@caelo-cms/provisioning 0.10.70 → 0.10.72

package/src/adc-check.ts

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Probe this machine's Application Default Credentials (#1078) — the
+ * credentials every local Pulumi run uses (the installer in local mode,
+ * `state migrate`). Without the probe, Pulumi starts with missing or
+ * expired ADC and prints one provider error per resource (`invalid_grant`
+ * … `invalid_rapt`) before failing, and the one line the Owner needs —
+ * `gcloud auth application-default login` — never appears.
+ *
+ * The probe runs `gcloud auth application-default print-access-token`,
+ * which refreshes the token exactly as Pulumi's Google provider would, so
+ * expired or reauth-blocked credentials fail here. The token is discarded.
+ */
+
+import { type GcloudResult, gcloudErrorLine, isGcloudAuthError } from "./gcloud.js";
+
+/** The command that fixes both a missing and an expired login. */
+export const ADC_LOGIN_COMMAND = "gcloud auth application-default login";
+
+export type AdcProbe =
+  | { readonly ok: true }
+  | {
+      readonly ok: false;
+      /**
+       * `missing`: no ADC on this machine; `expired`: they exist but can no
+       * longer mint a token (expired/revoked refresh token, reauth policy);
+       * `error`: gcloud failed for another reason (its line is in `error`).
+       */
+      readonly reason: "missing" | "expired" | "error";
+      /** One line naming {@link ADC_LOGIN_COMMAND}. */
+      readonly error: string;
+    };
+
+/** gcloud's wording when no ADC file exists (and google-auth's, for older SDKs). */
+const ADC_MISSING = /credentials were not found|could not automatically determine credentials/i;
+
+/**
+ * Classify the result of `gcloud auth application-default print-access-token`.
+ * Pure, so the async installer path and the sync attach path word it alike.
+ */
+export function adcProbeFromResult(r: GcloudResult): AdcProbe {
+  if (r.ok && r.stdout.trim().length > 0) return { ok: true };
+  if (ADC_MISSING.test(r.stderr) || (r.ok && r.stdout.trim().length === 0)) {
+    return {
+      ok: false,
+      reason: "missing",
+      error: `No Application Default Credentials on this machine; Pulumi needs them. Run \`${ADC_LOGIN_COMMAND}\` and re-run this command.`,
+    };
+  }
+  if (isGcloudAuthError(r.stderr)) {
+    return {
+      ok: false,
+      reason: "expired",
+      error: `The Application Default Credentials on this machine have expired (gcloud: ${gcloudErrorLine(r.stderr)}). Run \`${ADC_LOGIN_COMMAND}\` and re-run this command.`,
+    };
+  }
+  return {
+    ok: false,
+    reason: "error",
+    error: `Could not check the Application Default Credentials on this machine (gcloud: ${gcloudErrorLine(r.stderr)}). Run \`${ADC_LOGIN_COMMAND}\` if they are missing or expired, then re-run this command.`,
+  };
+}
+
+/** The `print-access-token` arguments the probe runs. */
+export const ADC_PROBE_ARGS: readonly string[] = [
+  "auth",
+  "application-default",
+  "print-access-token",
+];

package/src/adc-impersonation.ts

@@ -12,6 +12,7 @@
  * stay in local variables: never printed, logged, returned or written.
  */
 
+import { ADC_PROBE_ARGS, adcProbeFromResult } from "./adc-check.js";
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { type GcloudRunner, realSleep, type Sleep } from "./gcloud-retry.js";
 import {
@@ -30,8 +31,12 @@ export type AdcCheck =
   | { readonly ok: true }
   | {
       readonly ok: false;
-      /** `no-adc`: no Application Default Credentials; `denied`: they can't impersonate. */
-      readonly reason: "no-adc" | "denied" | "error";
+      /**
+       * `no-adc`: no Application Default Credentials; `expired-adc`: they
+       * exist but can no longer mint a token (#1078); `denied`: they can't
+       * impersonate.
+       */
+      readonly reason: "no-adc" | "expired-adc" | "denied" | "error";
       readonly error: string;
     };
 
