@caelo-cms/provisioning 0.10.57 → 0.10.58

package/src/operator-access.ts

@@ -6,10 +6,11 @@
  * `cms-provision upgrade`, both as the operator's own gcloud identity.
  *
  * Trust boundary. Who may pass the admin's IAP gate and sign as `caelo-mcp`
- * follows the Caelo user list; which OAuth client may call the admin
- * programmatically (IAP `programmatic_clients`, remote MCP #806) follows the
- * client the Owner configured under Settings → MCP → Remote. The admin does NOT write that: its runtime
- * service account holds no IAM-policy rights. A Cloud Run job with its own
+ * follows the Caelo user list; which OAuth client IAP signs people in with
+ * and accepts programmatically (IAP `oauthSettings`: browser client, its
+ * secret and `programmaticClients`, #914) follows the Google sign-in client
+ * the Owner configured under Settings → Google sign-in. The admin does NOT
+ * write that: its runtime service account holds no IAM-policy rights. A Cloud Run job with its own
  * service account (admin-core security/operator-access/sync-job.ts) is the
  * only principal that may change those two bindings, and it only ever grants
  * individual `user:` emails read from the database. The admin may only start
@@ -22,10 +23,12 @@
  * What this ensures, every step idempotent:
  *   1. the Cloud Scheduler API;
  *   2. the custom role `caeloOperatorAccess` (get/setIamPolicy, and
- *      get/updateSettings for `programmatic_clients`);
+ *      get/updateSettings for `oauthSettings`);
  *   3. the job's service account, bound to that role on exactly the admin's
- *      IAP resource and the `caelo-mcp` service account, plus
- *      `cloudsql.instanceUser` + `logging.logWriter`;
+ *      IAP resource and the `caelo-mcp` service account, `secretAccessor`
+ *      on exactly the Google sign-in client's secret (#914: IAP needs the
+ *      client secret too), plus `cloudsql.instanceUser` +
+ *      `logging.logWriter`;
  *   4. removal of the admin run SA's operator-access grants an earlier
  *      revision of this feature gave it;
  *   5. Cloud SQL IAM database authentication (flag + the job's IAM database
@@ -45,6 +48,7 @@ import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
 import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
 import {
   gcpNamePrefix,
+  gcpSecretId,
   mcpIapServiceAccountEmail,
   operatorAccessJobName,
   operatorAccessScheduleName,
@@ -53,6 +57,7 @@ import {
   runServiceAccountEmail,
 } from "./gcp-names.js";
 import { type IapResource, iapResourceArgs } from "./mcp-iap.js";
+import { operatorOAuthClientSecretResource } from "./stack-contract.js";
 
 type Run = (args: string[]) => Promise<GcloudResult>;
 
@@ -69,12 +74,12 @@ export const OPERATOR_ACCESS_ROLE: CustomRoleSpec = {
   roleId: "caeloOperatorAccess",
   title: "Caelo operator access",
   description:
-    "Lets the Caelo operator-access sync job set who passes the admin's IAP gate, which OAuth client may call it programmatically (remote MCP), and who may sign as caelo-mcp. Bound only on those two resources, only to the job's service account.",
+    "Lets the Caelo operator-access sync job set who passes the admin's IAP gate, which OAuth client IAP signs people in with and accepts programmatically (Google sign-in, remote MCP), and who may sign as caelo-mcp. Bound only on those two resources, only to the job's service account.",
   permissions: [
     "iap.webServices.getIamPolicy",
     "iap.webServices.setIamPolicy",
-    // #806 — the admin IAP resource's `programmatic_clients` (the remote-MCP
-    // OAuth client). IAP settings permissions per resource level:
+    // #914 — the admin IAP resource's `oauthSettings` (the install's Google
+    // sign-in client). IAP settings permissions per resource level:
     // cloud.google.com/iap/docs/customizing ("Web Services": getSettings /
     // updateSettings); the role is bound on exactly the admin's IAP web
     // service, so it reaches no other resource's settings.
@@ -196,6 +201,12 @@ export interface OperatorAccessSyncTarget {
 /** Env var of the sync job listing {@link OperatorAccessSyncTarget.mcpSigners}. */
 export const MCP_SIGNERS_ENV = "CAELO_OPERATOR_ACCESS_MCP_SIGNERS";
 
