@caelo-cms/provisioning 0.10.50 → 0.10.52

package/src/owner-reset.test.ts

@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #769 — `owner-reset` asks the admin for a reset link through IAP (as
+ * caelo-mcp) with the internal token for scope `auth.owner_reset`, and builds
+ * the link on the admin URL the operator can open.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import { describeOwnerReset, OWNER_RESET_SCOPE, requestOwnerReset } from "./owner-reset.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+const ADMIN = "https://caelo-production-admin-abc-ew.a.run.app";
+const target = { projectId: "proj", region: "europe-west1" };
+
+function fakeGcloud(
+  overrides: Record<string, GcloudResult> = {},
+): (args: string[]) => Promise<GcloudResult> {
+  const answers: Record<string, GcloudResult> = {
+    "auth list": ok("operator@example.com\n"),
+    "run services list": ok("caelo-production-admin-abc\n"),
+    "run services describe": ok(`${ADMIN}\n`),
+    "secrets versions access": ok("s".repeat(40)),
+    "auth print-access-token": ok("ya29.operator\n"),
+    "services enable iamcredentials.googleapis.com": ok(),
+    ...overrides,
+  };
+  return async (args) => {
+    const key = Object.keys(answers).find((k) => args.join(" ").startsWith(k));
+    return (key && answers[key]) || fail(`unexpected gcloud ${args.join(" ")}`);
+  };
+}
+
+interface Seen {
+  url: string;
+  headers: Record<string, string>;
+  body: unknown;
+}
+
+function fakeFetch(admin: () => Response) {
+  const seen: Seen[] = [];
+  const doFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = String(input);
+    seen.push({
+      url,
+      headers: Object.fromEntries(new Headers(init?.headers).entries()),
+      body: init?.body ? JSON.parse(String(init.body)) : null,
+    });
+    if (url.startsWith("https://iamcredentials.googleapis.com/")) {
+      return Response.json({ signedJwt: "iap.jwt.signed" });
+    }
+    return admin();
+  }) as typeof fetch;
+  return { doFetch, seen };
+}
+
+const ISSUED = {
+  ok: true,
+  email: "owner@example.com",
+  token: "tok/with+chars",
+  expiresAt: "2026-10-15T12:52:56.000Z",
+};
+
+describe("requestOwnerReset", () => {
+  it("calls the endpoint with the owner_reset scope and builds the link on the admin URL", async () => {
+    const { doFetch, seen } = fakeFetch(() => Response.json(ISSUED));
+    const r = await requestOwnerReset(target, {}, { run: fakeGcloud(), fetch: doFetch });
+    expect(r).toEqual({
+      ok: true,
+      value: {
+        email: "owner@example.com",
+        resetUrl: `${ADMIN}/reset?token=tok%2Fwith%2Bchars`,
+        expiresAt: "2026-10-15T12:52:56.000Z",
+      },
+    });
+    const call = seen[1];
+    expect(call?.url).toBe(`${ADMIN}/api/internal/owner-reset`);
+    expect(call?.headers.authorization).toBe("Bearer iap.jwt.signed");
+    expect(call?.body).toEqual({ requestedBy: "operator@example.com" });
