@caelo-cms/provisioning 0.11.13 → 0.11.14

package/src/admin-domain.ts

@@ -2,9 +2,9 @@
 
 /**
  * `cms-provision admin-domain enable` — serve a gcp-firebase admin at
- * `admin.<domain>` instead of its `*.run.app` URL — and, the same way,
- * `cms-provision staging-domain enable` (#650): serve the protected staging
- * site at `staging.<domain>` from the gateway, which gates and proxies it.
+ * `admin.<domain>` instead of its `*.run.app` URL. (The staging host has no
+ * Cloud Run domain mapping any more since #1330: it is a custom domain of
+ * the staging Hosting site, staging-gateway-setup.ts.)
  *
  * The gcp-firebase stack only creates that Cloud Run domain mapping behind
  * `provisionAdminDomain=true`, off by default: Google refuses a mapping
@@ -48,9 +48,6 @@ export type AdminDomainResult =
   | { status: "needs-verification"; hostname: string; verifyDomain: string }
   | { status: "failed"; error: string };
 
-/** What `staging-domain enable` reports; same shape as the admin's. */
-export type StagingDomainResult = AdminDomainResult;
-
 interface DomainMappingJson {
   status?: { resourceRecords?: { name?: string; type?: string; rrdata?: string }[] };
 }
@@ -80,7 +77,7 @@ function logOf(opts: DomainOpts): (message: string) => void {
 /**
  * The one deployed Cloud Run service playing `slug` on a gcp-firebase
  * install (stack-contract.ts cloudRunServicePrefix: since #1328 the visitor
- * gateway is `caelo-production-data-gateway`); also used by staging-admin.ts.
+ * gateway is `caelo-production-data-gateway`).
  */
 export async function findService(
   run: Run,
@@ -126,116 +123,6 @@ export async function enableAdminDomain(opts: DomainOpts): Promise<AdminDomainRe
   return mapDomain(run, logOf(opts), scope, opts.domain, `admin.${opts.domain}`, found.service);
 }
 
