@caelo-cms/provisioning 0.11.10 → 0.11.12

package/src/scheduler-setup.ts

@@ -0,0 +1,375 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1140 — set up (and converge) the scheduler tick on a Google Cloud install
+ * (`gcp`, `gcp-firebase`): the ONE Cloud Scheduler job that calls the
+ * admin's `/api/internal/scheduler/tick` every `schedulerIntervalMinutes`
+ * (1–15, default 5). Each task's own cadence lives in the admin's
+ * due-table; the tick only says "run what is due now". Run by the wizard
+ * after migrations and by `cms-provision upgrade`'s converge (and the
+ * converge job), as the operator's or the provisioner's identity.
+ *
+ * Why not Cloud Scheduler → admin directly. The admin sits behind IAP, and
+ * IAP accepts a service account's OIDC ID token only when its `aud` is an
+ * OAuth client allowlisted for programmatic access; an install on the
+ * Google-managed IAP client has none (cloud.google.com/iap/docs/
+ * authentication-howto). Cloud Scheduler's other credential, an OAuth
+ * access token, it sends only to `*.googleapis.com` (cloud.google.com/
+ * scheduler/docs/http-target-auth). What passes IAP for a service account
+ * on every install is a self-signed service-account JWT with `aud` =
+ * `<admin origin>/*` — the path caelo-mcp and admin-internal-google.ts
+ * take. Cloud Scheduler cannot sign one, so the job starts a Cloud
+ * Workflows execution (a googleapis.com target, OAuth), and the workflow
+ * signs the JWT as the scheduler account through the IAM Credentials API
+ * and POSTs the tick. No container per tick and no image to keep in step
+ * with the app-roll; cents a month (wizards/gcp-cost.ts).
+ *
+ * Why the CLI owns it and not the stacks: the same as audit-job-setup.ts —
+ * `upgrade` never runs Pulumi, and existing installs get the tick from here.
+ *
+ * Trust boundary. The scheduler's identity, `caelo-<env>-scheduler`, holds:
+ *
+ *   - `roles/iam.serviceAccountTokenCreator` on ITSELF only (signJwt);
+ *   - `roles/iap.httpsResourceAccessor` on the admin's IAP resource (the
+ *     operator-access sync job keeps it there, operator-access.ts);
+ *   - `roles/workflows.invoker` on the project (Cloud Scheduler starts the
+ *     workflow as it; Workflows has no per-workflow IAM policy to bind to);
+ *   - `roles/logging.logWriter` (the workflow's error call logs).
+ *
+ * Nothing else: no Secret Manager, no Cloud SQL, no Cloud Run rights. What
+ * it can do with the admin is the admin's to decide: the tick endpoint
+ * accepts exactly this account's IAP identity (`CAELO_SCHEDULER_SERVICE_
+ * ACCOUNT` on the admin) and only ever runs the due-table, never a build
+ * or a publish (scripts/no-automatic-production-deploy.test.ts).
+ * {@link SCHEDULER_FORBIDDEN_ROLES} names that line; the tests assert no
+ * grant crosses it.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
+import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
+import {
+  schedulerJobName,
+  schedulerServiceAccountEmail,
+  schedulerServiceAccountId,
+  schedulerWorkflowName,
+} from "./gcp-names.js";
+import { type IapResource, iapResourceArgs } from "./mcp-iap.js";
+import { schedulerCron } from "./stack-contract.js";
+
+/** The admin path the workflow calls (apps/admin `api/internal/scheduler/tick`). */
+export const SCHEDULER_TICK_PATH = "/api/internal/scheduler/tick";
+
+/**
+ * How long the workflow waits for the admin's answer, in seconds: Workflows'
