@caelo-cms/provisioning 0.10.61 → 0.10.62

package/src/mcp-iap.test.ts

@@ -62,11 +62,31 @@ describe("iapOperators", () => {
   });
 });
 
+/** The IAP policy before the MCP account existed: operators only. */
+const OPERATORS_ONLY = JSON.stringify({
+  bindings: [
+    {
+      role: "roles/iap.httpsResourceAccessor",
+      members: ["user:owner@example.com", "group:editors@example.com"],
+    },
+  ],
+});
+
+/** The MCP account's own policy once every operator may sign as it. */
+const SIGNERS = JSON.stringify({
+  bindings: [
+    {
+      role: "roles/iam.serviceAccountTokenCreator",
+      members: ["user:owner@example.com", "group:editors@example.com"],
+    },
+  ],
+});
+
 describe("ensureMcpIapAccess", () => {
   it("creates the SA, allowlists it on IAP and lets every IAP operator sign as it", async () => {
     const { run, calls } = fakeGcloud({
       "iam service-accounts describe": [fail("NOT_FOUND")],
-      "iap web get-iam-policy": [ok(POLICY)],
+      "iap web get-iam-policy": [ok(OPERATORS_ONLY)],
     });
     const r = await ensureMcpIapAccess({
       projectId: "p",
@@ -79,6 +99,11 @@ describe("ensureMcpIapAccess", () => {
       ok: true,
       serviceAccount: mcpIapServiceAccountEmail("p"),
       operators: ["user:owner@example.com", "group:editors@example.com"],
+      granted: [
+        "roles/iap.httpsResourceAccessor → serviceAccount:caelo-mcp@p.iam.gserviceaccount.com",
+        "roles/iam.serviceAccountTokenCreator → user:owner@example.com",
+        "roles/iam.serviceAccountTokenCreator → group:editors@example.com",
+      ],
     });
     const lines = calls.map((c) => c.join(" "));
     expect(lines.some((l) => l.startsWith("iam service-accounts create caelo-mcp"))).toBe(true);
@@ -92,11 +117,47 @@ describe("ensureMcpIapAccess", () => {
     }
   });
 
-  it("is a no-op re-run when the SA exists (no create)", async () => {
-    const { run, calls } = fakeGcloud({ "iap web get-iam-policy": [ok(POLICY)] });
+  it("is a no-op re-run when everything is in place: no create, no binding written, nothing granted", async () => {
+    const { run, calls } = fakeGcloud({
+      "iap web get-iam-policy": [ok(POLICY)],
+      "iam service-accounts get-iam-policy": [ok(SIGNERS)],
+    });
     const r = await ensureMcpIapAccess({ projectId: "p", resource: cloudRun, run });
-    expect(r.ok).toBe(true);
+    expect(r.ok && r.granted).toEqual([]);
     expect(calls.some((c) => c.join(" ").startsWith("iam service-accounts create"))).toBe(false);
+    expect(calls.some((c) => c.includes("add-iam-policy-binding"))).toBe(false);
+  });
+
+  it("#734 — names only the grant this run added (a new operator on the allowlist)", async () => {
+    const { run, calls } = fakeGcloud({
+      "iap web get-iam-policy": [ok(POLICY)],
+      "iam service-accounts get-iam-policy": [
+        ok(
+          JSON.stringify({
+            bindings: [
+              {
+                role: "roles/iam.serviceAccountTokenCreator",
+                members: ["user:owner@example.com"],
+              },
+            ],
+          }),
+        ),
+      ],
+    });
+    const r = await ensureMcpIapAccess({ projectId: "p", resource: cloudRun, run });
+    expect(r.ok && r.granted).toEqual([
+      "roles/iam.serviceAccountTokenCreator → group:editors@example.com",
+    ]);
+    expect(calls.filter((c) => c.includes("add-iam-policy-binding"))).toHaveLength(1);
+  });
+
+  it("writes every binding when the account's policy can't be read (and counts them as granted)", async () => {
+    const { run } = fakeGcloud({
+      "iap web get-iam-policy": [ok(POLICY)],
+      "iam service-accounts get-iam-policy": [fail("PERMISSION_DENIED")],
+    });
+    const r = await ensureMcpIapAccess({ projectId: "p", resource: cloudRun, run });
+    expect(r.ok && r.granted).toHaveLength(2);
   });
 
