@caelo-cms/provisioning 0.10.52 → 0.10.55

package/src/private-file.test.ts

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: MPL-2.0
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import {
+  chmodSync,
+  closeSync,
+  mkdirSync,
+  mkdtempSync,
+  openSync,
+  readdirSync,
+  readFileSync,
+  readSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { tightenPrivateTree, writePrivateFile } from "./private-file.js";
+
+let dir: string;
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "caelo-private-file-"));
+});
+afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+const mode = (path: string) => statSync(path).mode & 0o777;
+
+describe("writePrivateFile", () => {
+  it("creates the file owner-only and replaces a world-readable file with an owner-only one", () => {
+    const fresh = join(dir, "fresh.json");
+    writePrivateFile(fresh, "{}");
+    expect(mode(fresh)).toBe(0o600);
+
+    const legacy = join(dir, "legacy.json");
+    writeFileSync(legacy, "{}", { mode: 0o644 });
+    chmodSync(legacy, 0o644);
+    writePrivateFile(legacy, '{"secret":"x"}');
+    expect(mode(legacy)).toBe(0o600);
+    expect(readFileSync(legacy, "utf8")).toBe('{"secret":"x"}');
+    expect(readdirSync(dir).sort()).toEqual(["fresh.json", "legacy.json"]);
+  });
+
+  it("never writes the new secret into the old world-readable inode", () => {
+    // A local user who opened the 0644 file before the rewrite keeps that
+    // descriptor; a write-then-chmod would let it read the new secret.
+    const legacy = join(dir, "internal-secret.json");
+    writeFileSync(legacy, "old");
+    chmodSync(legacy, 0o644);
+    const fd = openSync(legacy, "r");
+    try {
+      writePrivateFile(legacy, "new-secret");
+      const buf = Buffer.alloc(64);
+      const n = readSync(fd, buf, 0, buf.length, 0);
+      expect(buf.subarray(0, n).toString()).toBe("old");
+    } finally {
+      closeSync(fd);
+    }
+  });
+});
+
+describe("tightenPrivateTree", () => {
+  it("takes group/other access off an older install's directory and secrets, skipping missing ones", () => {
+    const install = join(dir, ".caelo");
+    mkdirSync(join(install, "bootstrap"), { recursive: true });
+    chmodSync(install, 0o755);
+    chmodSync(join(install, "bootstrap"), 0o755);
+    writeFileSync(join(install, "config.json"), "{}");
+    chmodSync(join(install, "config.json"), 0o644);
+    writeFileSync(join(install, "Caddyfile"), "");
+    chmodSync(join(install, "Caddyfile"), 0o644);
+
+    tightenPrivateTree(install, ["bootstrap", "backups"], ["config.json", "internal-secret.json"]);
+
+    expect(mode(install)).toBe(0o700);
+    expect(mode(join(install, "bootstrap"))).toBe(0o700);
+    expect(mode(join(install, "config.json"))).toBe(0o600);
+    // Not a secret: the Caddy container reads it through its bind mount.
+    expect(mode(join(install, "Caddyfile"))).toBe(0o644);
+  });
+});