+/** #914 — env var of the sync job naming the Google sign-in client's secret. */
+export const OPERATOR_OAUTH_CLIENT_SECRET_ENV = "CAELO_OPERATOR_OAUTH_CLIENT_SECRET";
+
+/** The role the job holds on exactly the Google sign-in client's secret (#914). */
+export const OPERATOR_OAUTH_CLIENT_ACCESSOR_ROLE = "roles/secretmanager.secretAccessor";
+
 export type OperatorAccessSyncResult =
   | { readonly ok: true; readonly done: string[] }
   | { readonly ok: false; readonly done: string[]; readonly error: string };
@@ -286,6 +297,22 @@ export async function ensureOperatorAccessSync(
     if (!r.ok) return fail(`grant the job ${g.what}`, r);
     done.push(`job: ${g.what}`);
   }
+  // #914 — the job hands the Google sign-in client to IAP (`oauthSettings`
+  // needs the secret too), so it reads that one secret; no other.
+  const clientSecret = gcpSecretId(env, "operator-oauth-client");
+  const accessor = await retry([
+    "secrets",
+    "add-iam-policy-binding",
+    clientSecret,
+    `--member=${jobMember}`,
+    `--role=${OPERATOR_OAUTH_CLIENT_ACCESSOR_ROLE}`,
+    "--condition=None",
+    project,
+    "--quiet",
+    "--format=none",
+  ]);
+  if (!accessor.ok) return fail(`grant the job read access to ${clientSecret}`, accessor);
+  done.push(`job: ${OPERATOR_OAUTH_CLIENT_ACCESSOR_ROLE} on ${clientSecret}`);
   for (const role of ["roles/cloudsql.instanceUser", "roles/logging.logWriter"]) {
     const r = await retry([
       "projects",
@@ -364,6 +391,7 @@ export async function ensureOperatorAccessSync(
     `CAELO_MCP_IAP_SERVICE_ACCOUNT=${mcpSa}`,
     `CAELO_OPERATOR_ACCESS_STATIC_MEMBERS=${installIapAllowlist(target.ownerEmail).join(",")}`,
     `CAELO_OPERATOR_ACCESS_DB_HOST=${target.databaseHost}`,
+    `${OPERATOR_OAUTH_CLIENT_SECRET_ENV}=${operatorOAuthClientSecretResource(projectId, env)}`,
     ...(target.mcpSigners && target.mcpSigners.length > 0
       ? [`${MCP_SIGNERS_ENV}=${target.mcpSigners.join(",")}`]
       : []),

package/src/remote-mcp.test.ts

@@ -16,6 +16,7 @@ import {
   type LiveUrlMap,
   planUrlMapPaths,
   type RemoteMcpTarget,
+  resolveGoogleOrgDomain,
   resolveRemoteMcpIdentity,
 } from "./remote-mcp.js";
 import {
@@ -33,15 +34,18 @@ import {
   GATEWAY_TIMEOUT_SECONDS,
   GATEWAY_TRUSTED_PROXY_HOPS,
   GENERATED_SECRET_FORMAT,
-  MCP_OAUTH_CLIENT_FILE,
+  OPERATOR_OAUTH_CLIENT_FILE,
   REMOTE_MCP_ENV,
+  RETIRED_RUNTIME_SECRETS,
+  RETIRED_SECRET_FILES,
+  RETIRED_SERVICE_ENV,
   remoteMcpIdentity,
   remoteMcpIdentityEnv,
   SERVICE_SECRET_FILES,
   secretFileVolumesTemplate,
   stackIamInvariants,
 } from "./stack-contract.js";
-import { planRequestTimeout, planSecretFiles } from "./stack-converge.js";
+import { deleteRetiredSecrets, planRequestTimeout, planSecretFiles } from "./stack-converge.js";
 
 const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "" }) as GcloudResult;
 const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr }) as GcloudResult;
@@ -122,11 +126,13 @@ describe("remote-MCP identity (contract)", () => {
     expect(new URL(firebase.mcpPublicUrl).hostname.endsWith(".run.app")).toBe(true);
   });
 
