@caelo-cms/provisioning 0.11.10 → 0.11.12

package/src/public-role-isolation.ts

@@ -28,6 +28,9 @@
  * `public_role` is still a member of any role. This step therefore runs
  * BEFORE migrations, on every install pass and every `upgrade`. Idempotent:
  * revoking from a role that has none changes nothing.
+ *
+ * Since #1329 the staging gateway's login `public_staging_role` is an
+ * Admin API user too and gets the same revoke.
  */
 
 import { findSqlInstance } from "./gateway-credentials.js";
@@ -36,16 +39,20 @@ import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud
 import type { EnsureOutcome } from "./runtime-secrets.js";
 import { type GcloudCredentials, lookupFailure } from "./upgrade/gcp-lookup.js";
 
-/** The gcloud call that leaves `public_role` with no database roles. */
+/** The gateway logins the Admin API created, which must hold no database role (#633, #1329). */
+export const GATEWAY_DATABASE_LOGINS = ["public_role", "public_staging_role"] as const;
+
+/** The gcloud call that leaves a gateway login with no database roles. */
 export function revokePublicRoleMembershipsArgs(target: {
   readonly projectId: string;
   readonly sqlInstance: string;
+  readonly role: (typeof GATEWAY_DATABASE_LOGINS)[number];
 }): string[] {
   return [
     "sql",
     "users",
     "assign-roles",
-    "public_role",
+    target.role,
     `--instance=${target.sqlInstance}`,
     "--type=BUILT_IN",
     "--revoke-existing-roles",
@@ -55,8 +62,9 @@ export function revokePublicRoleMembershipsArgs(target: {
 }
 
 /**
- * Revoke every database role the Admin API gave `public_role`. Reports
- * instead of throwing; `failed` names the next step.
+ * Revoke every database role the Admin API gave the gateway logins
+ * ({@link GATEWAY_DATABASE_LOGINS}). Reports instead of throwing; `failed`
+ * names the next step.
  */
 export async function revokePublicRoleMemberships(
   install: {
@@ -67,7 +75,7 @@ export async function revokePublicRoleMemberships(
   deps: { readonly run?: GcloudRunner; readonly sleep?: Sleep } = {},
 ): Promise<EnsureOutcome> {
   const run = deps.run ?? defaultGcloud;
-  const id = "public_role database role memberships";
+  const id = "gateway logins' database role memberships";
   const lookup = await findSqlInstance(install, { run });
   if (lookup.status !== "found") {
     return {
@@ -77,17 +85,23 @@ export async function revokePublicRoleMemberships(
     };
   }
   const sqlInstance = lookup.name;
-  const r = await runWithRetry(
-    run,
-    deps.sleep ?? realSleep,
-    revokePublicRoleMembershipsArgs({ projectId: install.projectId, sqlInstance }),
-  );
-  if (!r.ok) {
-    return {
-      id,
-      status: "failed",
-      error: `gcloud sql users assign-roles public_role --revoke-existing-roles on ${sqlInstance}: ${r.stderr.trim()}. The account running this needs cloudsql.users.update on the project; re-run once it has.`,
-    };
+  for (const role of GATEWAY_DATABASE_LOGINS) {
+    const r = await runWithRetry(
+      run,
+      deps.sleep ?? realSleep,
+      revokePublicRoleMembershipsArgs({ projectId: install.projectId, sqlInstance, role }),
+    );
+    if (!r.ok) {
+      return {
+        id,
+        status: "failed",
+        error: `gcloud sql users assign-roles ${role} --revoke-existing-roles on ${sqlInstance}: ${r.stderr.trim()}. The account running this needs cloudsql.users.update on the project; re-run once it has.`,
+      };
+    }
   }
-  return { id, status: "applied", detail: `no database roles left on ${sqlInstance}` };
+  return {
+    id,
+    status: "applied",
+    detail: `${GATEWAY_DATABASE_LOGINS.join(" and ")} hold no database roles on ${sqlInstance}`,
+  };
 }

