@caelo-cms/provisioning 0.10.52 → 0.10.53

package/src/gateway-credentials.test.ts

@@ -2,7 +2,6 @@
 
 import { describe, expect, it } from "bun:test";
 import {
-  ensureGatewayRolePassword,
   findSqlInstance,
   gatewayMovesPublicRole,
   planPublicRoleSwitch,
@@ -52,7 +51,6 @@ const target = { projectId: "acme", env: "production", sqlInstance: "caelo-produ
 const SECRETS = {
   "postgres-password": "admin-pw",
   "public-role-password": "public-pw",
-  "gateway-role-password": "gateway-pw",
 };
 const secretRef = (secret: string): LiveEnvValue => ({
   kind: "secret",
@@ -66,7 +64,6 @@ const BEFORE_613 = new Map<string, LiveEnvValue>([
 ]);
 const AFTER_613 = new Map<string, LiveEnvValue>([
   ["PUBLIC_DATABASE_PASSWORD", secretRef("public-role-password")],
-  ["GATEWAY_DATABASE_PASSWORD", secretRef("gateway-role-password")],
 ]);
 
 describe("gatewayMovesPublicRole", () => {
@@ -85,32 +82,6 @@ describe("gatewayMovesPublicRole", () => {
   });
 });
 
-describe("ensureGatewayRolePassword", () => {
-  it("sets gateway_role from its secret through the API, never on argv", async () => {
-    const { run, lines } = fakeGcloud(SECRETS);
-    const sql = fakeSqlApi();
-    const r = await ensureGatewayRolePassword(target, {
-      run,
-      http: sql.http,
-      sleep: async () => {},
-    });
-    expect(r.status).toBe("applied");
-    expect(sql.set).toEqual(["gateway_role gateway-pw"]);
-    expect(lines.some((l) => l.includes("gateway-pw"))).toBe(false);
-  });
-
-  it("fails, naming the secret, when the secret can't be read", async () => {
-    const { run } = fakeGcloud({});
-    const r = await ensureGatewayRolePassword(target, {
-      run,
-      http: fakeSqlApi().http,
-      sleep: async () => {},
-    });
-    expect(r.status).toBe("failed");
-    expect(r.error).toContain("caelo-production-gateway-role-password");
-  });
-});
-
 describe("planPublicRoleSwitch", () => {
   it("first upgrade: moves public_role onto its own password before the gateway rolls", async () => {
     const { run } = fakeGcloud(SECRETS);

package/src/gateway-credentials.ts

@@ -2,28 +2,22 @@
 
 /**
  * Moving an existing install's API gateway off admin_role (issue #613),
- * as `cms-provision upgrade` does it. The env side — the per-role password
- * secrets in, ADMIN_DATABASE_* out (and, since #635, GATEWAY_DATABASE_* out
- * too: the gateway has no cms_admin login at all) — rides the gateway's
- * roll (stack-contract.ts). gateway_role keeps getting its password until
- * the contract release drops the role, because the previous release's
- * gateway logs in with it until it is rolled. The database side is ordered around
- * that roll so /api/* keeps working:
+ * as `cms-provision upgrade` does it. The env side — public_role's own
+ * password secret in, every cms_admin credential out (#613, #635) — rides
+ * the gateway's roll (stack-contract.ts). The database side is ordered
+ * around that roll so /api/* keeps working:
  *
- *   1. after migrations (which create `gateway_role` without a password):
- *      `gateway_role` gets its password. Nothing uses the role yet, so this
- *      is safe at any point before the gateway rolls.
- *   2. right before the gateway rolls: `public_role` moves off admin_role's
+ *   1. right before the gateway rolls: `public_role` moves off admin_role's
  *      password onto its own. Only the gateway logs in as public_role, so
  *      the window in which the old revision cannot open NEW public
  *      connections is the roll itself (open connections stay up).
- *   3. if the gateway's roll fails and it is rolled back: `public_role`
+ *   2. if the gateway's roll fails and it is rolled back: `public_role`
  *      goes back to the password the prior revision reads, so the rollback
  *      leaves a working gateway, not a locked-out one.
  *
  * On every later upgrade the gateway already reads public_role's own
- * secret: step 2 then re-applies the same value (a no-op for clients) and
- * step 3 has nothing to undo.
+ * secret: step 1 then re-applies the same value (a no-op for clients) and
+ * step 2 has nothing to undo.
  */
 
 import { gcloud as defaultGcloud } from "./gcloud.js";
@@ -60,22 +54,14 @@ export interface GatewayCredentialDeps {
   readonly http?: HttpFetch;
 }
 