package/src/private-file.ts

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: MPL-2.0
+import { randomUUID } from "node:crypto";
+import { chmodSync, existsSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+
+/**
+ * Write a file only its owner may read (0600), replacing any file at `path`.
+ *
+ * The data goes into a fresh temp file created 0600 (`wx`, so never an
+ * existing file or a planted symlink) and is renamed over `path`. Writing in
+ * place would not do: `writeFileSync`'s `mode` applies only when the call
+ * creates the file, so a secret file an older CLI wrote world-readable would
+ * hold the new secret world-readable until a chmod after the write — and a
+ * reader that opened it before any chmod keeps its descriptor. The rename
+ * gives the new contents a new inode that was never readable by anyone else.
+ */
+export function writePrivateFile(path: string, data: string): void {
+  const tmp = `${path}.${randomUUID()}.tmp`;
+  writeFileSync(tmp, data, { mode: 0o600, flag: "wx" });
+  try {
+    renameSync(tmp, path);
+  } catch (e) {
+    rmSync(tmp, { force: true });
+    throw e;
+  }
+}
+
+/**
+ * Take group/other access off an install's secrets directory and the secret
+ * files in it, for installs an older CLI created with the default umask
+ * (`.caelo/` 0755, `config.json` / `internal-secret.json` 0644). Those files
+ * are written once and rarely rewritten, so tightening only on the next write
+ * would leave them readable to every local user. Missing paths are skipped:
+ * which secrets exist depends on the provider and how far `init` got.
+ *
+ * @param dir the install's directory, tightened to 0700
+ * @param privateDirs subdirectories (relative to `dir`) tightened to 0700
+ * @param privateFiles files (relative to `dir`) tightened to 0600
+ */
+export function tightenPrivateTree(
+  dir: string,
+  privateDirs: readonly string[],
+  privateFiles: readonly string[],
+): void {
+  const tighten = (path: string, mode: number) => {
+    if (existsSync(path) && (statSync(path).mode & 0o077) !== 0) chmodSync(path, mode);
+  };
+  tighten(dir, 0o700);
+  for (const sub of privateDirs) tighten(`${dir}/${sub}`, 0o700);
+  for (const file of privateFiles) tighten(`${dir}/${file}`, 0o600);
+}

package/src/release-contract.ts

@@ -49,6 +49,9 @@ export const INFRA_CONTRACT_PATHS: readonly string[] = [
   // The in-cloud upgrader job's service account, custom roles and bucket
   // grants (#799 added one without the checks noticing).
   "packages/provisioning/src/upgrader-setup.ts",
+  // #875 — the quality-audit job, its service account, results bucket and
+  // grants.
+  "packages/provisioning/src/audit-job-setup.ts",
 ];
 
 /**

package/src/runtime-secrets.test.ts

@@ -115,13 +115,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "present",
-      "present",
-      "present",
-      "present",
-      "present",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["present", "present", "present", "present"]);
     expect(lines().some((l) => l.includes(" create ") || l.includes(" add "))).toBe(false);
   });
 
@@ -132,13 +126,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run, generate: () => `generated-value-${++n}` },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "applied", "applied", "applied"]);
     const creates = calls.filter((c) => c.line.startsWith("secrets create"));
     expect(creates).toEqual([
       {
@@ -149,19 +137,15 @@ describe("ensureGeneratedSecrets", () => {
         line: "secrets create caelo-production-tool-approval-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
         stdin: "generated-value-2",
       },
-      // #613 — the gateway's role passwords: fresh values, never admin_role's.
+      // #613 — the gateway's role password: a fresh value, never admin_role's.
       {
         line: "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
         stdin: "generated-value-3",
       },
-      {
-        line: "secrets create caelo-production-gateway-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-        stdin: "generated-value-4",
-      },
       // #650 — the staging access gate's key.
       {
         line: "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-        stdin: "generated-value-5",
+        stdin: "generated-value-4",
       },
     ]);
     for (const c of calls) expect(c.line).not.toContain("generated-value");
@@ -186,7 +170,6 @@ describe("ensureGeneratedSecrets", () => {
       "generated",
       "generated",
       "generated",
-      "generated",
     ]);
     for (const c of calls) expect(c.line).not.toContain("operator-set");
   });
@@ -197,20 +180,13 @@ describe("ensureGeneratedSecrets", () => {
       "secrets versions list caelo-production-internal-secret": [ok("")],
       "secrets versions list caelo-production-tool-approval-secret": [ok("v/1")],
       "secrets versions list caelo-production-public-role-password": [ok("v/1")],
-      "secrets versions list caelo-production-gateway-role-password": [ok("v/1")],
       "secrets versions list caelo-production-staging-gate-secret": [ok("v/1")],
     });
     const outcomes = await ensureGeneratedSecrets(
       { ...secretsInstall, replication: { kind: "automatic" } },
       { run, generate: () => "v" },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "applied",
-      "present",
-      "present",
-      "present",
-      "present",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "present", "present", "present"]);
     expect(calls.filter((c) => c.line.startsWith("secrets versions add"))).toEqual([
       {
         line: "secrets versions add caelo-production-internal-secret --project=acme --data-file=-",
@@ -244,13 +220,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: { kind: "automatic" } },
       { run, generate: () => "v" },
     );
-    expect(outcomes.map((o) => o.status)).toEqual([
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-      "applied",
-    ]);
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "applied", "applied", "applied"]);
     expect(outcomes.every((o) => o.detail?.includes("gcp.resourceLocations"))).toBe(true);
     const creates = lines().filter((l) => l.startsWith("secrets create"));
     // One refused automatic attempt; then every secret — the refused one
@@ -260,7 +230,6 @@ describe("ensureGeneratedSecrets", () => {
       "secrets create caelo-production-internal-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-tool-approval-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-      "secrets create caelo-production-gateway-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       // #652 — the staging gate's key follows the same path.
       "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
     ]);
@@ -290,7 +259,7 @@ describe("ensureGeneratedSecrets", () => {
       { run, generate: () => "v" },
     );
     expect(outcomes.every((o) => o.status === "failed")).toBe(true);
-    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(5);
+    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(4);
   });
 });
 
