@caelo-cms/provisioning 0.10.52 → 0.10.53

package/src/self-hosted-roles.ts

@@ -7,13 +7,14 @@
  * bootstrap.sh creates the application roles, but only on the Postgres
  * container's FIRST start (docker-entrypoint-initdb.d). An install created
  * before the per-role passwords has a data volume whose roles have other
- * passwords — and no `gateway_role` at all — so emitting Compose URLs with
- * the new passwords would lock the admin and the gateway out on the next
- * restart. `cms-provision up` therefore runs {@link roleConvergenceScript}
- * through the running container as the Postgres superuser BEFORE it writes
- * the new Compose file: it creates missing roles and databases, sets each
- * role's password to the configured one, and re-applies migration 0248's
- * gateway grants. Every statement is idempotent.
+ * passwords, so emitting Compose URLs with the new passwords would lock the
+ * admin and the gateway out on the next restart. `cms-provision up`
+ * therefore runs {@link roleConvergenceScript} through the running container
+ * as the Postgres superuser BEFORE it writes the new Compose file: it
+ * creates missing roles and databases and sets each role's password to the
+ * configured one. It also drops the former `gateway_role` (#635: the
+ * gateway has no cms_admin login), with whatever it still holds. Every
+ * statement is idempotent.
  *
  * Passwords travel on psql's stdin, never on argv.
  */
@@ -34,7 +35,7 @@ function literal(s: string): string {
 export const AGENT_DB_ROLE = "caelo_agent";
 
 /** The application roles bootstrap.sh and the convergence create. */
-const APP_ROLES = ["admin_role", "public_role", "gateway_role"] as const;
+const APP_ROLES = ["admin_role", "public_role"] as const;
 type AppRole = (typeof APP_ROLES)[number];
 
 /** How a role's password appears in the SQL: a literal, or a psql variable. */
@@ -69,12 +70,14 @@ function convergenceSql(password: PasswordSql, agent: boolean): string {
     "REVOKE ALL ON DATABASE cms_public FROM PUBLIC;",
     "GRANT CONNECT ON DATABASE cms_admin TO admin_role;",
     "GRANT CONNECT ON DATABASE cms_public TO public_role, admin_role;",
+    // #635 — the gateway's former cms_admin login goes, with whatever it
+    // still holds in either database (the superuser may drop what
+    // migration 0285 could only revoke).
+    "\\connect cms_public",
+    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
     "\\connect cms_admin",
-    // A database that ran migration 0248 before gateway_role existed has no
-    // grants for it yet; one that has not run it yet gets them from it.
-    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_proc WHERE proname = 'caelo_grant_gateway_role') THEN PERFORM caelo_grant_gateway_role(); END IF; END $$;",
-    // Migration 0251's staging-gate grants (issue #650), same convergence.
-    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_proc WHERE proname = 'caelo_grant_gateway_staging_access') THEN PERFORM caelo_grant_gateway_staging_access(); END IF; END $$;",
+    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
+    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP ROLE gateway_role; END IF; END $$;",
     // Migrations 0267 + 0270 (#696): the upgrader role's grants, applied
     // now that the role exists.
     "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_proc WHERE proname = 'caelo_grant_platform_updater') THEN PERFORM caelo_grant_platform_updater(); END IF; END $$;",
@@ -84,7 +87,7 @@ function convergenceSql(password: PasswordSql, agent: boolean): string {
 