-/**
- * #650 — map the install's staging host (its setting, default
- * `staging.<domain>`; any FQDN) to the gateway, which serves the protected
- * staging site. Cloud Run refuses domain-mapped requests while a service's
- * ingress is internal-only, so the gateway's ingress is opened first (the
- * stack declares the same since #650; installs from before keep the old
- * value until this runs). Idempotent like the admin mapping.
- *
- * #1328 — a new mapping goes to the data gateway, which runs the gate. A
- * mapping made before stays on the service that was the gateway (now the
- * MCP-Auth-Proxy, which forwards it there) until the staging cutover moves
- * it (#1330, #1331); an existing mapping is only reported here.
- */
-export async function enableStagingDomain(
-  opts: DomainOpts & { stagingHost: string },
-): Promise<StagingDomainResult> {
-  const run = opts.run ?? defaultGcloud;
-  const scope = [`--region=${opts.region}`, `--project=${opts.projectId}`];
-  const found = await findService(run, scope, "gateway");
-  if (!found.ok) return { status: "failed", error: found.error };
-  const ingress = await run([
-    "run",
-    "services",
-    "describe",
-    found.service,
-    ...scope,
-    '--format=value(metadata.annotations["run.googleapis.com/ingress"])',
-  ]);
-  if (!ingress.ok) {
-    return { status: "failed", error: `read the gateway's ingress: ${ingress.stderr.trim()}` };
-  }
-  if (ingress.stdout.trim() !== "all") {
-    const update = await run([
-      "run",
-      "services",
-      "update",
-      found.service,
-      ...scope,
-      "--ingress=all",
-      "--quiet",
-    ]);
-    if (!update.ok) {
-      return {
-        status: "failed",
-        error: `open the gateway's ingress for the domain mapping: ${update.stderr.trim()}`,
-      };
-    }
-  }
-  // Search Console verification: the install domain covers its own
-  // subdomains; a host on another domain is verified itself.
-  const verifyDomain =
-    opts.stagingHost === opts.domain || opts.stagingHost.endsWith(`.${opts.domain}`)
-      ? opts.domain
-      : opts.stagingHost;
-  return mapDomain(run, logOf(opts), scope, verifyDomain, opts.stagingHost, found.service);
-}
-
-/** What {@link stagingDomainState} found. */
-export type StagingDomainState =
-  | { readonly status: "mapped" }
-  | { readonly status: "unmapped" }
-  | { readonly status: "unknown"; readonly reason: string };
-
-/**
- * Whether the install's staging host already has its Cloud Run domain
- * mapping, read-only. The upgrade asks before it tells the operator to run
- * `staging-domain enable`, so an install that serves its staging host is
- * not sent to set it up again. It never installs the gcloud `beta`
- * component (an upgrade should not pause for a download to print a hint):
- * without it, or on any error but gcloud's NOT_FOUND, the state is unknown
- * and says why.
- */
-export async function stagingDomainState(opts: {
-  projectId: string;
-  region: string;
-  stagingHost: string;
-  run?: Run;
-}): Promise<StagingDomainState> {
-  const run = opts.run ?? defaultGcloud;
-  const listed = await run([
-    "components",
-    "list",
-    "--only-local-state",
-    "--filter=id=beta",
-    "--format=value(id)",
-  ]);
-  if (!listed.ok) {
-    return {
-      status: "unknown",
-      reason: `check the gcloud "beta" component: ${listed.stderr.trim() || `exit ${listed.exitCode}`}`,
-    };
-  }
-  if (!listed.stdout.split("\n").some((s) => s.trim() === "beta")) {
-    return { status: "unknown", reason: 'the gcloud "beta" component is not installed' };
-  }
-  const described = await run([
-    "beta",
-    "run",
-    "domain-mappings",
-    "describe",
-    `--domain=${opts.stagingHost}`,
-    `--region=${opts.region}`,
-    `--project=${opts.projectId}`,
-    "--format=value(metadata.name)",
-  ]);
-  if (described.ok) return { status: "mapped" };
-  if (/\bNOT_FOUND\b/.test(described.stderr)) return { status: "unmapped" };
-  return { status: "unknown", reason: described.stderr.trim() };
-}
-
 /** What {@link setAdminStagingHostEnv} did. */
 export type AdminStagingEnvResult =
   | { readonly status: "set"; readonly service: string; readonly previous: string | null }

package/src/admin-memory.test.ts

@@ -78,6 +78,8 @@ describe("self-hosted compose", () => {
     caeloSecretKek: "0".repeat(64),
     dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
     internalSecret: "i".repeat(48),
+    stagingHost: "staging.example.com",
+    stagingGateSecret: "g".repeat(64),
     diskSize: "20Gi",
     ports: { http: 80, https: 443 },
     project: "caelo-example-com",

package/src/audit-job-setup.test.ts

@@ -91,7 +91,7 @@ describe("ensureAuditJob", () => {
     for (const c of bucketGrants) expect(flag(c, "condition")).toBe("None");
   });
 
-  it("grants the job only results-create, build-read (gcp) and logs", async () => {
+  it("grants the job only results-create, read of the staging bucket and logs", async () => {
     const { run, calls } = fakeGcloud();
     const r = await ensureAuditJob(TARGET, { run, sleep: async () => {} });
     expect(r.ok).toBe(true);
@@ -102,10 +102,6 @@ describe("ensureAuditJob", () => {
         "storage buckets add-iam-policy-binding gs://acme-caelo-production-staging",
         "roles/storage.objectViewer",
       ],
-      [
-        "storage buckets add-iam-policy-binding gs://acme-caelo-production-static",
-        "roles/storage.objectViewer",
-      ],
       ["projects add-iam-policy-binding acme", "roles/logging.logWriter"],
     ]);
     for (const g of job) {
@@ -151,7 +147,7 @@ describe("ensureAuditJob", () => {
     expect(flag(deploy, "max-retries")).toBe("0");
     expect(flag(deploy, "parallelism")).toBe("15");
     expect(flag(deploy, "set-env-vars")).toBe(
-      `CAELO_PROVIDER=gcp,CAELO_AUDIT_RESULTS_BUCKET=${RESULTS},CAELO_STAGING_BUCKET=acme-caelo-production-staging,CAELO_STATIC_BUCKET=acme-caelo-production-static`,
+      `CAELO_PROVIDER=gcp,CAELO_AUDIT_RESULTS_BUCKET=${RESULTS},CAELO_STAGING_BUCKET=acme-caelo-production-staging`,
     );
     const line = deploy.join(" ");
     for (const banned of ["--network", "--subnet", "--vpc", "--set-secrets", "--update-secrets"]) {
@@ -206,16 +202,20 @@ describe("ensureAuditJob", () => {
     expect(deployOf(calls)).toBeUndefined();
   });
 
