@caelo-cms/provisioning 0.10.51 → 0.10.53

package/src/upgrader-job.test.ts

@@ -14,6 +14,7 @@ import type { GcloudResult } from "./gcloud.js";
 import type { GcloudRunner } from "./gcloud-retry.js";
 import type { InstallMetadata } from "./install-state.js";
 import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
+import { StateLockHeldError } from "./state-store.js";
 import type { HealthOutcome, HealthProbe } from "./upgrade/health.js";
 import {
   type ClaimedUpdate,
@@ -162,6 +163,7 @@ function setup(
     deep?: HealthOutcome;
     migrate?: { ok: boolean; error?: string };
     locked?: boolean;
+    lockDenied?: boolean;
   } = {},
 ) {
   const order: string[] = [];
@@ -188,7 +190,8 @@ function setup(
     },
     lockState: () => {
       order.push("lock");
-      if (opts.locked) throw new Error("held by caelo installer");
+      if (opts.locked) throw new StateLockHeldError("held by caelo installer");
+      if (opts.lockDenied) throw new Error("storage.objects.list denied");
       return () => order.push("unlock");
     },
     readInstall: () => (opts.meta === undefined ? META : opts.meta),
@@ -286,6 +289,19 @@ describe("runUpgraderJob", () => {
     expect(busy.order.some((l) => l.startsWith("manifest") || l.startsWith("gcloud"))).toBe(false);
   });
 
+  it("does not call a lock it cannot take 'busy': an access failure asks for Cloud Shell", async () => {
+    const denied = setup({ lockDenied: true });
+    const r = await runUpgraderJob(denied.deps);
+    expect(r.status).toBe("needs_cloud_shell");
+    const end = denied.q.end();
+    expect(end?.codes).toEqual(["state-access"]);
+    expect(end?.reason).not.toContain("another install operation");
+    expect(end?.reason).toContain("storage.objects.list denied");
+    expect(denied.order.some((l) => l.startsWith("manifest") || l.startsWith("gcloud"))).toBe(
+      false,
+    );
+  });
+
   it("retries recording the end, and fails the run when it cannot", async () => {
     const { deps, q } = setup();
     let calls = 0;

package/src/upgrader-job.ts

@@ -43,6 +43,7 @@ import type { GcloudRunner, Sleep } from "./gcloud-retry.js";
 import { gcpNamePrefix, upgraderJobName } from "./gcp-names.js";
 import type { InstallMetadata } from "./install-state.js";
 import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
+import { StateLockHeldError } from "./state-store.js";
 import {
   type AppRollPlan,
   executeAppRoll,
@@ -224,10 +225,19 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
     try {
       releaseLock = deps.lockState();
     } catch (e) {
+      if (e instanceof StateLockHeldError) {
+        return stopWith(
+          "failed",
+          ["state-locked"],
+          `Nothing was changed: another install operation is running on this site (${errorText(e)}). Try again when it has finished.`,
+        );
+      }
+      // Not contention: the job cannot reach its own ops bucket. Retrying
+      // will not help; a Cloud Shell upgrade re-converges the job's grants.
       return stopWith(
-        "failed",
-        ["state-locked"],
-        `Nothing was changed: another install operation is running on this site (${errorText(e)}). Try again when it has finished.`,
+        "needs_cloud_shell",
+        ["state-access"],
+        `Nothing was changed: the upgrader could not take the install's state lock (${errorText(e)}). Run the upgrade once with Cloud Shell; it repairs the upgrader's access.`,
       );
     }
 