 /**
  * The psql script (run as the superuser, connected to any database) that
- * brings roles, databases and the gateway's grants to the configured state.
+ * brings roles and databases to the configured state.
  * Mirrors bootstrap.sh, plus the password reset bootstrap.sh never does.
  * With `agentPassword`, also the host agent's login (#696 Phase 4c).
  */
@@ -92,7 +95,6 @@ export function roleConvergenceScript(passwords: RolePasswords, agentPassword?:
   const byRole: Record<AppRole, string> = {
     admin_role: passwords.admin,
     public_role: passwords.public,
-    gateway_role: passwords.gateway,
   };
   return convergenceSql(
     (role) => literal(role === AGENT_DB_ROLE ? (agentPassword ?? "") : byRole[role]),
@@ -104,7 +106,6 @@ export function roleConvergenceScript(passwords: RolePasswords, agentPassword?:
 const PASSWORD_ENV: Record<AppRole | typeof AGENT_DB_ROLE, string> = {
   admin_role: "ADMIN_ROLE_PASSWORD",
   public_role: "PUBLIC_ROLE_PASSWORD",
-  gateway_role: "GATEWAY_ROLE_PASSWORD",
   [AGENT_DB_ROLE]: "AGENT_ROLE_PASSWORD",
 };
 

package/src/self-hosted-upgrade.test.ts

@@ -19,6 +19,7 @@ import {
   readRelease,
   recordRelease,
 } from "./self-hosted-release.js";
+import type { ConvergeOutcome } from "./self-hosted-roles.js";
 import {
   composePath,
   legacyComposePath,
@@ -121,11 +122,15 @@ beforeEach(() => {
 });
 afterEach(() => rmSync(dir, { recursive: true, force: true }));
 
-function deps(runner: HostRunner) {
+function deps(runner: HostRunner & { calls: string[] }, roles: ConvergeOutcome = { ok: true }) {
   return {
     caeloDir: dir,
     runner,
     renderCompose: render,
+    convergeRoles: async () => {
+      runner.calls.push("converge roles");
+      return roles;
+    },
     log,
     fetchImpl: registry,
     sleep: async () => {},
@@ -151,6 +156,7 @@ describe("upgradeSelfHosted", () => {
       "pull",
       "migrate admin",
       "migrate public",
+      "converge roles",
       "up caelo-admin",
       "health admin",
       "up caelo-gateway",
@@ -269,6 +275,27 @@ describe("upgradeSelfHosted", () => {
     expect(readFileSync(composePath(dir), "utf8")).toBe(render(OLD));
   });
 
+  it("converges the database roles on every upgrade, after the migrations (#635: drops gateway_role)", async () => {
+    const runner = fakeRunner();
+    expect((await upgradeSelfHosted({ version: "0.11.0" }, deps(runner))).ok).toBe(true);
+    const s = steps(runner.calls);
+    expect(s.indexOf("converge roles")).toBeGreaterThan(s.indexOf("migrate public"));
+    expect(s.indexOf("converge roles")).toBeLessThan(s.indexOf("up caelo-admin"));
+  });
+
+  it("restores the Compose file and restarts nothing when the role convergence fails", async () => {
+    const runner = fakeRunner();
+    const r = await upgradeSelfHosted(
+      { version: "0.11.0" },
+      deps(runner, { ok: false, reachable: true, error: "role is busy" }),
+    );
+    expect(r).toMatchObject({ ok: false, stage: "roles", previousRunning: true });
+    if (!r.ok) expect(r.error).toContain("role is busy");
+    expect(steps(runner.calls).some((x) => x.startsWith("up "))).toBe(false);
+    expect(readFileSync(composePath(dir), "utf8")).toBe(render(OLD));
+    expect(readRelease(dir)?.version).toBe("0.10.0");
+  });
+
   it("rolls back to the previous images when the gateway fails its health check", async () => {
     let compose = "";
     const runner = fakeRunner([