+ * maximum (cloud.google.com/workflows/docs/reference/stdlib/http/post). The
+ * admin holds the request until the tick's work is done: it claims tasks for
+ * at most its budget (4 minutes, admin-core scheduler/tick.ts) and then waits
+ * at most one task's lease (10 minutes) for the last one, so 14 minutes in
+ * the worst case, inside the admin's own 3600 s request timeout.
+ */
+export const SCHEDULER_TICK_TIMEOUT_SECONDS = 1800;
+
+/** Lifetime of the IAP credential the workflow signs per tick. */
+const JWT_LIFETIME_SECONDS = 600;
+
+/** APIs the tick needs on the project. */
+export const SCHEDULER_APIS = [
+  "cloudscheduler.googleapis.com",
+  "workflows.googleapis.com",
+  "iamcredentials.googleapis.com",
+] as const;
+
+/**
+ * Roles the scheduler's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role).
+ */
+export const SCHEDULER_FORBIDDEN_ROLES = [
+  "roles/owner",
+  "roles/editor",
+  "roles/viewer",
+  "roles/run.",
+  "roles/iam.serviceAccountUser",
+  "roles/iam.serviceAccountAdmin",
+  "roles/iam.securityAdmin",
+  "roles/iap.admin",
+  "roles/iap.settingsAdmin",
+  "roles/secretmanager.",
+  "roles/cloudsql.",
+  "roles/compute.",
+  "roles/storage.",
+  "roles/resourcemanager.",
+  "roles/workflows.admin",
+  "roles/workflows.editor",
+  "roles/cloudscheduler.",
+] as const;
+
+export interface SchedulerTickTarget {
+  readonly projectId: string;
+  readonly region: string;
+  /** Pulumi stack name (`production`). */
+  readonly env: string;
+  /**
+   * Where the admin answers behind IAP, an origin: `https://admin.<domain>`
+   * on gcp, the admin service's URL on gcp-firebase (remote-mcp.ts
+   * RemoteMcpIdentity.adminUrl, the same value as the admin's
+   * CAELO_ADMIN_URL).
+   */
+  readonly adminUrl: string;
+  /** The admin's IAP resource (the service on gcp-firebase, the LB backend on gcp). */
+  readonly resource: IapResource;
+  /** The `schedulerIntervalMinutes` knob (1–15). */
+  readonly intervalMinutes: number;
+}
+
+export type SchedulerTickResult =
+  | { readonly ok: true; readonly done: string[]; readonly serviceAccount: string }
+  | { readonly ok: false; readonly done: string[]; readonly error: string };
+
+/**
+ * The tick's admin origin, or an error naming why it is not one: an https
+ * origin without path, query or credentials (it is written into the
+ * workflow's source, so nothing but an origin may get there).
+ */
+export function tickOrigin(
+  adminUrl: string,
+): { ok: true; origin: string } | { ok: false; error: string } {
+  let u: URL;
+  try {
+    u = new URL(adminUrl);
+  } catch {
+    return { ok: false, error: `the admin URL ${JSON.stringify(adminUrl)} is not a URL` };
+  }
+  if (
+    u.protocol !== "https:" ||
+    u.username ||
+    u.password ||
+    (u.pathname !== "/" && u.pathname !== "") ||
+    u.search ||
+    u.hash ||
+    !/^[a-z0-9.-]+$/.test(u.hostname)
+  ) {
+    return {
+      ok: false,
+      error: `the admin URL ${JSON.stringify(adminUrl)} is not a plain https origin`,
+    };
+  }
+  return { ok: true, origin: u.origin };
+}
+
+/**
+ * The workflow one tick runs (Cloud Workflows YAML): sign a service-account
+ * JWT for the admin's IAP as the scheduler account itself (the IAM
+ * Credentials API, authenticated with the workflow's own OAuth token), then
+ * POST the tick with it. A refused or failed tick (HTTP ≥ 400) fails the