+    const [message] = (call?.headers["x-caelo-internal-token"] ?? "").split(".");
+    expect(Buffer.from(message ?? "", "base64url").toString()).toEndWith(`:${OWNER_RESET_SCOPE}`);
+  });
+
+  it("forwards --email so the operator can pick among several Owners", async () => {
+    const { doFetch, seen } = fakeFetch(() => Response.json(ISSUED));
+    await requestOwnerReset(
+      target,
+      { email: "owner@example.com" },
+      { run: fakeGcloud(), fetch: doFetch },
+    );
+    expect(seen[1]?.body).toEqual({
+      email: "owner@example.com",
+      requestedBy: "operator@example.com",
+    });
+  });
+
+  it("refuses to run without an active gcloud account to name in the audit row", async () => {
+    const { doFetch, seen } = fakeFetch(() => Response.json(ISSUED));
+    for (const answer of [
+      ok(""),
+      fail("ERROR: no credentialed accounts"),
+      ok("a@x.com\nb@x.com"),
+    ]) {
+      const r = await requestOwnerReset(
+        target,
+        {},
+        { run: fakeGcloud({ "auth list": answer }), fetch: doFetch },
+      );
+      expect(r.ok ? "" : r.error).toContain("gcloud auth login");
+    }
+    expect(seen).toHaveLength(0);
+  });
+
+  it("passes the admin's refusal through and names the upgrade for an older admin", async () => {
+    const refused = await requestOwnerReset(
+      target,
+      {},
+      {
+        run: fakeGcloud(),
+        fetch: fakeFetch(() =>
+          Response.json(
+            { ok: false, error: "This install has 2 Owners (a@x.com, b@x.com). Name the one" },
+            { status: 422 },
+          ),
+        ).doFetch,
+      },
+    );
+    expect(refused.ok ? "" : refused.error).toContain("2 Owners (a@x.com, b@x.com)");
+
+    const old = await requestOwnerReset(
+      target,
+      {},
+      { run: fakeGcloud(), fetch: fakeFetch(() => new Response("nf", { status: 404 })).doFetch },
+    );
+    expect(old.ok ? "" : old.error).toContain("before #769");
+    expect(old.ok ? "" : old.error).toContain("cms-provision upgrade");
+  });
+
+  it("refuses an answer without a token instead of printing a broken link", async () => {
+    const r = await requestOwnerReset(
+      target,
+      {},
+      {
+        run: fakeGcloud(),
+        fetch: fakeFetch(() => Response.json({ ok: true, email: "owner@example.com" })).doFetch,
+      },
+    );
+    expect(r.ok).toBe(false);
+  });
+});
+
+describe("describeOwnerReset", () => {
+  it("prints the account, the link and when it stops working", () => {
+    const text = describeOwnerReset({
+      email: "owner@example.com",
+      resetUrl: `${ADMIN}/reset?token=abc`,
+      expiresAt: "2026-10-15T12:52:56.000Z",
+    }).join("\n");
+    expect(text).toContain("owner@example.com");
+    expect(text).toContain(`  ${ADMIN}/reset?token=abc`);
+    expect(text).toContain("2026-10-15T12:52:56.000Z");
+  });
+});