   it("addresses the LB backend service on the gcp provider", async () => {
@@ -117,7 +178,7 @@ describe("ensureMcpIapAccess", () => {
   it("retries bindings while a new SA propagates", async () => {
     const { run, calls } = fakeGcloud({
       "iam service-accounts describe": [fail("NOT_FOUND")],
-      "iap web get-iam-policy": [ok(POLICY)],
+      "iap web get-iam-policy": [ok(OPERATORS_ONLY)],
       "iap web add-iam-policy-binding": [fail("Service account caelo-mcp@p does not exist.")],
     });
     const slept: number[] = [];

package/src/mcp-iap.ts

@@ -17,7 +17,10 @@
  *      open the admin in a browser can also drive it over MCP
  *
  * Every step is an additive IAM binding or a create-if-missing, so re-running
- * is a no-op. The caller puts the returned email into the admin's
+ * is a no-op. Bindings already in place are not written again, and the
+ * result names the ones this run added: IAM applies a new binding only
+ * after a while (up to 7 minutes), so the upgrade's health check waits for
+ * a refusal to clear only when this run just granted something (#734). The caller puts the returned email into the admin's
  * `CAELO_MCP_IAP_SERVICE_ACCOUNT` env var, which /settings/mcp shows in the
  * `claude mcp add` command.
  */
@@ -25,6 +28,7 @@
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
 import { MCP_IAP_SERVICE_ACCOUNT_ID, mcpIapServiceAccountEmail } from "./gcp-names.js";
+import { policyGrants } from "./stack-converge.js";
 
 /** The admin's IAP resource, as `gcloud iap web` addresses it. */
 export type IapResource =
@@ -49,13 +53,33 @@ export function iapOperators(policyJson: string): string[] {
   return [...new Set(members.filter((m) => m.startsWith("user:") || m.startsWith("group:")))];
 }
 
+/**
+ * Whether a policy read (JSON) grants `role` to `member`; false when the
+ * policy could not be read or parsed, so the binding is written.
+ */
+function readGrants(policyJson: string | null, role: string, member: string): boolean {
+  if (policyJson === null) return false;
+  try {
+    return policyGrants(policyJson, role, member);
+  } catch {
+    return false;
+  }
+}
+
 export async function ensureMcpIapAccess(opts: {
   projectId: string;
   resource: IapResource;
   run?: GcloudRunner;
   sleep?: Sleep;
 }): Promise<
-  { ok: true; serviceAccount: string; operators: string[] } | { ok: false; error: string }
+  | {
+      ok: true;
+      serviceAccount: string;
+      operators: string[];
+      /** The bindings this run added (empty: everything was in place). */
+      granted: string[];
+    }
+  | { ok: false; error: string }
 > {
   const run = opts.run ?? defaultGcloud;
   const sleep = opts.sleep ?? realSleep;
@@ -73,7 +97,8 @@ export async function ensureMcpIapAccess(opts: {
     project,
     "--format=value(email)",
   ]);
-  if (!describe.ok) {
+  const created = !describe.ok;
+  if (created) {
     const create = await run([
       "iam",
       "service-accounts",
@@ -98,34 +123,47 @@ export async function ensureMcpIapAccess(opts: {
   ]);
   if (!policy.ok) return { ok: false, error: `read IAP policy: ${policy.stderr.trim()}` };
   const operators = iapOperators(policy.stdout);
+  const granted: string[] = [];
 
-  const allow = await withRetry([
-    "iap",
-    "web",
-    "add-iam-policy-binding",
-    ...iapResourceArgs(opts.resource),
-    `--member=serviceAccount:${sa}`,
-    "--role=roles/iap.httpsResourceAccessor",
-    "--condition=None",
-    project,
-    "--quiet",
-  ]);
-  if (!allow.ok) return { ok: false, error: `allow ${sa} on IAP: ${allow.stderr.trim()}` };
+  const ACCESSOR = "roles/iap.httpsResourceAccessor";
+  if (!readGrants(policy.stdout, ACCESSOR, `serviceAccount:${sa}`)) {
+    const allow = await withRetry([
+      "iap",
+      "web",
+      "add-iam-policy-binding",
+      ...iapResourceArgs(opts.resource),
+      `--member=serviceAccount:${sa}`,
+      `--role=${ACCESSOR}`,
+      "--condition=None",
+      project,
+      "--quiet",
+    ]);
+    if (!allow.ok) return { ok: false, error: `allow ${sa} on IAP: ${allow.stderr.trim()}` };
+    granted.push(`${ACCESSOR} → serviceAccount:${sa}`);
+  }
 