+ * execution, so it shows in the workflow's execution history and logs.
+ */
+export function schedulerWorkflowSource(opts: {
+  readonly serviceAccount: string;
+  readonly origin: string;
+}): string {
+  const { serviceAccount: sa, origin } = opts;
+  return `# Caelo scheduler tick (#1140) — generated by cms-provision, do not edit.
+main:
+  steps:
+    - claims:
+        assign:
+          - now: \${int(sys.now())}
+          - jwtClaims:
+              iss: "${sa}"
+              sub: "${sa}"
+              aud: "${origin}/*"
+              iat: \${now}
+              exp: \${now + ${JWT_LIFETIME_SECONDS}}
+    - sign:
+        call: http.post
+        args:
+          url: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${sa}:signJwt"
+          auth:
+            type: OAuth2
+          body:
+            payload: \${json.encode_to_string(jwtClaims)}
+        result: signed
+    - tick:
+        call: http.post
+        args:
+          url: "${origin}${SCHEDULER_TICK_PATH}"
+          headers:
+            Authorization: \${"Bearer " + signed.body.signedJwt}
+          timeout: ${SCHEDULER_TICK_TIMEOUT_SECONDS}
+        result: answer
+    - done:
+        return: \${answer.code}
+`;
+}
+
+/** Ensure the scheduler tick and everything it needs. Never throws for a gcloud failure. */
+export async function ensureSchedulerTick(
+  target: SchedulerTickTarget,
+  deps: { run?: GcloudRunner; sleep?: Sleep } = {},
+): Promise<SchedulerTickResult> {
+  const run = deps.run ?? defaultGcloud;
+  const sleep = deps.sleep ?? realSleep;
+  const retry = (args: string[]) => runWithRetry(run, sleep, args);
+  const { projectId, region, env } = target;
+  const project = `--project=${projectId}`;
+  const sa = schedulerServiceAccountEmail(projectId, env);
+  const member = `serviceAccount:${sa}`;
+  const workflow = schedulerWorkflowName(env);
+  const job = schedulerJobName(env);
+  const done: string[] = [];
+  const fail = (step: string, r: GcloudResult): SchedulerTickResult => ({
+    ok: false,
+    done,
+    error: `${step}: ${r.stderr.trim()}`,
+  });
+
+  const origin = tickOrigin(target.adminUrl);
+  if (!origin.ok) return { ok: false, done, error: origin.error };
+  let cron: string;
+  try {
+    cron = schedulerCron(target.intervalMinutes);
+  } catch (e) {
+    return { ok: false, done, error: (e as Error).message };
+  }
+
+  // 1. APIs.
+  const api = await run(["services", "enable", ...SCHEDULER_APIS, project, "--quiet"]);
+  if (!api.ok) return fail(`enable ${SCHEDULER_APIS.join(", ")}`, api);
+  done.push(`APIs enabled (${SCHEDULER_APIS.join(", ")})`);
+
+  // 2. The scheduler's own service account.
+  const describe = await run([
+    "iam",
+    "service-accounts",
+    "describe",
+    sa,
+    project,
+    "--format=value(email)",
+  ]);
+  if (!describe.ok) {
+    const create = await run([
+      "iam",
+      "service-accounts",
+      "create",
+      schedulerServiceAccountId(env),
+      "--display-name=Caelo scheduler tick",
+      "--description=Calls the admin's scheduler tick through IAP every few minutes; signs its own IAP credential, nothing else.",
+      project,
+    ]);
+    if (!create.ok && !/already exists/i.test(create.stderr)) return fail(`create ${sa}`, create);
+  }
+  done.push(`service account ${sa}`);
+
+  // 3. Its grants (see the file comment).
+  const self = await retry([
+    "iam",
+    "service-accounts",