package/src/self-hosted-upgrade.ts

@@ -13,9 +13,15 @@
  *      the same `migrate.ts` entrypoint the GCP migrate job runs) while the
  *      old containers keep serving — migrations are expand-only, so the
  *      running release works on the new schema;
- *   5. recreate the admin, health-check it (`/_caelo/health`, which proves
+ *   5. converge the database roles (the same script `cms-provision up`
+ *      runs): bootstrap.sh only runs on the data volume's first start, so a
+ *      role a release retires — #635's gateway_role — is dropped here, on
+ *      every existing install. After the migrations, because the runner
+ *      refuses an install that skipped the release the old role's last user
+ *      was retired in (run-order.ts): past it, nothing running uses it;
+ *   6. recreate the admin, health-check it (`/_caelo/health`, which proves
  *      the DB pool and roles); then the gateway (`/healthz`);
- *   6. record the release in `.caelo/release.json`.
+ *   7. record the release in `.caelo/release.json`.
  * Any failure after step 3 puts the previous Compose file back; once a
  * container was recreated the previous images are started again and
  * health-checked (rollback). The database is never restored automatically:
@@ -52,6 +58,7 @@ import {
   releaseImages,
   resolveVerifiedRelease,
 } from "./self-hosted-release.js";
+import type { ConvergeOutcome } from "./self-hosted-roles.js";
 import { fetchLatestReleaseTag, RELEASE_SERVICES, releaseTag } from "./upgrade/release-images.js";
 
 /** The Compose service names of the two Caelo services. */
@@ -78,6 +85,11 @@ export interface SelfHostedUpgradeDeps {
   /** Renders the Compose file for `images` from the install's config (secrets included). */
   readonly renderCompose: (images: ReleaseImages) => string;
   readonly log: UpgradeLog;
+  /**
+   * Converges the database roles as the Postgres superuser
+   * (`convergeSelfHostedRoles`); drops roles a release retired (#635).
+   */
+  readonly convergeRoles: () => Promise<ConvergeOutcome>;
   readonly fetchImpl?: typeof fetch;
   readonly sleep?: (ms: number) => Promise<void>;
   readonly now?: () => Date;
@@ -116,6 +128,7 @@ type UpgradeStage =
   | "backup"
   | "pull"
   | "migrate"
+  | "roles"
   | "roll-admin"
   | "roll-gateway";
 
@@ -321,7 +334,19 @@ export async function upgradeSelfHosted(
     );
   }
 
-  // 5. Roll admin, then gateway, each health-checked.
+  // 5. Database roles: drops what this release retired (#635 gateway_role).
+  log.step("Converging the database roles");
+  const roles = await deps.convergeRoles();
+  if (!roles.ok) {
+    restoreCompose(file, previousCompose);
+    return fail(
+      "roles",
+      `Could not converge the database roles: ${roles.error}\nThe previous release keeps running; the migrations are applied (expand-only). Fix the cause and re-run the upgrade. Database backup: ${backup.dir}`,
+      true,
+    );
+  }
+
+  // 6. Roll admin, then gateway, each health-checked.
   for (const service of RELEASE_SERVICES) {
     const stage = service === "admin" ? "roll-admin" : "roll-gateway";
     log.phase?.("roll");
@@ -353,7 +378,7 @@ export async function upgradeSelfHosted(
     log.info(`${service} healthy ✓`);
   }
 
-  // 6. Record.
+  // 7. Record.
   log.phase?.("record");
   recordRelease(
     caeloDir,

package/src/stack-contract.test.ts

@@ -158,12 +158,21 @@ describe("gatewayEnvContract", () => {
       CAELO_PROVIDER: "gcp",
       CAELO_ENV: "production",
       MEDIA_STORAGE_URL: "gs://acme-caelo-production-media",
+      // #845 — gcp: the LB appends <client>,<LB IP>.
+      CAELO_TRUSTED_PROXY_HOPS: "2",
       PUBLIC_DATABASE_URL: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
       PUBLIC_DATABASE_PASSWORD: "secret:caelo-production-public-role-password:latest",
       CAELO_STAGING_GATE_SECRET: "secret:caelo-production-staging-gate-secret:latest",
     });
   });
 