-  it("gives the admin the audience + public URL and the gateway the admin + public URL", () => {
+  it("gives the admin the audience, public URL and its own URL, and the gateway the admin + public URL", () => {
     const env = remoteMcpIdentityEnv({ adminUrl: "A", mcpPublicUrl: "P", iapAudience: "AUD" });
     expect(env.admin).toEqual([
       { name: REMOTE_MCP_ENV.iapAudience, value: "AUD" },
       { name: REMOTE_MCP_ENV.mcpPublicUrl, value: "P" },
+      // #914 — Google sign-in's self-check opens the admin signed out.
+      { name: REMOTE_MCP_ENV.adminUrl, value: "A" },
     ]);
     expect(env.gateway).toEqual([
       { name: REMOTE_MCP_ENV.adminUrl, value: "A" },
@@ -136,8 +142,22 @@ describe("remote-MCP identity (contract)", () => {
       adminUrl: "CAELO_ADMIN_URL",
       mcpPublicUrl: "CAELO_MCP_PUBLIC_URL",
       iapAudience: "CAELO_IAP_AUDIENCE",
+      googleOrgDomain: "CAELO_GOOGLE_ORG_DOMAIN",
     });
   });
+
+  it("#914 — gives the admin the organisation domain only when it was read", () => {
+    const known = remoteMcpIdentityEnv({
+      adminUrl: "A",
+      mcpPublicUrl: "P",
+      iapAudience: "AUD",
+      googleOrgDomain: "acme.com",
+    });
+    expect(known.admin).toContainEqual({ name: "CAELO_GOOGLE_ORG_DOMAIN", value: "acme.com" });
+    expect(known.gateway.map((e) => e.name)).not.toContain("CAELO_GOOGLE_ORG_DOMAIN");
+    const unknown = remoteMcpIdentityEnv({ adminUrl: "A", mcpPublicUrl: "P", iapAudience: "AUD" });
+    expect(unknown.admin.map((e) => e.name)).not.toContain("CAELO_GOOGLE_ORG_DOMAIN");
+  });
 });
 
 describe("remote-MCP secrets + IAM (contract)", () => {
@@ -146,7 +166,7 @@ describe("remote-MCP secrets + IAM (contract)", () => {
   });
 
   it("starts the OAuth client as the {} placeholder and the seal key as 32 random bytes", () => {
-    expect(initialSecretValue("mcp-oauth-client")).toBe("{}");
+    expect(initialSecretValue("operator-oauth-client")).toBe("{}");
     const a = initialSecretValue("mcp-oauth-seal-key");
     expect(Buffer.from(a, "base64")).toHaveLength(32);
     expect(initialSecretValue("mcp-oauth-seal-key")).not.toBe(a);
@@ -160,9 +180,9 @@ describe("remote-MCP secrets + IAM (contract)", () => {
       );
       expect(adders).toEqual([
         expect.objectContaining({
-          stackResource: "admin-mcp-oauth-client-version-adder",
+          stackResource: "admin-operator-oauth-client-version-adder",
           member: "run-sa",
-          target: { kind: "secret", name: "mcp-oauth-client" },
+          target: { kind: "secret", name: "operator-oauth-client" },
           onFailure: "warn",
         }),
       ]);
@@ -171,7 +191,7 @@ describe("remote-MCP secrets + IAM (contract)", () => {
           i.member === "run-sa" &&
           i.role === "roles/secretmanager.secretAccessor" &&
           i.target.kind === "secret" &&
-          i.target.name.startsWith("mcp-oauth"),
+          (i.target.name.startsWith("mcp-oauth") || i.target.name === "operator-oauth-client"),
       );
       expect(adminReads).toEqual([]);
     }
@@ -179,18 +199,20 @@ describe("remote-MCP secrets + IAM (contract)", () => {
 