@@ -299,7 +268,6 @@ describe("rotationRefusal", () => {
     for (const s of [
       "postgres-password",
       "public-role-password",
-      "gateway-role-password",
       "internal-secret",
       "tool-approval-secret",
       "staging-gate-secret",
@@ -311,6 +279,8 @@ describe("rotationRefusal", () => {
   it("refuses the KEK (re-encryption needed) and secrets nothing reads", () => {
     expect(rotationRefusal("secret-kek")).toContain("re-encryption");
     expect(rotationRefusal("csrf-secret")).toContain("Rotatable");
+    // #635 — the former gateway_role is gone; there is nothing to rotate.
+    expect(rotationRefusal("gateway-role-password")).toContain("Rotatable");
   });
 });
 
@@ -411,28 +381,6 @@ describe("rotateRuntimeSecret", () => {
     ).toBe(true);
   });
 
-  it("gateway-role-password: changes gateway_role only and rolls no service (#613, #635)", async () => {
-    const { run, lines } = fakeGcloud({
-      ...converged(),
-      "secrets versions access": [ok("old-pw")],
-    });
-    const sql = fakeSqlApi();
-    const report = await rotateRuntimeSecret(target, "gateway-role-password", {
-      run,
-      http: sql.http,
-      sleep: async () => {},
-      generate: () => "new-pw",
-    });
-    expect(report.ok).toBe(true);
-    expect(sql.passwords()).toEqual(["gateway_role new-pw"]);
-    // No service logs in as gateway_role any more: the gateway reads
-    // cms_public only (#635).
-    expect(lines().filter((l) => l.startsWith("run services update "))).toEqual([]);
-    expect(lines()).toContain(
-      "secrets versions access latest --secret=caelo-production-gateway-role-password --project=acme",
-    );
-  });
-
   it("public-role-password: stores nothing and rolls nothing when public_role can't be changed", async () => {
     const { run, lines } = fakeGcloud({
       ...converged(),
@@ -474,26 +422,6 @@ describe("rotateRuntimeSecret", () => {
     expect(lines().every((l) => l.startsWith("run services describe"))).toBe(true);
   });
 
-  it("refuses gateway-role-password while the gateway still logs in with it (before #635)", async () => {
-    const answers = converged();
-    answers["run services describe gw-svc"] = [
-      service([
-        ref("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
-        ref("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
-      ]),
-    ];
-    const { run } = fakeGcloud(answers);
-    const sql = fakeSqlApi();
-    const report = await rotateRuntimeSecret(target, "gateway-role-password", {
-      run,
-      http: sql.http,
-      generate: () => "new-pw",
-    });
-    expect(report.ok).toBe(false);
-    expect(report.error).toContain("GATEWAY_DATABASE_PASSWORD");
-    expect(sql.requests).toHaveLength(0);
-  });
-
   it("refuses before changing anything on an install upgrade hasn't moved over", async () => {
     const { run, lines } = fakeGcloud({
       "run services describe adm-svc": [

