@caelo-cms/provisioning 0.10.71 → 0.11.0

package/src/adc-check.test.ts

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import { adcProbeFromResult } from "./adc-check.js";
+import type { GcloudResult } from "./gcloud.js";
+
+const failed = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+
+describe("adcProbeFromResult (#1078)", () => {
+  it("a printed token is working ADC", () => {
+    expect(adcProbeFromResult({ ok: true, stdout: "ya29.x\n", stderr: "", exitCode: 0 })).toEqual({
+      ok: true,
+    });
+  });
+
+  it("no ADC file reads as missing and names the login", () => {
+    const r = adcProbeFromResult(
+      failed(
+        "ERROR: (gcloud.auth.application-default.print-access-token) Your default credentials were not found. To set up Application Default Credentials, see https://cloud.google.com/docs/authentication/external/set-up-adc for more information.",
+      ),
+    );
+    expect(r.ok).toBe(false);
+    if (r.ok) return;
+    expect(r.reason).toBe("missing");
+    expect(r.error).toContain("No Application Default Credentials");
+    expect(r.error).toContain("`gcloud auth application-default login`");
+    expect(r.error).not.toContain("\n");
+  });
+
+  for (const stderr of [
+    "ERROR: (gcloud.auth.application-default.print-access-token) There was a problem refreshing your current auth tokens: ('invalid_grant: reauth related error (invalid_rapt)', {'error': 'invalid_grant', 'error_subtype': 'invalid_rapt'})",
+    "ERROR: (gcloud.auth.application-default.print-access-token) Reauthentication failed. cannot prompt during non-interactive execution.",
+    "ERROR: (gcloud.auth.application-default.print-access-token) ('invalid_grant: Bad Request', {'error': 'invalid_grant', 'error_description': 'Bad Request'})",
+  ]) {
+    it(`reads as expired: ${stderr.slice(62, 110)}`, () => {
+      const r = adcProbeFromResult(failed(stderr));
+      expect(r.ok).toBe(false);
+      if (r.ok) return;
+      expect(r.reason).toBe("expired");
+      expect(r.error).toContain("have expired");
+      expect(r.error).toContain("`gcloud auth application-default login`");
+      expect(r.error).not.toContain("\n");
+    });
+  }
+
+  it("any other failure still names the login, with gcloud's line", () => {
+    const r = adcProbeFromResult(failed("ERROR: network unreachable"));
+    expect(r.ok).toBe(false);
+    if (r.ok) return;
+    expect(r.reason).toBe("error");
+    expect(r.error).toContain("network unreachable");
+    expect(r.error).toContain("gcloud auth application-default login");
+  });
+});

package/src/adc-check.ts

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Probe this machine's Application Default Credentials (#1078) — the
+ * credentials every local Pulumi run uses (the installer in local mode,
+ * `state migrate`). Without the probe, Pulumi starts with missing or
+ * expired ADC and prints one provider error per resource (`invalid_grant`
+ * … `invalid_rapt`) before failing, and the one line the Owner needs —
+ * `gcloud auth application-default login` — never appears.
+ *
+ * The probe runs `gcloud auth application-default print-access-token`,
+ * which refreshes the token exactly as Pulumi's Google provider would, so
+ * expired or reauth-blocked credentials fail here. The token is discarded.
+ */
+
+import { type GcloudResult, gcloudErrorLine, isGcloudAuthError } from "./gcloud.js";
+
+/** The command that fixes both a missing and an expired login. */
+export const ADC_LOGIN_COMMAND = "gcloud auth application-default login";
+
+export type AdcProbe =
+  | { readonly ok: true }
+  | {
+      readonly ok: false;
+      /**
+       * `missing`: no ADC on this machine; `expired`: they exist but can no
+       * longer mint a token (expired/revoked refresh token, reauth policy);
+       * `error`: gcloud failed for another reason (its line is in `error`).
+       */
+      readonly reason: "missing" | "expired" | "error";
+      /** One line naming {@link ADC_LOGIN_COMMAND}. */
+      readonly error: string;
+    };
+
+/** gcloud's wording when no ADC file exists (and google-auth's, for older SDKs). */
+const ADC_MISSING = /credentials were not found|could not automatically determine credentials/i;
+
+/**
+ * Classify the result of `gcloud auth application-default print-access-token`.
+ * Pure, so the async installer path and the sync attach path word it alike.
+ */
+export function adcProbeFromResult(r: GcloudResult): AdcProbe {
+  if (r.ok && r.stdout.trim().length > 0) return { ok: true };
+  if (ADC_MISSING.test(r.stderr) || (r.ok && r.stdout.trim().length === 0)) {
+    return {
+      ok: false,
+      reason: "missing",
+      error: `No Application Default Credentials on this machine; Pulumi needs them. Run \`${ADC_LOGIN_COMMAND}\` and re-run this command.`,
+    };
+  }
+  if (isGcloudAuthError(r.stderr)) {
+    return {
+      ok: false,
+      reason: "expired",
+      error: `The Application Default Credentials on this machine have expired (gcloud: ${gcloudErrorLine(r.stderr)}). Run \`${ADC_LOGIN_COMMAND}\` and re-run this command.`,
+    };
+  }
+  return {
+    ok: false,
+    reason: "error",
+    error: `Could not check the Application Default Credentials on this machine (gcloud: ${gcloudErrorLine(r.stderr)}). Run \`${ADC_LOGIN_COMMAND}\` if they are missing or expired, then re-run this command.`,
+  };
+}
+
+/** The `print-access-token` arguments the probe runs. */
+export const ADC_PROBE_ARGS: readonly string[] = [
+  "auth",
+  "application-default",
+  "print-access-token",
+];