package/src/release-contract.ts

@@ -55,6 +55,9 @@ export const INFRA_CONTRACT_PATHS: readonly string[] = [
   "packages/provisioning/src/audit-job-setup.ts",
   // #1217 — the capture job, its service account, bucket and grants.
   "packages/provisioning/src/capture-job-setup.ts",
+  // #1140 — the scheduler tick: its service account, workflow, Cloud
+  // Scheduler job and grants.
+  "packages/provisioning/src/scheduler-setup.ts",
   // #819 — the converge job, its database login and the admin's grant on it.
   "packages/provisioning/src/converge-job-setup.ts",
   // #891 — the edge security headers the stacks attach, and the converge's

package/src/runtime-secrets.test.ts

@@ -115,7 +115,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run },
     );
-    expect(outcomes.map((o) => o.status)).toEqual(Array(6).fill("present"));
+    expect(outcomes.map((o) => o.status)).toEqual(Array(7).fill("present"));
     expect(lines().some((l) => l.includes(" create ") || l.includes(" add "))).toBe(false);
   });
 
@@ -126,7 +126,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run, generate: () => `generated-value-${++n}` },
     );
-    expect(outcomes.map((o) => o.status)).toEqual(Array(6).fill("applied"));
+    expect(outcomes.map((o) => o.status)).toEqual(Array(7).fill("applied"));
     const creates = calls.filter((c) => c.line.startsWith("secrets create"));
     // #806 — the seal key is 32 random bytes in base64 (not the injected hex generator).
     const sealKey = creates.find((c) => c.line.includes("mcp-oauth-seal-key"))?.stdin ?? "";
@@ -145,10 +145,15 @@ describe("ensureGeneratedSecrets", () => {
         line: "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
         stdin: "generated-value-3",
       },
+      // #1329 — the staging gateway's role password: its own, never the live one's.
+      {
+        line: "secrets create caelo-production-public-staging-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
+        stdin: "generated-value-4",
+      },
       // #650 — the staging access gate's key.
       {
         line: "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-        stdin: "generated-value-4",
+        stdin: "generated-value-5",
       },
       // #806 — remote MCP's OAuth client starts as the "not configured"
       // placeholder; the Owner writes the real one from Settings → MCP.
@@ -178,11 +183,12 @@ describe("ensureGeneratedSecrets", () => {
       { run, generate: () => "generated" },
     );
     const creates = calls.filter((c) => c.line.startsWith("secrets create"));
-    expect(creates.map((c) => c.stdin).slice(0, 5)).toEqual([
+    expect(creates.map((c) => c.stdin).slice(0, 6)).toEqual([
       "operator-set",
       "generated",
       "generated",
       "generated",
+      "generated",
       "{}",
     ]);
     for (const c of calls) expect(c.line).not.toContain("operator-set");
@@ -194,6 +200,7 @@ describe("ensureGeneratedSecrets", () => {
       "secrets versions list caelo-production-internal-secret": [ok("")],
       "secrets versions list caelo-production-tool-approval-secret": [ok("v/1")],
       "secrets versions list caelo-production-public-role-password": [ok("v/1")],
+      "secrets versions list caelo-production-public-staging-role-password": [ok("v/1")],
       "secrets versions list caelo-production-staging-gate-secret": [ok("v/1")],
       "secrets versions list caelo-production-operator-oauth-client": [ok("v/1")],
       "secrets versions list caelo-production-mcp-oauth-seal-key": [ok("v/1")],
@@ -209,6 +216,7 @@ describe("ensureGeneratedSecrets", () => {
       "present",
       "present",
       "present",
+      "present",
     ]);
     expect(calls.filter((c) => c.line.startsWith("secrets versions add"))).toEqual([
       {
@@ -243,7 +251,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: { kind: "automatic" } },
       { run, generate: () => "v" },
     );
-    expect(outcomes.map((o) => o.status)).toEqual(Array(6).fill("applied"));
+    expect(outcomes.map((o) => o.status)).toEqual(Array(7).fill("applied"));
     expect(outcomes.every((o) => o.detail?.includes("gcp.resourceLocations"))).toBe(true);
     const creates = lines().filter((l) => l.startsWith("secrets create"));
     // One refused automatic attempt; then every secret — the refused one
@@ -253,6 +261,7 @@ describe("ensureGeneratedSecrets", () => {
       "secrets create caelo-production-internal-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-tool-approval-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
+      "secrets create caelo-production-public-staging-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       // #652 — the staging gate's key follows the same path.
       "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-operator-oauth-client --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
@@ -284,7 +293,7 @@ describe("ensureGeneratedSecrets", () => {
       { run, generate: () => "v" },
     );
     expect(outcomes.every((o) => o.status === "failed")).toBe(true);
-    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(6);
+    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(7);
   });
 });
 