package/src/upgrader-setup.test.ts

@@ -13,6 +13,7 @@ import type { GcloudResult } from "./gcloud.js";
 import {
   ensureUpgraderJob,
   UPGRADER_FORBIDDEN_ROLES,
+  UPGRADER_OPS_LIST_ROLE,
   UPGRADER_SQL_BACKUP_ROLE,
   type UpgraderSetupTarget,
 } from "./upgrader-setup.js";
@@ -83,6 +84,7 @@ describe("ensureUpgraderJob", () => {
         "iam service-accounts add-iam-policy-binding caelo-production-upgrader@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-mcp@acme.iam.gserviceaccount.com → roles/iam.serviceAccountTokenCreator",
         "storage buckets add-iam-policy-binding gs://acme-caelo-ops → roles/storage.objectUser",
+        "storage buckets add-iam-policy-binding gs://acme-caelo-ops → projects/acme/roles/caeloUpgraderOpsList",
       ].sort(),
     );
     // The bucket grant only reaches install.json, not the Pulumi state.
@@ -90,6 +92,12 @@ describe("ensureUpgraderJob", () => {
     expect(bucket?.condition).toContain(
       'resource.name.startsWith("projects/_/buckets/acme-caelo-ops/objects/install/")',
     );
+    // gcloud storage cp lists the bucket before every upload; GCS checks the
+    // list against the bucket itself, so this grant cannot carry the
+    // install/ condition — and so it carries nothing but the list.
+    const list = mine.find((g) => g.role.endsWith("/caeloUpgraderOpsList"));
+    expect(list?.condition).toBe("None");
+    expect(UPGRADER_OPS_LIST_ROLE.permissions).toEqual(["storage.objects.list"]);
   });
 
   it("never grants a forbidden role, a setIamPolicy permission, or a project-wide iam role", async () => {
@@ -101,7 +109,10 @@ describe("ensureUpgraderJob", () => {
       }
       if (g.role.startsWith("roles/iam.")) expect(g.where).toStartWith("iam service-accounts");
     }
-    const role = calls.find((c) => c.slice(0, 3).join(" ") === "iam roles create");
+    const role = calls.find(
+      (c) =>
+        c.slice(0, 3).join(" ") === "iam roles create" && c[3] === UPGRADER_SQL_BACKUP_ROLE.roleId,
+    );
     const perms = (flag(role ?? [], "permissions") ?? "").split(",");
     expect(perms.sort()).toEqual([...UPGRADER_SQL_BACKUP_ROLE.permissions].sort());
     // Nothing but the one write it needs: create a backup.

package/src/upgrader-setup.ts

@@ -31,7 +31,13 @@
  *     health check signs its IAP credential as that account
  *     (upgrade/health.ts). The operator-access sync job keeps it there.
  *   - `roles/storage.objectUser` on the ops bucket, conditioned to the
- *     `install/` prefix (install.json) — not the Pulumi state.
+ *     `install/` prefix (install.json, the state lock) — not the Pulumi state.
+ *   - the custom role `caeloUpgraderOpsList` (`storage.objects.list` only)
+ *     on the ops bucket, unconditioned: `gcloud storage cp` lists the
+ *     destination prefix and reads the bucket's storage layout before every
+ *     upload, and GCS checks both against the bucket, never an object path,
+ *     so no `install/` condition can admit them. It reveals object names,
+ *     not contents.
  *   - `roles/logging.logWriter`.
  *
  * It gets no `*.setIamPolicy`, no service-account admin, no secret
@@ -71,6 +77,18 @@ export const UPGRADER_SQL_BACKUP_ROLE: CustomRoleSpec = {
   ],
 };
 
+/**
+ * Listing the ops bucket, which every `gcloud storage cp` into it needs (see
+ * the file header). Names only — reads and writes stay on `install/`.
+ */
+export const UPGRADER_OPS_LIST_ROLE: CustomRoleSpec = {
+  roleId: "caeloUpgraderOpsList",
+  title: "Caelo upgrader: list the ops bucket",
+  description:
+    "Lets the Caelo upgrader job list object names in the install's ops bucket (gcloud storage cp needs it). Names only; object reads/writes stay limited to install/.",
+  permissions: ["storage.objects.list"],
+};
+
 /** Project-level roles of the upgrader's service account. */
 export const UPGRADER_PROJECT_ROLES = [
   "roles/run.developer",
@@ -176,10 +194,12 @@ export async function ensureUpgraderJob(
     };
   }
 
-  // 1. The backup role.
-  const roleError = await ensureCustomRole(run, projectId, UPGRADER_SQL_BACKUP_ROLE);
-  if (roleError) return { ok: false, done, error: roleError };
-  done.push(`custom role ${UPGRADER_SQL_BACKUP_ROLE.roleId}`);
+  // 1. The backup and ops-bucket-list roles.
+  for (const role of [UPGRADER_SQL_BACKUP_ROLE, UPGRADER_OPS_LIST_ROLE]) {
+    const roleError = await ensureCustomRole(run, projectId, role);
+    if (roleError) return { ok: false, done, error: roleError };
+    done.push(`custom role ${role.roleId}`);
+  }
 