package/src/adc-impersonation.ts

@@ -12,6 +12,7 @@
  * stay in local variables: never printed, logged, returned or written.
  */
 
+import { ADC_PROBE_ARGS, adcProbeFromResult } from "./adc-check.js";
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { type GcloudRunner, realSleep, type Sleep } from "./gcloud-retry.js";
 import {
@@ -30,8 +31,12 @@ export type AdcCheck =
   | { readonly ok: true }
   | {
       readonly ok: false;
-      /** `no-adc`: no Application Default Credentials; `denied`: they can't impersonate. */
-      readonly reason: "no-adc" | "denied" | "error";
+      /**
+       * `no-adc`: no Application Default Credentials; `expired-adc`: they
+       * exist but can no longer mint a token (#1078); `denied`: they can't
+       * impersonate.
+       */
+      readonly reason: "no-adc" | "expired-adc" | "denied" | "error";
       readonly error: string;
     };
 
@@ -53,19 +58,17 @@ export async function checkAdcImpersonation(
   const sa = provisionerServiceAccountEmail(target.projectId);
   const env = withoutAmbientGoogleCredentials(deps.env ?? process.env);
 
-  const adc = await run(["auth", "application-default", "print-access-token"], { env });
-  const sourceToken = adc.ok ? adc.stdout.trim() : "";
-  if (!sourceToken) {
+  const adc = await run([...ADC_PROBE_ARGS], { env });
+  const probe = adcProbeFromResult(adc);
+  if (!probe.ok) {
     return {
       ok: false,
-      reason: "no-adc",
-      error: [
-        "No Application Default Credentials on this machine.",
-        `Infrastructure runs authenticate with your own Google login and impersonate ${sa}; no key file is used.`,
-        `Run \`gcloud auth application-default login\` (sign in as ${target.operatorAccount}), then re-run.`,
-      ].join("\n"),
+      reason: probe.reason === "expired" ? "expired-adc" : "no-adc",
+      // One line (#1078): the login command must not drown in context.
+      error: `${probe.error} Sign in as ${target.operatorAccount}: Pulumi uses these credentials to impersonate ${sa}, no key file.`,
     };
   }
+  const sourceToken = adc.stdout.trim();
 
   // The account to impersonate is the one IAM reports, not a string
   // assembled from install.json: what goes into the request is an email

package/src/provisioner-identity.test.ts

@@ -369,6 +369,31 @@ describe("checkAdcImpersonation", () => {
     expect(env.GOOGLE_OAUTH_ACCESS_TOKEN).toBeUndefined();
   });
 
+  it("expired ADC stop before IAM or the Credentials API is asked (#1078)", async () => {
+    const g = fakeGcloud({
+      "auth application-default print-access-token": [
+        fail(
+          "ERROR: (gcloud.auth.application-default.print-access-token) There was a problem refreshing your current auth tokens: ('invalid_grant: reauth related error (invalid_rapt)', {'error': 'invalid_grant'})",
+        ),
+      ],
+    });
+    const f = fakeFetch([]);
+    const r = await checkAdcImpersonation(
+      { projectId: PROJECT, operatorAccount: OPERATOR, freshGrant: false },
+      { run: g.run, sleep: noSleep, fetch: f.impl },
+    );
+    expect(r.ok).toBe(false);
+    if (r.ok) return;
+    expect(r.reason).toBe("expired-adc");
+    expect(r.error).toContain("have expired");
+    expect(r.error).toContain("`gcloud auth application-default login`");
+    expect(r.error).not.toContain("\n");
+    expect(g.calls.map((c) => c.args.join(" "))).toEqual([
+      "auth application-default print-access-token",
+    ]);
+    expect(f.urls).toEqual([]);
+  });
+
   it("succeeds when ADC may mint a token for the provisioner, and keeps no token", async () => {
     const g = fakeGcloud({
       "auth application-default print-access-token": [ok(`${SOURCE}\n`)],