-  it("on gcp-firebase reads no bucket: the task audits the public preview channel", async () => {
+  it("#1330 — on gcp-firebase reads the staging bucket too: no preview channel any more", async () => {
     const { run, calls } = fakeGcloud();
     await ensureAuditJob({ ...TARGET, provider: "gcp-firebase" }, { run, sleep: async () => {} });
     const job = grants(calls).filter((g) => g.member === AUDIT);
-    expect(job.map((g) => g.role)).toEqual([
-      "roles/storage.objectCreator",
-      "roles/logging.logWriter",
+    expect(job.map((g) => [g.where, g.role])).toEqual([
+      [`storage buckets add-iam-policy-binding gs://${RESULTS}`, "roles/storage.objectCreator"],
+      [
+        "storage buckets add-iam-policy-binding gs://acme-caelo-production-staging",
+        "roles/storage.objectViewer",
+      ],
+      ["projects add-iam-policy-binding acme", "roles/logging.logWriter"],
     ]);
     expect(flag(deployOf(calls), "set-env-vars")).toBe(
-      `CAELO_PROVIDER=gcp-firebase,CAELO_AUDIT_RESULTS_BUCKET=${RESULTS}`,
+      `CAELO_PROVIDER=gcp-firebase,CAELO_AUDIT_RESULTS_BUCKET=${RESULTS},CAELO_STAGING_BUCKET=acme-caelo-production-staging`,
     );
   });
 

package/src/audit-job-setup.ts

@@ -22,10 +22,12 @@
  *
  *   - `roles/storage.objectCreator` on the audit results bucket — create
  *     only: it can neither read results back nor overwrite one;
- *   - on `gcp` only, `roles/storage.objectViewer` on the staging and static
- *     buckets: it serves the staged build to its own browser, as the admin's
- *     audit does (admin-core quality/staged-origin.ts). gcp-firebase audits
- *     the public preview channel and needs no bucket;
+ *   - `roles/storage.objectViewer` on the staging bucket: it serves the
+ *     staged build to its own browser from the served build slot, which
+ *     holds the complete build (#1330, admin-core quality/staged-origin.ts),
+ *     so Lighthouse never goes through the staging gateway (#875). Both
+ *     providers since #1330 (gcp-firebase had no bucket and audited the
+ *     preview channel before); no read on the static bucket any more;
  *   - `roles/logging.logWriter`.
  *
  * Nothing else: no Secret Manager, no Cloud SQL, and no VPC egress, so the
@@ -231,18 +233,16 @@ export async function ensureAuditJob(
   }
   done.push(`bucket ${resultsUrl} (results deleted after 1 day)`);
 