+  const TOKEN_CREATOR = "roles/iam.serviceAccountTokenCreator";
+  // A just-created account has no policy yet; an unreadable one is rewritten.
+  const saPolicy = created
+    ? null
+    : await run(["iam", "service-accounts", "get-iam-policy", sa, project, "--format=json"]);
+  const saPolicyJson = saPolicy?.ok ? saPolicy.stdout : null;
   for (const member of operators) {
+    if (readGrants(saPolicyJson, TOKEN_CREATOR, member)) continue;
     const grant = await withRetry([
       "iam",
       "service-accounts",
       "add-iam-policy-binding",
       sa,
       `--member=${member}`,
-      "--role=roles/iam.serviceAccountTokenCreator",
+      `--role=${TOKEN_CREATOR}`,
       "--condition=None",
       project,
       "--quiet",
     ]);
     if (!grant.ok)
       return { ok: false, error: `let ${member} sign as ${sa}: ${grant.stderr.trim()}` };
+    granted.push(`${TOKEN_CREATOR} → ${member}`);
   }
-  return { ok: true, serviceAccount: sa, operators };
+  return { ok: true, serviceAccount: sa, operators, granted };
 }

package/src/owner-reset-providers.test.ts

@@ -0,0 +1,370 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #770 — `owner-reset` beyond gcp-firebase: plain gcp reaches the admin on
+ * `admin.<domain>` behind the load balancer's IAP, self-hosted reaches it
+ * through `docker compose exec` with nothing secret in the process
+ * arguments, aws / azure refuse naming #952 — and on no provider does the
+ * reset link (or the token in it) reach a log line.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, spyOn } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { GcloudResult } from "./gcloud.js";
+import {
+  describeOwnerReset,
+  OWNER_RESET_SCOPE,
+  ownerResetTarget,
+  requestOwnerReset,
+} from "./owner-reset.js";
+import { writeInternalSecret } from "./self-hosted-internal-secret.js";
+import type { CommandResult, HostRunner, HostRunOptions } from "./self-hosted-release.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+
+const TOKEN = "tok/with+chars";
+const ISSUED = {
+  ok: true,
+  email: "owner@example.com",
+  token: TOKEN,
+  expiresAt: "2026-10-15T12:52:56.000Z",
+};
+
+/** gcloud for a gcp install: no Cloud Run lookup is expected (the LB host is the URL). */
+function fakeGcloud(seen: string[][]): (args: string[]) => Promise<GcloudResult> {
+  const answers: Record<string, GcloudResult> = {
+    "auth list": ok("operator@example.com\n"),
+    "secrets versions access": ok("s".repeat(40)),
+    "auth print-access-token": ok("ya29.operator\n"),
+    "services enable iamcredentials.googleapis.com": ok(),
+  };
+  return async (args) => {
+    seen.push(args);
+    const key = Object.keys(answers).find((k) => args.join(" ").startsWith(k));
+    return (key && answers[key]) || fail(`unexpected gcloud ${args.join(" ")}`);
+  };
+}
+
+interface Seen {
+  url: string;
+  headers: Record<string, string>;
+  body: Record<string, unknown> | null;
+}
+
+function fakeFetch(admin: () => Response) {
+  const seen: Seen[] = [];
+  const doFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = String(input);
+    seen.push({
+      url,
+      headers: Object.fromEntries(new Headers(init?.headers).entries()),
+      body: init?.body ? (JSON.parse(String(init.body)) as Record<string, unknown>) : null,
+    });
+    if (url.startsWith("https://iamcredentials.googleapis.com/")) {
+      return Response.json({ signedJwt: "iap.jwt.signed" });
+    }
+    return admin();
+  }) as typeof fetch;
+  return { doFetch, seen };
+}
+
+/** A host whose `docker compose exec` answers `reply` and records every call. */
+function fakeHost(reply: CommandResult) {
+  const calls: { argv: readonly string[]; opts?: HostRunOptions }[] = [];
+  const host: HostRunner = {
+    run: async (argv, opts) => {