-/** Step 1: `gateway_role`'s password from its secret. */
-export function ensureGatewayRolePassword(
-  target: DatabaseRoleTarget,
-  deps: GatewayCredentialDeps = {},
-): Promise<EnsureOutcome> {
-  return ensureDatabaseRolePassword(target, "gateway_role", deps);
-}
-
-/** Steps 2 and 3 for one roll of the gateway. */
+/** Steps 1 and 2 for one roll of the gateway. */
 export interface PublicRoleSwitch {
   /** Whether this roll moves public_role off admin_role's password. */
   readonly moves: boolean;
-  /** Step 2 — run right before the gateway's `services update`. */
+  /** Step 1 — run right before the gateway's `services update`. */
   beforeGatewayRoll(): Promise<EnsureOutcome>;
   /**
-   * Step 3 — run when the gateway's roll failed and it goes back to its
+   * Step 2 — run when the gateway's roll failed and it goes back to its
    * prior revision. Returns what happened, for the operator.
    */
   afterGatewayRollFailed(): Promise<string>;

package/src/gateway-env-isolation.test.ts

@@ -126,7 +126,7 @@ describe("self-hosted: the generated compose gateway service (#635)", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "superpw",
-      rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+      rolePasswords: { admin: "adminpw", public: "publicpw" },
       caeloSecretKek: "0".repeat(64),
       diskSize: "20Gi",
       images: {
@@ -148,7 +148,12 @@ describe("self-hosted: the generated compose gateway service (#635)", () => {
     expect(gateway).not.toMatch(/^ {4}(secrets|env_file|volumes):/m);
     const env = gateway.slice(gateway.indexOf("    environment:"));
     const keys = [...env.matchAll(/^ {6}([A-Z_][A-Z0-9_]*):/gm)].map((m) => m[1]);
-    expect(keys.sort()).toEqual(["GATEWAY_PORT", "NODE_ENV", "PUBLIC_DATABASE_URL"]);
+    expect(keys.sort()).toEqual([
+      "CAELO_TRUSTED_PROXY_HOPS",
+      "GATEWAY_PORT",
+      "NODE_ENV",
+      "PUBLIC_DATABASE_URL",
+    ]);
     expect(out).not.toMatch(/^secrets:/m);
   });
 });

package/src/index.test.ts

@@ -115,7 +115,7 @@ describe("docker-compose generator", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "supersecret",
-      rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+      rolePasswords: { admin: "adminpw", public: "publicpw" },
       caeloSecretKek: "0".repeat(64),
       anthropicApiKey: "sk-ant-…",
       diskSize: "20Gi",
@@ -136,7 +136,7 @@ describe("docker-compose generator", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "supersecret",
-      rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+      rolePasswords: { admin: "adminpw", public: "publicpw" },
       caeloSecretKek: "0".repeat(64),
       diskSize: "20Gi",
       images: RELEASE_IMAGES,
@@ -150,16 +150,17 @@ describe("docker-compose generator", () => {
     expect(gateway).not.toMatch(
       /ADMIN_DATABASE|GATEWAY_DATABASE|cms_admin|admin_role|gateway_role|adminpw|gatewaypw|supersecret|CAELO_SECRET_KEK/,
     );
-    // bootstrap.sh still creates the three roles from these (gateway_role
-    // until the contract release drops it).
-    expect(out).toContain('GATEWAY_ROLE_PASSWORD: "gatewaypw"');
+    // bootstrap.sh creates the two application roles from these (#635: no
+    // gateway_role).
+    expect(out).toContain('PUBLIC_ROLE_PASSWORD: "publicpw"');
+    expect(out).not.toContain("GATEWAY_ROLE_PASSWORD");
   });
 
   it("escapes secrets containing quotes safely", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: 'pa"ss',
-      rolePasswords: { admin: "a", public: "b", gateway: "g" },
+      rolePasswords: { admin: "a", public: "b" },
       caeloSecretKek: "0".repeat(64),
       diskSize: "1Gi",
       images: RELEASE_IMAGES,

package/src/infra-contract.test.ts

@@ -20,12 +20,13 @@ describe("infrastructure contract steps", () => {
     );
   });
 