-  // 3. Bucket grants: the job creates results and (gcp) reads the build;
+  // 3. Bucket grants: the job creates results and reads the staged build;
   //    the admin reads results.
   const bucketGrants: { bucket: string; member: string; role: string; why: string }[] = [
     { bucket: results, member, role: "roles/storage.objectCreator", why: "tasks write results" },
-    ...(provider === "gcp"
-      ? (["staging", "static"] as const).map((b) => ({
-          bucket: gcpBucketName(projectId, env, b),
-          member,
-          role: "roles/storage.objectViewer",
-          why: "tasks serve the staged build to their browser",
-        }))
-      : []),
+    {
+      bucket: gcpBucketName(projectId, env, "staging"),
+      member,
+      role: "roles/storage.objectViewer",
+      why: "tasks serve the staged build to their browser",
+    },
     {
       bucket: results,
       member: runSaMember,
@@ -295,12 +295,7 @@ export async function ensureAuditJob(
   const envVars = [
     `CAELO_PROVIDER=${provider}`,
     `CAELO_AUDIT_RESULTS_BUCKET=${results}`,
-    ...(provider === "gcp"
-      ? [
-          `CAELO_STAGING_BUCKET=${gcpBucketName(projectId, env, "staging")}`,
-          `CAELO_STATIC_BUCKET=${gcpBucketName(projectId, env, "static")}`,
-        ]
-      : []),
+    `CAELO_STAGING_BUCKET=${gcpBucketName(projectId, env, "staging")}`,
   ];
   const deploy = await run([
     "run",

package/src/caddy-redirects.docker.test.ts

@@ -9,9 +9,10 @@
  *   imported;
  * - a container started like the Compose service (same Caddyfile shape,
  *   same `/srv/caelo` mount, same reload-loop command and snippet glob)
- *   answers redirected paths on the live and the staging host with the
- *   planned status + Location — query kept, case-sensitive, the live page
- *   wins, 410 for gone;
+ *   answers redirected paths on the live host with the planned status +
+ *   Location — query kept, case-sensitive, the live page wins, 410 for
+ *   gone — and serves nothing of output/staging on the staging host (#1330:
+ *   that is the staging gateway's);
  * - the reload loop picks up a deploy's new snippet, a snippet Caddy
  *   rejects leaves the previous redirects live, and the next good snippet
  *   is picked up again.
@@ -147,7 +148,7 @@ describe.skipIf(!dockerUp)(`self-hosted redirects through ${CADDY_IMAGE}`, () =>
         ownerEmail: "owner@example.test",
         tls: "internal",
         publicSiteRoot: `${SITE_OUTPUT_ROOT}/output/production/current`,
-        stagingSiteRoot: `${SITE_OUTPUT_ROOT}/output/staging/current`,
+        stagingGatewayUpstream: "caelo-staging-gateway:8091",
         adminUpstream: COMPOSE_ADMIN_UPSTREAM,
         gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
         mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
@@ -246,7 +247,11 @@ describe.skipIf(!dockerUp)(`self-hosted redirects through ${CADDY_IMAGE}`, () =>
     expectRedirect("/hop1", 301, "/blog/");
     expectRedirect("/Case", 301, "/about/");
     expectRedirect("/q?dropped=1", 301, "/about?ref=old");
-    expectRedirect("/staged-old", 301, "/blog/", STAGING);
+    // #1330 — Caddy serves no staged file and answers no staging redirect:
+    // the staging host goes to the staging gateway (not running here, so
+    // Caddy answers 502), whatever lies in output/staging.
+    expect(probe(STAGING, "/staged-old").status).toBe(502);
+    expect(probe(STAGING, "/index.html").status).toBe(502);
     expect(probe(LIVE, "/gone").status).toBe(410);
     // Exact, case-sensitive: /case is not /Case.
     expect(probe(LIVE, "/case").status).toBe(404);

package/src/caddy-redirects.test.ts

@@ -24,7 +24,7 @@ const caddyfile = generateCaddyfile({
   ownerEmail: "owner@example.com",
   tls: "acme",
   publicSiteRoot: "/srv/caelo/output/production/current",
-  stagingSiteRoot: "/srv/caelo/output/staging/current",
+  stagingGatewayUpstream: "caelo-staging-gateway:8091",
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
   mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
@@ -41,13 +41,13 @@ function block(host: string): string {
 }
 