   it("mounts the OAuth client on the gateway only, at latest, as the file its env names", () => {
     expect(SERVICE_SECRET_FILES.admin).toEqual([]);
-    expect(SERVICE_SECRET_FILES.gateway).toEqual([MCP_OAUTH_CLIENT_FILE]);
+    expect(SERVICE_SECRET_FILES.gateway).toEqual([OPERATOR_OAUTH_CLIENT_FILE]);
     expect(secretFileVolumesTemplate("gateway", "production")).toEqual({
       volumes: [
         {
-          name: "mcp-oauth-client",
+          name: "operator-oauth-client",
           secret: {
-            secret: "caelo-production-mcp-oauth-client",
+            secret: "caelo-production-operator-oauth-client",
             items: [{ version: "latest", path: "client.json" }],
           },
         },
       ],
-      volumeMounts: [{ name: "mcp-oauth-client", mountPath: "/secrets/mcp-oauth-client" }],
+      volumeMounts: [
+        { name: "operator-oauth-client", mountPath: "/secrets/operator-oauth-client" },
+      ],
     });
     expect(secretFileVolumesTemplate("admin", "production")).toEqual({
       volumes: [],
@@ -203,33 +225,33 @@ describe("planSecretFiles / planRequestTimeout (upgrade)", () => {
   const empty = { executionEnvironment: null, volumes: [], mounts: [] };
 
   it("mounts a missing secret file with the documented --update-secrets path form", () => {
-    expect(planSecretFiles(empty, [MCP_OAUTH_CLIENT_FILE], "production")).toEqual({
+    expect(planSecretFiles(empty, [OPERATOR_OAUTH_CLIENT_FILE], "production")).toEqual({
       ok: true,
       flags: [
-        "--update-secrets=/secrets/mcp-oauth-client/client.json=caelo-production-mcp-oauth-client:latest",
+        "--update-secrets=/secrets/operator-oauth-client/client.json=caelo-production-operator-oauth-client:latest",
       ],
       changes: [
-        "secret file /secrets/mcp-oauth-client/client.json: (none) → caelo-production-mcp-oauth-client:latest",
+        "secret file /secrets/operator-oauth-client/client.json: (none) → caelo-production-operator-oauth-client:latest",
       ],
     });
   });
 
   it("leaves the file the stack (or an earlier upgrade) mounted alone, whatever its volume is called", () => {
-    for (const name of ["mcp-oauth-client", "secret-1a2b3c"]) {
+    for (const name of ["operator-oauth-client", "secret-1a2b3c"]) {
       const live = {
         executionEnvironment: null,
         volumes: [
           {
             name,
             secret: {
-              secretName: "projects/42/secrets/caelo-production-mcp-oauth-client",
+              secretName: "projects/42/secrets/caelo-production-operator-oauth-client",
               items: [{ key: "latest", path: "client.json" }],
             },
           },
         ],
-        mounts: [{ name, mountPath: "/secrets/mcp-oauth-client" }],
+        mounts: [{ name, mountPath: "/secrets/operator-oauth-client" }],
       };
-      expect(planSecretFiles(live, [MCP_OAUTH_CLIENT_FILE], "production")).toEqual({
+      expect(planSecretFiles(live, [OPERATOR_OAUTH_CLIENT_FILE], "production")).toEqual({
         ok: true,
         flags: [],
         changes: [],
@@ -237,6 +259,101 @@ describe("planSecretFiles / planRequestTimeout (upgrade)", () => {
     }
   });
 