-  it("is at 6: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6)", () => {
-    expect(INFRA_CONTRACT_VERSION).toBe(6);
+  it("is at 7: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6), gateway proxy hops (7)", () => {
+    expect(INFRA_CONTRACT_VERSION).toBe(7);
     expect(INFRA_CONTRACT_STEPS[3]).toContain("#633");
     expect(INFRA_CONTRACT_STEPS[4]).toContain("#587");
     expect(INFRA_CONTRACT_STEPS[5]).toContain("#635");
     expect(INFRA_CONTRACT_STEPS[6]).toContain("#799");
+    expect(INFRA_CONTRACT_STEPS[7]).toContain("#845");
   });
 
   it("lists the pending steps oldest first", () => {
@@ -36,6 +37,6 @@ describe("infrastructure contract steps", () => {
   });
 
   it("names a version a newer release added by number", () => {
-    expect(infraStepsText(6, 7)).toBe("infrastructure step 7 (see that release's notes)");
+    expect(infraStepsText(7, 8)).toBe("infrastructure step 8 (see that release's notes)");
   });
 });

package/src/infra-contract.ts

@@ -22,7 +22,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 6;
+export const INFRA_CONTRACT_VERSION = 7;
 
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
@@ -45,6 +45,12 @@ export const INFRA_CONTRACT_VERSION = 6;
 //       into the bucket lists it first; without the binding the in-cloud
 //       upgrader fails at its state lock, so it must not run before the
 //       converge grants it.
+//   7 — #845: the gateway refuses to boot without CAELO_TRUSTED_PROXY_HOPS
+//       (which X-Forwarded-For entry is the visitor). A plain env var, but
+//       the in-cloud upgrader rolls with the env contract of the release it
+//       runs from (the installed one), which does not set it — so the new
+//       gateway would not start. The operator-identity upgrade runs the new
+//       release's contract and sets it.
 
 /**
  * What each contract version adds, in operator terms — the upgrader's
@@ -58,6 +64,7 @@ export const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>> = {
   4: "the admin's permission to serve redirects from the load balancer (#587)",
   5: "the gateway's cms_admin login removed from its env and IAM (#635)",
   6: "the upgrader's permission to list its ops bucket (#799)",
+  7: "the gateway's trusted proxy hop count, CAELO_TRUSTED_PROXY_HOPS (#845)",
 };
 
 /**

package/src/runtime-secrets.test.ts

@@ -115,13 +115,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "present",
-      "present",
-      "present",
-      "present",
-      "present",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["present", "present", "present", "present"]);
     expect(lines().some((l) => l.includes(" create ") || l.includes(" add "))).toBe(false);
   });
 
@@ -132,13 +126,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run, generate: () => `generated-value-${++n}` },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "applied", "applied", "applied"]);
     const creates = calls.filter((c) => c.line.startsWith("secrets create"));
     expect(creates).toEqual([
       {
@@ -149,19 +137,15 @@ describe("ensureGeneratedSecrets", () => {
         line: "secrets create caelo-production-tool-approval-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
         stdin: "generated-value-2",
       },
-      // #613 — the gateway's role passwords: fresh values, never admin_role's.
+      // #613 — the gateway's role password: a fresh value, never admin_role's.
       {
         line: "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
         stdin: "generated-value-3",
       },
-      {
-        line: "secrets create caelo-production-gateway-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-        stdin: "generated-value-4",
-      },
       // #650 — the staging access gate's key.
       {
         line: "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-        stdin: "generated-value-5",
+        stdin: "generated-value-4",
       },
     ]);
     for (const c of calls) expect(c.line).not.toContain("generated-value");
@@ -186,7 +170,6 @@ describe("ensureGeneratedSecrets", () => {
       "generated",
       "generated",
       "generated",
-      "generated",
     ]);
     for (const c of calls) expect(c.line).not.toContain("operator-set");
   });
@@ -197,20 +180,13 @@ describe("ensureGeneratedSecrets", () => {
       "secrets versions list caelo-production-internal-secret": [ok("")],
       "secrets versions list caelo-production-tool-approval-secret": [ok("v/1")],
       "secrets versions list caelo-production-public-role-password": [ok("v/1")],
-      "secrets versions list caelo-production-gateway-role-password": [ok("v/1")],
       "secrets versions list caelo-production-staging-gate-secret": [ok("v/1")],
     });
     const outcomes = await ensureGeneratedSecrets(
       { ...secretsInstall, replication: { kind: "automatic" } },
       { run, generate: () => "v" },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "applied",
-      "present",
-      "present",
-      "present",
-      "present",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "present", "present", "present"]);
     expect(calls.filter((c) => c.line.startsWith("secrets versions add"))).toEqual([
       {
         line: "secrets versions add caelo-production-internal-secret --project=acme --data-file=-",
@@ -244,13 +220,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: { kind: "automatic" } },
       { run, generate: () => "v" },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "applied", "applied", "applied"]);
     expect(outcomes.every((o) => o.detail?.includes("gcp.resourceLocations"))).toBe(true);
     const creates = lines().filter((l) => l.startsWith("secrets create"));
     // One refused automatic attempt; then every secret — the refused one
@@ -260,7 +230,6 @@ describe("ensureGeneratedSecrets", () => {
       "secrets create caelo-production-internal-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-tool-approval-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-      "secrets create caelo-production-gateway-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       // #652 — the staging gate's key follows the same path.
       "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
     ]);
@@ -290,7 +259,7 @@ describe("ensureGeneratedSecrets", () => {
       { run, generate: () => "v" },
     );
     expect(outcomes.every((o) => o.status === "failed")).toBe(true);
-    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(5);
+    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(4);
   });
 });
 