+      calls.push({ argv, ...(opts ? { opts } : {}) });
+      return reply;
+    },
+  };
+  return { host, calls };
+}
+
+const answered = (status: number, body: unknown): CommandResult => ({
+  exitCode: 0,
+  stdout: JSON.stringify({ status, text: JSON.stringify(body) }),
+  stderr: "",
+});
+
+describe("owner-reset on gcp (IAP on the load balancer)", () => {
+  it("calls admin.<domain> with a JWT for that origin and builds the link there", async () => {
+    const gcloudCalls: string[][] = [];
+    const { doFetch, seen } = fakeFetch(() => Response.json(ISSUED));
+    const r = await requestOwnerReset(
+      { provider: "gcp", projectId: "proj", domain: "example.com" },
+      {},
+      { run: fakeGcloud(gcloudCalls), fetch: doFetch, now: () => 1_000 },
+    );
+    expect(r).toEqual({
+      ok: true,
+      value: {
+        email: "owner@example.com",
+        resetUrl: "https://admin.example.com/reset?token=tok%2Fwith%2Bchars",
+        expiresAt: "2026-10-15T12:52:56.000Z",
+      },
+    });
+    const sign = seen[0];
+    expect(sign?.url).toContain("caelo-mcp%40proj.iam.gserviceaccount.com:signJwt");
+    expect(JSON.parse(String(sign?.body?.payload))).toMatchObject({
+      aud: "https://admin.example.com/*",
+      iat: 1_000,
+    });
+    const call = seen[1];
+    expect(call?.url).toBe("https://admin.example.com/api/internal/owner-reset");
+    expect(call?.headers.authorization).toBe("Bearer iap.jwt.signed");
+    expect(call?.body).toEqual({ requestedBy: "operator@example.com" });
+    // The run.app URL is not reachable from outside the LB; nothing looks it up.
+    expect(gcloudCalls.some((a) => a[0] === "run")).toBe(false);
+  });
+
+  it("points an unreachable admin host at its DNS record and certificate", async () => {
+    const r = await requestOwnerReset(
+      { provider: "gcp", projectId: "proj", domain: "example.com" },
+      {},
+      {
+        run: fakeGcloud([]),
+        fetch: (async (input: RequestInfo | URL) => {
+          if (String(input).startsWith("https://iamcredentials")) {
+            return Response.json({ signedJwt: "j" });
+          }
+          throw new TypeError("getaddrinfo ENOTFOUND admin.example.com");
+        }) as typeof fetch,
+      },
+    );
+    expect(r.ok ? "" : r.error).toContain("dig +short admin.example.com");
+  });
+});
+
+describe("owner-reset on self-hosted (docker compose exec)", () => {
+  let dir: string;
+  const SECRET = "x".repeat(96);
+  const target = () => ({
+    provider: "self-hosted" as const,
+    caeloDir: dir,
+    adminUrl: "https://admin.example.com",
+  });
+  const localUser = () => ({ user: "michael", host: "box.lan" });
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "caelo-owner-reset-"));
+    writeInternalSecret(dir, SECRET);
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  it("runs one exec into caelo-admin with the token and body on stdin only", async () => {
+    const { host, calls } = fakeHost(answered(200, ISSUED));
+    const r = await requestOwnerReset(
+      target(),
+      { email: "owner@example.com" },
+      {
+        host,
+        localUser,
+      },
+    );
+    expect(r).toEqual({
+      ok: true,
+      value: {
+        email: "owner@example.com",
+        resetUrl: "https://admin.example.com/reset?token=tok%2Fwith%2Bchars",
+        expiresAt: "2026-10-15T12:52:56.000Z",
+      },
+    });
+    expect(calls).toHaveLength(1);
+    const [call] = calls;
+    expect(call?.argv.slice(0, 9)).toEqual([
+      "docker",
+      "compose",
+      "-f",
+      join(dir, "docker-compose.yml"),
+      "exec",
+      "-T",
+      "caelo-admin",
+      "bun",
+      "-e",
+    ]);
+    const stdin = JSON.parse(call?.opts?.stdinText ?? "{}") as {
+      endpoint: string;
+      token: string;
+      body: unknown;
+    };
