@caelo-cms/provisioning 0.10.51 → 0.10.53

package/src/compose.ts

@@ -29,7 +29,13 @@
 
 import { CADDY_REDIRECTS_FILE } from "@caelo-cms/shared";
 import { caddyRedirectReloadCommand } from "./caddy-redirects.js";
-import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB, publicSiteUrl } from "./stack-contract.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  GATEWAY_TRUSTED_PROXY_HOPS,
+  memoryQuantityMiB,
+  publicSiteUrl,
+  TRUSTED_PROXY_HOPS_ENV,
+} from "./stack-contract.js";
 import { ghcrRepository, isImageDigest, type ReleaseService } from "./upgrade/release-images.js";
 
 /** The admin + gateway release images, each `ghcr.io/caelo-cms/<svc>@sha256:…`. */
@@ -160,13 +166,14 @@ export function ghcrImageDigest(service: ReleaseService, ref: string): string |
 
 /**
  * The application roles' passwords (bootstrap.sh creates the roles with
- * them). One per role, so the gateway — which gets only the public and
- * gateway logins — never holds admin_role's (#613, CLAUDE.md §2).
+ * them). One per role, so the gateway — which gets only the public login —
+ * never holds admin_role's (#613, #635, CLAUDE.md §2). An install's
+ * config.json from before #635 still carries a `gateway` entry; it is
+ * ignored.
  */
 export interface RolePasswords {
   readonly admin: string;
   readonly public: string;
-  readonly gateway: string;
 }
 
 export interface ComposeSpec {
@@ -254,7 +261,6 @@ services:
       POSTGRES_DB: caelo
       ADMIN_ROLE_PASSWORD: "${escapeYaml(spec.rolePasswords.admin)}"
       PUBLIC_ROLE_PASSWORD: "${escapeYaml(spec.rolePasswords.public)}"
-      GATEWAY_ROLE_PASSWORD: "${escapeYaml(spec.rolePasswords.gateway)}"
 ${postgresAgent(spec.agent)}    volumes:
       - caelo-pg:/var/lib/postgresql/data
       - ./bootstrap.sh:/docker-entrypoint-initdb.d/00_bootstrap.sh:ro
@@ -392,6 +398,8 @@ ${serviceRuntime(spec.images, "gateway", "bun run apps/api-gateway/src/server.ts
       # CLAUDE.md §2: the public side has no path to the authoring database).
       PUBLIC_DATABASE_URL: "${dbUrl("public_role", spec.rolePasswords.public, "cms_public")}"
       GATEWAY_PORT: "${COMPOSE_GATEWAY_PORT}"
+      # Caddy is the one proxy in front (client-ip.ts in the gateway).
+      ${TRUSTED_PROXY_HOPS_ENV}: "${GATEWAY_TRUSTED_PROXY_HOPS["self-hosted"]}"
       NODE_ENV: production`;
 }
 

package/src/error-pages-stacks.test.ts

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #802 — every provider answers an unknown URL with the site's own
+ * `/404.html` (written by the static generator from the designated 404
+ * page) and status 404. Firebase Hosting does this by convention for a
+ * root `/404.html`; the other stacks must wire it. Source-level checks:
+ * the Pulumi programs cannot run in a unit test.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const stack = (provider: string): string =>
+  readFileSync(resolve(import.meta.dir, "..", "stacks", provider, "index.ts"), "utf8");
+
+describe("#802 site 404 page wiring per provider", () => {
+  it("gcp: the static bucket's website serves 404.html for unknown objects", () => {
+    expect(stack("gcp")).toContain('notFoundPage: "404.html"');
+  });
+
+  it("aws: CloudFront maps both 404 and the OAI origin's 403 to /404.html with status 404", () => {
+    const src = stack("aws");
+    expect(src).toContain(
+      '{ errorCode: 404, responseCode: 404, responsePagePath: "/404.html", errorCachingMinTtl: 60 }',
+    );
+    // S3 behind an OAI without s3:ListBucket answers a missing key with
+    // 403 — without this entry visitors get S3's AccessDenied XML.
+    expect(src).toContain(
+      '{ errorCode: 403, responseCode: 404, responsePagePath: "/404.html", errorCachingMinTtl: 60 }',
+    );
+  });
+
+  it("azure: the static website's error document is 404.html", () => {
+    expect(stack("azure")).toContain('error404Document: "404.html"');
+  });
+});