+  it("#914 — moves the gateway from the retired mcp-oauth-client mount to the renamed secret in one roll", () => {
+    const live = {
+      executionEnvironment: null,
+      volumes: [
+        {
+          name: "mcp-oauth-client",
+          secret: {
+            secretName: "caelo-production-mcp-oauth-client",
+            items: [{ key: "latest", path: "client.json" }],
+          },
+        },
+      ],
+      mounts: [{ name: "mcp-oauth-client", mountPath: "/secrets/mcp-oauth-client" }],
+    };
+    expect(RETIRED_SECRET_FILES.gateway.map((f) => f.mountDir)).toEqual([
+      "/secrets/mcp-oauth-client",
+    ]);
+    const plan = planSecretFiles(
+      live,
+      [OPERATOR_OAUTH_CLIENT_FILE],
+      "production",
+      RETIRED_SECRET_FILES.gateway,
+    );
+    expect(plan.ok && plan.flags).toEqual([
+      "--remove-secrets=/secrets/mcp-oauth-client/client.json",
+      "--update-secrets=/secrets/operator-oauth-client/client.json=caelo-production-operator-oauth-client:latest",
+    ]);
+    // Converged: nothing left to remove or mount.
+    const after = {
+      executionEnvironment: null,
+      volumes: [
+        {
+          name: "operator-oauth-client",
+          secret: {
+            secretName: "caelo-production-operator-oauth-client",
+            items: [{ key: "latest", path: "client.json" }],
+          },
+        },
+      ],
+      mounts: [{ name: "operator-oauth-client", mountPath: "/secrets/operator-oauth-client" }],
+    };
+    expect(
+      planSecretFiles(
+        after,
+        [OPERATOR_OAUTH_CLIENT_FILE],
+        "production",
+        RETIRED_SECRET_FILES.gateway,
+      ),
+    ).toEqual({ ok: true, flags: [], changes: [] });
+  });
+
+  it("#914 — deletes the retired secret after the roll; an absent one is fine", async () => {
+    const install = {
+      provider: "gcp-firebase" as const,
+      projectId: "acme",
+      region: "europe-west1",
+      env: "production",
+    };
+    const present = fakeGcloud({
+      "secrets describe caelo-production-mcp-oauth-client": ok("projects/1/secrets/x\n"),
+      "secrets delete caelo-production-mcp-oauth-client": ok(),
+    });
+    expect(await deleteRetiredSecrets(install, { run: present.run })).toEqual([
+      {
+        id: "secret caelo-production-mcp-oauth-client",
+        status: "removed",
+        why: "the Google sign-in client moved to operator-oauth-client (#914)",
+      },
+    ]);
+    expect(present.calls).toContain(
+      "secrets delete caelo-production-mcp-oauth-client --project=acme --quiet",
+    );
+    const absent = fakeGcloud({
+      "secrets describe caelo-production-mcp-oauth-client": fail("NOT_FOUND: Secret not found"),
+    });
+    const outcomes = await deleteRetiredSecrets(install, { run: absent.run });
+    expect(outcomes.map((o) => o.status)).toEqual(["absent"]);
+    expect(absent.calls.some((c) => c.startsWith("secrets delete"))).toBe(false);
+    const denied = fakeGcloud({
+      "secrets describe caelo-production-mcp-oauth-client": ok("x"),
+      "secrets delete caelo-production-mcp-oauth-client": fail("PERMISSION_DENIED"),
+    });
+    expect((await deleteRetiredSecrets(install, { run: denied.run }))[0]).toMatchObject({
+      status: "failed",
+      error: "PERMISSION_DENIED",
+    });
+  });
+
+  it("#914 — retires the old secret and the old env names", () => {
+    expect(RETIRED_RUNTIME_SECRETS.map((s) => s.name)).toEqual(["mcp-oauth-client"]);
+    expect(RETIRED_SERVICE_ENV.gateway).toContain("CAELO_MCP_OAUTH_CLIENT_FILE");
+    expect(RETIRED_SERVICE_ENV.admin).toContain("CAELO_MCP_OAUTH_CLIENT_STORE");
+    expect(CLI_GENERATED_SECRETS).not.toContain("mcp-oauth-client" as never);
+  });
+
   it("refuses something else mounted where the client belongs (a pinned version included)", () => {
     const live = {
       executionEnvironment: null,
@@ -244,16 +361,17 @@ describe("planSecretFiles / planRequestTimeout (upgrade)", () => {
         {
           name: "v",
           secret: {
-            secretName: "caelo-production-mcp-oauth-client",
+            secretName: "caelo-production-operator-oauth-client",
             items: [{ key: "3", path: "client.json" }],
           },
         },
       ],
-      mounts: [{ name: "v", mountPath: "/secrets/mcp-oauth-client" }],
+      mounts: [{ name: "v", mountPath: "/secrets/operator-oauth-client" }],
     };
-    const plan = planSecretFiles(live, [MCP_OAUTH_CLIENT_FILE], "production");
+    const plan = planSecretFiles(live, [OPERATOR_OAUTH_CLIENT_FILE], "production");
     expect(plan.ok).toBe(false);
-    if (!plan.ok) expect(plan.error).toContain("--remove-volume-mount=/secrets/mcp-oauth-client");
+    if (!plan.ok)
+      expect(plan.error).toContain("--remove-volume-mount=/secrets/operator-oauth-client");
   });
 
   it("raises the gateway's request timeout to the contract's", () => {
@@ -277,10 +395,20 @@ const firebase: RemoteMcpTarget = {
   services: { admin: "caelo-production-admin-aaa", gateway: "caelo-production-gateway-bbb" },
 };
 