package/src/state-command.test.ts

@@ -28,4 +28,16 @@ describe("adcNote (#816)", () => {
     expect(note).toContain("gcloud auth application-default login");
     expect(note).toContain("upgrade, status and backup don't need them");
   });
+
+  it("expired ADC say so instead of 'no ADC' (#1078)", () => {
+    const note = adcNote(() => ({
+      ok: false,
+      stdout: "",
+      stderr:
+        "ERROR: (gcloud.auth.application-default.print-access-token) Reauthentication failed. cannot prompt during non-interactive execution.",
+      exitCode: 1,
+    }));
+    expect(note).toContain("have expired");
+    expect(note).toContain("gcloud auth application-default login");
+  });
 });

package/src/state-command.ts

@@ -14,6 +14,8 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { confirm, isCancel, log, note } from "@clack/prompts";
 import { bold, red } from "kleur/colors";
+import { ADC_LOGIN_COMMAND, ADC_PROBE_ARGS, adcProbeFromResult } from "./adc-check.js";
+import { checkAdcImpersonation } from "./adc-impersonation.js";
 import { adoptionCandidates, existingCandidates } from "./adopt-existing.js";
 import { checkGcloudAuth, gcloud } from "./gcloud.js";
 import { GCP_STACK_ENV } from "./gcp-names.js";
@@ -209,6 +211,8 @@ export async function stateCommand(argv: readonly string[]): Promise<void> {
           }),
       }),
       report: clackReporter(),
+      checkAdc: () =>
+        checkAdcImpersonation({ projectId, operatorAccount: operator, freshGrant: false }),
       resolve: (record) =>
         resolveBackend(
           { installId, stateBackend: record },
@@ -334,9 +338,13 @@ export function attachProject(projectId: string): string {
  * do not, so a note on every attach sent Owners on a detour (#816).
  */
 export function adcNote(run: SyncGcloud): string | null {
-  const r = run(["auth", "application-default", "print-access-token"]);
-  if (r.ok) return null;
-  return "No Application Default Credentials on this machine. upgrade, status and backup don't need them; re-running the installer or `state migrate` does: gcloud auth application-default login";
+  const probe = adcProbeFromResult(run([...ADC_PROBE_ARGS]));
+  if (probe.ok) return null;
+  const state =
+    probe.reason === "expired"
+      ? "The Application Default Credentials on this machine have expired."
+      : "No Application Default Credentials on this machine.";
+  return `${state} upgrade, status and backup don't need them; re-running the installer or \`state migrate\` does: ${ADC_LOGIN_COMMAND}`;
 }
 
 /**

package/src/state-migrate.test.ts

@@ -156,6 +156,9 @@ function machine(initial: StateBackendRecord = { kind: "local" }) {
     planFiles: [] as { label: string; steps: number }[],
     /** What existingInProject answers (#1079); an Error is thrown. */
     existing: [] as readonly string[] | Error,
+    /** What checkAdc answers (#1078). */
+    adc: { ok: true } as { ok: true } | { ok: false; error: string },
+    adcChecks: 0,
   };
   const meta = (): MigrateInstall => ({
     installId: "gcp-firebase-acme",
@@ -169,6 +172,10 @@ function machine(initial: StateBackendRecord = { kind: "local" }) {
   const deps: MigrateDeps = {
     pulumi: p.ops,
     report,
+    checkAdc: async () => {
+      m.adcChecks++;
+      return m.adc;
+    },
     resolve: (record) =>
       resolveBackend(
         { installId: "gcp-firebase-acme", stateBackend: record },
@@ -566,3 +573,49 @@ describe("helpers", () => {
     expect(localStateNotice({ installId: "x", provider: "self-hosted" })).toBeNull();
   });
 });
+
+describe("migrateState — Application Default Credentials (#1078)", () => {
+  /** A Pulumi workspace that fails the test on any call. */
+  const untouchable = (): StatePulumiOps =>
+    new Proxy({} as StatePulumiOps, {
+      get: (_t, name) => () => {
+        throw new Error(`Pulumi ${String(name)} must not run without working ADC`);
+      },
+    });
+
+  for (const [what, error] of [
+    [
+      "missing",
+      "No Application Default Credentials on this machine; Pulumi needs them. Run `gcloud auth application-default login` and re-run this command.",
+    ],
+    [
+      "expired",
+      "The Application Default Credentials on this machine have expired (gcloud: invalid_grant: reauth related error (invalid_rapt)). Run `gcloud auth application-default login` and re-run this command.",
+    ],
+  ] as const) {
+    for (const dryRun of [false, true]) {
+      it(`${what} ADC stop the run before any Pulumi call${dryRun ? " (dry run)" : ""}`, async () => {
+        const t = machine();
+        t.m.adc = { ok: false, error };
+        const r = await migrateState(
+          t.meta(),
+          { to: "remote", dryRun },
+          { ...t.deps, pulumi: untouchable() },
+        );
+        expect(r).toEqual({ ok: false, error: `${error} Nothing was changed.` });
+        expect(t.m.adcChecks).toBe(1);
+        expect(t.m.backend).toEqual({ kind: "local" });
+        expect(t.m.backups).toBe(0);
+        expect(t.m.ensureRemoteCalls).toEqual([]);
+        expect(t.m.locked).toBe(false);
+      });
+    }
+  }
+
+  it("working ADC let the migration run", async () => {
+    const t = machine();
+    const r = await migrateState(t.meta(), { to: "remote", dryRun: false }, t.deps);
+    expect(r).toEqual({ ok: true, changed: true });
+    expect(t.m.adcChecks).toBe(1);
+  });
+});