package/src/gateway-credentials.test.ts

@@ -2,7 +2,6 @@
 
 import { describe, expect, it } from "bun:test";
 import {
-  ensureGatewayRolePassword,
   findSqlInstance,
   gatewayMovesPublicRole,
   planPublicRoleSwitch,
@@ -52,7 +51,6 @@ const target = { projectId: "acme", env: "production", sqlInstance: "caelo-produ
 const SECRETS = {
   "postgres-password": "admin-pw",
   "public-role-password": "public-pw",
-  "gateway-role-password": "gateway-pw",
 };
 const secretRef = (secret: string): LiveEnvValue => ({
   kind: "secret",
@@ -66,7 +64,6 @@ const BEFORE_613 = new Map<string, LiveEnvValue>([
 ]);
 const AFTER_613 = new Map<string, LiveEnvValue>([
   ["PUBLIC_DATABASE_PASSWORD", secretRef("public-role-password")],
-  ["GATEWAY_DATABASE_PASSWORD", secretRef("gateway-role-password")],
 ]);
 
 describe("gatewayMovesPublicRole", () => {
@@ -85,32 +82,6 @@ describe("gatewayMovesPublicRole", () => {
   });
 });
 
-describe("ensureGatewayRolePassword", () => {
-  it("sets gateway_role from its secret through the API, never on argv", async () => {
-    const { run, lines } = fakeGcloud(SECRETS);
-    const sql = fakeSqlApi();
-    const r = await ensureGatewayRolePassword(target, {
-      run,
-      http: sql.http,
-      sleep: async () => {},
-    });
-    expect(r.status).toBe("applied");
-    expect(sql.set).toEqual(["gateway_role gateway-pw"]);
-    expect(lines.some((l) => l.includes("gateway-pw"))).toBe(false);
-  });
-
-  it("fails, naming the secret, when the secret can't be read", async () => {
-    const { run } = fakeGcloud({});
-    const r = await ensureGatewayRolePassword(target, {
-      run,
-      http: fakeSqlApi().http,
-      sleep: async () => {},
-    });
-    expect(r.status).toBe("failed");
-    expect(r.error).toContain("caelo-production-gateway-role-password");
-  });
-});
-
 describe("planPublicRoleSwitch", () => {
   it("first upgrade: moves public_role onto its own password before the gateway rolls", async () => {
     const { run } = fakeGcloud(SECRETS);

package/src/gateway-credentials.ts

@@ -2,28 +2,22 @@
 
 /**
  * Moving an existing install's API gateway off admin_role (issue #613),
- * as `cms-provision upgrade` does it. The env side — the per-role password
- * secrets in, ADMIN_DATABASE_* out (and, since #635, GATEWAY_DATABASE_* out
- * too: the gateway has no cms_admin login at all) — rides the gateway's
- * roll (stack-contract.ts). gateway_role keeps getting its password until
- * the contract release drops the role, because the previous release's
- * gateway logs in with it until it is rolled. The database side is ordered around
- * that roll so /api/* keeps working:
+ * as `cms-provision upgrade` does it. The env side — public_role's own
+ * password secret in, every cms_admin credential out (#613, #635) — rides
+ * the gateway's roll (stack-contract.ts). The database side is ordered
+ * around that roll so /api/* keeps working:
  *
- *   1. after migrations (which create `gateway_role` without a password):
- *      `gateway_role` gets its password. Nothing uses the role yet, so this
- *      is safe at any point before the gateway rolls.
- *   2. right before the gateway rolls: `public_role` moves off admin_role's
+ *   1. right before the gateway rolls: `public_role` moves off admin_role's
  *      password onto its own. Only the gateway logs in as public_role, so
  *      the window in which the old revision cannot open NEW public
  *      connections is the roll itself (open connections stay up).
- *   3. if the gateway's roll fails and it is rolled back: `public_role`
+ *   2. if the gateway's roll fails and it is rolled back: `public_role`
  *      goes back to the password the prior revision reads, so the rollback
  *      leaves a working gateway, not a locked-out one.
  *
  * On every later upgrade the gateway already reads public_role's own
- * secret: step 2 then re-applies the same value (a no-op for clients) and
- * step 3 has nothing to undo.
+ * secret: step 1 then re-applies the same value (a no-op for clients) and
+ * step 2 has nothing to undo.
  */
 
 import { gcloud as defaultGcloud } from "./gcloud.js";
@@ -60,22 +54,14 @@ export interface GatewayCredentialDeps {
   readonly http?: HttpFetch;
 }
 