+const ANCESTORS_IN_ORG = ok(
+  JSON.stringify([
+    { id: "acme", type: "project" },
+    { id: "555", type: "folder" },
+    { id: "123456", type: "organization" },
+  ]),
+);
+
 describe("resolveRemoteMcpIdentity", () => {
-  it("gcp-firebase: reads the project number and both services' URLs", async () => {
+  it("gcp-firebase: reads the project number, both services' URLs and the organisation", async () => {
     const { run } = fakeGcloud({
       "projects describe acme": ok("42\n"),
+      "projects get-ancestors acme": ANCESTORS_IN_ORG,
+      "organizations describe 123456": ok("Acme.com\n"),
       "run services describe caelo-production-admin-aaa": ok(
         "https://caelo-production-admin-aaa-xyz.a.run.app\n",
       ),
@@ -295,10 +423,26 @@ describe("resolveRemoteMcpIdentity", () => {
         adminUrl: "https://caelo-production-admin-aaa-xyz.a.run.app",
         mcpPublicUrl: "https://caelo-production-gateway-bbb-xyz.a.run.app",
         iapAudience: "/projects/42/locations/europe-west1/services/caelo-production-admin-aaa",
+        googleOrgDomain: "acme.com",
       },
     });
   });
 
+  it("#914 — an unreadable organisation is reported, not fatal, and sets no domain", async () => {
+    const { run } = fakeGcloud({
+      "projects describe acme": ok("42\n"),
+      "projects get-ancestors acme": ANCESTORS_IN_ORG,
+      "organizations describe 123456": fail("PERMISSION_DENIED: organizations.get"),
+      "run services describe caelo-production-admin-aaa": ok("https://a-xyz.a.run.app\n"),
+      "run services describe caelo-production-gateway-bbb": ok("https://g-xyz.a.run.app\n"),
+    });
+    const r = await resolveRemoteMcpIdentity(firebase, { run });
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.identity.googleOrgDomain).toBeUndefined();
+    expect(r.orgDomainError).toContain("Organization Viewer");
+  });
+
   it("gcp: reads the IAP-enabled admin backend service's numeric id", async () => {
     const { run, calls } = fakeGcloud({
       "projects describe acme": ok("42"),
@@ -323,6 +467,34 @@ describe("resolveRemoteMcpIdentity", () => {
   });
 });
 
+describe("resolveGoogleOrgDomain (#914)", () => {
+  it("reads the organisation's domain through the project's ancestors", async () => {
+    const { run, calls } = fakeGcloud({
+      "projects get-ancestors acme": ANCESTORS_IN_ORG,
+      "organizations describe 123456": ok("acme.com\n"),
+    });
+    expect(await resolveGoogleOrgDomain("acme", { run })).toEqual({ ok: true, domain: "acme.com" });
+    expect(calls).toContain("organizations describe 123456 --format=value(displayName)");
+  });
+
+  it("answers `none` for a project in no organisation", async () => {
+    const { run } = fakeGcloud({
+      "projects get-ancestors acme": ok(JSON.stringify([{ id: "acme", type: "project" }])),
+    });
+    expect(await resolveGoogleOrgDomain("acme", { run })).toEqual({ ok: true, domain: "none" });
+  });
+
+  it("fails naming the missing role when the organisation cannot be read", async () => {
+    const { run } = fakeGcloud({
+      "projects get-ancestors acme": ANCESTORS_IN_ORG,
+      "organizations describe 123456": ok("not a domain\n"),
+    });
+    const r = await resolveGoogleOrgDomain("acme", { run });
+    expect(r.ok).toBe(false);
+    if (!r.ok) expect(r.error).toContain("Organization Viewer");
+  });
+});
+
 describe("applyRemoteMcpIdentityEnv", () => {
   const identity = {
     adminUrl: "https://a.run.app",
@@ -337,6 +509,7 @@ describe("applyRemoteMcpIdentityEnv", () => {
       "run services describe caelo-production-admin-aaa": serviceJson([
         { name: "CAELO_IAP_AUDIENCE", value: identity.iapAudience },
         { name: "CAELO_MCP_PUBLIC_URL", value: identity.mcpPublicUrl },
+        { name: "CAELO_ADMIN_URL", value: identity.adminUrl },
       ]),
       "run services describe caelo-production-gateway-bbb": serviceJson([]),
       "run services update caelo-production-gateway-bbb": ok(),

