@caelo-cms/provisioning 0.11.9 → 0.11.10

package/src/infra-contract.ts

@@ -22,7 +22,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 14;
+export const INFRA_CONTRACT_VERSION = 16;
 
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
@@ -110,6 +110,27 @@ export const INFRA_CONTRACT_VERSION = 14;
 //       CAELO_CAPTURE_BUCKET / CAELO_MEDIA_BUCKET on the admin. The new admin
 //       runs no browser itself on GCP and the app-roll moves the job's image,
 //       so it must exist before an in-cloud upgrader rolls onto it.
+//  15 — #1338: verify-full TLS to Cloud SQL. The instance moves to the
+//       shared server CA (a patch plus a server-certificate rotation) and
+//       refuses plaintext, a private Cloud DNS zone resolves its DNS name in
+//       the VPC, and the services dial that name (cloudsql-tls.ts). The new
+//       images refuse any database URL weaker than verify-full, and the
+//       in-cloud upgrader may neither patch the instance nor create a DNS
+//       zone, so it must not roll an install onto them first.
+//  16 — #1328: the MCP-Auth-Proxy, remote MCP's broker as a service of its
+//       own (no database, its own image). Its service account with
+//       secretAccessor on exactly the Google sign-in client and the seal
+//       key, and the upgrader's actAs on it. On `gcp-firebase` the visitor
+//       gateway moves to a new Cloud Run service (`caelo-<env>-data-gateway`,
+//       public invoker, the admin's run.viewer for the Firebase rewrite) and
+//       the old `gateway` service, whose run.app URL every connector holds
+//       (E13 a), becomes the proxy: new image, new account, no VPC, no
+//       database env. On `gcp` the proxy is a new service behind its own
+//       serverless NEG, backend service and Cloud Armor policy (the MCP rule
+//       moves there) and the URL map sends the MCP paths to it. New
+//       services, accounts, IAM and load-balancer resources — none of which
+//       the in-cloud upgrader may create, and the app-roll rolls three
+//       services from now on.
 
 /**
  * What each contract version adds, in operator terms — the upgrader's
@@ -131,6 +152,8 @@ export const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>> = {
   12: "Google sign-in at project level: the operator-access job's permission to set the sign-in client in the project's IAP settings (#914)",
   13: "the public site's security headers at the edge: nosniff on every file, uploaded SVGs no longer run as documents on the site's origin, and a one-time CDN purge (#891)",
   14: "the capture job that takes server-side screenshots outside the admin, its service account, bucket and grants (#1217)",
+  15: "verified TLS to the database: Cloud SQL's shared server CA, encrypted connections only, and a private DNS name the services dial (#1338)",
+  16: "the MCP sign-in service as its own Cloud Run service with its own account (no database access), the visitor gateway as its own service on Firebase installs, and on Google Cloud load-balancer installs the sign-in service's backend and Cloud Armor rule (#1328)",
 };
 
 /**

package/src/install-state.ts

@@ -155,10 +155,25 @@ export function recordableStagingHost(host: string): string | null {
 export interface ImageDigests {
   readonly admin: string;
   readonly gateway: string;
+  /**
+   * #1328 — the MCP-Auth-Proxy's. Absent on installs recorded before it
+   * existed: their first upgrade to a release with it records it, and a
+   * stack run without it deploys the release tag's proxy image.
+   */
+  readonly "mcp-auth-proxy"?: string;
 }
 
 const DIGEST = /^sha256:[0-9a-f]{64}$/;
 
+/** {@link ImageDigests} without the keys that are absent (a JSON-stable copy). */
+function imageDigestsRecord(d: ImageDigests): ImageDigests {
+  return {
+    admin: d.admin,
+    gateway: d.gateway,
+    ...(d["mcp-auth-proxy"] ? { "mcp-auth-proxy": d["mcp-auth-proxy"] } : {}),
+  };
+}
+
 /**
  * The image digests recorded for an install, or null when none are. Throws
  * on a malformed record rather than deploying a guess.
@@ -166,7 +181,12 @@ const DIGEST = /^sha256:[0-9a-f]{64}$/;
 export function recordedImageDigests(meta: InstallMetadata): ImageDigests | null {
   const d = meta.imageDigests;
   if (d === undefined) return null;
-  if (!DIGEST.test(d.admin ?? "") || !DIGEST.test(d.gateway ?? "")) {
+  const proxy = d["mcp-auth-proxy"];
+  if (
+    !DIGEST.test(d.admin ?? "") ||
+    !DIGEST.test(d.gateway ?? "") ||
+    (proxy !== undefined && !DIGEST.test(proxy))
+  ) {
     throw new Error(
       `install.json imageDigests is malformed (${JSON.stringify(d)}); fix or remove it, then re-run.`,
     );
@@ -211,15 +231,17 @@ export function recordImageDigests(
   // drop it — a stale one would be worse than none (the upgrader job
   // refuses on none and judges downgrades by it).
   const same =
-    meta.imageDigests?.admin === digests.admin && meta.imageDigests?.gateway === digests.gateway;
+    meta.imageDigests?.admin === digests.admin &&
+    meta.imageDigests?.gateway === digests.gateway &&
+    meta.imageDigests?.["mcp-auth-proxy"] === digests["mcp-auth-proxy"];
   const { releaseVersion: previous, platformDigests: previousPlatform, ...rest } = meta;
   const version = releaseVersion ?? (same ? previous : undefined);
   // The platform forms belong to their indexes just as the version does.
   const platform = platformDigests ?? (same ? previousPlatform : undefined);
   writeMetadata(installId, {
     ...rest,
-    imageDigests: { admin: digests.admin, gateway: digests.gateway },
-    ...(platform ? { platformDigests: { admin: platform.admin, gateway: platform.gateway } } : {}),
+    imageDigests: imageDigestsRecord(digests),
+    ...(platform ? { platformDigests: imageDigestsRecord(platform) } : {}),
     ...(version ? { releaseVersion: version } : {}),
   });
 }