@@ -299,7 +268,6 @@ describe("rotationRefusal", () => {
     for (const s of [
       "postgres-password",
       "public-role-password",
-      "gateway-role-password",
       "internal-secret",
       "tool-approval-secret",
       "staging-gate-secret",
@@ -311,6 +279,8 @@ describe("rotationRefusal", () => {
   it("refuses the KEK (re-encryption needed) and secrets nothing reads", () => {
     expect(rotationRefusal("secret-kek")).toContain("re-encryption");
     expect(rotationRefusal("csrf-secret")).toContain("Rotatable");
+    // #635 — the former gateway_role is gone; there is nothing to rotate.
+    expect(rotationRefusal("gateway-role-password")).toContain("Rotatable");
   });
 });
 
@@ -411,28 +381,6 @@ describe("rotateRuntimeSecret", () => {
     ).toBe(true);
   });
 
-  it("gateway-role-password: changes gateway_role only and rolls no service (#613, #635)", async () => {
-    const { run, lines } = fakeGcloud({
-      ...converged(),
-      "secrets versions access": [ok("old-pw")],
-    });
-    const sql = fakeSqlApi();
-    const report = await rotateRuntimeSecret(target, "gateway-role-password", {
-      run,
-      http: sql.http,
-      sleep: async () => {},
-      generate: () => "new-pw",
-    });
-    expect(report.ok).toBe(true);
-    expect(sql.passwords()).toEqual(["gateway_role new-pw"]);
-    // No service logs in as gateway_role any more: the gateway reads
-    // cms_public only (#635).
-    expect(lines().filter((l) => l.startsWith("run services update "))).toEqual([]);
-    expect(lines()).toContain(
-      "secrets versions access latest --secret=caelo-production-gateway-role-password --project=acme",
-    );
-  });
-
   it("public-role-password: stores nothing and rolls nothing when public_role can't be changed", async () => {
     const { run, lines } = fakeGcloud({
       ...converged(),
@@ -474,26 +422,6 @@ describe("rotateRuntimeSecret", () => {
     expect(lines().every((l) => l.startsWith("run services describe"))).toBe(true);
   });
 
-  it("refuses gateway-role-password while the gateway still logs in with it (before #635)", async () => {
-    const answers = converged();
-    answers["run services describe gw-svc"] = [
-      service([
-        ref("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
-        ref("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
-      ]),
-    ];
-    const { run } = fakeGcloud(answers);
-    const sql = fakeSqlApi();
-    const report = await rotateRuntimeSecret(target, "gateway-role-password", {
-      run,
-      http: sql.http,
-      generate: () => "new-pw",
-    });
-    expect(report.ok).toBe(false);
-    expect(report.error).toContain("GATEWAY_DATABASE_PASSWORD");
-    expect(sql.requests).toHaveLength(0);
-  });
-
   it("refuses before changing anything on an install upgrade hasn't moved over", async () => {
     const { run, lines } = fakeGcloud({
       "run services describe adm-svc": [