@@ -329,6 +338,7 @@ describe("rotateRuntimeSecret", () => {
       service([
         ref("ADMIN_DATABASE_PASSWORD", "postgres-password"),
         ref("PUBLIC_ADMIN_DATABASE_PASSWORD", "postgres-password"),
+        ref("PUBLIC_STAGING_ADMIN_DATABASE_PASSWORD", "postgres-password"),
         ref("CAELO_SECRET_KEK", "secret-kek"),
         ref("CAELO_INTERNAL_SECRET", "internal-secret"),
         ref("CAELO_TOOL_APPROVAL_SECRET", "tool-approval-secret"),
@@ -574,8 +584,8 @@ describe("migrationJobEnvArgs", () => {
   it("gives the job password-less URLs and the password as a secret reference", () => {
     const args = migrationJobEnvArgs("db1.p-label.europe-west1.sql-psa.goog");
     expect(args).toEqual([
-      "--set-env-vars=ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem,PUBLIC_ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
-      "--set-secrets=ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest,PUBLIC_ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest",
+      "--set-env-vars=ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem,PUBLIC_ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem,PUBLIC_STAGING_ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      "--set-secrets=ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest,PUBLIC_ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest,PUBLIC_STAGING_ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest",
     ]);
   });
 });

package/src/runtime-secrets.ts

@@ -572,6 +572,12 @@ async function setSqlUserPassword(
   http: HttpFetch,
   sleep: Sleep,
   user: { projectId: string; instance: string; role: string; password: string },
+  /**
+   * `update` sets an existing user's password (`users.update`); `create`
+   * adds the user with it (`users.insert`, #1329: the staging gateway's
+   * login on an install from before it).
+   */
+  mode: "update" | "create",
 ): Promise<{ ok: true } | { ok: false; error: string }> {
   const token = await run(["auth", "print-access-token"]);
   const bearer = token.ok ? token.stdout.trim() : "";
@@ -587,11 +593,17 @@ async function setSqlUserPassword(
     ok: false as const,
     error: `${what}: HTTP ${res.status} ${(await res.text()).slice(0, 500)}`,
   });
-  const put = await http(
-    `${project}/instances/${encodeURIComponent(user.instance)}/users?name=${encodeURIComponent(user.role)}`,
-    { method: "PUT", headers, body: JSON.stringify({ name: user.role, password: user.password }) },
-  );
-  if (!put.ok) return failed("update the user", put);
+  const users = `${project}/instances/${encodeURIComponent(user.instance)}/users`;
+  const body = JSON.stringify({ name: user.role, password: user.password });
+  const put =
+    mode === "update"
+      ? await http(`${users}?name=${encodeURIComponent(user.role)}`, {
+          method: "PUT",
+          headers,
+          body,
+        })
+      : await http(users, { method: "POST", headers, body });
+  if (!put.ok) return failed(mode === "update" ? "update the user" : "create the user", put);
   type Operation = {
     name?: string;
     status?: string;
@@ -693,12 +705,13 @@ export async function rotateRuntimeSecret(
     }
     const previous = current.stdout;
     const setPassword = (role: string, password: string) =>
-      setSqlUserPassword(run, http, sleep, {
-        projectId: target.projectId,
-        instance,
-        role,
-        password,
-      });
+      setSqlUserPassword(
+        run,
+        http,
+        sleep,
+        { projectId: target.projectId, instance, role, password },
+        "update",
+      );
     const changed: string[] = [];
     const restore = async (): Promise<string> => {
       const failed: string[] = [];
@@ -807,7 +820,12 @@ export async function readSecretValue(
 export async function ensureDatabaseRolePassword(
   target: DatabaseRoleTarget,
   role: DatabaseRole,
-  deps: RuntimeDeps & { readonly http?: HttpFetch; readonly password?: string } = {},
+  deps: RuntimeDeps & {
+    readonly http?: HttpFetch;
+    readonly password?: string;
+    /** Create the Cloud SQL user with the password instead (it does not exist yet, #1329). */
+    readonly create?: boolean;
+  } = {},
 ): Promise<EnsureOutcome> {
   const run = deps.run ?? defaultGcloud;
   const sleep = deps.sleep ?? realSleep;
@@ -819,11 +837,12 @@ export async function ensureDatabaseRolePassword(
     if (!value.ok) return { id, status: "failed", error: value.error };
     password = value.value;
   }
-  const set = await setSqlUserPassword(run, http, sleep, {
-    projectId: target.projectId,
-    instance: target.sqlInstance,
-    role,
-    password,
-  });
+  const set = await setSqlUserPassword(
+    run,
+    http,
+    sleep,
+    { projectId: target.projectId, instance: target.sqlInstance, role, password },
+    deps.create === true ? "create" : "update",
+  );
   return set.ok ? { id, status: "applied" } : { id, status: "failed", error: set.error };
 }