 describe("Caddyfile — redirects (#587)", () => {
-  it("each public vhost imports the redirect snippet of the build it serves", () => {
+  it("the live vhost imports the redirect snippet of the build it serves", () => {
     expect(block("example.com")).toContain(
       "  root * /srv/caelo/output/production/current\n  import /srv/caelo/output/production/current/_redirects.caddy*\n",
     );
-    expect(block("staging.example.com")).toContain(
-      "import /srv/caelo/output/staging/current/_redirects.caddy*",
-    );
+    // #1330 — staging's redirects are the staging gateway's (from the
+    // staging projection), not Caddy's.
+    expect(block("staging.example.com")).not.toContain("_redirects.caddy");
     expect(block("admin.example.com")).not.toContain("_redirects.caddy");
   });
 
@@ -67,6 +67,8 @@ describe("Compose — Caddy picks up new redirects (#587)", () => {
     caeloSecretKek: "0".repeat(64),
     dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
     internalSecret: "i".repeat(48),
+    stagingHost: "staging.example.com",
+    stagingGateSecret: "g".repeat(64),
     diskSize: "20Gi",
     ports: { http: 80, https: 443 },
     project: "caelo-example-com",

package/src/caddy-validate.test.ts

@@ -64,7 +64,7 @@ const base: CaddyfileSpec = {
   ownerEmail: "owner@example.com",
   tls: "acme",
   publicSiteRoot: "/srv/caelo/output/production/current",
-  stagingSiteRoot: "/srv/caelo/output/staging/current",
+  stagingGatewayUpstream: "caelo-staging-gateway:8091",
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
   mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,

package/src/caddy.test.ts

@@ -20,7 +20,7 @@ const spec: CaddyfileSpec = {
   ownerEmail: "owner@example.com",
   tls: "acme",
   publicSiteRoot: "/srv/caelo/output/production/current",
-  stagingSiteRoot: "/srv/caelo/output/staging/current",
+  stagingGatewayUpstream: "caelo-staging-gateway:8091",
   adminUpstream: COMPOSE_ADMIN_UPSTREAM,
   gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
   mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
@@ -96,9 +96,12 @@ describe("Caddyfile upstreams (#707)", () => {
     expect(out).not.toContain("localhost");
     expect(out).not.toContain("127.0.0.1");
     expect(block(out, "admin.example.com")).toContain("reverse_proxy caelo-admin:5173");
-    for (const host of ["example.com", "staging.example.com"]) {
-      expect(block(out, host)).toContain("handle /api/* {\n    reverse_proxy caelo-gateway:8090\n");
-    }
+    expect(block(out, "example.com")).toContain(
+      "handle /api/* {\n    reverse_proxy caelo-gateway:8090\n",
+    );
+    // #1330 — the staging host goes to the staging gateway, every path.
+    expect(block(out, "staging.example.com")).toContain("reverse_proxy caelo-staging-gateway:8091");
+    expect(block(out, "staging.example.com")).not.toContain("caelo-gateway:8090");
   });
 
   it("does not route /admin/* on the public site (the admin routes from / on its own host)", () => {
@@ -123,12 +126,15 @@ describe("Caddyfile static site (#566)", () => {
     );
   });
 
-  it("serves production and staging from their own roots; only staging is noindex", () => {
+  it("serves production from its root; staging only through the staging gateway, noindex", () => {
     const out = generateCaddyfile(spec);
     expect(block(out, "example.com")).toContain("root * /srv/caelo/output/production/current");
     expect(block(out, "example.com")).not.toContain("X-Robots-Tag");
     const staging = block(out, "staging.example.com");
-    expect(staging).toContain("root * /srv/caelo/output/staging/current");
+    // #1330 — no second path to the staged files: Caddy serves none of them.
+    expect(staging).not.toContain("root *");
+    expect(staging).not.toContain("file_server");
+    expect(staging).not.toContain("output/staging");
     expect(staging).toContain('header X-Robots-Tag "noindex"');
   });
 });