+    "add-iam-policy-binding",
+    sa,
+    `--member=${member}`,
+    "--role=roles/iam.serviceAccountTokenCreator",
+    "--condition=None",
+    project,
+    "--quiet",
+    "--format=none",
+  ]);
+  if (!self.ok) return fail("let the scheduler sign its IAP credential as itself", self);
+  done.push(`scheduler: roles/iam.serviceAccountTokenCreator on ${sa} (itself, signJwt)`);
+
+  for (const g of [
+    { role: "roles/workflows.invoker", why: "Cloud Scheduler starts the tick workflow as it" },
+    { role: "roles/logging.logWriter", why: "the workflow logs failed calls" },
+  ]) {
+    const r = await retry([
+      "projects",
+      "add-iam-policy-binding",
+      projectId,
+      `--member=${member}`,
+      `--role=${g.role}`,
+      "--condition=None",
+      "--quiet",
+      "--format=none",
+    ]);
+    if (!r.ok) return fail(`grant the scheduler ${g.role} (${g.why})`, r);
+    done.push(`scheduler: ${g.role} on the project`);
+  }
+
+  const iap = await retry([
+    "iap",
+    "web",
+    "add-iam-policy-binding",
+    ...iapResourceArgs(target.resource),
+    `--member=${member}`,
+    "--role=roles/iap.httpsResourceAccessor",
+    "--condition=None",
+    project,
+    "--quiet",
+  ]);
+  if (!iap.ok) return fail("let the scheduler pass the admin's IAP", iap);
+  done.push(`scheduler: roles/iap.httpsResourceAccessor on the admin (${target.resource.service})`);
+
+  // 4. The workflow. A private directory (mkdtemp, mode 700): no other local
+  //    user can swap the file between write and read.
+  const dir = mkdtempSync(join(tmpdir(), "caelo-scheduler-"));
+  try {
+    const file = join(dir, "tick.yaml");
+    writeFileSync(file, schedulerWorkflowSource({ serviceAccount: sa, origin: origin.origin }), {
+      mode: 0o600,
+    });
+    const deploy = await retry([
+      "workflows",
+      "deploy",
+      workflow,
+      `--source=${file}`,
+      `--location=${region}`,
+      `--service-account=${sa}`,
+      "--call-log-level=log-errors-only",
+      `--description=Caelo scheduler tick (#1140): calls ${origin.origin}${SCHEDULER_TICK_PATH}`,
+      project,
+      "--quiet",
+    ]);
+    if (!deploy.ok) return fail(`deploy workflow ${workflow}`, deploy);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  done.push(`workflow ${workflow} (calls ${origin.origin}${SCHEDULER_TICK_PATH})`);
+
+  // 5. The one Cloud Scheduler job.
+  const scheduleArgs = [
+    job,
+    `--location=${region}`,
+    project,
+    `--schedule=${cron}`,
+    "--time-zone=Etc/UTC",
+    `--uri=https://workflowexecutions.googleapis.com/v1/projects/${projectId}/locations/${region}/workflows/${workflow}/executions`,
+    "--http-method=POST",
+    `--oauth-service-account-email=${sa}`,
+    // A tick that has not answered when the next one is due is the admin's
+    // lease to sort out (its due-table), not a reason to retry this one.
+    "--max-retry-attempts=0",
+    "--quiet",
+  ];
+  const existing = await run([
+    "scheduler",
+    "jobs",
+    "describe",
+    job,
+    `--location=${region}`,
+    project,
+    "--format=value(name)",
+  ]);
+  const sched = await retry([
+    "scheduler",
+    "jobs",
+    existing.ok ? "update" : "create",
+    "http",
+    ...scheduleArgs,
+  ]);
+  if (!sched.ok) return fail(`schedule ${job}`, sched);
+  done.push(`Cloud Scheduler job ${job} (${cron}, UTC)`);
+
+  return { ok: true, done, serviceAccount: sa };
+}