package/src/scheduler-setup.test.ts

@@ -0,0 +1,201 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The scheduler tick's setup (scheduler-setup.ts) against a fake gcloud. The
+ * load-bearing assertions are the trust boundary (#1140): the scheduler's
+ * account may sign as itself, pass the admin's IAP, start workflows and
+ * write logs — no secret, database, storage, run or IAM-admin right — and
+ * the one Cloud Scheduler job starts the workflow at the knob's cadence.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import {
+  ensureSchedulerTick,
+  SCHEDULER_FORBIDDEN_ROLES,
+  SCHEDULER_TICK_PATH,
+  type SchedulerTickTarget,
+  schedulerWorkflowSource,
+  tickOrigin,
+} from "./scheduler-setup.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+
+const SA = "caelo-production-scheduler@acme.iam.gserviceaccount.com";
+const MEMBER = `serviceAccount:${SA}`;
+
+const TARGET: SchedulerTickTarget = {
+  projectId: "acme",
+  region: "europe-west1",
+  env: "production",
+  adminUrl: "https://admin.acme.com",
+  resource: { kind: "backend-services", service: "caelo-production-admin-backend-1a2b" },
+  intervalMinutes: 5,
+};
+
+function fakeGcloud(overrides: [RegExp, GcloudResult][] = []) {
+  const calls: string[][] = [];
+  const sources: string[] = [];
+  const rules: [RegExp, GcloudResult][] = [
+    ...overrides,
+    [/^iam service-accounts describe/, fail("NOT_FOUND")],
+    [/^scheduler jobs describe/, fail("NOT_FOUND")],
+  ];
+  const run = async (args: string[]) => {
+    calls.push(args);
+    const src = args.find((a) => a.startsWith("--source="));
+    if (src) sources.push(await Bun.file(src.slice("--source=".length)).text());
+    const line = args.join(" ");
+    return rules.find(([re]) => re.test(line))?.[1] ?? ok("");
+  };
+  return { run, calls, sources };
+}
+
+const flag = (args: string[], name: string) =>
+  args.find((a) => a.startsWith(`--${name}=`))?.slice(name.length + 3);
+
+function grants(calls: string[][]) {
+  return calls
+    .filter((c) => c.includes("add-iam-policy-binding"))
+    .map((c) => ({
+      where: c.slice(0, c.indexOf("add-iam-policy-binding") + 2).join(" "),
+      member: flag(c, "member"),
+      role: flag(c, "role") as string,
+    }));
+}
+
+const sleep = async () => {};
+
+describe("ensureSchedulerTick", () => {
+  it("grants the scheduler only self-signing, IAP access, workflow start and logs", async () => {
+    const { run, calls } = fakeGcloud();
+    const r = await ensureSchedulerTick(TARGET, { run, sleep });
+    expect(r.ok).toBe(true);
+    const mine = grants(calls).filter((g) => g.member === MEMBER);
+    expect(mine.map((g) => [g.where, g.role])).toEqual([
+      [`iam service-accounts add-iam-policy-binding ${SA}`, "roles/iam.serviceAccountTokenCreator"],
+      ["projects add-iam-policy-binding acme", "roles/workflows.invoker"],