package/src/remote-mcp.ts

@@ -20,9 +20,13 @@
  * come through the shared contract like everything else
  * (runtime-secrets.ts, stack-contract.ts, upgrade/app-roll.ts).
  *
- * Nothing here enables remote MCP: that is the Owner's opt-in under
- * Settings → MCP → Remote. Until then the gateway answers 503
- * `remote_mcp_not_configured`.
+ * The same identity env carries what the admin's Google sign-in needs
+ * (#914): its own URL and the project's Google organisation domain
+ * ({@link resolveGoogleOrgDomain}).
+ *
+ * Nothing here enables remote MCP: that happens when the Owner sets up the
+ * install's Google sign-in client (Settings → Google sign-in). Until then
+ * the gateway answers 503 `remote_mcp_not_configured`.
  */
 
 import { GCP_PUBLIC_BASE_PATHS } from "@caelo-cms/shared";
@@ -81,14 +85,68 @@ function lines(stdout: string): string[] {
 // Identity env
 // ===========================================================================
 
+/**
+ * #914 — the project's Google organisation domain (the organisation's
+ * `displayName`, which Cloud Resource Manager sets to its primary domain),
+ * or `none` when the project sits in no organisation. Read as the
+ * operator's identity: `organizations describe` needs
+ * `resourcemanager.organizations.get` on the organisation, which project
+ * Owners often have and the admin's service account never does.
+ */
+export async function resolveGoogleOrgDomain(
+  projectId: string,
+  deps: { run?: GcloudRunner } = {},
+): Promise<RemoteMcpResult<{ readonly domain: string }>> {
+  const run = deps.run ?? defaultGcloud;
+  const ancestors = await run(["projects", "get-ancestors", projectId, "--format=json"]);
+  if (!ancestors.ok) {
+    return { ok: false, error: `read the ancestors of ${projectId}: ${ancestors.stderr.trim()}` };
+  }
+  const list = parseJson(ancestors.stdout || "[]");
+  if (!Array.isArray(list)) return { ok: false, error: "get-ancestors: output is not a JSON list" };
+  const org = (list as { id?: string; type?: string }[]).find((a) => a.type === "organization");
+  if (!org?.id) return { ok: true, domain: NO_GOOGLE_ORGANISATION };
+  const describe = await run(["organizations", "describe", org.id, "--format=value(displayName)"]);
+  const domain = describe.ok ? describe.stdout.trim().toLowerCase() : "";
+  if (!/^[a-z0-9.-]+\.[a-z]{2,}$/.test(domain)) {
+    return {
+      ok: false,
+      error: `read organization ${org.id}: ${describe.stderr.trim() || `unexpected name "${domain}"`} (needs the Organization Viewer role)`,
+    };
+  }
+  return { ok: true, domain };
+}
+
+/** `CAELO_GOOGLE_ORG_DOMAIN` value for a project outside any organisation (admin-core identity-gate.ts). */
+export const NO_GOOGLE_ORGANISATION = "none";
+
 /**
  * Read the live identities {@link remoteMcpIdentity} derives from: the
  * project number, and the admin's backend service id (`gcp`) or both
  * services' URLs (`gcp-firebase`). Fails naming what it could not read.
+ *
+ * The organisation domain (#914) is best-effort: when it cannot be read,
+ * `orgDomainError` says why and the identity carries none, so the admin's
+ * var keeps its value — the admin then reports the organisation as unknown
+ * and refuses user creation loudly until the Owner sets up Google sign-in.
  */
 export async function resolveRemoteMcpIdentity(
   target: RemoteMcpTarget,
   deps: { run?: GcloudRunner } = {},
+): Promise<
+  RemoteMcpResult<{ readonly identity: RemoteMcpIdentity; readonly orgDomainError?: string }>
+> {
+  const resolved = await resolveServiceIdentity(target, deps);
+  if (!resolved.ok) return resolved;
+  const org = await resolveGoogleOrgDomain(target.projectId, deps);
+  return org.ok
+    ? { ok: true, identity: { ...resolved.identity, googleOrgDomain: org.domain } }
+    : { ok: true, identity: resolved.identity, orgDomainError: org.error };
+}
+
+async function resolveServiceIdentity(
+  target: RemoteMcpTarget,
+  deps: { run?: GcloudRunner } = {},
 ): Promise<RemoteMcpResult<{ readonly identity: RemoteMcpIdentity }>> {
   const run = deps.run ?? defaultGcloud;
   const project = `--project=${target.projectId}`;
@@ -223,13 +281,19 @@ export async function ensureRemoteMcpIdentityEnv(
   RemoteMcpResult<{
     readonly identity: RemoteMcpIdentity;
     readonly changes: Record<CloudRunSlug, EnvChange[]>;
+    readonly orgDomainError?: string;
   }>
 > {
   const resolved = await resolveRemoteMcpIdentity(target, deps);
   if (!resolved.ok) return resolved;
   const applied = await applyRemoteMcpIdentityEnv(target, resolved.identity, deps);
   if (!applied.ok) return applied;
-  return { ok: true, identity: resolved.identity, changes: applied.changes };
+  return {
+    ok: true,
+    identity: resolved.identity,
+    changes: applied.changes,
+    ...(resolved.orgDomainError ? { orgDomainError: resolved.orgDomainError } : {}),
+  };
 }
 