package/src/caddy.ts

@@ -15,6 +15,9 @@
  *     #           MCP-Auth-Proxy on its own host, never the site's origin)
  *     # public  → /api/* → <gatewayUpstream>; everything else is the
  *     #           static site (try_files + file_server, 404 → /404.html)
+ *     # staging → reverse_proxy <stagingGatewayUpstream> for every path
+ *     #           (#1330: the staging gateway serves the staged build
+ *     #           behind the staging gate, and staging's own /api)
  *   }
  *
  * Upstreams are `host:port` as seen FROM CADDY. In the Compose install
@@ -27,7 +30,10 @@
  * run in CI) — issue #566 shipped a `try_files` nested inside
  * `file_server { }`, which Caddy 2.11 refuses, so no vhost came up.
  *
- * Staging vhosts force `X-Robots-Tag: noindex`.
+ * Staging vhosts force `X-Robots-Tag: noindex`. Caddy serves no staging
+ * file itself (#1330): the staging gateway mounts the staged builds
+ * read-only, and Caddy has no other path to them, so nothing reaches a
+ * staged page without passing the gate.
  *
  * Public vhosts import the redirect snippet of the build they serve
  * (`_redirects.caddy`, #587); the Caddy container reloads itself when a
@@ -91,7 +97,8 @@ export interface CaddyfileSpec {
   readonly ownerEmail: string;
   readonly tls: CaddyTlsMode;
   readonly publicSiteRoot: string; // absolute path inside the Caddy container
-  readonly stagingSiteRoot: string;
+  /** #1330 — `host:port` of the staging gateway as Caddy reaches it (Compose: `caelo-staging-gateway:8091`). */
+  readonly stagingGatewayUpstream: string;
   /** `host:port` of the admin as Caddy reaches it (Compose: `caelo-admin:5173`). */
   readonly adminUpstream: string;
   /** `host:port` of the API gateway as Caddy reaches it (Compose: `caelo-gateway:8090`). */
@@ -173,7 +180,7 @@ function assertSafeCaddyToken(label: string, value: string, kind: "address" | "t
 export function generateCaddyfile(spec: CaddyfileSpec): string {
   assertSafeCaddyToken("ownerEmail", spec.ownerEmail, "token");
   assertSafeCaddyToken("publicSiteRoot", spec.publicSiteRoot, "token");
-  assertSafeCaddyToken("stagingSiteRoot", spec.stagingSiteRoot, "token");
+  assertSafeCaddyToken("stagingGatewayUpstream", spec.stagingGatewayUpstream, "token");
   assertSafeCaddyToken("adminUpstream", spec.adminUpstream, "token");
   assertSafeCaddyToken("gatewayUpstream", spec.gatewayUpstream, "token");
   assertSafeCaddyToken("mcpAuthProxyUpstream", spec.mcpAuthProxyUpstream, "token");
@@ -232,12 +239,24 @@ function vhost(d: CaddyDomainSpec, spec: CaddyfileSpec): string {
   header X-Content-Type-Options "${NOSNIFF}"
   reverse_proxy ${spec.mcpAuthProxyUpstream}
 }
+`;
+  }
+  if (d.env === "staging") {
+    // #1330 — every path to the staging gateway: it runs the gate first and
+    // serves the staged build and staging's /api itself. The #891 security
+    // headers stay on as a second layer over the gateway's own.
+    return `${d.hostname} {${noindex}
+  header X-Content-Type-Options "${NOSNIFF}"
+  @svg path *.svg
+  header @svg Content-Security-Policy "${SVG_DOCUMENT_CSP}"
+  reverse_proxy ${spec.stagingGatewayUpstream}
+}
 `;
   }
   // public — API routes go to the gateway, the rest is the static site.
   // `try_files` is its own directive (a rewrite), never a file_server
   // subdirective (#566).
-  const root = d.env === "staging" ? spec.stagingSiteRoot : spec.publicSiteRoot;
+  const root = spec.publicSiteRoot;
   // #587 — the redirects table of the build this vhost serves.
   return `${d.hostname} {${noindex}
   root * ${root}