package/src/runtime-secrets.ts

@@ -13,9 +13,8 @@
  *     Secret Manager on stdin — never on argv, never to disk.
  *   - {@link ensureDatabaseRolePassword}: a database role's password set
  *     from its secret (`DATABASE_ROLE_SECRET`), through the Cloud SQL Admin
- *     API — how `gateway_role` (created by migration 0248, without a
- *     password) and `public_role` (moved off admin_role's password, #613)
- *     get theirs.
+ *     API — how `public_role` (moved off admin_role's password, #613) gets
+ *     its own.
  *   - {@link rotateRuntimeSecret}: `cms-provision rotate-secret`.
  *
  * Every function reports instead of throwing on a gcloud failure.
@@ -368,7 +367,6 @@ async function addVersion(
 export const ROTATABLE_SECRETS = [
   "postgres-password",
   "public-role-password",
-  "gateway-role-password",
   "internal-secret",
   "tool-approval-secret",
   // #650 — rotating it signs every staging session out and replaces the
@@ -726,8 +724,6 @@ export async function readSecretValue(
  * the role already has is a no-op for every client, so upgrade runs this on
  * every roll and an install converges whatever state it was left in.
  *
- * The role must exist: `gateway_role` is created by migration 0248, so this
- * runs after migrations.
  */
 export async function ensureDatabaseRolePassword(
   target: DatabaseRoleTarget,

package/src/self-hosted-compose.test.ts

@@ -19,7 +19,7 @@ const GATEWAY = `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`;
 const base: Omit<ComposeSpec, "images"> = {
   domain: "example.com",
   postgresPassword: "pgpw",
-  rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+  rolePasswords: { admin: "adminpw", public: "publicpw" },
   caeloSecretKek: "0".repeat(64),
   anthropicApiKey: "sk-ant-x",
   diskSize: "20Gi",

package/src/self-hosted-roles.integration.test.ts

@@ -1,11 +1,12 @@
 // SPDX-License-Identifier: MPL-2.0
 
 /**
- * #613 review — `cms-provision up` on a self-hosted volume created before
- * the per-role passwords: no `gateway_role`, `public_role` on another
- * password. The convergence script, run as the superuser exactly as `up`
- * runs it (psql, script on stdin), must leave the roles on the configured
- * passwords with the gateway's grants in place — and be safe to re-run.
+ * #613 review, #635 — `cms-provision up` on a self-hosted volume from
+ * before: `public_role` on another password, and the gateway's former
+ * `gateway_role` login still there with its grants. The convergence
+ * script, run as the superuser exactly as `up` runs it (psql, script on
+ * stdin), must leave the roles on the configured passwords and the former
+ * gateway_role gone — and be safe to re-run.
  *
  * Runs against the test database with the passwords the environment already
  * uses, so the other suites' connection URLs keep working afterwards.
@@ -25,9 +26,8 @@ const required = [
   "POSTGRES_PORT",
   "ADMIN_ROLE_PASSWORD",
   "PUBLIC_ROLE_PASSWORD",
-  "GATEWAY_ROLE_PASSWORD",
   "ADMIN_DATABASE_URL",
-  "GATEWAY_DATABASE_URL",
+  "PUBLIC_DATABASE_URL",
 ] as const;
 const missing = required.filter((name) => !env[name]);
 if (missing.length > 0) throw new Error(`${missing.join(", ")} required (see .env.example)`);
@@ -63,19 +63,20 @@ const psql: SuperuserPsql = async (script) => {
 const passwords = {
   admin: env.ADMIN_ROLE_PASSWORD as string,
   public: env.PUBLIC_ROLE_PASSWORD as string,
-  gateway: env.GATEWAY_ROLE_PASSWORD as string,
 };
 