package/src/owner-reset.ts

@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #769 — `cms-provision owner-reset` — get an Owner back into a locked-out admin
+ * when the install cannot email a reset link (no email transport set up).
+ *
+ * The root of trust is the operator's cloud identity: whoever may read the
+ * install's internal secret and pass the admin's IAP already controls its
+ * database and deploys, so issuing them a reset link grants nothing new. The
+ * admin issues the one-hour, single-use token (`auth.issue_owner_reset`,
+ * audited) and hands it back over the admin-internal.ts channel; the CLI
+ * prints the link once. It is never logged, so it does not land in the
+ * project's Cloud Logging the way a "log the link" fallback would.
+ *
+ * The request carries the operator's gcloud account so the admin's audit row
+ * names who asked. That account is self-asserted (the admin sees the shared
+ * `caelo-mcp` identity and the shared internal secret), and labelled so; the
+ * authoritative record is Google's Data Access audit log for the IAM
+ * Credentials and Secret Manager calls this command makes as the operator.
+ */
+
+import {
+  type AdminInternalDeps,
+  type AdminInternalResult,
+  type AdminInternalTarget,
+  callAdminInternal,
+} from "./admin-internal.js";
+import { activeAccount, gcloud as defaultGcloud } from "./gcloud.js";
+
+/** Token scope the admin endpoint checks (apps/admin …/api/internal/owner-reset). */
+export const OWNER_RESET_SCOPE = "auth.owner_reset";
+const ENDPOINT = "/api/internal/owner-reset";
+
+/** What the admin issued: whose account, the link to open, and until when it works. */
+export interface OwnerReset {
+  readonly email: string;
+  readonly resetUrl: string;
+  readonly expiresAt: string;
+}
+
+/**
+ * Ask the admin for a reset link for the install's Owner (or the Owner named
+ * by `email` when there are several).
+ */
+export async function requestOwnerReset(
+  target: AdminInternalTarget,
+  request: { readonly email?: string },
+  deps: AdminInternalDeps = {},
+): Promise<AdminInternalResult<OwnerReset>> {
+  const account = await readGcloudAccount(deps.run ?? defaultGcloud);
+  if (!account.ok) return account;
+  const r = await callAdminInternal<{ email: string; token: string; expiresAt: string }>(
+    target,
+    {
+      endpoint: ENDPOINT,
+      scope: OWNER_RESET_SCOPE,
+      body: {
+        ...(request.email !== undefined ? { email: request.email } : {}),
+        requestedBy: account.value,
+      },
+      introducedBy: "#769",
+    },
+    deps,
+  );
+  if (!r.ok) return r;
+  const { answer, adminUrl } = r.value;
+  const { email, token, expiresAt } = answer;
+  if (!email || !token || !expiresAt) {
+    return { ok: false, error: "the admin answered without an email, token or expiry" };
+  }
+  const resetUrl = new URL(`/reset?token=${encodeURIComponent(token)}`, adminUrl).toString();
+  return { ok: true, value: { email, resetUrl, expiresAt } };
+}
+
+/**
+ * The gcloud account this command runs as, for the admin's audit row. Without
+ * one there is nobody to name, and the IAP step after this would fail anyway.
+ */
+async function readGcloudAccount(
+  run: NonNullable<AdminInternalDeps["run"]>,
+): Promise<AdminInternalResult<string>> {
+  // `auth list --filter=status:ACTIVE`, not `config get-value account`: the
+  // latter prints the sentinel `(unset)` and exits 0 when no account is set.
+  const account = await activeAccount(run);
+  if (!account || /\s/.test(account)) {
+    return {
+      ok: false,
+      error:
+        "read the active gcloud account: none is signed in. Run `gcloud auth login` with the account you provisioned with.",
+    };
+  }
+  return { ok: true, value: account };
+}
+
+/** The lines the command prints. Pure — the CLI prints them and stores nothing. */
+export function describeOwnerReset(r: OwnerReset): string[] {
+  return [
+    `Reset link for ${r.email} — open it to set a new password:`,
+    "",
+    `  ${r.resetUrl}`,
+    "",
+    `It works once and expires at ${r.expiresAt}. Setting the password signs out every`,
+    "other session of this account. The link is not saved anywhere; run the command",
+    "again for a new one.",
+  ];
+}

package/src/release-contract.ts

@@ -46,6 +46,9 @@ export const INFRA_CONTRACT_PATHS: readonly string[] = [
   // #587 — the admin's URL-map redirects role and the URL map's shape.
   "packages/provisioning/src/url-map-redirects-access.ts",
   "packages/provisioning/src/gcp-url-map.ts",
+  // The in-cloud upgrader job's service account, custom roles and bucket
+  // grants (#799 added one without the checks noticing).
+  "packages/provisioning/src/upgrader-setup.ts",
 ];
 
 /**

package/src/release-manifest.test.ts

@@ -296,6 +296,7 @@ describe("release-contract", () => {
     expect(isInfraContractPath("packages/provisioning/stacks/gcp/index.ts")).toBe(true);
     expect(isInfraContractPath("packages/provisioning/src/stack-converge.ts")).toBe(true);
     expect(isInfraContractPath("packages/provisioning/src/upgrade/converge.ts")).toBe(true);
+    expect(isInfraContractPath("packages/provisioning/src/upgrader-setup.ts")).toBe(true);
     expect(isInfraContractPath("packages/provisioning/src/stack-converge.test.ts")).toBe(false);
     expect(isInfraContractPath("packages/provisioning/stacks/gcp/README.md")).toBe(false);
     expect(isInfraContractPath("packages/provisioning/src/cli.ts")).toBe(false);

package/src/runtime-secrets.test.ts

@@ -340,10 +340,7 @@ describe("rotateRuntimeSecret", () => {
       ]),
     ],
     "run services describe gw-svc": [
-      service([
-        ref("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
-        ref("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
-      ]),
+      service([ref("PUBLIC_DATABASE_PASSWORD", "public-role-password")]),
     ],
     "auth print-access-token": [ok("tok\n")],
   });
@@ -414,7 +411,7 @@ describe("rotateRuntimeSecret", () => {
     ).toBe(true);
   });
 