@@ -53,19 +58,17 @@ export async function checkAdcImpersonation(
   const sa = provisionerServiceAccountEmail(target.projectId);
   const env = withoutAmbientGoogleCredentials(deps.env ?? process.env);
 
-  const adc = await run(["auth", "application-default", "print-access-token"], { env });
-  const sourceToken = adc.ok ? adc.stdout.trim() : "";
-  if (!sourceToken) {
+  const adc = await run([...ADC_PROBE_ARGS], { env });
+  const probe = adcProbeFromResult(adc);
+  if (!probe.ok) {
     return {
       ok: false,
-      reason: "no-adc",
-      error: [
-        "No Application Default Credentials on this machine.",
-        `Infrastructure runs authenticate with your own Google login and impersonate ${sa}; no key file is used.`,
-        `Run \`gcloud auth application-default login\` (sign in as ${target.operatorAccount}), then re-run.`,
-      ].join("\n"),
+      reason: probe.reason === "expired" ? "expired-adc" : "no-adc",
+      // One line (#1078): the login command must not drown in context.
+      error: `${probe.error} Sign in as ${target.operatorAccount}: Pulumi uses these credentials to impersonate ${sa}, no key file.`,
     };
   }
+  const sourceToken = adc.stdout.trim();
 
   // The account to impersonate is the one IAM reports, not a string
   // assembled from install.json: what goes into the request is an email

package/src/provisioner-identity.test.ts

@@ -369,6 +369,31 @@ describe("checkAdcImpersonation", () => {
     expect(env.GOOGLE_OAUTH_ACCESS_TOKEN).toBeUndefined();
   });
 
+  it("expired ADC stop before IAM or the Credentials API is asked (#1078)", async () => {
+    const g = fakeGcloud({
+      "auth application-default print-access-token": [
+        fail(
+          "ERROR: (gcloud.auth.application-default.print-access-token) There was a problem refreshing your current auth tokens: ('invalid_grant: reauth related error (invalid_rapt)', {'error': 'invalid_grant'})",
+        ),
+      ],
+    });
+    const f = fakeFetch([]);
+    const r = await checkAdcImpersonation(
+      { projectId: PROJECT, operatorAccount: OPERATOR, freshGrant: false },
+      { run: g.run, sleep: noSleep, fetch: f.impl },
+    );
+    expect(r.ok).toBe(false);
+    if (r.ok) return;
+    expect(r.reason).toBe("expired-adc");
+    expect(r.error).toContain("have expired");
+    expect(r.error).toContain("`gcloud auth application-default login`");
+    expect(r.error).not.toContain("\n");
+    expect(g.calls.map((c) => c.args.join(" "))).toEqual([
+      "auth application-default print-access-token",
+    ]);
+    expect(f.urls).toEqual([]);
+  });
+
   it("succeeds when ADC may mint a token for the provisioner, and keeps no token", async () => {
     const g = fakeGcloud({
       "auth application-default print-access-token": [ok(`${SOURCE}\n`)],