   // 2. The job's own service account.
   const describe = await run([
@@ -276,6 +296,22 @@ export async function ensureUpgraderJob(
     return fail(`grant the upgrader install.json in gs://${bucket}`, bucketGrant);
   done.push(`upgrader: roles/storage.objectUser on gs://${bucket}/${OPS_INSTALL_PREFIX}/`);
 
+  const listRole = customRoleName(projectId, UPGRADER_OPS_LIST_ROLE.roleId);
+  const listGrant = await retry([
+    "storage",
+    "buckets",
+    "add-iam-policy-binding",
+    `gs://${bucket}`,
+    `--member=${member}`,
+    `--role=${listRole}`,
+    "--condition=None",
+    project,
+    "--quiet",
+    "--format=none",
+  ]);
+  if (!listGrant.ok) return fail(`grant the upgrader object listing on gs://${bucket}`, listGrant);
+  done.push(`upgrader: ${listRole} on gs://${bucket}`);
+
   // 6. Its database login (migration 0267's platform_updater role).
   const sqlUser = await ensureCloudSqlIamUser(run, {
     projectId,

package/src/welcome-page.test.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #781 — contracts of `static/welcome.html`, the placeholder the GCP
+ * wizard uploads to a fresh static bucket. It must stay fully
+ * self-contained (the bucket holds nothing else, and a first impression
+ * that fetches from third parties leaks the visitor), keep the
+ * `{{ADMIN_URL}}` placeholder the wizard substitutes, and carry the
+ * Caelatum sky instead of the old animated mesh.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+
+const html = readFileSync(new URL("../static/welcome.html", import.meta.url), "utf8");
+
+describe("welcome.html", () => {
+  it("makes no external requests", () => {
+    // Any absolute or protocol-relative URL, stylesheet/script/image
+    // reference or CSS import/url() would be a network fetch.
+    expect(html).not.toMatch(/https?:\/\//i);
+    expect(html).not.toMatch(/["'(]\s*\/\//);
+    expect(html).not.toMatch(/<link\b/i);
+    expect(html).not.toMatch(/<script\b/i);
+    expect(html).not.toMatch(/<img\b/i);
+    expect(html).not.toMatch(/@import|url\(|@font-face/i);
+    expect(html).not.toMatch(/\b(src|href)\s*=/i);
+  });
+
+  it("keeps the admin URL placeholder the wizard substitutes", () => {
+    expect(html).toContain("{{ADMIN_URL}}");
+  });
+
+  it("uses the sky + relief plate with the inline mark, not the mesh", () => {
+    expect(html).toContain("#c3dbf2 0%, #dce9f6 40%, #efe7ef 72%, #f8e6d8 100%");
+    expect(html).toContain("0 0 0 5px var(--plate-ring)");
+    expect(html).toMatch(/<svg viewBox="0 0 32 32" aria-hidden="true"/);
+    expect(html).not.toMatch(/class="blob|@keyframes (drift|pulse)/);
+  });
+});

package/src/wizards/gcp.ts

@@ -45,7 +45,6 @@ import {
 import { formatDnsRecordGroups, groupDnsRecords, type InstallDnsRecord } from "../dns/groups.js";
 import { pickDnsAdapter } from "../dns/index.js";
 import type { DnsRecord } from "../dns/types.js";
-import { ensureGatewayRolePassword, findSqlInstance } from "../gateway-credentials.js";
 import {
   activeAccount,
   type BillingAccount,
@@ -453,13 +452,7 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     }
   }
 
-  // === 11.2. The gateway's database login (#613) ===
-  // Migration 0248 created gateway_role without a password; it gets the
-  // gateway-role-password secret's value here. The gateway (deployed by
-  // Pulumi before migrations) retries its database on every request, so it
-  // starts serving /api/* as soon as this lands — no restart.
-  phase("Finishing: database logins, operator access, welcome page");
-  await stepGatewayRolePassword(projectId);
+  phase("Finishing: operator access, welcome page");
 
   // === 11.4. The upgrader job: Settings → Updates → Install update (#696) ===
   // Before operator access, which keeps the upgrader's caelo-mcp grant.
@@ -934,29 +927,6 @@ async function stepUrlMapRedirectsAccess(projectId: string): Promise<void> {
   s.stop(green(`Redirects role ready (${r.role})`));
 }
 