 // ===========================================================================

package/src/runtime-secrets.test.ts

@@ -153,7 +153,7 @@ describe("ensureGeneratedSecrets", () => {
       // #806 — remote MCP's OAuth client starts as the "not configured"
       // placeholder; the Owner writes the real one from Settings → MCP.
       {
-        line: "secrets create caelo-production-mcp-oauth-client --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
+        line: "secrets create caelo-production-operator-oauth-client --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
         stdin: "{}",
       },
       {
@@ -195,7 +195,7 @@ describe("ensureGeneratedSecrets", () => {
       "secrets versions list caelo-production-tool-approval-secret": [ok("v/1")],
       "secrets versions list caelo-production-public-role-password": [ok("v/1")],
       "secrets versions list caelo-production-staging-gate-secret": [ok("v/1")],
-      "secrets versions list caelo-production-mcp-oauth-client": [ok("v/1")],
+      "secrets versions list caelo-production-operator-oauth-client": [ok("v/1")],
       "secrets versions list caelo-production-mcp-oauth-seal-key": [ok("v/1")],
     });
     const outcomes = await ensureGeneratedSecrets(
@@ -255,7 +255,7 @@ describe("ensureGeneratedSecrets", () => {
       "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       // #652 — the staging gate's key follows the same path.
       "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-      "secrets create caelo-production-mcp-oauth-client --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
+      "secrets create caelo-production-operator-oauth-client --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-mcp-oauth-seal-key --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
     ]);
   });

package/src/runtime-secrets.ts

@@ -419,8 +419,8 @@ export function rotationRefusal(name: string): string | null {
   if ((ROTATABLE_SECRETS as readonly string[]).includes(name)) return null;
   // #806 — two-step rotation with an overlap window (seal-key-rotation.ts).
   if (name === SEAL_KEY_SECRET) return null;
-  if (name === "mcp-oauth-client") {
-    return "mcp-oauth-client is the Google OAuth client of remote MCP; the Owner replaces it under Settings → MCP → Remote (create a new client secret in the Google console first).";
+  if (name === "operator-oauth-client") {
+    return "operator-oauth-client is the install's Google sign-in client (IAP sign-in and remote MCP); the Owner replaces it under Settings → Google sign-in (create a new client secret in the Google console first).";
   }
   if (name === "secret-kek") {
     return "secret-kek encrypts the AI provider keys and other at-rest secrets in cms_admin; a new KEK would make them unreadable. Rotating it needs a re-encryption step that does not exist yet.";