package/src/remote-mcp-stack-config.test.ts

@@ -0,0 +1,195 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1082 — the remote-MCP identity env has one owner: the stack, which
+ * declares it from the config the CLI writes before `up`. These tests pin
+ * the config round trip and what a refreshed `pulumi up` / `state migrate`
+ * preview would plan for the services' env against an install whose live
+ * services carry the vars (the viu.one shape: contract env plus the four /
+ * two identity vars gcloud added, in gcloud's order).
+ */
+
+import { describe, expect, it } from "bun:test";
+import type * as automation from "@pulumi/pulumi/automation";
+import {
+  adminEnvContract,
+  type CloudRunEnvVar,
+  databaseUrls,
+  gatewayEnvContract,
+  parseRemoteMcpIdentityConfig,
+  REMOTE_MCP_ENV,
+  REMOTE_MCP_IDENTITY_CONFIG,
+  type RemoteMcpIdentity,
+  remoteMcpIdentityEnv,
+  remoteMcpIdentityStackEnv,
+  sameRemoteMcpIdentity,
+  serializeRemoteMcpIdentity,
+} from "./stack-contract.js";
+import { applyStackConfig, type StackConfigInputs } from "./wizards/gcp-pulumi.js";
+
+const identity: RemoteMcpIdentity = {
+  adminUrl: "https://caelo-production-admin-f89c711-7whkh344ca-ew.a.run.app",
+  mcpPublicUrl: "https://caelo-production-gateway-6da3bb0-7whkh344ca-ew.a.run.app",
+  iapAudience: "/projects/42/locations/europe-west1/services/caelo-production-admin-f89c711",
+  googleOrgDomain: "acme.com",
+};
+
+const contractInputs = {
+  provider: "gcp-firebase",
+  projectId: "viu-one-web",
+  env: "production",
+  domain: "viu.one",
+  region: "europe-west1",
+  stagingHost: "staging.viu.one",
+  databaseUrls: databaseUrls("10.153.0.3"),
+} as const;
+const contract = {
+  admin: adminEnvContract({
+    ...contractInputs,
+    firebaseSiteId: "caelo-production-site-eb4697",
+    gatewayService: "caelo-production-gateway-6da3bb0",
+  }),
+  gateway: gatewayEnvContract(contractInputs),
+};
+
+/** The env a stack declares for one service, given the config value. */
+function declared(slug: "admin" | "gateway", config: string | undefined): CloudRunEnvVar[] {
+  return [...contract[slug], ...remoteMcpIdentityStackEnv(config)[slug]];
+}
+
+/** The live services after an installer run plus its old gcloud post-step: gcloud reorders. */
+function live(slug: "admin" | "gateway"): CloudRunEnvVar[] {
+  return [...contract[slug], ...remoteMcpIdentityEnv(identity)[slug]].reverse();
+}
+
+/**
+ * What a refreshed preview plans for `containers.env`: the provider holds it
+ * as a set (terraform-provider-google `google_cloud_run_v2_service`), so
+ * order is no diff — a var only the live service has is removed, one only
+ * the program has is added, a different value is changed.
+ */
+function envPlan(desired: readonly CloudRunEnvVar[], actual: readonly CloudRunEnvVar[]) {
+  const key = (v: CloudRunEnvVar) => JSON.stringify(v);
+  const want = new Map(desired.map((v) => [v.name, key(v)]));
+  const have = new Map(actual.map((v) => [v.name, key(v)]));
+  return {
+    removed: [...have.keys()].filter((n) => !want.has(n)).sort(),
+    added: [...want.keys()].filter((n) => !have.has(n)).sort(),
+    changed: [...want.keys()].filter((n) => have.has(n) && have.get(n) !== want.get(n)).sort(),
+  };
+}
+
+describe("remote-MCP identity as stack config (#1082)", () => {
+  it("round-trips through the config value", () => {
+    const raw = serializeRemoteMcpIdentity(identity);
+    expect(parseRemoteMcpIdentityConfig(raw)).toEqual(identity);
+    const { googleOrgDomain: _d, ...noOrg } = identity;
+    expect(parseRemoteMcpIdentityConfig(serializeRemoteMcpIdentity(noOrg))).toEqual(noOrg);
+  });
+
+  it("declares nothing while the config is unset (a fresh install's first up)", () => {
+    expect(parseRemoteMcpIdentityConfig(undefined)).toBeNull();
+    expect(remoteMcpIdentityStackEnv(undefined)).toEqual({ admin: [], gateway: [] });
+  });
+
+  it("refuses a corrupt or foreign value loudly instead of dropping the vars", () => {