+  it("#845 — tells the gateway its provider's proxy hop count", () => {
+    // Firebase Hosting / the domain mapping: Cloud Run's front end only.
+    const fb = asRecord(gatewayEnvContract({ ...base, provider: "gcp-firebase" }));
+    expect(fb.CAELO_TRUSTED_PROXY_HOPS).toBe("1");
+    expect(asRecord(gateway).CAELO_TRUSTED_PROXY_HOPS).toBe("2");
+  });
+
   it("#650 — reads the staging host from the database, not its env", () => {
     const fb = asRecord(gatewayEnvContract({ ...base, provider: "gcp-firebase" }));
     expect(fb.CAELO_STAGING_HOST).toBeUndefined();
@@ -223,14 +232,13 @@ describe("database role secrets (#613)", () => {
     expect(DATABASE_ROLE_SECRET).toEqual({
       admin_role: "postgres-password",
       public_role: "public-role-password",
-      gateway_role: "gateway-role-password",
     });
   });
 
-  it("the CLI generates the gateway's role passwords (never seeded from admin_role's)", () => {
-    expect(CLI_GENERATED_SECRETS).toEqual(
-      expect.arrayContaining(["public-role-password", "gateway-role-password"]),
-    );
+  it("the CLI generates the gateway's role password (never seeded from admin_role's)", () => {
+    expect(CLI_GENERATED_SECRETS).toContain("public-role-password");
+    // #635 — the former gateway_role is gone; nothing generates its password.
+    expect(CLI_GENERATED_SECRETS as readonly string[]).not.toContain("gateway-role-password");
   });
 
   it("retires the gateway SA's read access to admin_role's password", () => {
@@ -287,11 +295,7 @@ describe("runtime secrets", () => {
   });
 
   it("every CLI-generated secret is read by some service", () => {
-    // gateway-role-password is read by no service since #635: it only keeps
-    // the legacy gateway_role's password set until the contract release
-    // drops the role (the previous release's gateway logs in with it while
-    // an upgrade rolls).
-    for (const s of CLI_GENERATED_SECRETS.filter((x) => x !== "gateway-role-password")) {
+    for (const s of CLI_GENERATED_SECRETS) {
       expect([...serviceSecrets("admin"), ...serviceSecrets("gateway")]).toContain(s);
     }
   });
@@ -302,7 +306,7 @@ describe("self-hosted compose", () => {
     const yaml = generateDockerCompose({
       domain: "acme.com",
       postgresPassword: "p",
-      rolePasswords: { admin: "a", public: "b", gateway: "g" },
+      rolePasswords: { admin: "a", public: "b" },
       caeloSecretKek: "k",
       diskSize: "10G",
       ports: { http: 80, https: 443 },

package/src/stack-contract.ts

@@ -34,6 +34,7 @@
  * Pure module — the stacks import it from `dist/`.
  */
 
+import type { SupportedProvider } from "./adapter.js";
 import {
   gatewayServiceAccountEmail,
   gcpBucketName,
@@ -237,14 +238,13 @@ export function adminMediaVolumeTemplate(volume: MediaVolumeContract) {
 export type RuntimeSecret =
   | "postgres-password"
   | "public-role-password"
-  | "gateway-role-password"
   | "secret-kek"
   | "internal-secret"
   | "tool-approval-secret"
   | "staging-gate-secret";
 
 /** The Postgres roles Caelo's services log in as, with their passwords. */
-export type DatabaseRole = "admin_role" | "public_role" | "gateway_role";
+export type DatabaseRole = "admin_role" | "public_role";
 
 /**
  * Each database role's password secret — one per role (#613), so the
@@ -256,7 +256,6 @@ export type DatabaseRole = "admin_role" | "public_role" | "gateway_role";
 export const DATABASE_ROLE_SECRET: Readonly<Record<DatabaseRole, RuntimeSecret>> = {
   admin_role: "postgres-password",
   public_role: "public-role-password",
-  gateway_role: "gateway-role-password",
 };
 