-/**
- * Give `gateway_role` (created by migration 0248) its password from the
- * `gateway-role-password` secret (#613). public_role already has its own:
- * the stack set it from `public-role-password`. Idempotent, so it runs on
- * every wizard pass.
- */
-async function stepGatewayRolePassword(projectId: string): Promise<void> {
-  const s = spinner();
-  s.start("Setting the gateway's database login (gateway_role)...");
-  const install = { projectId, env: GCP_STACK_ENV };
-  const sqlInstance = await findSqlInstance(install);
-  const r = sqlInstance
-    ? await ensureGatewayRolePassword({ ...install, sqlInstance })
-    : { status: "failed" as const, error: "the Cloud SQL instance was not found" };
-  if (r.status === "failed") {
-    s.stop(red(`Failed: ${r.error ?? ""}`));
-    log.error("Re-run the wizard once the cause is fixed (this step is idempotent).");
-    cancel("Aborted.");
-    process.exit(1);
-  }
-  s.stop(green("gateway_role ready"));
-}
-
 /**
  * Set up the upgrader job (upgrader-setup.ts, #696): what the admin's
  * "Install update" starts. After migrations, because the job's database
@@ -1965,7 +1935,7 @@ async function stepFinalize(installId: string, setupLink: "print" | "secret"): P
       `     click ${bold("New token")} (scope ${bold("chat")}: Caelo's AI does the work; ${bold("admin")}: your agent drives Caelo's tools),`,
       "     copy the bearer (shown once) and run the `claude mcp add` command the page shows.",
       "     The admin is behind Google IAP, so run `gcloud auth application-default login` once on that machine.",
-      `     Details: ${cyan("https://caelo-cms.com/mcp")}`,
+      `     Details: ${cyan("https://caelo-cms.com/docs/mcp/")}`,
       ...adminNote,
       "",
       bold("Lifecycle commands:"),

package/stacks/aws/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on AWS managed services. Implements the shared `
 | Blob storage | Two S3 buckets (`caelo-<env>-media` + `caelo-<env>-static`) |
 | CDN | CloudFront distribution with two origins (S3 static + S3 media); static files are served as files, no edge compute on the request path |
 | Container runtime | ECS Fargate cluster + four services (admin / gateway / orchestrator / runner) |
-| Secret store | AWS Secrets Manager (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `publicDatabaseUrlOut` only, never a cms_admin URL of any role (#613, #635). |
+| Secret store | AWS Secrets Manager (postgres-password, public-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `publicDatabaseUrlOut` only, never a cms_admin URL of any role (#613, #635). |
 | DNS + cert | ACM cert (us-east-1, DNS-validated, supports `*.<domain>`) |
 | Edge-log sink | CloudFront access logs delivered to the CloudWatch log group `/caelo/<env>/cloudfront` in us-east-1 (queryable by P12A analytics plugin) |
 
@@ -18,6 +18,8 @@ The Caelo runtime never knows it's on AWS — it just consumes `DATABASE_URL` /
 