+    expect(() => parseRemoteMcpIdentityConfig("{")).toThrow(REMOTE_MCP_IDENTITY_CONFIG);
+    expect(() =>
+      parseRemoteMcpIdentityConfig(JSON.stringify({ ...identity, adminUrl: "http://x" })),
+    ).toThrow("adminUrl");
+    expect(() => parseRemoteMcpIdentityConfig(JSON.stringify({ ...identity, extra: "x" }))).toThrow(
+      REMOTE_MCP_IDENTITY_CONFIG,
+    );
+  });
+
+  it("declares exactly the vars and values upgrade's gcloud roll sets", () => {
+    expect(remoteMcpIdentityStackEnv(serializeRemoteMcpIdentity(identity))).toEqual(
+      remoteMcpIdentityEnv(identity),
+    );
+    expect(
+      remoteMcpIdentityStackEnv(serializeRemoteMcpIdentity(identity))
+        .admin.map((v) => v.name)
+        .sort(),
+    ).toEqual(Object.values(REMOTE_MCP_ENV).sort());
+  });
+
+  it.each(["admin", "gateway"] as const)(
+    "%s: with the config the CLI writes, a refreshed plan removes and changes nothing",
+    (slug) => {
+      const plan = envPlan(declared(slug, serializeRemoteMcpIdentity(identity)), live(slug));
+      expect(plan).toEqual({ removed: [], added: [], changed: [] });
+    },
+  );
+
+  it("without it (the bug), every up strips the vars gcloud set", () => {
+    expect(envPlan(declared("admin", undefined), live("admin")).removed).toEqual([
+      "CAELO_ADMIN_URL",
+      "CAELO_GOOGLE_ORG_DOMAIN",
+      "CAELO_IAP_AUDIENCE",
+      "CAELO_MCP_PUBLIC_URL",
+    ]);
+    expect(envPlan(declared("gateway", undefined), live("gateway")).removed).toEqual([
+      "CAELO_ADMIN_URL",
+      "CAELO_MCP_PUBLIC_URL",
+    ]);
+  });
+
+  it("compares identities by every var they set", () => {
+    expect(sameRemoteMcpIdentity(identity, { ...identity })).toBe(true);
+    expect(sameRemoteMcpIdentity(identity, { ...identity, googleOrgDomain: undefined })).toBe(
+      false,
+    );
+    expect(sameRemoteMcpIdentity(identity, null)).toBe(false);
+    expect(sameRemoteMcpIdentity(null, null)).toBe(true);
+  });
+});
+
+describe("applyStackConfig writes the identity (#1082)", () => {
+  /** A Stack fake recording the config the CLI sets. */
+  function fakeStack() {
+    const config: Record<string, string> = {};
+    const stack = {
+      setAllConfig: async (c: automation.ConfigMap) => {
+        for (const [k, v] of Object.entries(c)) config[k] = v.value;
+      },
+      setConfig: async (k: string, v: automation.ConfigValue) => {
+        config[k] = v.value;
+      },
+      getConfig: async (k: string) => {
+        if (!(k in config)) throw new Error(`configuration key '${k}' not found`);
+        return { value: config[k] as string };
+      },
+    } as unknown as automation.Stack;
+    return { stack, config };
+  }
+  const inputs: StackConfigInputs = {
+    provider: "gcp-firebase",
+    projectId: "viu-one-web",
+    domain: "viu.one",
+    stagingDomain: "staging.viu.one",
+    ownerEmail: "owner@viu.one",
+    region: "europe-west1",
+    cloudSqlTier: "db-f1-micro",
+    cloudSqlHa: false,
+    adminMinInstances: 0,
+    adminMemory: "2Gi",
+    gatewayMinInstances: 0,
+    wafAdaptiveProtection: false,
+    iapAllowlist: ["owner@viu.one"],
+    imageDigests: { admin: "sha256:a", gateway: "sha256:g" },
+  };
+  const key = `caelo-gcp-firebase:${REMOTE_MCP_IDENTITY_CONFIG}`;
+
+  it("sets the key the stack reads, from the resolved identity", async () => {
+    const { stack, config } = fakeStack();
+    await applyStackConfig(stack, { ...inputs, remoteMcpIdentity: identity }, []);
+    expect(parseRemoteMcpIdentityConfig(config[key])).toEqual(identity);
+  });
+
+  it("keeps what an earlier run recorded when the identity could not be read", async () => {
+    const { stack, config } = fakeStack();
+    config[key] = serializeRemoteMcpIdentity(identity);
+    await applyStackConfig(stack, { ...inputs, remoteMcpIdentity: null }, []);
+    expect(parseRemoteMcpIdentityConfig(config[key])).toEqual(identity);
+  });
+});