-/** Step 1: `gateway_role`'s password from its secret. */
-export function ensureGatewayRolePassword(
-  target: DatabaseRoleTarget,
-  deps: GatewayCredentialDeps = {},
-): Promise<EnsureOutcome> {
-  return ensureDatabaseRolePassword(target, "gateway_role", deps);
-}
-
-/** Steps 2 and 3 for one roll of the gateway. */
+/** Steps 1 and 2 for one roll of the gateway. */
 export interface PublicRoleSwitch {
   /** Whether this roll moves public_role off admin_role's password. */
   readonly moves: boolean;
-  /** Step 2 — run right before the gateway's `services update`. */
+  /** Step 1 — run right before the gateway's `services update`. */
   beforeGatewayRoll(): Promise<EnsureOutcome>;
   /**
-   * Step 3 — run when the gateway's roll failed and it goes back to its
+   * Step 2 — run when the gateway's roll failed and it goes back to its
    * prior revision. Returns what happened, for the operator.
    */
   afterGatewayRollFailed(): Promise<string>;

package/src/gateway-env-isolation.test.ts

@@ -126,7 +126,7 @@ describe("self-hosted: the generated compose gateway service (#635)", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "superpw",
-      rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+      rolePasswords: { admin: "adminpw", public: "publicpw" },
       caeloSecretKek: "0".repeat(64),
       diskSize: "20Gi",
       images: {
@@ -148,7 +148,12 @@ describe("self-hosted: the generated compose gateway service (#635)", () => {
     expect(gateway).not.toMatch(/^ {4}(secrets|env_file|volumes):/m);
     const env = gateway.slice(gateway.indexOf("    environment:"));
     const keys = [...env.matchAll(/^ {6}([A-Z_][A-Z0-9_]*):/gm)].map((m) => m[1]);
-    expect(keys.sort()).toEqual(["GATEWAY_PORT", "NODE_ENV", "PUBLIC_DATABASE_URL"]);
+    expect(keys.sort()).toEqual([
+      "CAELO_TRUSTED_PROXY_HOPS",
+      "GATEWAY_PORT",
+      "NODE_ENV",
+      "PUBLIC_DATABASE_URL",
+    ]);
     expect(out).not.toMatch(/^secrets:/m);
   });
 });

package/src/index.test.ts

@@ -115,7 +115,7 @@ describe("docker-compose generator", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "supersecret",
-      rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+      rolePasswords: { admin: "adminpw", public: "publicpw" },
       caeloSecretKek: "0".repeat(64),
       anthropicApiKey: "sk-ant-…",
       diskSize: "20Gi",
@@ -136,7 +136,7 @@ describe("docker-compose generator", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "supersecret",
-      rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+      rolePasswords: { admin: "adminpw", public: "publicpw" },
       caeloSecretKek: "0".repeat(64),
       diskSize: "20Gi",
       images: RELEASE_IMAGES,
@@ -150,16 +150,17 @@ describe("docker-compose generator", () => {
     expect(gateway).not.toMatch(
       /ADMIN_DATABASE|GATEWAY_DATABASE|cms_admin|admin_role|gateway_role|adminpw|gatewaypw|supersecret|CAELO_SECRET_KEK/,
     );
-    // bootstrap.sh still creates the three roles from these (gateway_role
-    // until the contract release drops it).
-    expect(out).toContain('GATEWAY_ROLE_PASSWORD: "gatewaypw"');
+    // bootstrap.sh creates the two application roles from these (#635: no
+    // gateway_role).
+    expect(out).toContain('PUBLIC_ROLE_PASSWORD: "publicpw"');
+    expect(out).not.toContain("GATEWAY_ROLE_PASSWORD");
   });
 
   it("escapes secrets containing quotes safely", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: 'pa"ss',
-      rolePasswords: { admin: "a", public: "b", gateway: "g" },
+      rolePasswords: { admin: "a", public: "b" },
       caeloSecretKek: "0".repeat(64),
       diskSize: "1Gi",
       images: RELEASE_IMAGES,

package/src/infra-contract.test.ts

@@ -20,11 +20,13 @@ describe("infrastructure contract steps", () => {
     );
   });
 