+      ["projects add-iam-policy-binding acme", "roles/logging.logWriter"],
+      [
+        "iap web add-iam-policy-binding --resource-type=backend-services",
+        "roles/iap.httpsResourceAccessor",
+      ],
+    ]);
+    for (const g of mine) {
+      for (const forbidden of SCHEDULER_FORBIDDEN_ROLES) {
+        expect(g.role.startsWith(forbidden)).toBe(false);
+      }
+    }
+    // Nobody else is granted anything.
+    expect(grants(calls).every((g) => g.member === MEMBER)).toBe(true);
+    // The IAP grant names the admin's resource.
+    const iap = calls.find((c) => c[0] === "iap") as string[];
+    expect(iap).toContain("--resource-type=backend-services");
+    expect(iap).toContain("--service=caelo-production-admin-backend-1a2b");
+  });
+
+  it("signs as itself only: token creator on its own account, never on another", async () => {
+    const { run, calls } = fakeGcloud();
+    await ensureSchedulerTick(TARGET, { run, sleep });
+    const saGrants = calls.filter(
+      (c) => c[0] === "iam" && c[1] === "service-accounts" && c[2] === "add-iam-policy-binding",
+    );
+    expect(saGrants.map((c) => c[3])).toEqual([SA]);
+  });
+
+  it("deploys the workflow as the scheduler account and schedules it every 5 minutes", async () => {
+    const { run, calls, sources } = fakeGcloud();
+    await ensureSchedulerTick(TARGET, { run, sleep });
+    const deploy = calls.find((c) => c[0] === "workflows" && c[1] === "deploy") as string[];
+    expect(deploy[2]).toBe("caelo-production-scheduler-tick");
+    expect(flag(deploy, "service-account")).toBe(SA);
+    expect(flag(deploy, "location")).toBe("europe-west1");
+    expect(sources[0]).toContain(`url: "https://admin.acme.com${SCHEDULER_TICK_PATH}"`);
+    const create = calls.find(
+      (c) => c[0] === "scheduler" && c[1] === "jobs" && c[2] === "create",
+    ) as string[];
+    expect(create[4]).toBe("caelo-production-scheduler-tick");
+    expect(flag(create, "schedule")).toBe("*/5 * * * *");
+    expect(flag(create, "time-zone")).toBe("Etc/UTC");
+    expect(flag(create, "uri")).toBe(
+      "https://workflowexecutions.googleapis.com/v1/projects/acme/locations/europe-west1/workflows/caelo-production-scheduler-tick/executions",
+    );
+    expect(flag(create, "oauth-service-account-email")).toBe(SA);
+    // OAuth (a googleapis.com target), never an OIDC token IAP would refuse.
+    expect(create.some((a) => a.startsWith("--oidc"))).toBe(false);
+  });
+
+  it("updates the existing job on a re-run, at the knob's new cadence", async () => {
+    const { run, calls } = fakeGcloud([[/^scheduler jobs describe/, ok("projects/acme/…")]]);
+    const r = await ensureSchedulerTick({ ...TARGET, intervalMinutes: 1 }, { run, sleep });
+    expect(r.ok).toBe(true);
+    const update = calls.find(
+      (c) => c[0] === "scheduler" && c[1] === "jobs" && c[2] === "update",