 /**
@@ -269,10 +268,9 @@ export const DATABASE_ROLE_SECRET: Readonly<Record<DatabaseRole, RuntimeSecret>>
 export const CLI_GENERATED_SECRETS = [
   "internal-secret",
   "tool-approval-secret",
-  // #613 — the gateway's own role passwords. Generated (never seeded from
+  // #613 — the gateway's own role password. Generated (never seeded from
   // `postgres-password`), so the gateway never learns admin_role's.
   "public-role-password",
-  "gateway-role-password",
   // #650 — the staging access gate's key: signs "Open staging" links and
   // session cookies, derives the crawler credentials. Read by the admin
   // (issues) and the gateway (verifies).
@@ -358,6 +356,42 @@ function commonEnv(inputs: ServiceEnvInputs): CloudRunEnvVar[] {
   ];
 }
 
+/**
+ * The env var telling the gateway which `X-Forwarded-For` entry is the
+ * visitor (apps/api-gateway client-ip.ts): the number of entries the proxies
+ * in front of it append, counting the client's own.
+ */
+export const TRUSTED_PROXY_HOPS_ENV = "CAELO_TRUSTED_PROXY_HOPS";
+
+/**
+ * {@link TRUSTED_PROXY_HOPS_ENV} per provider — a property of each
+ * adapter's topology (CLAUDE.md §11.B), so it is declared here once and every
+ * adapter sets it on its gateway. The gateway refuses to boot without it.
+ * A change to an adapter's path to the gateway must update its entry, or
+ * rate limits pool every visitor (too high) or trust a forgeable entry (too
+ * low).
+ */
+export const GATEWAY_TRUSTED_PROXY_HOPS: Readonly<Record<SupportedProvider, number>> = {
+  // External Application LB appends `<client>,<LB IP>`; the gateway's
+  // ingress is internal-and-LB only, so nothing reaches it around the LB.
+  gcp: 2,
+  // Cloud Run's front end appends its peer. Behind the Firebase Hosting
+  // rewrite that peer is the Hosting CDN edge, and the entry Hosting adds
+  // before it cannot be told apart from a forged one (the service is
+  // invokable on *.run.app too) — so the edge address is the most that can
+  // be trusted. Staging (Cloud Run domain mapping) gets the visitor.
+  "gcp-firebase": 1,
+  // Caddy without `trusted_proxies` replaces the header with its peer; the
+  // gateway is reachable only on the Compose network.
+  "self-hosted": 1,
+  // CloudFront appends the viewer, the ALB appends CloudFront. (No ECS task
+  // definition consumes it yet — see stacks/aws.)
+  aws: 2,
+  // Container Apps ingress appends its peer; the gateway's ingress is
+  // internal to the environment (no Front Door route to it yet).
+  azure: 1,
+};
+
 /**
  * The env of the gateway service. Order is stable so the stacks see no
  * spurious diffs.
@@ -365,6 +399,7 @@ function commonEnv(inputs: ServiceEnvInputs): CloudRunEnvVar[] {
 export function gatewayEnvContract<V>(inputs: RuntimeEnvInputs<V>): CloudRunEnvVar<V | string>[] {
   return [
     ...commonEnv(inputs),
+    { name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS[inputs.provider]) },
     { name: "PUBLIC_DATABASE_URL", value: inputs.databaseUrls.public },
     ...secretEnv("gateway", inputs.env),
   ];

package/src/stack-converge-secrets.test.ts

@@ -344,6 +344,8 @@ describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", (
       "ADMIN_DATABASE_URL",
       // #650 — the staging gate key arrives in the same roll.
       "CAELO_STAGING_GATE_SECRET",
+      // #845 — and which forwarded address is the visitor.
+      "CAELO_TRUSTED_PROXY_HOPS",
       "PUBLIC_DATABASE_PASSWORD",
     ]);
   });

package/src/stack-converge.test.ts

@@ -316,6 +316,8 @@ describe("planContractEnv", () => {
       "--update-secrets=CAELO_STAGING_GATE_SECRET=caelo-production-staging-gate-secret:latest",
     ]);
     expect(plan.services.gateway.flags).toEqual([
+      // The gateway learns which forwarded address is the visitor (#845).
+      "--update-env-vars=CAELO_TRUSTED_PROXY_HOPS=1",
       "--update-secrets=CAELO_STAGING_GATE_SECRET=caelo-production-staging-gate-secret:latest",
     ]);
   });

package/src/upgrade/converge.ts

@@ -24,11 +24,7 @@
  * {@link AppRollHooks} the app-roll calls in between, and a part after it.
  */
 