package/src/self-hosted-backup.test.ts

@@ -203,6 +203,7 @@ describe("restoreSelfHosted", () => {
       "<converge roles>",
       `${MIGRATE} admin`,
       `${MIGRATE} public`,
+      `${MIGRATE} public-staging`,
       "run --rm --no-deps -T --entrypoint sh caelo-admin -c set -e; find /srv/caelo /data/media -mindepth 1 -delete; tar -C / -xf -",
       "up -d --remove-orphans",
       "exec -T caelo-admin bun -e <probe>",

package/src/self-hosted-compose.test.ts

@@ -9,6 +9,8 @@ import {
   COMPOSE_MCP_AUTH_PROXY_SERVICE,
   COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
   COMPOSE_POOL_BUDGET,
+  COMPOSE_SCHEDULER_SERVICE,
+  COMPOSE_SCHEDULER_TICK_URL,
   type ComposeSpec,
   composeProjectName,
   generateDockerCompose,
@@ -22,7 +24,7 @@ const GATEWAY = `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`;
 const base: Omit<ComposeSpec, "images"> = {
   domain: "example.com",
   postgresPassword: "pgpw",
-  rolePasswords: { admin: "adminpw", public: "publicpw" },
+  rolePasswords: { admin: "adminpw", public: "publicpw", publicStaging: "ps" },
   caeloSecretKek: "0".repeat(64),
   dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
   internalSecret: "i".repeat(48),
@@ -410,3 +412,72 @@ describe("self-hosted Compose — the MCP-Auth-Proxy (#1328)", () => {
     ).toThrow(/mcp-auth-proxy image/);
   });
 });
+
+describe("self-hosted Compose — the scheduler tick (#1140)", () => {
+  const yaml = generateDockerCompose({
+    ...base,
+    images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+  });
+  const scheduler = service(yaml, COMPOSE_SCHEDULER_SERVICE);
+
+  it("runs the admin image's clock against the admin's tick endpoint", () => {
+    expect(scheduler).toContain(`image: ${ADMIN}`);
+    expect(scheduler).toContain(
+      'command: ["bun", "--bun", "/app/packages/admin-core/src/scheduler/clock.ts"]',
+    );
+    expect(COMPOSE_SCHEDULER_TICK_URL).toBe("http://caelo-admin:5173/api/internal/scheduler/tick");
+    expect(scheduler).toContain(`CAELO_SCHEDULER_TICK_URL: "${COMPOSE_SCHEDULER_TICK_URL}"`);
+    expect(scheduler).toContain("depends_on: [caelo-admin]");
+  });
+
+  it("ticks every 5 minutes by default and follows the knob", () => {
+    expect(scheduler).toContain('CAELO_SCHEDULER_INTERVAL_MINUTES: "5"');
+    const fast = generateDockerCompose({
+      ...base,
+      schedulerIntervalMinutes: 1,
+      images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+    });
+    expect(service(fast, COMPOSE_SCHEDULER_SERVICE)).toContain(
+      'CAELO_SCHEDULER_INTERVAL_MINUTES: "1"',
+    );
+  });
+
+  it("refuses an interval outside 1-15 minutes", () => {
+    for (const bad of [0, 16, 2.5]) {
+      expect(() =>
+        generateDockerCompose({
+          ...base,
+          schedulerIntervalMinutes: bad,
+          images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+        }),
+      ).toThrow("schedulerIntervalMinutes");
+    }
+  });
+
+  it("holds only the internal secret it signs with: no database, no KEK, no mount", () => {
+    expect(scheduler).toContain(`CAELO_INTERNAL_SECRET: "${"i".repeat(48)}"`);
+    expect(scheduler).not.toMatch(/DATABASE|PASSWORD|KEK|postgres:\/\/|volumes:/);
+    expect(scheduler).not.toContain("adminpw");
+    expect(scheduler).not.toContain("0".repeat(64));
+  });
+
+  it("runs locked down: read-only root, no capabilities, no privilege escalation", () => {
+    expect(scheduler).toContain("read_only: true");
+    expect(scheduler).toContain('cap_drop: ["ALL"]');
+    expect(scheduler).toContain('security_opt: ["no-new-privileges:true"]');
+  });
+
+  it("runs the checkout's clock in dev mode", () => {
+    const dev = generateDockerCompose({ ...base, images: { mode: "dev" } });
+    expect(service(dev, COMPOSE_SCHEDULER_SERVICE)).toContain(
+      "command: bun run packages/admin-core/src/scheduler/clock.ts",
+    );
+  });
+
+  it("is part of every rendered Compose file, so an upgrade of an older install adds it", () => {
+    // self-hosted-upgrade.ts rolls onto renderCompose(<new images>), which is
+    // this generator: the next upgrade of an install without the service
+    // writes a Compose file that has it, and `docker compose up -d` starts it.
+    expect(yaml).toContain(`\n  ${COMPOSE_SCHEDULER_SERVICE}:\n`);
+  });
+});