package/src/state-migrate.ts

@@ -82,6 +82,13 @@ export interface StatePulumiOps {
 export interface MigrateDeps {
   readonly pulumi: StatePulumiOps;
   readonly report: UpgradeReporter;
+  /**
+   * #1078 — whether this machine's Application Default Credentials (which
+   * every Pulumi call here uses) work now. Checked before the first Pulumi
+   * call, so missing or expired ones stop the run with the login command
+   * instead of a page of per-resource provider errors.
+   */
+  checkAdc(): Promise<{ readonly ok: true } | { readonly ok: false; readonly error: string }>;
   /** The install's backend resolved for Pulumi. */
   resolve(record: StateBackendRecord): ResolvedBackend;
   /** Ask the operator to accept the ops backend's cost; false = cancel. */
@@ -241,6 +248,10 @@ export async function migrateState(
       };
     }
   }
+  const adc = await deps.checkAdc();
+  if (!adc.ok) {
+    return { ok: false, error: `${adc.error} Nothing was changed.` };
+  }
   const pre = report.step("Preflight: Pulumi CLI, source stack, pending operations, drift");
   let from: ResolvedBackend;
   let mode: "stack-migrate" | "export-import";

package/src/wizards/gcp.ts

@@ -51,6 +51,7 @@ import type { DnsRecord } from "../dns/types.js";
 import {
   activeAccount,
   type BillingAccount,
+  checkGcloudAuth,
   createProject,
   createServiceAccount,
   enableApis,
@@ -639,19 +640,20 @@ async function resolveImageDigests(): Promise<ImageDigests> {
 // Per-step helpers
 // =========================================================================
 
+/**
+ * An active gcloud account that can mint a token now. `activeAccount` alone
+ * passes with an expired login (`auth list` reads local config), and the
+ * first real gcloud call of the run then failed with a reauth error deep in
+ * a later step (#630, #1078).
+ */
 async function stepActiveGcloud(): Promise<void> {
-  const stepName = "gcloud-active";
-  const account = await activeAccount();
-  if (!account) {
-    log.error(red("No active gcloud account."));
-    log.warn(
-      `Run ${bold("gcloud auth login")} in another terminal, then re-run ${bold(selfCommand())}.`,
-    );
-    cancel("Aborted — no gcloud auth.");
+  const auth = await checkGcloudAuth();
+  if (!auth.ok) {
+    log.error(red(auth.error));
+    cancel("Aborted — nothing was changed.");
     process.exit(2);
   }
-  log.success(`gcloud auth: ${bold(account)}`);
-  void stepName;
+  log.success(`gcloud auth: ${bold(auth.account)}`);
 }
 
 async function stepProjectId(opts: GcpWizardOpts): Promise<string> {
@@ -1385,8 +1387,18 @@ async function stepKeylessProvisioner(
   const sAdc = spinner();
   sAdc.start("Checking that your Application Default Credentials can impersonate it...");
   let adc = await check();
-  if (!adc.ok && adc.reason === "no-adc" && !opts.nonInteractive) {
-    sAdc.stop(yellow("No Application Default Credentials yet"));
+  if (
+    !adc.ok &&
+    (adc.reason === "no-adc" || adc.reason === "expired-adc") &&
+    !opts.nonInteractive
+  ) {
+    sAdc.stop(
+      yellow(
+        adc.reason === "expired-adc"
+          ? "Your Application Default Credentials have expired"
+          : "No Application Default Credentials yet",
+      ),
+    );
     const login = await confirm({
       message: `Run ${bold("gcloud auth application-default login")} now (opens your browser; sign in as ${account})?`,
       initialValue: true,
@@ -1403,7 +1415,7 @@ async function stepKeylessProvisioner(
   }
   if (!adc.ok) {
     sAdc.stop(red("Infrastructure credentials not ready"));
-    log.error(adc.error);
+    log.error(`${adc.error}\nPulumi was not started.`);
     cancel("Aborted.");
     process.exit(1);
   }