-import {
-  ensureGatewayRolePassword,
-  findSqlInstance,
-  planPublicRoleSwitch,
-} from "../gateway-credentials.js";
+import { findSqlInstance, planPublicRoleSwitch } from "../gateway-credentials.js";
 import type { GcloudRunner, Sleep } from "../gcloud-retry.js";
 import { upgraderServiceAccountEmail } from "../gcp-names.js";
 import type { InstallMetadata } from "../install-state.js";
@@ -291,10 +287,9 @@ export function startConverge(
   }
 
   async function databaseLogins(): Promise<boolean> {
-    // #613 — migration 0248 creates gateway_role without a password; it gets
-    // its secret's value before the gateway rolls onto it. public_role
-    // moves onto its own password right before the gateway's roll.
-    const s = r.step("Ensuring the gateway's database login (gateway_role)...");
+    // #613 — public_role moves onto its own password right before the
+    // gateway's roll. The gateway has no other database login (#635).
+    const s = r.step("Preparing the gateway's database login (public_role)...");
     const sqlInstance = await findSqlInstance(install, { run });
     if (!sqlInstance) {
       s.failed("Could not find the Cloud SQL instance. Aborting upgrade.");
@@ -303,16 +298,7 @@ export function startConverge(
     }
     const roleTarget = { projectId: install.projectId, env: install.env, sqlInstance };
     const roleDeps = { ...runDeps, ...(deps.http ? { http: deps.http } : {}) };
-    const gatewayRole = await ensureGatewayRolePassword(roleTarget, roleDeps);
-    if (gatewayRole.status === "failed") {
-      s.failed("gateway_role could not be given its password. Aborting upgrade.");
-      r.error(`  ${gatewayRole.error ?? ""}`);
-      r.warn(
-        "Migrations ran (0248 creates gateway_role); no traffic was shifted. Fix the above and re-run upgrade.",
-      );
-      return false;
-    }
-    s.done("gateway_role ready");
+    s.done("public_role ready to switch");
     publicRole = planPublicRoleSwitch(roleTarget, service("gateway").liveEnv, roleDeps);
     return true;
   }

package/src/wizards/gcp.ts

@@ -45,7 +45,6 @@ import {
 import { formatDnsRecordGroups, groupDnsRecords, type InstallDnsRecord } from "../dns/groups.js";
 import { pickDnsAdapter } from "../dns/index.js";
 import type { DnsRecord } from "../dns/types.js";
-import { ensureGatewayRolePassword, findSqlInstance } from "../gateway-credentials.js";
 import {
   activeAccount,
   type BillingAccount,
@@ -453,13 +452,7 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     }
   }
 
-  // === 11.2. The gateway's database login (#613) ===
-  // Migration 0248 created gateway_role without a password; it gets the
-  // gateway-role-password secret's value here. The gateway (deployed by
-  // Pulumi before migrations) retries its database on every request, so it
-  // starts serving /api/* as soon as this lands — no restart.
-  phase("Finishing: database logins, operator access, welcome page");
-  await stepGatewayRolePassword(projectId);
+  phase("Finishing: operator access, welcome page");
 
   // === 11.4. The upgrader job: Settings → Updates → Install update (#696) ===
   // Before operator access, which keeps the upgrader's caelo-mcp grant.
@@ -934,29 +927,6 @@ async function stepUrlMapRedirectsAccess(projectId: string): Promise<void> {
   s.stop(green(`Redirects role ready (${r.role})`));
 }
 