-  it("gateway-role-password: changes gateway_role only and rolls the gateway only (#613)", async () => {
+  it("gateway-role-password: changes gateway_role only and rolls no service (#613, #635)", async () => {
     const { run, lines } = fakeGcloud({
       ...converged(),
       "secrets versions access": [ok("old-pw")],
@@ -428,9 +425,9 @@ describe("rotateRuntimeSecret", () => {
     });
     expect(report.ok).toBe(true);
     expect(sql.passwords()).toEqual(["gateway_role new-pw"]);
-    expect(lines().filter((l) => l.startsWith("run services update "))).toEqual([
-      expect.stringContaining("run services update gw-svc"),
-    ]);
+    // No service logs in as gateway_role any more: the gateway reads
+    // cms_public only (#635).
+    expect(lines().filter((l) => l.startsWith("run services update "))).toEqual([]);
     expect(lines()).toContain(
       "secrets versions access latest --secret=caelo-production-gateway-role-password --project=acme",
     );
@@ -477,6 +474,26 @@ describe("rotateRuntimeSecret", () => {
     expect(lines().every((l) => l.startsWith("run services describe"))).toBe(true);
   });
 
+  it("refuses gateway-role-password while the gateway still logs in with it (before #635)", async () => {
+    const answers = converged();
+    answers["run services describe gw-svc"] = [
+      service([
+        ref("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
+        ref("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
+      ]),
+    ];
+    const { run } = fakeGcloud(answers);
+    const sql = fakeSqlApi();
+    const report = await rotateRuntimeSecret(target, "gateway-role-password", {
+      run,
+      http: sql.http,
+      generate: () => "new-pw",
+    });
+    expect(report.ok).toBe(false);
+    expect(report.error).toContain("GATEWAY_DATABASE_PASSWORD");
+    expect(sql.requests).toHaveLength(0);
+  });
+
   it("refuses before changing anything on an install upgrade hasn't moved over", async () => {
     const { run, lines } = fakeGcloud({
       "run services describe adm-svc": [

package/src/stack-contract.test.ts

@@ -49,12 +49,11 @@ const ADMIN_SECRETS = {
 };
 
 describe("databaseUrls", () => {
-  it("builds password-less URLs for the four role/database pairs", () => {
+  it("builds password-less URLs for the three role/database pairs", () => {
     expect(databaseUrls("10.20.0.3")).toEqual({
       admin: "postgresql://admin_role@10.20.0.3:5432/cms_admin?sslmode=require",
       publicAdmin: "postgresql://admin_role@10.20.0.3:5432/cms_public?sslmode=require",
       public: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
-      gateway: "postgresql://gateway_role@10.20.0.3:5432/cms_admin?sslmode=require",
     });
   });
 });
@@ -154,15 +153,13 @@ describe.each([
 describe("gatewayEnvContract", () => {
   const gateway = gatewayEnvContract({ ...base, provider: "gcp" });
 
-  it("carries its two own logins and none of the admin's database or app secrets", () => {
+  it("carries its one own login and none of the admin's database or app secrets (#635)", () => {
     expect(asRecord(gateway)).toEqual({
       CAELO_PROVIDER: "gcp",
       CAELO_ENV: "production",
       MEDIA_STORAGE_URL: "gs://acme-caelo-production-media",
       PUBLIC_DATABASE_URL: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
-      GATEWAY_DATABASE_URL: "postgresql://gateway_role@10.20.0.3:5432/cms_admin?sslmode=require",
       PUBLIC_DATABASE_PASSWORD: "secret:caelo-production-public-role-password:latest",
-      GATEWAY_DATABASE_PASSWORD: "secret:caelo-production-gateway-role-password:latest",
       CAELO_STAGING_GATE_SECRET: "secret:caelo-production-staging-gate-secret:latest",
     });
   });
@@ -188,11 +185,7 @@ describe("gatewayEnvContract", () => {
   });
 