package/src/self-hosted-roles.integration.test.ts

@@ -26,6 +26,7 @@ const required = [
   "POSTGRES_PORT",
   "ADMIN_ROLE_PASSWORD",
   "PUBLIC_ROLE_PASSWORD",
+  "PUBLIC_STAGING_ROLE_PASSWORD",
   "ADMIN_DATABASE_URL",
   "PUBLIC_DATABASE_URL",
 ] as const;
@@ -63,6 +64,7 @@ const psql: SuperuserPsql = async (script) => {
 const passwords = {
   admin: env.ADMIN_ROLE_PASSWORD as string,
   public: env.PUBLIC_ROLE_PASSWORD as string,
+  publicStaging: env.PUBLIC_STAGING_ROLE_PASSWORD as string,
 };
 
 describe("self-hosted role convergence against Postgres (#613 review, #635)", () => {

package/src/self-hosted-roles.test.ts

@@ -4,16 +4,16 @@ import { describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import {
-  applyPublicRoleLimits,
+  applyPreMigrationRoles,
   convergeSelfHostedRoles,
   decideUp,
   PUBLIC_ROLE_LIMITS,
-  publicRoleLimitsScript,
+  preMigrationRolesScript,
   roleConvergenceScript,
   selfHostedBootstrapScript,
 } from "./self-hosted-roles.js";
 
-const PASSWORDS = { admin: "a'pw", public: "p-pw" };
+const PASSWORDS = { admin: "a'pw", public: "p-pw", publicStaging: "s'pw" };
 
 describe("roleConvergenceScript (#613 review)", () => {
   const script = roleConvergenceScript(PASSWORDS);
@@ -28,13 +28,13 @@ describe("roleConvergenceScript (#613 review)", () => {
     expect(script).not.toContain("CREATE ROLE gateway_role");
   });
 
-  it("drops the former gateway_role with what it holds in both databases, and stops on the first error (#635)", () => {
+  it("drops the former gateway_role with what it holds in every database, and stops on the first error (#635, #1329)", () => {
     expect(script.startsWith("\\set ON_ERROR_STOP on")).toBe(true);
     const publicDrop = script.indexOf("\\connect cms_public");
     const adminDrop = script.indexOf("\\connect cms_admin");
     expect(publicDrop).toBeGreaterThan(-1);
     expect(adminDrop).toBeGreaterThan(publicDrop);
-    expect(script.match(/DROP OWNED BY gateway_role/g)).toHaveLength(2);
+    expect(script.match(/DROP OWNED BY gateway_role/g)).toHaveLength(3);
     expect(script.indexOf("THEN DROP ROLE gateway_role;")).toBeGreaterThan(adminDrop);
     expect(script).not.toContain("caelo_grant_gateway_role");
   });
@@ -132,27 +132,56 @@ describe("decideUp — `cms-provision up` never switches URLs onto unapplied pas
   });
 });
 
-describe("public_role's limits (#1338, H3)", () => {
-  const statements = [
-    `ALTER ROLE public_role CONNECTION LIMIT ${PUBLIC_ROLE_LIMITS.connectionLimit};`,
-    `ALTER ROLE public_role SET statement_timeout = '${PUBLIC_ROLE_LIMITS.statementTimeout}';`,
-    `ALTER ROLE public_role SET idle_in_transaction_session_timeout = '${PUBLIC_ROLE_LIMITS.idleInTransactionSessionTimeout}';`,
-    `ALTER ROLE public_role SET work_mem = '${PUBLIC_ROLE_LIMITS.workMem}';`,
+describe("the staging database and its login (#1329)", () => {
+  const staging = [
+    "SELECT 'CREATE ROLE public_staging_role NOINHERIT LOGIN' WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'public_staging_role') \\gexec",
+    "SELECT 'CREATE DATABASE cms_public_staging OWNER admin_role' WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'cms_public_staging') \\gexec",
+    "REVOKE ALL ON DATABASE cms_public_staging FROM PUBLIC;",
+    "GRANT CONNECT ON DATABASE cms_public_staging TO public_staging_role, admin_role;",
+    "REVOKE ALL ON DATABASE cms_public_staging FROM public_role;",
+    "REVOKE ALL ON DATABASE cms_public FROM public_staging_role;",
   ];
 