package/src/runtime-secrets.ts

@@ -13,9 +13,8 @@
  *     Secret Manager on stdin — never on argv, never to disk.
  *   - {@link ensureDatabaseRolePassword}: a database role's password set
  *     from its secret (`DATABASE_ROLE_SECRET`), through the Cloud SQL Admin
- *     API — how `gateway_role` (created by migration 0248, without a
- *     password) and `public_role` (moved off admin_role's password, #613)
- *     get theirs.
+ *     API — how `public_role` (moved off admin_role's password, #613) gets
+ *     its own.
  *   - {@link rotateRuntimeSecret}: `cms-provision rotate-secret`.
  *
  * Every function reports instead of throwing on a gcloud failure.
@@ -368,7 +367,6 @@ async function addVersion(
 export const ROTATABLE_SECRETS = [
   "postgres-password",
   "public-role-password",
-  "gateway-role-password",
   "internal-secret",
   "tool-approval-secret",
   // #650 — rotating it signs every staging session out and replaces the
@@ -726,8 +724,6 @@ export async function readSecretValue(
  * the role already has is a no-op for every client, so upgrade runs this on
  * every roll and an install converges whatever state it was left in.
  *
- * The role must exist: `gateway_role` is created by migration 0248, so this
- * runs after migrations.
  */
 export async function ensureDatabaseRolePassword(
   target: DatabaseRoleTarget,

package/src/self-hosted-compose.test.ts

@@ -19,7 +19,7 @@ const GATEWAY = `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`;
 const base: Omit<ComposeSpec, "images"> = {
   domain: "example.com",
   postgresPassword: "pgpw",
-  rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+  rolePasswords: { admin: "adminpw", public: "publicpw" },
   caeloSecretKek: "0".repeat(64),
   anthropicApiKey: "sk-ant-x",
   diskSize: "20Gi",

package/src/self-hosted-roles.integration.test.ts

@@ -1,11 +1,12 @@
 // SPDX-License-Identifier: MPL-2.0
 
 /**
- * #613 review — `cms-provision up` on a self-hosted volume created before
- * the per-role passwords: no `gateway_role`, `public_role` on another
- * password. The convergence script, run as the superuser exactly as `up`
- * runs it (psql, script on stdin), must leave the roles on the configured
- * passwords with the gateway's grants in place — and be safe to re-run.
+ * #613 review, #635 — `cms-provision up` on a self-hosted volume from
+ * before: `public_role` on another password, and the gateway's former
+ * `gateway_role` login still there with its grants. The convergence
+ * script, run as the superuser exactly as `up` runs it (psql, script on
+ * stdin), must leave the roles on the configured passwords and the former
+ * gateway_role gone — and be safe to re-run.
  *
  * Runs against the test database with the passwords the environment already
  * uses, so the other suites' connection URLs keep working afterwards.
@@ -25,9 +26,8 @@ const required = [
   "POSTGRES_PORT",
   "ADMIN_ROLE_PASSWORD",
   "PUBLIC_ROLE_PASSWORD",
-  "GATEWAY_ROLE_PASSWORD",
   "ADMIN_DATABASE_URL",
-  "GATEWAY_DATABASE_URL",
+  "PUBLIC_DATABASE_URL",
 ] as const;
 const missing = required.filter((name) => !env[name]);
 if (missing.length > 0) throw new Error(`${missing.join(", ")} required (see .env.example)`);
@@ -63,19 +63,20 @@ const psql: SuperuserPsql = async (script) => {
 const passwords = {
   admin: env.ADMIN_ROLE_PASSWORD as string,
   public: env.PUBLIC_ROLE_PASSWORD as string,
-  gateway: env.GATEWAY_ROLE_PASSWORD as string,
 };
 
-describe("self-hosted role convergence against Postgres (#613 review)", () => {
-  it("brings a pre-#613 volume to the configured roles, grants and passwords — twice", async () => {
-    // The pre-#613 volume: no gateway_role, public_role on another password.
+describe("self-hosted role convergence against Postgres (#613 review, #635)", () => {
+  it("brings an old volume to the configured roles and passwords, without gateway_role — twice", async () => {
+    // The old volume: the former gateway_role with a cms_admin grant, and
+    // public_role on another password.
     const reset = await psql(
       [
         "\\set ON_ERROR_STOP on",
+        "SELECT 'CREATE ROLE gateway_role NOINHERIT LOGIN' WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') \\gexec",
+        "GRANT CONNECT ON DATABASE cms_admin TO gateway_role;",
         "\\connect cms_admin",
-        "DROP OWNED BY gateway_role;",
+        "GRANT SELECT (gateway_cookie_secret) ON site_settings TO gateway_role;",
         "\\connect postgres",
-        "DROP ROLE gateway_role;",
         "ALTER ROLE public_role WITH PASSWORD 'the-old-shared-password';",
         "",
       ].join("\n"),
@@ -87,36 +88,20 @@ describe("self-hosted role convergence against Postgres (#613 review)", () => {
       expect(r).toEqual({ ok: true });
     }
 
