@caelo-cms/provisioning 0.10.57 → 0.10.58

package/src/wizards/gcp.ts

@@ -1165,7 +1165,7 @@ async function stepRemoteMcp(
   const failed = (error: string) => {
     s.stop(yellow(`Remote MCP not prepared: ${error}`));
     log.warn(
-      `The install works; Settings → MCP reports remote MCP as unavailable until ${bold(selfCommand("upgrade"))} prepares it.`,
+      `The install works; Settings → Google sign-in and Settings → MCP report this install as not prepared until ${bold(selfCommand("upgrade"))} prepares it.`,
     );
     return false;
   };
@@ -1181,7 +1181,16 @@ async function stepRemoteMcp(
     services: { admin, gateway },
   });
   if (!env.ok) return failed(env.error);
-  s.stop(green(`Remote MCP prepared (${env.identity.mcpPublicUrl})`));
+  s.stop(green(`Remote MCP and Google sign-in prepared (${env.identity.mcpPublicUrl})`));
+  if (env.orgDomainError) {
+    // #914 — without the organisation's domain the admin cannot tell who
+    // IAP's built-in sign-in admits, so it refuses new users until the
+    // Owner sets up Google sign-in. Say so now rather than at the first
+    // invite.
+    log.warn(
+      `Could not read this project's Google organisation (${env.orgDomainError}). Set up Google sign-in under Settings → Google sign-in before adding users, or re-run ${bold(selfCommand("upgrade"))} as an account with the Organization Viewer role.`,
+    );
+  }
   return true;
 }
 

package/stacks/gcp/index.ts

@@ -254,9 +254,10 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
-  // #806 — remote MCP: the Owner-set Google OAuth client (a placeholder
-  // until then) and the broker's seal key, both CLI-generated.
-  "mcp-oauth-client": gcpSecretId(env, "mcp-oauth-client"),
+  // #914 / #806 — the Owner-set Google sign-in client (a placeholder until
+  // then; IAP login, IAP programmatic access and the remote-MCP broker) and
+  // the broker's seal key, both CLI-generated.
+  "operator-oauth-client": gcpSecretId(env, "operator-oauth-client"),
   "mcp-oauth-seal-key": gcpSecretId(env, "mcp-oauth-seal-key"),
 };
 
@@ -479,14 +480,14 @@ for (const binding of runtimeSecretBindings()) {
   );
 }
 
-// #806 — the Owner's remote-MCP setup (Settings → MCP → Remote) stores the
-// Google OAuth client in this one secret. Add-version only: the admin can
-// replace the client the gateway reads, never read it back or touch any
+// #914 — the Owner's Google sign-in setup (Settings → Google sign-in) stores
+// the install's Google OAuth client in this one secret. Add-version only: the
+// admin can replace the client the gateway and the operator-access job read, never read it back or touch any
 // other secret (stack-contract.ts GCP_COMMON says why).
 new gcp.secretmanager.SecretIamMember(
-  `${namePrefix}-admin-mcp-oauth-client-version-adder`,
+  `${namePrefix}-admin-operator-oauth-client-version-adder`,
   {
-    secretId: runtimeSecretIds["mcp-oauth-client"],
+    secretId: runtimeSecretIds["operator-oauth-client"],
     role: "roles/secretmanager.secretVersionAdder",
     member: pulumi.interpolate`serviceAccount:${runSa.email}`,
   },

package/stacks/gcp-firebase/index.ts

@@ -226,9 +226,10 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
-  // #806 — remote MCP: the Owner-set Google OAuth client (a placeholder
-  // until then) and the broker's seal key, both CLI-generated.
-  "mcp-oauth-client": gcpSecretId(env, "mcp-oauth-client"),
+  // #914 / #806 — the Owner-set Google sign-in client (a placeholder until
+  // then; IAP login, IAP programmatic access and the remote-MCP broker) and
+  // the broker's seal key, both CLI-generated.
+  "operator-oauth-client": gcpSecretId(env, "operator-oauth-client"),
   "mcp-oauth-seal-key": gcpSecretId(env, "mcp-oauth-seal-key"),
 };
 
@@ -382,14 +383,14 @@ for (const binding of runtimeSecretBindings()) {
   );
 }
 
-// #806 — the Owner's remote-MCP setup (Settings → MCP → Remote) stores the
-// Google OAuth client in this one secret. Add-version only: the admin can
-// replace the client the gateway reads, never read it back or touch any
+// #914 — the Owner's Google sign-in setup (Settings → Google sign-in) stores
+// the install's Google OAuth client in this one secret. Add-version only: the
+// admin can replace the client the gateway and the operator-access job read, never read it back or touch any
 // other secret (stack-contract.ts GCP_COMMON says why).
 new gcp.secretmanager.SecretIamMember(
-  `${namePrefix}-admin-mcp-oauth-client-version-adder`,
+  `${namePrefix}-admin-operator-oauth-client-version-adder`,
   {
-    secretId: runtimeSecretIds["mcp-oauth-client"],
+    secretId: runtimeSecretIds["operator-oauth-client"],
     role: "roles/secretmanager.secretVersionAdder",
     member: pulumi.interpolate`serviceAccount:${runSa.email}`,
   },