package/src/remote-mcp.test.ts

@@ -11,13 +11,15 @@ import { GCP_PUBLIC_BASE_PATHS } from "@caelo-cms/shared";
 import type { GcloudResult } from "./gcloud.js";
 import type { GcloudRunner } from "./gcloud-retry.js";
 import {
-  applyRemoteMcpIdentityEnv,
+  checkRemoteMcpIdentityEnv,
   ensureMcpArmorRule,
+  findRemoteMcpTarget,
   type LiveUrlMap,
   planUrlMapPaths,
   type RemoteMcpTarget,
   resolveGoogleOrgDomain,
   resolveRemoteMcpIdentity,
+  resolveStackRemoteMcpIdentity,
 } from "./remote-mcp.js";
 import {
   GENERAL_RATE_LIMIT_PRIORITY,
@@ -497,30 +499,111 @@ describe("resolveGoogleOrgDomain (#914)", () => {
   });
 });
 
-describe("applyRemoteMcpIdentityEnv", () => {
+const serviceJson = (env: { name: string; value: string }[]) =>
+  ok(JSON.stringify({ spec: { template: { spec: { containers: [{ env }] } } } }));
+const DESCRIBE_JSON = "--region=europe-west1 --project=acme --format=json";
+
+describe("findRemoteMcpTarget (#1082)", () => {
+  it("finds the Pulumi-suffixed services by prefix", async () => {
+    const { run } = fakeGcloud({
+      "run services list --region europe-west1 --project acme --filter metadata.name~^caelo-production-admin":
+        ok("caelo-production-admin-aaa\n"),
+      "run services list --region europe-west1 --project acme --filter metadata.name~^caelo-production-gateway":
+        ok("caelo-production-gateway-bbb\n"),
+    });
+    const { services: _s, ...base } = firebase;
+    expect(await findRemoteMcpTarget(base, { run })).toEqual({ ok: true, target: firebase });
+  });
+
+  it("fails naming the service it cannot find (a fresh install before its first up)", async () => {
+    const { run } = fakeGcloud({ "run services list": ok("") });
+    const { services: _s, ...base } = firebase;
+    const r = await findRemoteMcpTarget(base, { run });
+    expect(r.ok).toBe(false);
+    if (!r.ok) expect(r.error).toContain("caelo-production-admin* Cloud Run service");
+  });
+});
+
+describe("resolveStackRemoteMcpIdentity (#1082)", () => {
+  const base = {
+    "projects describe acme": ok("42\n"),
+    "projects get-ancestors acme": ANCESTORS_IN_ORG,
+    "run services describe caelo-production-admin-aaa": ok("https://a-xyz.a.run.app\n"),
+    "run services describe caelo-production-gateway-bbb": ok("https://g-xyz.a.run.app\n"),
+  };
+
+  it("is the live identity when the organisation is readable", async () => {
+    const { run } = fakeGcloud({ ...base, "organizations describe 123456": ok("acme.com\n") });
+    const r = await resolveStackRemoteMcpIdentity(firebase, { run });
+    expect(r.ok && r.identity.googleOrgDomain).toBe("acme.com");
+    expect(r.ok && r.orgDomainError).toBeUndefined();
+  });
+
+  it("carries the admin's live organisation domain over when it cannot be read now", async () => {
+    // The stack owns the var: leaving it out of the config would remove it
+    // on the next `up`, where a gcloud roll leaves it as it is.
+    const { run } = fakeGcloud({
+      ...base,
+      "organizations describe 123456": fail("PERMISSION_DENIED"),
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson([
+        { name: "CAELO_GOOGLE_ORG_DOMAIN", value: "acme.com" },
+      ]),
+    });
+    const r = await resolveStackRemoteMcpIdentity(firebase, { run });
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.identity.googleOrgDomain).toBe("acme.com");
+    expect(r.orgDomainError).toContain("Organization Viewer");
+  });
+
+  it("sets no domain when neither the organisation nor the admin has one", async () => {
+    const { run } = fakeGcloud({
+      ...base,
+      "organizations describe 123456": fail("PERMISSION_DENIED"),
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson([]),
+    });
+    const r = await resolveStackRemoteMcpIdentity(firebase, { run });
+    expect(r.ok && r.identity.googleOrgDomain).toBeUndefined();
+  });
+});
+
+describe("checkRemoteMcpIdentityEnv (#1082)", () => {
   const identity = {
     adminUrl: "https://a.run.app",
     mcpPublicUrl: "https://g.run.app",
     iapAudience: "/projects/42/locations/europe-west1/services/caelo-production-admin-aaa",
   };
-  const serviceJson = (env: { name: string; value: string }[]) =>
-    ok(JSON.stringify({ spec: { template: { spec: { containers: [{ env }] } } } }));
+  const full = remoteMcpIdentityEnv(identity);
+  const plain = (env: ReturnType<typeof remoteMcpIdentityEnv>["admin"]) =>
+    env.map((e) => ({ name: e.name, value: "value" in e ? e.value : "" }));
 