-  it("are set on the first start, on every `up`, and alone before an upgrade's migrations", () => {
+  it("are created on the first start, on every `up`, and before an upgrade's migrations", () => {
+    for (const script of [roleConvergenceScript(PASSWORDS), preMigrationRolesScript("s'pw")]) {
+      for (const st of staging) expect(script).toContain(st);
+      expect(script).toContain("ALTER ROLE public_staging_role WITH LOGIN PASSWORD 's''pw';");
+    }
+    const bootstrap = selfHostedBootstrapScript({ agent: false });
+    for (const st of staging) expect(bootstrap).toContain(st);
+    expect(bootstrap).toContain(
+      "ALTER ROLE public_staging_role WITH LOGIN PASSWORD :'public_staging_role_pw';",
+    );
+    expect(bootstrap).toContain('-v public_staging_role_pw="$PUBLIC_STAGING_ROLE_PASSWORD"');
+  });
+
+  it("drops the former gateway_role's leftovers in the staging database too", () => {
+    expect(roleConvergenceScript(PASSWORDS)).toContain("\\connect cms_public_staging");
+  });
+});
+
+describe("the gateway logins' limits (#1338, H3; #1329)", () => {
+  const statements = ["public_role", "public_staging_role"].flatMap((role) => [
+    `ALTER ROLE ${role} CONNECTION LIMIT ${PUBLIC_ROLE_LIMITS.connectionLimit};`,
+    `ALTER ROLE ${role} SET statement_timeout = '${PUBLIC_ROLE_LIMITS.statementTimeout}';`,
+    `ALTER ROLE ${role} SET idle_in_transaction_session_timeout = '${PUBLIC_ROLE_LIMITS.idleInTransactionSessionTimeout}';`,
+    `ALTER ROLE ${role} SET work_mem = '${PUBLIC_ROLE_LIMITS.workMem}';`,
+  ]);
+
+  it("are set on the first start, on every `up`, and before an upgrade's migrations", () => {
     for (const script of [
       selfHostedBootstrapScript({ agent: false }),
       roleConvergenceScript(PASSWORDS),
-      publicRoleLimitsScript(),
+      preMigrationRolesScript("s'pw"),
     ]) {
       for (const st of statements) expect(script).toContain(st);
     }
-    // The pre-migration script touches nothing else (no role drop, no grant).
-    expect(publicRoleLimitsScript().split("\n").filter(Boolean)).toEqual([
-      "\\set ON_ERROR_STOP on",
-      ...statements,
-    ]);
+    // The pre-migration script drops no role and touches no other database:
+    // only the staging database with its login, then the limits.
+    const lines = preMigrationRolesScript("s'pw").split("\n").filter(Boolean);
+    expect(lines[0]).toBe("\\set ON_ERROR_STOP on");
+    expect(lines.slice(-statements.length)).toEqual(statements);
+    expect(lines.some((l) => /DROP|\\connect/.test(l))).toBe(false);
   });
 
   it("match the values packages/migrations/src/bootstrap.sh sets (dev, CI, Cloud SQL bootstrap)", () => {
@@ -165,7 +194,8 @@ describe("public_role's limits (#1338, H3)", () => {
 
   it("refuse to run against a stopped database", async () => {
     let ran = false;
-    const r = await applyPublicRoleLimits({
+    const r = await applyPreMigrationRoles({
+      stagingPassword: "s",
       probe: async () => false,
       psql: async () => {
         ran = true;