRET_KEK/);
-    // bootstrap.sh creates the three roles from these.
+    expect(gateway).not.toMatch(
+      /ADMIN_DATABASE|GATEWAY_DATABASE|cms_admin|admin_role|gateway_role|adminpw|gatewaypw|supersecret|CAELO_SECRET_KEK/,
+    );
+    // bootstrap.sh still creates the three roles from these (gateway_role
+    // until the contract release drops it).
     expect(out).toContain('GATEWAY_ROLE_PASSWORD: "gatewaypw"');
   });
 

package/src/infra-contract.test.ts

@@ -20,10 +20,12 @@ describe("infrastructure contract steps", () => {
     );
   });
 
-  it("is at 4: the public_role revoke (3) and the URL-map redirects role (4) are separate", () => {
-    expect(INFRA_CONTRACT_VERSION).toBe(4);
+  it("is at 6: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6)", () => {
+    expect(INFRA_CONTRACT_VERSION).toBe(6);
     expect(INFRA_CONTRACT_STEPS[3]).toContain("#633");
     expect(INFRA_CONTRACT_STEPS[4]).toContain("#587");
+    expect(INFRA_CONTRACT_STEPS[5]).toContain("#635");
+    expect(INFRA_CONTRACT_STEPS[6]).toContain("#799");
   });
 
   it("lists the pending steps oldest first", () => {
@@ -34,6 +36,6 @@ describe("infrastructure contract steps", () => {
   });
 
   it("names a version a newer release added by number", () => {
-    expect(infraStepsText(4, 5)).toBe("infrastructure step 5 (see that release's notes)");
+    expect(infraStepsText(6, 7)).toBe("infrastructure step 7 (see that release's notes)");
   });
 });

package/src/infra-contract.ts

@@ -22,7 +22,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 4;
+export const INFRA_CONTRACT_VERSION = 6;
 
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
@@ -36,6 +36,15 @@ export const INFRA_CONTRACT_VERSION = 4;
 //       first.
 //   4 — #587: on `gcp`, the admin's custom role for writing the redirects
 //       table into the URL map (url-map-redirects-access.ts).
+//   5 — #635: the gateway has no cms_admin login. Its GATEWAY_DATABASE_URL /
+//       GATEWAY_DATABASE_PASSWORD go, and its SA loses access to the
+//       gateway-role-password secret (a retired IAM binding, removed after
+//       the roll — the in-cloud upgrader cannot change IAM).
+//   6 — #799: the upgrader's custom role `caeloUpgraderOpsList`
+//       (`storage.objects.list` on the ops bucket). Every `gcloud storage cp`
+//       into the bucket lists it first; without the binding the in-cloud
+//       upgrader fails at its state lock, so it must not run before the
+//       converge grants it.
 
 /**
  * What each contract version adds, in operator terms — the upgrader's
@@ -47,6 +56,8 @@ export const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>> = {
   2: "the in-cloud upgrader job and its scoped permissions",
   3: "public_role out of the Cloud SQL superuser group (#633)",
   4: "the admin's permission to serve redirects from the load balancer (#587)",
+  5: "the gateway's cms_admin login removed from its env and IAM (#635)",
+  6: "the upgrader's permission to list its ops bucket (#799)",
 };
 
 /**

package/src/ops-backend.ts

@@ -20,7 +20,7 @@
  *     anything. The bucket's convenience bindings for project viewers and
  *     editors are removed; public principals are refused outright. Project
  *     Owners keep access through their project role (that cannot be taken
- *     away at the bucket); docs-site/pages/install-gcp.md says so.
+ *     away at the bucket); the GCP install docs say so.
  *
  * Every step reads before it writes, so a re-run is a no-op and an operator
  * without IAM-write permission can still run against an ops backend someone