   it("the gateway's run SA reads no admin-only secret (admin password, KEK, internal, tool approval)", () => {
-    expect(serviceSecrets("gateway")).toEqual([
-      "gateway-role-password",
-      "public-role-password",
-      "staging-gate-secret",
-    ]);
+    expect(serviceSecrets("gateway")).toEqual(["public-role-password", "staging-gate-secret"]);
     for (const v of gateway) {
       expect(v.name).not.toMatch(/KEK|INTERNAL|TOOL_APPROVAL|PUBLIC_ADMIN/);
     }
@@ -280,11 +273,6 @@ describe("runtime secrets", () => {
         secret: "staging-gate-secret",
         stackResource: "staging-gate-secret-binding",
       },
-      {
-        service: "gateway",
-        secret: "gateway-role-password",
-        stackResource: "gateway-gateway-role-password-binding",
-      },
       {
         service: "gateway",
         secret: "public-role-password",
@@ -299,7 +287,11 @@ describe("runtime secrets", () => {
   });
 
   it("every CLI-generated secret is read by some service", () => {
-    for (const s of CLI_GENERATED_SECRETS) {
+    // gateway-role-password is read by no service since #635: it only keeps
+    // the legacy gateway_role's password set until the contract release
+    // drops the role (the previous release's gateway logs in with it while
+    // an upgrade rolls).
+    for (const s of CLI_GENERATED_SECRETS.filter((x) => x !== "gateway-role-password")) {
       expect([...serviceSecrets("admin"), ...serviceSecrets("gateway")]).toContain(s);
     }
   });
@@ -351,13 +343,12 @@ describe("stackIamInvariants", () => {
     }
   });
 
-  it("grants the gateway SA only its two role passwords, the staging gate key + telemetry roles", () => {
+  it("grants the gateway SA only its own role password, the staging gate key + telemetry roles", () => {
     for (const provider of ["gcp", "gcp-firebase"] as const) {
       const gateway = stackIamInvariants(provider).filter((i) => i.member === "gateway-sa");
       expect(gateway.map((i) => `${i.role} ${JSON.stringify(i.target)}`).sort()).toEqual([
         'roles/logging.logWriter {"kind":"project"}',
         'roles/monitoring.metricWriter {"kind":"project"}',
-        'roles/secretmanager.secretAccessor {"kind":"secret","name":"gateway-role-password"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"public-role-password"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"staging-gate-secret"}',
       ]);

package/src/stack-contract.ts

@@ -86,14 +86,12 @@ export interface DatabaseUrls<V = string> {
   readonly admin: V;
   /** admin_role on cms_public — the admin's second pool (DDL, migrations). */
   readonly publicAdmin: V;
-  /** public_role on cms_public — the gateway's visitor-write pool. */
-  readonly public: V;
   /**
-   * gateway_role on cms_admin — the gateway's narrow pool (#613): its
-   * settings, rate limits, captcha, request log, plugin op audit and the
-   * plugin registry, read-mostly (migration 0248).
+   * public_role on cms_public — the gateway's only pool. The gateway has no
+   * cms_admin login (#635, CLAUDE.md §2): what it needs from authoring
+   * state the admin publishes into cms_public.
    */
-  readonly gateway: V;
+  readonly public: V;
 }
 
 /** Port Cloud SQL Postgres listens on (private IP). */
@@ -111,7 +109,6 @@ export function databaseUrls(host: string): DatabaseUrls {
     admin: url("admin_role", "cms_admin"),
     publicAdmin: url("admin_role", "cms_public"),
     public: url("public_role", "cms_public"),
-    gateway: url("gateway_role", "cms_admin"),
   };
 }
 
@@ -251,8 +248,8 @@ export type DatabaseRole = "admin_role" | "public_role" | "gateway_role";
 