+    expect(stdin.endpoint).toBe("/api/internal/owner-reset");
+    expect(stdin.body).toEqual({
+      email: "owner@example.com",
+      requestedByHostUser: "michael@box.lan",
+    });
+    const [message] = stdin.token.split(".");
+    expect(Buffer.from(message ?? "", "base64url").toString()).toEndWith(`:${OWNER_RESET_SCOPE}`);
+    // `ps` shows argv to every user of the host: neither the secret nor the
+    // token may be in it.
+    const argv = call?.argv.join(" ") ?? "";
+    expect(argv).not.toContain(SECRET);
+    expect(argv).not.toContain(stdin.token);
+  });
+
+  it("tells an install whose running admin lacks the secret to run `up`", async () => {
+    const { host } = fakeHost(answered(401, { ok: false, error: "missing-secret" }));
+    const r = await requestOwnerReset(target(), {}, { host, localUser });
+    expect(r.ok ? "" : r.error).toContain("missing-secret");
+    expect(r.ok ? "" : r.error).toMatch(/Run `bunx @caelo-cms\/provisioning@\S+ up`/);
+  });
+
+  it("names a missing secret file and a stopped admin with the fix", async () => {
+    rmSync(join(dir, "internal-secret.json"));
+    const none = await requestOwnerReset(
+      target(),
+      {},
+      { host: fakeHost(answered(200, ISSUED)).host, localUser },
+    );
+    expect(none.ok ? "" : none.error).toContain("internal-secret.json does not exist");
+
+    writeInternalSecret(dir, SECRET);
+    const stopped = await requestOwnerReset(
+      target(),
+      {},
+      {
+        host: fakeHost({ exitCode: 1, stdout: "", stderr: 'service "caelo-admin" is not running' })
+          .host,
+        localUser,
+      },
+    );
+    expect(stopped.ok ? "" : stopped.error).toContain('service "caelo-admin" is not running');
+    expect(stopped.ok ? "" : stopped.error).toContain("up`");
+  });
+
+  it("names an admin from before #770 for an upgrade", async () => {
+    const { host } = fakeHost({
+      exitCode: 0,
+      stdout: JSON.stringify({ status: 404, text: "Not Found" }),
+      stderr: "",
+    });
+    const r = await requestOwnerReset(target(), {}, { host, localUser });
+    expect(r.ok ? "" : r.error).toContain("before #770");
+  });
+
+  it("refuses a host user the admin's audit row would not accept", async () => {
+    const { host, calls } = fakeHost(answered(200, ISSUED));
+    const r = await requestOwnerReset(
+      target(),
+      {},
+      { host, localUser: () => ({ user: "evil user\n", host: "box" }) },
+    );
+    expect(r.ok).toBe(false);
+    expect(calls).toHaveLength(0);
+  });
+});
+
+describe("ownerResetTarget", () => {
+  const meta = {
+    installId: "example.com",
+    projectId: "proj",
+    region: "europe-west1",
+    domain: "example.com",
+  };
+
+  it("addresses gcp-firebase by project + region and gcp by project + domain", () => {
+    expect(ownerResetTarget({ ...meta, provider: "gcp-firebase" })).toEqual({
+      ok: true,
+      value: { provider: "gcp-firebase", projectId: "proj", region: "europe-west1" },
+    });
+    expect(ownerResetTarget({ ...meta, provider: "gcp" })).toEqual({
+      ok: true,
+      value: { provider: "gcp", projectId: "proj", domain: "example.com" },
+    });
+  });
+
+  it("refuses aws and azure naming #952 and the ways in meanwhile", () => {
+    for (const provider of ["aws", "azure"] as const) {
+      const r = ownerResetTarget({ ...meta, provider });
+      expect(r.ok).toBe(false);
+      expect(r.ok ? "" : r.error).toContain("#952");
+      expect(r.ok ? "" : r.error).toContain("Settings -> Users");
+    }
+  });
+
+  it("sends a self-hosted install to its .caelo/ directory", () => {
+    const r = ownerResetTarget({ ...meta, provider: "self-hosted", projectId: null });
+    expect(r.ok ? "" : r.error).toContain(".caelo/");
+  });
+});
+
+describe("the reset link is never logged", () => {