-    // The gateway logs in with its configured password and reads what 0248 grants.
-    const gateway = new SQL(env.GATEWAY_DATABASE_URL as string);
+    // public_role logs in with its configured password again.
+    const pub = new SQL(env.PUBLIC_DATABASE_URL as string);
     try {
-      const rows = (await gateway.begin(async (tx) => {
-        await tx.unsafe("SET LOCAL caelo.actor_kind = 'system'");
-        return tx`SELECT current_user::text AS u, length(gateway_cookie_secret) > 0 AS s FROM site_settings`;
-      })) as { u: string; s: boolean }[];
-      expect(rows[0]).toEqual({ u: "gateway_role", s: true });
+      const [who] = (await pub`SELECT current_user::text AS u`) as { u: string }[];
+      expect(who?.u).toBe("public_role");
     } finally {
-      await gateway.end();
+      await pub.end();
     }
+    // The former gateway_role is gone, with its grants (#635).
     const admin = new SQL(env.ADMIN_DATABASE_URL as string);
     try {
-      const [attrs] = (await admin`
-        SELECT rolcanlogin, rolinherit FROM pg_roles WHERE rolname = 'gateway_role'`) as {
-        rolcanlogin: boolean;
-        rolinherit: boolean;
-      }[];
-      expect(attrs).toEqual({ rolcanlogin: true, rolinherit: false });
-      const policies = (await admin`
-        SELECT policyname::text AS p FROM pg_policies WHERE 'gateway_role' = ANY (roles) ORDER BY 1`) as {
-        p: string;
-      }[];
-      expect(policies.map((p) => p.p)).toEqual([
-        "audit_events_gateway_plugin_only",
-        // #634 (migration 0252): the visitor paths' row limits. The A/B
-        // ones went with the experiment tables (#676, migration 0259).
-        "comment_archive_gateway_approved_only",
-        "rate_limit_buckets_gateway_keys",
-      ]);
+      const roles =
+        (await admin`SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role'`) as unknown[];
+      expect(roles).toEqual([]);
     } finally {
       await admin.end();
     }

package/src/self-hosted-roles.test.ts

@@ -8,26 +8,30 @@ import {
   selfHostedBootstrapScript,
 } from "./self-hosted-roles.js";
 
-const PASSWORDS = { admin: "a'pw", public: "p-pw", gateway: "g-pw" };
+const PASSWORDS = { admin: "a'pw", public: "p-pw" };
 
 describe("roleConvergenceScript (#613 review)", () => {
   const script = roleConvergenceScript(PASSWORDS);
 
   it("creates missing roles and (re)sets every role's password, quoted", () => {
-    for (const role of ["admin_role", "public_role", "gateway_role"]) {
+    for (const role of ["admin_role", "public_role"]) {
       expect(script).toContain(
         `WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}')`,
       );
     }
     expect(script).toContain("ALTER ROLE admin_role WITH LOGIN PASSWORD 'a''pw';");
-    expect(script).toContain("ALTER ROLE gateway_role WITH LOGIN PASSWORD 'g-pw';");
+    expect(script).not.toContain("CREATE ROLE gateway_role");
   });
 
-  it("re-applies migration 0248's gateway grants in cms_admin, and stops on the first error", () => {
+  it("drops the former gateway_role with what it holds in both databases, and stops on the first error (#635)", () => {
     expect(script.startsWith("\\set ON_ERROR_STOP on")).toBe(true);
-    expect(script.indexOf("\\connect cms_admin")).toBeLessThan(
-      script.indexOf("PERFORM caelo_grant_gateway_role()"),
-    );
+    const publicDrop = script.indexOf("\\connect cms_public");
+    const adminDrop = script.indexOf("\\connect cms_admin");
+    expect(publicDrop).toBeGreaterThan(-1);
+    expect(adminDrop).toBeGreaterThan(publicDrop);
+    expect(script.match(/DROP OWNED BY gateway_role/g)).toHaveLength(2);
+    expect(script.indexOf("THEN DROP ROLE gateway_role;")).toBeGreaterThan(adminDrop);
+    expect(script).not.toContain("caelo_grant_gateway_role");
   });
 });