-describe("self-hosted role convergence against Postgres (#613 review)", () => {
-  it("brings a pre-#613 volume to the configured roles, grants and passwords — twice", async () => {
-    // The pre-#613 volume: no gateway_role, public_role on another password.
+describe("self-hosted role convergence against Postgres (#613 review, #635)", () => {
+  it("brings an old volume to the configured roles and passwords, without gateway_role — twice", async () => {
+    // The old volume: the former gateway_role with a cms_admin grant, and
+    // public_role on another password.
     const reset = await psql(
       [
         "\\set ON_ERROR_STOP on",
+        "SELECT 'CREATE ROLE gateway_role NOINHERIT LOGIN' WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') \\gexec",
+        "GRANT CONNECT ON DATABASE cms_admin TO gateway_role;",
         "\\connect cms_admin",
-        "DROP OWNED BY gateway_role;",
+        "GRANT SELECT (gateway_cookie_secret) ON site_settings TO gateway_role;",
         "\\connect postgres",
-        "DROP ROLE gateway_role;",
         "ALTER ROLE public_role WITH PASSWORD 'the-old-shared-password';",
         "",
       ].join("\n"),
@@ -87,36 +88,20 @@ describe("self-hosted role convergence against Postgres (#613 review)", () => {
       expect(r).toEqual({ ok: true });
     }
 
-    // The gateway logs in with its configured password and reads what 0248 grants.
-    const gateway = new SQL(env.GATEWAY_DATABASE_URL as string);
+    // public_role logs in with its configured password again.
+    const pub = new SQL(env.PUBLIC_DATABASE_URL as string);
     try {
-      const rows = (await gateway.begin(async (tx) => {
-        await tx.unsafe("SET LOCAL caelo.actor_kind = 'system'");
-        return tx`SELECT current_user::text AS u, length(gateway_cookie_secret) > 0 AS s FROM site_settings`;
-      })) as { u: string; s: boolean }[];
-      expect(rows[0]).toEqual({ u: "gateway_role", s: true });
+      const [who] = (await pub`SELECT current_user::text AS u`) as { u: string }[];
+      expect(who?.u).toBe("public_role");
     } finally {
-      await gateway.end();
+      await pub.end();
     }
+    // The former gateway_role is gone, with its grants (#635).
     const admin = new SQL(env.ADMIN_DATABASE_URL as string);
     try {
-      const [attrs] = (await admin`
-        SELECT rolcanlogin, rolinherit FROM pg_roles WHERE rolname = 'gateway_role'`) as {
-        rolcanlogin: boolean;
-        rolinherit: boolean;
-      }[];
-      expect(attrs).toEqual({ rolcanlogin: true, rolinherit: false });
-      const policies = (await admin`
-        SELECT policyname::text AS p FROM pg_policies WHERE 'gateway_role' = ANY (roles) ORDER BY 1`) as {
-        p: string;
-      }[];
-      expect(policies.map((p) => p.p)).toEqual([
-        "audit_events_gateway_plugin_only",
-        // #634 (migration 0252): the visitor paths' row limits. The A/B
-        // ones went with the experiment tables (#676, migration 0259).
-        "comment_archive_gateway_approved_only",
-        "rate_limit_buckets_gateway_keys",
-      ]);
+      const roles =
+        (await admin`SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role'`) as unknown[];
+      expect(roles).toEqual([]);
     } finally {
       await admin.end();
     }

package/src/self-hosted-roles.test.ts

@@ -8,26 +8,30 @@ import {
   selfHostedBootstrapScript,
 } from "./self-hosted-roles.js";
 
-const PASSWORDS = { admin: "a'pw", public: "p-pw", gateway: "g-pw" };
+const PASSWORDS = { admin: "a'pw", public: "p-pw" };
 
 describe("roleConvergenceScript (#613 review)", () => {
   const script = roleConvergenceScript(PASSWORDS);
 
   it("creates missing roles and (re)sets every role's password, quoted", () => {
-    for (const role of ["admin_role", "public_role", "gateway_role"]) {
+    for (const role of ["admin_role", "public_role"]) {
       expect(script).toContain(
         `WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}')`,
       );
     }
     expect(script).toContain("ALTER ROLE admin_role WITH LOGIN PASSWORD 'a''pw';");
-    expect(script).toContain("ALTER ROLE gateway_role WITH LOGIN PASSWORD 'g-pw';");
+    expect(script).not.toContain("CREATE ROLE gateway_role");
   });
 