 /**
  * Each database role's password secret — one per role (#613), so the
- * gateway's SA, which reads only the public_role and gateway_role
- * passwords, can never read admin_role's. `postgres-password` keeps its
+ * gateway's SA, which reads only the public_role password, can never read
+ * admin_role's (or, since #635, gateway_role's). `postgres-password` keeps its
  * name: it has always been admin_role's (and, before #613, shared with
  * public_role). `rotate-secret` changes exactly the role(s) listed here.
  */
@@ -306,9 +303,8 @@ export const SERVICE_SECRET_ENV: Readonly<
     CAELO_STAGING_GATE_SECRET: "staging-gate-secret",
   },
   gateway: {
-    // CLAUDE.md §2: never an admin_role credential (#613). gateway_role on
-    // cms_admin + public_role on cms_public, each with its own password.
-    GATEWAY_DATABASE_PASSWORD: "gateway-role-password",
+    // CLAUDE.md §2: no cms_admin credential of any role (#613, #635).
+    // public_role on cms_public is the gateway's only login.
     PUBLIC_DATABASE_PASSWORD: "public-role-password",
     // #650 — verifies staging-host requests (api-gateway staging-proxy.ts).
     CAELO_STAGING_GATE_SECRET: "staging-gate-secret",
@@ -323,12 +319,20 @@ export function serviceSecrets(service: CloudRunSlug): RuntimeSecret[] {
 /**
  * Env vars an older stack set that the contract no longer gives a service;
  * upgrade removes them. The gateway never used the KEK, and its run SA
- * cannot read it. Its admin_role pool went with #613 — the gateway refuses
- * to boot while either var is set (apps/api-gateway `gatewayDatabaseUrls`).
+ * cannot read it. Its admin_role pool went with #613 and its gateway_role
+ * pool with #635 — the gateway refuses to boot while any cms_admin
+ * credential is in its env (apps/api-gateway `adminDatabaseAccessInEnv`).
  */
 export const RETIRED_SERVICE_ENV: Readonly<Record<CloudRunSlug, readonly string[]>> = {
   admin: [],
-  gateway: ["CAELO_SECRET_KEK", "ADMIN_DATABASE_URL", "ADMIN_DATABASE_PASSWORD"],
+  gateway: [
+    "CAELO_SECRET_KEK",
+    "ADMIN_DATABASE_URL",
+    "ADMIN_DATABASE_PASSWORD",
+    // #635 — its gateway_role login on cms_admin is gone too.
+    "GATEWAY_DATABASE_URL",
+    "GATEWAY_DATABASE_PASSWORD",
+  ],
 };
 
 function secretEnv(service: CloudRunSlug, env: string): CloudRunEnvVar[] {
@@ -362,7 +366,6 @@ export function gatewayEnvContract<V>(inputs: RuntimeEnvInputs<V>): CloudRunEnvV
   return [
     ...commonEnv(inputs),
     { name: "PUBLIC_DATABASE_URL", value: inputs.databaseUrls.public },
-    { name: "GATEWAY_DATABASE_URL", value: inputs.databaseUrls.gateway },
     ...secretEnv("gateway", inputs.env),
   ];
 }
@@ -679,6 +682,12 @@ export const RETIRED_IAM_BINDINGS: readonly RetiredIamBinding[] = [
     target: { kind: "secret", name: "postgres-password" },
     why: "the gateway no longer logs in as admin_role and must not be able to read its password (CLAUDE.md §2)",
   },
+  {
+    role: SECRET_ACCESSOR,
+    member: "gateway-sa",
+    target: { kind: "secret", name: "gateway-role-password" },
+    why: "the gateway has no cms_admin login at all and must not be able to read gateway_role's password (CLAUDE.md §2, #635)",
+  },
 ];
 
 /** Every IAM binding upgrade ensures on an install of `provider`. */

package/src/stack-converge-secrets.test.ts

@@ -38,12 +38,14 @@ const SECRET_VALUES: Record<string, string> = {
   "caelo-production-gateway-role-password": "g".repeat(64),
 };
 
-/** Env vars that would hand the gateway an admin_role credential (apps/api-gateway ADMIN_CREDENTIAL_ENV). */
+/** Env vars that would hand the gateway a cms_admin credential (a subset of what apps/api-gateway adminDatabaseAccessInEnv refuses). */
 const ADMIN_CREDENTIAL_ENV = [
   "ADMIN_DATABASE_URL",
   "ADMIN_DATABASE_PASSWORD",
   "PUBLIC_ADMIN_DATABASE_URL",
   "PUBLIC_ADMIN_DATABASE_PASSWORD",
+  "GATEWAY_DATABASE_URL",
+  "GATEWAY_DATABASE_PASSWORD",
 ];
 