-  it("is at 5: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5)", () => {
-    expect(INFRA_CONTRACT_VERSION).toBe(5);
+  it("is at 7: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6), gateway proxy hops (7)", () => {
+    expect(INFRA_CONTRACT_VERSION).toBe(7);
     expect(INFRA_CONTRACT_STEPS[3]).toContain("#633");
     expect(INFRA_CONTRACT_STEPS[4]).toContain("#587");
     expect(INFRA_CONTRACT_STEPS[5]).toContain("#635");
+    expect(INFRA_CONTRACT_STEPS[6]).toContain("#799");
+    expect(INFRA_CONTRACT_STEPS[7]).toContain("#845");
   });
 
   it("lists the pending steps oldest first", () => {
@@ -35,6 +37,6 @@ describe("infrastructure contract steps", () => {
   });
 
   it("names a version a newer release added by number", () => {
-    expect(infraStepsText(5, 6)).toBe("infrastructure step 6 (see that release's notes)");
+    expect(infraStepsText(7, 8)).toBe("infrastructure step 8 (see that release's notes)");
   });
 });

package/src/infra-contract.ts

@@ -22,7 +22,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 5;
+export const INFRA_CONTRACT_VERSION = 7;
 
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
@@ -40,6 +40,17 @@ export const INFRA_CONTRACT_VERSION = 5;
 //       GATEWAY_DATABASE_PASSWORD go, and its SA loses access to the
 //       gateway-role-password secret (a retired IAM binding, removed after
 //       the roll — the in-cloud upgrader cannot change IAM).
+//   6 — #799: the upgrader's custom role `caeloUpgraderOpsList`
+//       (`storage.objects.list` on the ops bucket). Every `gcloud storage cp`
+//       into the bucket lists it first; without the binding the in-cloud
+//       upgrader fails at its state lock, so it must not run before the
+//       converge grants it.
+//   7 — #845: the gateway refuses to boot without CAELO_TRUSTED_PROXY_HOPS
+//       (which X-Forwarded-For entry is the visitor). A plain env var, but
+//       the in-cloud upgrader rolls with the env contract of the release it
+//       runs from (the installed one), which does not set it — so the new
+//       gateway would not start. The operator-identity upgrade runs the new
+//       release's contract and sets it.
 
 /**
  * What each contract version adds, in operator terms — the upgrader's
@@ -52,6 +63,8 @@ export const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>> = {
   3: "public_role out of the Cloud SQL superuser group (#633)",
   4: "the admin's permission to serve redirects from the load balancer (#587)",
   5: "the gateway's cms_admin login removed from its env and IAM (#635)",
+  6: "the upgrader's permission to list its ops bucket (#799)",
+  7: "the gateway's trusted proxy hop count, CAELO_TRUSTED_PROXY_HOPS (#845)",
 };
 
 /**

package/src/ops-backend.ts

@@ -20,7 +20,7 @@
  *     anything. The bucket's convenience bindings for project viewers and
  *     editors are removed; public principals are refused outright. Project
  *     Owners keep access through their project role (that cannot be taken
- *     away at the bucket); docs-site/pages/install-gcp.md says so.
+ *     away at the bucket); the GCP install docs say so.
  *
  * Every step reads before it writes, so a re-run is a no-op and an operator
  * without IAM-write permission can still run against an ops backend someone

package/src/release-contract.ts

@@ -46,6 +46,9 @@ export const INFRA_CONTRACT_PATHS: readonly string[] = [
   // #587 — the admin's URL-map redirects role and the URL map's shape.
   "packages/provisioning/src/url-map-redirects-access.ts",
   "packages/provisioning/src/gcp-url-map.ts",
+  // The in-cloud upgrader job's service account, custom roles and bucket
+  // grants (#799 added one without the checks noticing).
+  "packages/provisioning/src/upgrader-setup.ts",
 ];
 