+  const LOGGERS = ["log", "info", "warn", "error", "debug"] as const;
+
+  async function captured(run: () => Promise<unknown>): Promise<string> {
+    const lines: string[] = [];
+    const spies = [
+      ...LOGGERS.map((m) =>
+        spyOn(console, m).mockImplementation((...a: unknown[]) => {
+          lines.push(a.map(String).join(" "));
+        }),
+      ),
+      spyOn(process.stdout, "write").mockImplementation((chunk: unknown) => {
+        lines.push(String(chunk));
+        return true;
+      }),
+      spyOn(process.stderr, "write").mockImplementation((chunk: unknown) => {
+        lines.push(String(chunk));
+        return true;
+      }),
+    ];
+    try {
+      await run();
+    } finally {
+      for (const s of spies) s.mockRestore();
+    }
+    return lines.join("\n");
+  }
+
+  it("on gcp-firebase, gcp and self-hosted, nothing is printed while the link is fetched", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "caelo-owner-reset-log-"));
+    writeInternalSecret(dir, "x".repeat(96));
+    try {
+      const firebaseRun = async (args: string[]): Promise<GcloudResult> => {
+        const line = args.join(" ");
+        if (line.startsWith("run services list")) return ok("caelo-production-admin-abc\n");
+        if (line.startsWith("run services describe")) return ok("https://admin-abc.a.run.app\n");
+        return fakeGcloud([])(args);
+      };
+      const results: unknown[] = [];
+      const output = await captured(async () => {
+        results.push(
+          await requestOwnerReset(
+            { provider: "gcp-firebase", projectId: "proj", region: "europe-west1" },
+            {},
+            { run: firebaseRun, fetch: fakeFetch(() => Response.json(ISSUED)).doFetch },
+          ),
+          await requestOwnerReset(
+            { provider: "gcp", projectId: "proj", domain: "example.com" },
+            {},
+            { run: fakeGcloud([]), fetch: fakeFetch(() => Response.json(ISSUED)).doFetch },
+          ),
+          await requestOwnerReset(
+            { provider: "self-hosted", caeloDir: dir, adminUrl: "https://admin.example.com" },
+            {},
+            {
+              host: fakeHost(answered(200, ISSUED)).host,
+              localUser: () => ({ user: "op", host: "box" }),
+            },
+          ),
+        );
+      });
+      expect(results.every((r) => (r as { ok: boolean }).ok)).toBe(true);
+      expect(output).not.toContain(TOKEN);
+      expect(output).not.toContain(encodeURIComponent(TOKEN));
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("the printed lines are the only place the link appears", () => {
+    const text = describeOwnerReset({
+      email: "owner@example.com",
+      resetUrl: "https://admin.example.com/reset?token=abc",
+      expiresAt: "2026-10-15T12:52:56.000Z",
+    }).join("\n");
+    expect(text).toContain("not saved anywhere");
+  });
+});

package/src/owner-reset.test.ts

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MPL-2.0
 
 /**
- * #769 — `owner-reset` asks the admin for a reset link through IAP (as
+ * #769 — `owner-reset` on gcp-firebase asks the admin for a reset link through IAP (as
  * caelo-mcp) with the internal token for scope `auth.owner_reset`, and builds
  * the link on the admin URL the operator can open.
  */
@@ -13,7 +13,7 @@ import { describeOwnerReset, OWNER_RESET_SCOPE, requestOwnerReset } from "./owne
 const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
 const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
 const ADMIN = "https://caelo-production-admin-abc-ew.a.run.app";
-const target = { projectId: "proj", region: "europe-west1" };
+const target = { provider: "gcp-firebase" as const, projectId: "proj", region: "europe-west1" };
 
 function fakeGcloud(
   overrides: Record<string, GcloudResult> = {},