-  it("re-applies migration 0248's gateway grants in cms_admin, and stops on the first error", () => {
+  it("drops the former gateway_role with what it holds in both databases, and stops on the first error (#635)", () => {
     expect(script.startsWith("\\set ON_ERROR_STOP on")).toBe(true);
-    expect(script.indexOf("\\connect cms_admin")).toBeLessThan(
-      script.indexOf("PERFORM caelo_grant_gateway_role()"),
-    );
+    const publicDrop = script.indexOf("\\connect cms_public");
+    const adminDrop = script.indexOf("\\connect cms_admin");
+    expect(publicDrop).toBeGreaterThan(-1);
+    expect(adminDrop).toBeGreaterThan(publicDrop);
+    expect(script.match(/DROP OWNED BY gateway_role/g)).toHaveLength(2);
+    expect(script.indexOf("THEN DROP ROLE gateway_role;")).toBeGreaterThan(adminDrop);
+    expect(script).not.toContain("caelo_grant_gateway_role");
   });
 });
 

package/src/self-hosted-roles.ts

@@ -7,13 +7,14 @@
  * bootstrap.sh creates the application roles, but only on the Postgres
  * container's FIRST start (docker-entrypoint-initdb.d). An install created
  * before the per-role passwords has a data volume whose roles have other
- * passwords — and no `gateway_role` at all — so emitting Compose URLs with
- * the new passwords would lock the admin and the gateway out on the next
- * restart. `cms-provision up` therefore runs {@link roleConvergenceScript}
- * through the running container as the Postgres superuser BEFORE it writes
- * the new Compose file: it creates missing roles and databases, sets each
- * role's password to the configured one, and re-applies migration 0248's
- * gateway grants. Every statement is idempotent.
+ * passwords, so emitting Compose URLs with the new passwords would lock the
+ * admin and the gateway out on the next restart. `cms-provision up`
+ * therefore runs {@link roleConvergenceScript} through the running container
+ * as the Postgres superuser BEFORE it writes the new Compose file: it
+ * creates missing roles and databases and sets each role's password to the
+ * configured one. It also drops the former `gateway_role` (#635: the
+ * gateway has no cms_admin login), with whatever it still holds. Every
+ * statement is idempotent.
  *
  * Passwords travel on psql's stdin, never on argv.
  */
@@ -34,7 +35,7 @@ function literal(s: string): string {
 export const AGENT_DB_ROLE = "caelo_agent";
 
 /** The application roles bootstrap.sh and the convergence create. */
-const APP_ROLES = ["admin_role", "public_role", "gateway_role"] as const;
+const APP_ROLES = ["admin_role", "public_role"] as const;
 type AppRole = (typeof APP_ROLES)[number];
 
 /** How a role's password appears in the SQL: a literal, or a psql variable. */
@@ -69,12 +70,14 @@ function convergenceSql(password: PasswordSql, agent: boolean): string {
     "REVOKE ALL ON DATABASE cms_public FROM PUBLIC;",
     "GRANT CONNECT ON DATABASE cms_admin TO admin_role;",
     "GRANT CONNECT ON DATABASE cms_public TO public_role, admin_role;",
+    // #635 — the gateway's former cms_admin login goes, with whatever it
+    // still holds in either database (the superuser may drop what
+    // migration 0285 could only revoke).
+    "\\connect cms_public",
+    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
     "\\connect cms_admin",
-    // A database that ran migration 0248 before gateway_role existed has no
-    // grants for it yet; one that has not run it yet gets them from it.
-    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_proc WHERE proname = 'caelo_grant_gateway_role') THEN PERFORM caelo_grant_gateway_role(); END IF; END $$;",
-    // Migration 0251's staging-gate grants (issue #650), same convergence.
-    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_proc WHERE proname = 'caelo_grant_gateway_staging_access') THEN PERFORM caelo_grant_gateway_staging_access(); END IF; END $$;",
+    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
+    "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP ROLE gateway_role; END IF; END $$;",
     // Migrations 0267 + 0270 (#696): the upgrader role's grants, applied
     // now that the role exists.
     "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_proc WHERE proname = 'caelo_grant_platform_updater') THEN PERFORM caelo_grant_platform_updater(); END IF; END $$;",
@@ -84,7 +87,7 @@ function convergenceSql(password: PasswordSql, agent: boolean): string {
 