 /**

package/src/release-manifest.test.ts

@@ -296,6 +296,7 @@ describe("release-contract", () => {
     expect(isInfraContractPath("packages/provisioning/stacks/gcp/index.ts")).toBe(true);
     expect(isInfraContractPath("packages/provisioning/src/stack-converge.ts")).toBe(true);
     expect(isInfraContractPath("packages/provisioning/src/upgrade/converge.ts")).toBe(true);
+    expect(isInfraContractPath("packages/provisioning/src/upgrader-setup.ts")).toBe(true);
     expect(isInfraContractPath("packages/provisioning/src/stack-converge.test.ts")).toBe(false);
     expect(isInfraContractPath("packages/provisioning/stacks/gcp/README.md")).toBe(false);
     expect(isInfraContractPath("packages/provisioning/src/cli.ts")).toBe(false);

package/src/runtime-secrets.test.ts

@@ -115,13 +115,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "present",
-      "present",
-      "present",
-      "present",
-      "present",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["present", "present", "present", "present"]);
     expect(lines().some((l) => l.includes(" create ") || l.includes(" add "))).toBe(false);
   });
 
@@ -132,13 +126,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run, generate: () => `generated-value-${++n}` },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "applied", "applied", "applied"]);
     const creates = calls.filter((c) => c.line.startsWith("secrets create"));
     expect(creates).toEqual([
       {
@@ -149,19 +137,15 @@ describe("ensureGeneratedSecrets", () => {
         line: "secrets create caelo-production-tool-approval-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
         stdin: "generated-value-2",
       },
-      // #613 — the gateway's role passwords: fresh values, never admin_role's.
+      // #613 — the gateway's role password: a fresh value, never admin_role's.
       {
         line: "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
         stdin: "generated-value-3",
       },
-      {
-        line: "secrets create caelo-production-gateway-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-        stdin: "generated-value-4",
-      },
       // #650 — the staging access gate's key.
       {
         line: "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-        stdin: "generated-value-5",
+        stdin: "generated-value-4",
       },
     ]);
     for (const c of calls) expect(c.line).not.toContain("generated-value");
@@ -186,7 +170,6 @@ describe("ensureGeneratedSecrets", () => {
       "generated",
       "generated",
       "generated",
-      "generated",
     ]);
     for (const c of calls) expect(c.line).not.toContain("operator-set");
   });
@@ -197,20 +180,13 @@ describe("ensureGeneratedSecrets", () => {
       "secrets versions list caelo-production-internal-secret": [ok("")],
       "secrets versions list caelo-production-tool-approval-secret": [ok("v/1")],
       "secrets versions list caelo-production-public-role-password": [ok("v/1")],
-      "secrets versions list caelo-production-gateway-role-password": [ok("v/1")],
       "secrets versions list caelo-production-staging-gate-secret": [ok("v/1")],
     });
     const outcomes = await ensureGeneratedSecrets(
       { ...secretsInstall, replication: { kind: "automatic" } },
       { run, generate: () => "v" },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "applied",
-      "present",
-      "present",
-      "present",
-      "present",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "present", "present", "present"]);
     expect(calls.filter((c) => c.line.startsWith("secrets versions add"))).toEqual([
       {
         line: "secrets versions add caelo-production-internal-secret --project=acme --data-file=-",
@@ -244,13 +220,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: { kind: "automatic" } },
       { run, generate: () => "v" },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "applied", "applied", "applied"]);
     expect(outcomes.every((o) => o.detail?.includes("gcp.resourceLocations"))).toBe(true);
     const creates = lines().filter((l) => l.startsWith("secrets create"));
     // One refused automatic attempt; then every secret — the refused one
@@ -260,7 +230,6 @@ describe("ensureGeneratedSecrets", () => {
       "secrets create caelo-production-internal-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-tool-approval-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-      "secrets create caelo-production-gateway-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       // #652 — the staging gate's key follows the same path.
       "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
     ]);
@@ -290,7 +259,7 @@ describe("ensureGeneratedSecrets", () => {
       { run, generate: () => "v" },
     );
     expect(outcomes.every((o) => o.status === "failed")).toBe(true);
-    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(5);
+    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(4);
   });
 });
 
@@ -299,7 +268,6 @@ describe("rotationRefusal", () => {
     for (const s of [
       "postgres-password",
       "public-role-password",
-      "gateway-role-password",
       "internal-secret",
       "tool-approval-secret",
       "staging-gate-secret",
@@ -311,6 +279,8 @@ describe("rotationRefusal", () => {
   it("refuses the KEK (re-encryption needed) and secrets nothing reads", () => {
     expect(rotationRefusal("secret-kek")).toContain("re-encryption");
     expect(rotationRefusal("csrf-secret")).toContain("Rotatable");
+    // #635 — the former gateway_role is gone; there is nothing to rotate.
+    expect(rotationRefusal("gateway-role-password")).toContain("Rotatable");
   });
 });
 