 /** Split a gcloud list flag value, honouring the `^<delim>^` escape. */
@@ -122,16 +124,15 @@ function credentials(url: string | undefined): string {
 }
 
 /**
- * The gateway's process env after the upgrade: gateway_role on cms_admin and
- * public_role on cms_public, each with its own secret, and no admin_role
- * credential at all (the gateway refuses to boot with one).
+ * The gateway's process env after the upgrade: public_role on cms_public
+ * with its own secret, and no cms_admin credential of any role at all
+ * (#613, #635 — the gateway refuses to boot with one).
  */
 function expectGatewayOnItsOwnLogins(env: Record<string, string>): void {
   for (const name of ADMIN_CREDENTIAL_ENV) expect(Object.keys(env)).not.toContain(name);
   expect(Object.values(env).join("\n")).not.toContain(PW);
-  expect(credentials(databaseUrlFromEnv(["GATEWAY_DATABASE_URL"], env))).toBe(
-    `gateway_role:${"g".repeat(64)}@${HOST}:5432/cms_admin?sslmode=require`,
-  );
+  expect(Object.values(env).join("\n")).not.toContain("g".repeat(64));
+  expect(Object.values(env).join("\n")).not.toContain("cms_admin");
   expect(credentials(databaseUrlFromEnv(["PUBLIC_DATABASE_URL"], env))).toBe(
     `public_role:${"p".repeat(64)}@${HOST}:5432/cms_public?sslmode=require`,
   );
@@ -331,7 +332,7 @@ function v01035Install() {
 }
 
 describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", () => {
-  it("drops the admin_role credential and adds the gateway's own logins in one revision", () => {
+  it("drops the admin_role credential and adds the gateway's own login in one revision", () => {
     const services = v01035Install();
     const plan = upgrade(services);
     expect(services.gateway.revisions).toHaveLength(2);
@@ -343,8 +344,6 @@ describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", (
       "ADMIN_DATABASE_URL",
       // #650 — the staging gate key arrives in the same roll.
       "CAELO_STAGING_GATE_SECRET",
-      "GATEWAY_DATABASE_PASSWORD",
-      "GATEWAY_DATABASE_URL",
       "PUBLIC_DATABASE_PASSWORD",
     ]);
   });
@@ -374,6 +373,42 @@ describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", (
   });
 });
 
+/**
+ * A v0.10.50 install (#613, before #635): the gateway on gateway_role's
+ * cms_admin pool next to public_role's.
+ */
+function v01050Install() {
+  const services = v01035Install();
+  upgrade(services);
+  const env = new Map(services.gateway.env);
+  env.set("GATEWAY_DATABASE_URL", {
+    kind: "value",
+    value: `postgresql://gateway_role@${HOST}:5432/cms_admin?sslmode=require`,
+  });
+  env.set("GATEWAY_DATABASE_PASSWORD", {
+    kind: "secret",
+    secret: "caelo-production-gateway-role-password",
+    version: "latest",
+  });
+  services.gateway = new FakeService(env, SERVICE_ACCOUNTS.gateway);
+  return services;
+}
+
+describe("upgrading a v0.10.50 install: the gateway leaves cms_admin entirely (#635)", () => {
+  it("removes the gateway_role login in one revision and keeps the public pool", () => {
+    const services = v01050Install();
+    const plan = upgrade(services);
+    expect(plan.ok && plan.services.gateway.changes.map((c) => c.name).sort()).toEqual([
+      "GATEWAY_DATABASE_PASSWORD",
+      "GATEWAY_DATABASE_URL",
+    ]);
+    expectGatewayOnItsOwnLogins(containerEnv(services.gateway.env));
+    for (const revision of services.gateway.revisions) {
+      expect(revision.has("PUBLIC_DATABASE_URL")).toBe(true);
+    }
+  });
+});
+
 describe("plain → Secret Manager migration of an existing var", () => {
   it("never leaves a revision without the var", () => {
     // An operator set CAELO_INTERNAL_SECRET by hand as a plain value.