 /**
  * The psql script (run as the superuser, connected to any database) that
- * brings roles, databases and the gateway's grants to the configured state.
+ * brings roles and databases to the configured state.
  * Mirrors bootstrap.sh, plus the password reset bootstrap.sh never does.
  * With `agentPassword`, also the host agent's login (#696 Phase 4c).
  */
@@ -92,7 +95,6 @@ export function roleConvergenceScript(passwords: RolePasswords, agentPassword?:
   const byRole: Record<AppRole, string> = {
     admin_role: passwords.admin,
     public_role: passwords.public,
-    gateway_role: passwords.gateway,
   };
   return convergenceSql(
     (role) => literal(role === AGENT_DB_ROLE ? (agentPassword ?? "") : byRole[role]),
@@ -104,7 +106,6 @@ export function roleConvergenceScript(passwords: RolePasswords, agentPassword?:
 const PASSWORD_ENV: Record<AppRole | typeof AGENT_DB_ROLE, string> = {
   admin_role: "ADMIN_ROLE_PASSWORD",
   public_role: "PUBLIC_ROLE_PASSWORD",
-  gateway_role: "GATEWAY_ROLE_PASSWORD",
   [AGENT_DB_ROLE]: "AGENT_ROLE_PASSWORD",
 };
 

package/src/self-hosted-upgrade.test.ts

@@ -19,6 +19,7 @@ import {
   readRelease,
   recordRelease,
 } from "./self-hosted-release.js";
+import type { ConvergeOutcome } from "./self-hosted-roles.js";
 import {
   composePath,
   legacyComposePath,
@@ -121,11 +122,15 @@ beforeEach(() => {
 });
 afterEach(() => rmSync(dir, { recursive: true, force: true }));
 
-function deps(runner: HostRunner) {
+function deps(runner: HostRunner & { calls: string[] }, roles: ConvergeOutcome = { ok: true }) {
   return {
     caeloDir: dir,
     runner,
     renderCompose: render,
+    convergeRoles: async () => {
+      runner.calls.push("converge roles");
+      return roles;
+    },
     log,
     fetchImpl: registry,
     sleep: async () => {},
@@ -151,6 +156,7 @@ describe("upgradeSelfHosted", () => {
       "pull",
       "migrate admin",
       "migrate public",
+      "converge roles",
       "up caelo-admin",
       "health admin",
       "up caelo-gateway",
@@ -269,6 +275,27 @@ describe("upgradeSelfHosted", () => {
     expect(readFileSync(composePath(dir), "utf8")).toBe(render(OLD));
   });
 
+  it("converges the database roles on every upgrade, after the migrations (#635: drops gateway_role)", async () => {
+    const runner = fakeRunner();
+    expect((await upgradeSelfHosted({ version: "0.11.0" }, deps(runner))).ok).toBe(true);
+    const s = steps(runner.calls);
+    expect(s.indexOf("converge roles")).toBeGreaterThan(s.indexOf("migrate public"));
+    expect(s.indexOf("converge roles")).toBeLessThan(s.indexOf("up caelo-admin"));
+  });
+
+  it("restores the Compose file and restarts nothing when the role convergence fails", async () => {
+    const runner = fakeRunner();
+    const r = await upgradeSelfHosted(
+      { version: "0.11.0" },
+      deps(runner, { ok: false, reachable: true, error: "role is busy" }),
+    );
+    expect(r).toMatchObject({ ok: false, stage: "roles", previousRunning: true });
+    if (!r.ok) expect(r.error).toContain("role is busy");
+    expect(steps(runner.calls).some((x) => x.startsWith("up "))).toBe(false);
+    expect(readFileSync(composePath(dir), "utf8")).toBe(render(OLD));
+    expect(readRelease(dir)?.version).toBe("0.10.0");
+  });
+
   it("rolls back to the previous images when the gateway fails its health check", async () => {
     let compose = "";
     const runner = fakeRunner([