-/**
- * Give `gateway_role` (created by migration 0248) its password from the
- * `gateway-role-password` secret (#613). public_role already has its own:
- * the stack set it from `public-role-password`. Idempotent, so it runs on
- * every wizard pass.
- */
-async function stepGatewayRolePassword(projectId: string): Promise<void> {
-  const s = spinner();
-  s.start("Setting the gateway's database login (gateway_role)...");
-  const install = { projectId, env: GCP_STACK_ENV };
-  const sqlInstance = await findSqlInstance(install);
-  const r = sqlInstance
-    ? await ensureGatewayRolePassword({ ...install, sqlInstance })
-    : { status: "failed" as const, error: "the Cloud SQL instance was not found" };
-  if (r.status === "failed") {
-    s.stop(red(`Failed: ${r.error ?? ""}`));
-    log.error("Re-run the wizard once the cause is fixed (this step is idempotent).");
-    cancel("Aborted.");
-    process.exit(1);
-  }
-  s.stop(green("gateway_role ready"));
-}
-
 /**
  * Set up the upgrader job (upgrader-setup.ts, #696): what the admin's
  * "Install update" starts. After migrations, because the job's database

package/stacks/aws/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on AWS managed services. Implements the shared `
 | Blob storage | Two S3 buckets (`caelo-<env>-media` + `caelo-<env>-static`) |
 | CDN | CloudFront distribution with two origins (S3 static + S3 media); static files are served as files, no edge compute on the request path |
 | Container runtime | ECS Fargate cluster + four services (admin / gateway / orchestrator / runner) |
-| Secret store | AWS Secrets Manager (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `publicDatabaseUrlOut` only, never a cms_admin URL of any role (#613, #635). |
+| Secret store | AWS Secrets Manager (postgres-password, public-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `publicDatabaseUrlOut` only, never a cms_admin URL of any role (#613, #635). |
 | DNS + cert | ACM cert (us-east-1, DNS-validated, supports `*.<domain>`) |
 | Edge-log sink | CloudFront access logs delivered to the CloudWatch log group `/caelo/<env>/cloudfront` in us-east-1 (queryable by P12A analytics plugin) |
 

package/stacks/aws/index.ts

@@ -97,11 +97,8 @@ function randomHex(bytes: number): string {
 const postgresPassword = pulumi.secret(randomHex(32));
 // #613 — one password per database role, so the gateway (public_role only,
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
-// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
-// any service's login; its password stays until the contract release that
-// drops the role (#635).
+// (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
-const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -122,7 +119,6 @@ function secret(name: string, value: pulumi.Output<string>): aws.secretsmanager.
 
 const pgSecret = secret("postgres-password", postgresPassword);
 const publicRoleSecret = secret("public-role-password", publicRolePassword);
-const gatewayRoleSecret = secret("gateway-role-password", gatewayRolePassword);
 const csrfSecretRes = secret("csrf-secret", csrfSecret);
 const cookieSecretRes = secret("cookie-secret", cookieSecret);
 const anthropicSecretRes = secret("anthropic-api-key", anthropicApiKey);
@@ -365,7 +361,6 @@ const cluster = new aws.ecs.Cluster(`${namePrefix}-ecs`, {
 const secretArns: Record<AwsSecret, pulumi.Output<string>> = {
   "postgres-password": pgSecret.arn,
   "public-role-password": publicRoleSecret.arn,
-  "gateway-role-password": gatewayRoleSecret.arn,
   "csrf-secret": csrfSecretRes.arn,
   "cookie-secret": cookieSecretRes.arn,
   "anthropic-api-key": anthropicSecretRes.arn,

package/stacks/azure/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on Azure managed services. Implements the shared
 | Blob storage | Storage Account with a private `media` container and static-website hosting (`$web`) |
 | CDN / Edge | Azure Front Door Standard: the primary domain serves the static website as files, with a Front Door managed certificate; no edge compute on the request path |
 | Container runtime | Four Container Apps (admin / gateway / orchestrator / runner) in one managed environment |
-| Secret store | Key Vault (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `PUBLIC_DATABASE_URL` only, never a cms_admin credential of any role (#613, #635). |
+| Secret store | Key Vault (postgres-password, public-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `PUBLIC_DATABASE_URL` only, never a cms_admin credential of any role (#613, #635). |
 | Edge-log sink | Log Analytics workspace receives Container Apps logs (queryable by P12A analytics plugin via Azure Monitor) |
 