 ## First-time install
 
+Run this stack from a checkout of the Caelo repository after `bun install` at its root. `@pulumi/aws` + `@pulumi/awsx` are devDependencies of `@caelo-cms/provisioning`: the CLI wizard does not provision AWS yet, so the published package does not make every GCP and self-hosted install download them (the one-click install from Cloud Shell runs in a 5 GB home directory). They move back to `dependencies` when the AWS wizard ships.
+
 ```bash
 cd packages/provisioning/stacks/aws
 pulumi stack init prod

package/stacks/aws/index.ts

@@ -97,11 +97,8 @@ function randomHex(bytes: number): string {
 const postgresPassword = pulumi.secret(randomHex(32));
 // #613 — one password per database role, so the gateway (public_role only,
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
-// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
-// any service's login; its password stays until the contract release that
-// drops the role (#635).
+// (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
-const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -122,7 +119,6 @@ function secret(name: string, value: pulumi.Output<string>): aws.secretsmanager.
 
 const pgSecret = secret("postgres-password", postgresPassword);
 const publicRoleSecret = secret("public-role-password", publicRolePassword);
-const gatewayRoleSecret = secret("gateway-role-password", gatewayRolePassword);
 const csrfSecretRes = secret("csrf-secret", csrfSecret);
 const cookieSecretRes = secret("cookie-secret", cookieSecret);
 const anthropicSecretRes = secret("anthropic-api-key", anthropicApiKey);
@@ -297,7 +293,14 @@ const distribution = new aws.cloudfront.Distribution(`${namePrefix}-cdn`, {
     minimumProtocolVersion: "TLSv1.2_2021",
   },
   restrictions: { geoRestriction: { restrictionType: "none" } },
+  // #802 — unknown URLs get the site's own 404 page (the generator writes
+  // `/404.html` from the designated page) with status 404. The S3 origins
+  // are OAI-only with `s3:GetObject` and no `s3:ListBucket`, so S3 answers
+  // a missing key with 403, not 404; without the 403 entry visitors saw
+  // S3's AccessDenied XML. Both origins on this distribution are private
+  // buckets, so a 403 here always means "no such object".
   customErrorResponses: [
+    { errorCode: 403, responseCode: 404, responsePagePath: "/404.html", errorCachingMinTtl: 60 },
     { errorCode: 404, responseCode: 404, responsePagePath: "/404.html", errorCachingMinTtl: 60 },
   ],
 });
@@ -358,7 +361,6 @@ const cluster = new aws.ecs.Cluster(`${namePrefix}-ecs`, {
 const secretArns: Record<AwsSecret, pulumi.Output<string>> = {
   "postgres-password": pgSecret.arn,
   "public-role-password": publicRoleSecret.arn,
-  "gateway-role-password": gatewayRoleSecret.arn,
   "csrf-secret": csrfSecretRes.arn,
   "cookie-secret": cookieSecretRes.arn,
   "anthropic-api-key": anthropicSecretRes.arn,

package/stacks/azure/README.md

@@ -10,13 +10,15 @@ Pulumi stack provisioning Caelo on Azure managed services. Implements the shared
 | Blob storage | Storage Account with a private `media` container and static-website hosting (`$web`) |
 | CDN / Edge | Azure Front Door Standard: the primary domain serves the static website as files, with a Front Door managed certificate; no edge compute on the request path |
 | Container runtime | Four Container Apps (admin / gateway / orchestrator / runner) in one managed environment |
-| Secret store | Key Vault (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `PUBLIC_DATABASE_URL` only, never a cms_admin credential of any role (#613, #635). |
+| Secret store | Key Vault (postgres-password, public-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `PUBLIC_DATABASE_URL` only, never a cms_admin credential of any role (#613, #635). |
 | Edge-log sink | Log Analytics workspace receives Container Apps logs (queryable by P12A analytics plugin via Azure Monitor) |
 
 The Caelo runtime never knows it's on Azure — every Container App consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.
 
 ## First-time install
 
+Run this stack from a checkout of the Caelo repository after `bun install` at its root. `@pulumi/azure-native` is a devDependency of `@caelo-cms/provisioning`: the CLI wizard does not provision Azure yet, so the published package does not make every GCP and self-hosted install download it (the one-click install from Cloud Shell runs in a 5 GB home directory). It moves back to `dependencies` when the Azure wizard ships.
+
 ```bash
 cd packages/provisioning/stacks/azure
 pulumi stack init prod

package/stacks/azure/index.ts

@@ -39,7 +39,12 @@ import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { azureFrontDoorDnsRecords } from "../../dist/azure-front-door.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
-import { ADMIN_MEMORY_DEFAULT, azureContainerAppResources } from "../../dist/stack-contract.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  azureContainerAppResources,
+  GATEWAY_TRUSTED_PROXY_HOPS,
+  TRUSTED_PROXY_HOPS_ENV,
+} from "../../dist/stack-contract.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
@@ -83,11 +88,8 @@ function randomHex(bytes: number): string {
 const postgresPassword = pulumi.secret(randomHex(32));
 // #613 — one password per database role, so the gateway (public_role only,
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
-// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
-// any service's login; its password stays until the contract release that
-// drops the role (#635).
+// (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
-const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -117,7 +119,6 @@ function keyVaultSecret(shortName: string, value: pulumi.Output<string>): azure.
 
