@caelo-cms/provisioning 0.10.71 → 0.10.72

package/src/state-migrate.ts

@@ -82,6 +82,13 @@ export interface StatePulumiOps {
 export interface MigrateDeps {
   readonly pulumi: StatePulumiOps;
   readonly report: UpgradeReporter;
+  /**
+   * #1078 — whether this machine's Application Default Credentials (which
+   * every Pulumi call here uses) work now. Checked before the first Pulumi
+   * call, so missing or expired ones stop the run with the login command
+   * instead of a page of per-resource provider errors.
+   */
+  checkAdc(): Promise<{ readonly ok: true } | { readonly ok: false; readonly error: string }>;
   /** The install's backend resolved for Pulumi. */
   resolve(record: StateBackendRecord): ResolvedBackend;
   /** Ask the operator to accept the ops backend's cost; false = cancel. */
@@ -241,6 +248,10 @@ export async function migrateState(
       };
     }
   }
+  const adc = await deps.checkAdc();
+  if (!adc.ok) {
+    return { ok: false, error: `${adc.error} Nothing was changed.` };
+  }
   const pre = report.step("Preflight: Pulumi CLI, source stack, pending operations, drift");
   let from: ResolvedBackend;
   let mode: "stack-migrate" | "export-import";

package/src/wizards/gcp.ts

@@ -51,6 +51,7 @@ import type { DnsRecord } from "../dns/types.js";
 import {
   activeAccount,
   type BillingAccount,
+  checkGcloudAuth,
   createProject,
   createServiceAccount,
   enableApis,
@@ -639,19 +640,20 @@ async function resolveImageDigests(): Promise<ImageDigests> {
 // Per-step helpers
 // =========================================================================
 
+/**
+ * An active gcloud account that can mint a token now. `activeAccount` alone
+ * passes with an expired login (`auth list` reads local config), and the
+ * first real gcloud call of the run then failed with a reauth error deep in
+ * a later step (#630, #1078).
+ */
 async function stepActiveGcloud(): Promise<void> {
-  const stepName = "gcloud-active";
-  const account = await activeAccount();
-  if (!account) {
-    log.error(red("No active gcloud account."));
-    log.warn(
-      `Run ${bold("gcloud auth login")} in another terminal, then re-run ${bold(selfCommand())}.`,
-    );
-    cancel("Aborted — no gcloud auth.");
+  const auth = await checkGcloudAuth();
+  if (!auth.ok) {
+    log.error(red(auth.error));
+    cancel("Aborted — nothing was changed.");
     process.exit(2);
   }
-  log.success(`gcloud auth: ${bold(account)}`);
-  void stepName;
+  log.success(`gcloud auth: ${bold(auth.account)}`);
 }
 
 async function stepProjectId(opts: GcpWizardOpts): Promise<string> {
@@ -1385,8 +1387,18 @@ async function stepKeylessProvisioner(
   const sAdc = spinner();
   sAdc.start("Checking that your Application Default Credentials can impersonate it...");
   let adc = await check();
-  if (!adc.ok && adc.reason === "no-adc" && !opts.nonInteractive) {
-    sAdc.stop(yellow("No Application Default Credentials yet"));
+  if (
+    !adc.ok &&
+    (adc.reason === "no-adc" || adc.reason === "expired-adc") &&
+    !opts.nonInteractive
+  ) {
+    sAdc.stop(
+      yellow(
+        adc.reason === "expired-adc"
+          ? "Your Application Default Credentials have expired"
+          : "No Application Default Credentials yet",
+      ),
+    );
     const login = await confirm({
       message: `Run ${bold("gcloud auth application-default login")} now (opens your browser; sign in as ${account})?`,
       initialValue: true,
@@ -1403,7 +1415,7 @@ async function stepKeylessProvisioner(
   }
   if (!adc.ok) {
     sAdc.stop(red("Infrastructure credentials not ready"));
-    log.error(adc.error);
+    log.error(`${adc.error}\nPulumi was not started.`);
     cancel("Aborted.");
     process.exit(1);
   }