 The Caelo runtime never knows it's on Azure — every Container App consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.

package/stacks/azure/index.ts

@@ -39,7 +39,12 @@ import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { azureFrontDoorDnsRecords } from "../../dist/azure-front-door.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
-import { ADMIN_MEMORY_DEFAULT, azureContainerAppResources } from "../../dist/stack-contract.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  azureContainerAppResources,
+  GATEWAY_TRUSTED_PROXY_HOPS,
+  TRUSTED_PROXY_HOPS_ENV,
+} from "../../dist/stack-contract.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
@@ -83,11 +88,8 @@ function randomHex(bytes: number): string {
 const postgresPassword = pulumi.secret(randomHex(32));
 // #613 — one password per database role, so the gateway (public_role only,
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
-// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
-// any service's login; its password stays until the contract release that
-// drops the role (#635).
+// (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
-const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -117,7 +119,6 @@ function keyVaultSecret(shortName: string, value: pulumi.Output<string>): azure.
 
 const _pgSecret = keyVaultSecret("pg-password", postgresPassword);
 keyVaultSecret("public-role-password", publicRolePassword);
-keyVaultSecret("gateway-role-password", gatewayRolePassword);
 keyVaultSecret("csrf-secret", csrfSecret);
 keyVaultSecret("cookie-secret", cookieSecret);
 keyVaultSecret("anthropic-api-key", anthropicApiKey);
@@ -419,6 +420,8 @@ const adminApp = containerApp({
 const _gatewayApp = containerApp({
   serviceName: "gateway",
   databaseEnv: [{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }],
+  // Which X-Forwarded-For entry is the visitor (api-gateway client-ip.ts).
+  extraEnv: [{ name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS.azure) }],
 });
 const _orchestratorApp = containerApp({
   serviceName: "orchestrator",

package/stacks/gcp/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | Blob storage | Two GCS buckets (`<project>-caelo-<env>-media`, `<project>-caelo-<env>-static`) with uniform bucket-level access |
 | CDN | Global HTTPS load balancer + Cloud CDN backend bucket: `<domain>` serves the static bucket as files, `/api/*` goes to the gateway, `admin.<domain>` to the IAP-gated admin |
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
-| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login); `gateway_role`, created by migration 0248, is no service's login any more. |
+| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret and public-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login). |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.

package/stacks/gcp/index.ts

@@ -251,14 +251,11 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
-  "gateway-role-password": gcpSecretId(env, "gateway-role-password"),
 };
 
 // #613 — public_role's own password (CLI-generated, stack-contract.ts
 // DATABASE_ROLE_SECRET), so the gateway, which reads it, never holds
-// admin_role's. gateway_role is not declared here: migration 0248 creates
-// it in SQL (an API-created user would join cloudsqlsuperuser) and the CLI
-// sets its password after migrations.
+// admin_role's. The gateway has no other database login (#635).
 const publicRolePassword = pulumi.secret(
   gcp.secretmanager.getSecretVersionOutput(
     { project, secret: gcpSecretId(env, "public-role-password") },

package/stacks/gcp-firebase/index.ts

@@ -224,14 +224,11 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
-  "gateway-role-password": gcpSecretId(env, "gateway-role-password"),
 };
 
 // #613 — public_role's own password (CLI-generated, stack-contract.ts
 // DATABASE_ROLE_SECRET), so the gateway, which reads it, never holds
-// admin_role's. gateway_role is not declared here: migration 0248 creates
-// it in SQL (an API-created user would join cloudsqlsuperuser) and the CLI
-// sets its password after migrations.
+// admin_role's. The gateway has no other database login (#635).
 const publicRolePassword = pulumi.secret(
   gcp.secretmanager.getSecretVersionOutput(
     { project, secret: gcpSecretId(env, "public-role-password") },