-  it("updates only a service whose vars differ", async () => {
+  it("reports no drift when the services carry the vars, and never updates a service", async () => {
     const { run, calls } = fakeGcloud({
-      "run services describe caelo-production-admin-aaa": serviceJson([
-        { name: "CAELO_IAP_AUDIENCE", value: identity.iapAudience },
-        { name: "CAELO_MCP_PUBLIC_URL", value: identity.mcpPublicUrl },
-        { name: "CAELO_ADMIN_URL", value: identity.adminUrl },
-      ]),
-      "run services describe caelo-production-gateway-bbb": serviceJson([]),
-      "run services update caelo-production-gateway-bbb": ok(),
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson(
+        plain(full.admin),
+      ),
+      [`run services describe caelo-production-gateway-bbb ${DESCRIBE_JSON}`]: serviceJson(
+        plain(full.gateway),
+      ),
     });
-    const r = await applyRemoteMcpIdentityEnv(firebase, identity, { run });
-    expect(r.ok).toBe(true);
-    expect(calls.filter((c) => c.startsWith("run services update"))).toEqual([
-      "run services update caelo-production-gateway-bbb --region=europe-west1 --project=acme --update-env-vars=CAELO_ADMIN_URL=https://a.run.app,CAELO_MCP_PUBLIC_URL=https://g.run.app --quiet",
+    const r = await checkRemoteMcpIdentityEnv(firebase, identity, { run });
+    expect(r).toEqual({ ok: true, drift: { admin: [], gateway: [] } });
+    expect(calls.some((c) => c.startsWith("run services update"))).toBe(false);
+  });
+
+  it("names what a service lacks", async () => {
+    const { run, calls } = fakeGcloud({
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson(
+        plain(full.admin),
+      ),
+      [`run services describe caelo-production-gateway-bbb ${DESCRIBE_JSON}`]: serviceJson([]),
+    });
+    const r = await checkRemoteMcpIdentityEnv(firebase, identity, { run });
+    expect(r.ok && r.drift.gateway.map((c) => c.name)).toEqual([
+      "CAELO_ADMIN_URL",
+      "CAELO_MCP_PUBLIC_URL",
     ]);
+    expect(calls.some((c) => c.startsWith("run services update"))).toBe(false);
   });
 });