 const _pgSecret = keyVaultSecret("pg-password", postgresPassword);
 keyVaultSecret("public-role-password", publicRolePassword);
-keyVaultSecret("gateway-role-password", gatewayRolePassword);
 keyVaultSecret("csrf-secret", csrfSecret);
 keyVaultSecret("cookie-secret", cookieSecret);
 keyVaultSecret("anthropic-api-key", anthropicApiKey);
@@ -419,6 +420,8 @@ const adminApp = containerApp({
 const _gatewayApp = containerApp({
   serviceName: "gateway",
   databaseEnv: [{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }],
+  // Which X-Forwarded-For entry is the visitor (api-gateway client-ip.ts).
+  extraEnv: [{ name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS.azure) }],
 });
 const _orchestratorApp = containerApp({
   serviceName: "orchestrator",

package/stacks/gcp/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | Blob storage | Two GCS buckets (`<project>-caelo-<env>-media`, `<project>-caelo-<env>-static`) with uniform bucket-level access |
 | CDN | Global HTTPS load balancer + Cloud CDN backend bucket: `<domain>` serves the static bucket as files, `/api/*` goes to the gateway, `admin.<domain>` to the IAP-gated admin |
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
-| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login); `gateway_role`, created by migration 0248, is no service's login any more. |
+| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret and public-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login). |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.

package/stacks/gcp/index.ts

@@ -251,14 +251,11 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
-  "gateway-role-password": gcpSecretId(env, "gateway-role-password"),
 };
 
 // #613 — public_role's own password (CLI-generated, stack-contract.ts
 // DATABASE_ROLE_SECRET), so the gateway, which reads it, never holds
-// admin_role's. gateway_role is not declared here: migration 0248 creates
-// it in SQL (an API-created user would join cloudsqlsuperuser) and the CLI
-// sets its password after migrations.
+// admin_role's. The gateway has no other database login (#635).
 const publicRolePassword = pulumi.secret(
   gcp.secretmanager.getSecretVersionOutput(
     { project, secret: gcpSecretId(env, "public-role-password") },

package/stacks/gcp-firebase/index.ts

@@ -224,14 +224,11 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
-  "gateway-role-password": gcpSecretId(env, "gateway-role-password"),
 };
 
 // #613 — public_role's own password (CLI-generated, stack-contract.ts
 // DATABASE_ROLE_SECRET), so the gateway, which reads it, never holds
-// admin_role's. gateway_role is not declared here: migration 0248 creates
-// it in SQL (an API-created user would join cloudsqlsuperuser) and the CLI
-// sets its password after migrations.
+// admin_role's. The gateway has no other database login (#635).
 const publicRolePassword = pulumi.secret(
   gcp.secretmanager.getSecretVersionOutput(
     { project, secret: gcpSecretId(env, "public-role-password") },

package/stacks/self-hosted/index.ts

@@ -62,26 +62,19 @@ const tokenPath = resolve(caeloDir, "bootstrap", "pending-token.json");
 // is the operator's recovery path.
 const postgresPassword = pulumi.secret(randomHex(32));
 // #613 — one password per application role; the gateway gets only the
-// public_role and gateway_role ones.
+// public_role one (#635: no cms_admin login).
 const adminRolePassword = pulumi.secret(randomHex(32));
 const publicRolePassword = pulumi.secret(randomHex(32));
-const gatewayRolePassword = pulumi.secret(randomHex(32));
 // P18 — the KEK that encrypts stored provider keys.
 const caeloSecretKek = pulumi.secret(randomHex(32));
 
 const composeYaml = pulumi
-  .all([
-    postgresPassword,
-    adminRolePassword,
-    publicRolePassword,
-    gatewayRolePassword,
-    caeloSecretKek,
-  ])
-  .apply(([pgPw, adminPw, publicPw, gatewayPw, kek]) =>
+  .all([postgresPassword, adminRolePassword, publicRolePassword, caeloSecretKek])
+  .apply(([pgPw, adminPw, publicPw, kek]) =>
     generateDockerCompose({
       domain,
       postgresPassword: pgPw,
-      rolePasswords: { admin: adminPw, public: publicPw, gateway: gatewayPw },
+      rolePasswords: { admin: adminPw, public: publicPw },
       caeloSecretKek: kek,
       anthropicApiKey: process.env.ANTHROPIC_API_KEY,
       resendApiKey: process.env.RESEND_API_KEY,