@@ -411,28 +381,6 @@ describe("rotateRuntimeSecret", () => {
     ).toBe(true);
   });
 
-  it("gateway-role-password: changes gateway_role only and rolls no service (#613, #635)", async () => {
-    const { run, lines } = fakeGcloud({
-      ...converged(),
-      "secrets versions access": [ok("old-pw")],
-    });
-    const sql = fakeSqlApi();
-    const report = await rotateRuntimeSecret(target, "gateway-role-password", {
-      run,
-      http: sql.http,
-      sleep: async () => {},
-      generate: () => "new-pw",
-    });
-    expect(report.ok).toBe(true);
-    expect(sql.passwords()).toEqual(["gateway_role new-pw"]);
-    // No service logs in as gateway_role any more: the gateway reads
-    // cms_public only (#635).
-    expect(lines().filter((l) => l.startsWith("run services update "))).toEqual([]);
-    expect(lines()).toContain(
-      "secrets versions access latest --secret=caelo-production-gateway-role-password --project=acme",
-    );
-  });
-
   it("public-role-password: stores nothing and rolls nothing when public_role can't be changed", async () => {
     const { run, lines } = fakeGcloud({
       ...converged(),
@@ -474,26 +422,6 @@ describe("rotateRuntimeSecret", () => {
     expect(lines().every((l) => l.startsWith("run services describe"))).toBe(true);
   });
 
-  it("refuses gateway-role-password while the gateway still logs in with it (before #635)", async () => {
-    const answers = converged();
-    answers["run services describe gw-svc"] = [
-      service([
-        ref("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
-        ref("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
-      ]),
-    ];
-    const { run } = fakeGcloud(answers);
-    const sql = fakeSqlApi();
-    const report = await rotateRuntimeSecret(target, "gateway-role-password", {
-      run,
-      http: sql.http,
-      generate: () => "new-pw",
-    });
-    expect(report.ok).toBe(false);
-    expect(report.error).toContain("GATEWAY_DATABASE_PASSWORD");
-    expect(sql.requests).toHaveLength(0);
-  });
-
   it("refuses before changing anything on an install upgrade hasn't moved over", async () => {
     const { run, lines } = fakeGcloud({
       "run services describe adm-svc": [

package/src/runtime-secrets.ts

@@ -13,9 +13,8 @@
  *     Secret Manager on stdin — never on argv, never to disk.
  *   - {@link ensureDatabaseRolePassword}: a database role's password set
  *     from its secret (`DATABASE_ROLE_SECRET`), through the Cloud SQL Admin
- *     API — how `gateway_role` (created by migration 0248, without a
- *     password) and `public_role` (moved off admin_role's password, #613)
- *     get theirs.
+ *     API — how `public_role` (moved off admin_role's password, #613) gets
+ *     its own.
  *   - {@link rotateRuntimeSecret}: `cms-provision rotate-secret`.
  *
  * Every function reports instead of throwing on a gcloud failure.
@@ -368,7 +367,6 @@ async function addVersion(
 export const ROTATABLE_SECRETS = [
   "postgres-password",
   "public-role-password",
-  "gateway-role-password",
   "internal-secret",
   "tool-approval-secret",
   // #650 — rotating it signs every staging session out and replaces the
@@ -726,8 +724,6 @@ export async function readSecretValue(
  * the role already has is a no-op for every client, so upgrade runs this on
  * every roll and an install converges whatever state it was left in.
  *
- * The role must exist: `gateway_role` is created by migration 0248, so this
- * runs after migrations.
  */
 export async function ensureDatabaseRolePassword(
   target: DatabaseRoleTarget,

package/src/self-hosted-compose.test.ts

@@ -19,7 +19,7 @@ const GATEWAY = `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`;
 const base: Omit<ComposeSpec, "images"> = {
   domain: "example.com",
   postgresPassword: "pgpw",
-  rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+  rolePasswords: { admin: "adminpw", public: "publicpw" },
   caeloSecretKek: "0".repeat(64),
   anthropicApiKey: "sk-ant-x",
   diskSize: "20Gi",