+    ) as string[];
+    expect(flag(update, "schedule")).toBe("* * * * *");
+    expect(calls.some((c) => c[0] === "scheduler" && c[2] === "create")).toBe(false);
+  });
+
+  it("refuses an interval outside 1-15 minutes before touching the project", async () => {
+    const { run, calls } = fakeGcloud();
+    const r = await ensureSchedulerTick({ ...TARGET, intervalMinutes: 30 }, { run, sleep });
+    expect(r.ok).toBe(false);
+    expect(r.ok ? "" : r.error).toContain("between 1 and 15");
+    expect(calls).toEqual([]);
+  });
+
+  it("refuses an admin URL that is not a plain https origin", async () => {
+    for (const bad of ["http://admin.acme.com", "https://admin.acme.com/x", "https://a@b.com"]) {
+      const { run, calls } = fakeGcloud();
+      const r = await ensureSchedulerTick({ ...TARGET, adminUrl: bad }, { run, sleep });
+      expect(r.ok).toBe(false);
+      expect(calls).toEqual([]);
+    }
+  });
+
+  it("stops at the first failing step and says which", async () => {
+    const { run, calls } = fakeGcloud([[/^workflows deploy/, fail("PERMISSION_DENIED: nope")]]);
+    const r = await ensureSchedulerTick(TARGET, { run, sleep });
+    expect(r.ok).toBe(false);
+    expect(r.ok ? "" : r.error).toContain("deploy workflow caelo-production-scheduler-tick");
+    expect(calls.some((c) => c[0] === "scheduler")).toBe(false);
+  });
+});
+
+describe("schedulerWorkflowSource", () => {
+  const src = schedulerWorkflowSource({ serviceAccount: SA, origin: "https://admin.acme.com" });
+
+  it("signs a JWT for the admin origin as the scheduler itself", () => {
+    expect(src).toContain(`iss: "${SA}"`);
+    expect(src).toContain(`sub: "${SA}"`);
+    expect(src).toContain('aud: "https://admin.acme.com/*"');
+    expect(src).toContain(
+      `url: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${SA}:signJwt"`,
+    );
+    expect(src).toContain("type: OAuth2");
+    expect(src).toContain(`exp: \${now + 600}`);
+  });
+
+  it("posts the tick with the signed JWT and a bounded timeout", () => {
+    expect(src).toContain('url: "https://admin.acme.com/api/internal/scheduler/tick"');
+    expect(src).toContain(`Authorization: \${"Bearer " + signed.body.signedJwt}`);
+    expect(src).toMatch(/timeout: (\d+)/);
+    const timeout = Number(/timeout: (\d+)/.exec(src)?.[1]);
+    expect(timeout).toBeGreaterThan(300);
+    expect(timeout).toBeLessThanOrEqual(1800);
+  });
+});
+
+describe("tickOrigin", () => {
+  it("accepts the admin's origin, with or without a trailing slash", () => {
+    expect(tickOrigin("https://admin.acme.com/")).toEqual({
+      ok: true,
+      origin: "https://admin.acme.com",
+    });
+    expect(tickOrigin("https://caelo-production-admin-x-ew.a.run.app")).toEqual({
+      ok: true,
+      origin: "https://caelo-production-admin-x-ew.a.run.app",
+    });
+  });
+});