package/src/lifecycle.ts

@@ -60,6 +60,7 @@ import {
 } from "./runtime-secrets.js";
 import { finishSealKeyRotation, startSealKeyRotation } from "./seal-key-rotation.js";
 import { selfCommand } from "./self-command.js";
+import { CLOUD_RUN_SLUGS, type CloudRunSlug, cloudRunServicePrefix } from "./stack-contract.js";
 import {
   backendShellEnv,
   localStateNotice,
@@ -720,6 +721,7 @@ async function gcpHealthProbe(
         domain: install.domain,
         adminServiceUrl: urls.admin as string,
         gatewayServiceUrl: urls.gateway as string,
+        mcpAuthProxyServiceUrl: urls["mcp-auth-proxy"] as string,
       },
       { run, http, sleep: realSleep, accessJustChanged: context.accessJustChanged },
     ),
@@ -880,23 +882,29 @@ export async function rotateSecretCommand(
   }
 
   if (name === SEAL_KEY_SECRET) {
-    const gateway = await resolveGcpResourceName(
+    // #1328 — the broker, and with it the seal key, lives in the MCP-Auth-Proxy.
+    const proxyPrefix = cloudRunServicePrefix(meta.provider, GCP_STACK_ENV, "mcp-auth-proxy");
+    const proxy = await resolveGcpResourceName(
       gcloud,
       "run-service",
-      "caelo-production-gateway",
+      proxyPrefix,
       meta.projectId,
       region,
     );
-    if (gateway.status !== "found") {
+    if (proxy.status !== "found") {
       log.error(
         red(
-          `${lookupFailure(gateway, "caelo-production-gateway* Cloud Run service", "operator")} — nothing rotated`,
+          `${lookupFailure(proxy, `${proxyPrefix}* Cloud Run service`, "operator")} — nothing rotated`,
         ),
       );
       return;
     }
-    const gatewayService = gateway.name;
-    const target = { projectId: meta.projectId, region, env: GCP_STACK_ENV, gatewayService };
+    const target = {
+      projectId: meta.projectId,
+      region,
+      env: GCP_STACK_ENV,
+      proxyService: proxy.name,
+    };
     const report = opts.finish
       ? await finishSealKeyRotation(target, {}, { now: opts.now === true })
       : await startSealKeyRotation(target);
@@ -910,19 +918,20 @@ export async function rotateSecretCommand(
 
   const s = spinner();
   s.start(`Rotating ${secret}...`);
-  const services: Partial<Record<"admin" | "gateway", string>> = {};
-  for (const slug of ["admin", "gateway"] as const) {
+  const services: Partial<Record<CloudRunSlug, string>> = {};
+  for (const slug of CLOUD_RUN_SLUGS) {
+    const prefix = cloudRunServicePrefix(meta.provider, GCP_STACK_ENV, slug);
     const service = await resolveGcpResourceName(
       gcloud,
       "run-service",
-      `caelo-production-${slug}`,
+      prefix,
       meta.projectId,
       region,
     );
     if (service.status !== "found") {
       s.stop(
         red(
-          `${lookupFailure(service, `caelo-production-${slug}* Cloud Run service`, "operator")} — nothing rotated`,
+          `${lookupFailure(service, `${prefix}* Cloud Run service`, "operator")} — nothing rotated`,
         ),
       );
       return;
@@ -952,7 +961,7 @@ export async function rotateSecretCommand(
       projectId: meta.projectId,
       region,
       env: GCP_STACK_ENV,
-      services: services as Record<"admin" | "gateway", string>,
+      services: services as Record<CloudRunSlug, string>,
       ...(sqlInstance ? { sqlInstance } : {}),
     },
     secret,

package/src/mcp-auth-proxy-setup.test.ts

@@ -0,0 +1,305 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1328 — the services an upgrade to the MCP-Auth-Proxy release creates on
+ * installs whose stack predates them (mcp-auth-proxy-setup.ts): the proxy's
+ * account and its two secret grants, the gcp-firebase data gateway copied
+ * from the old gateway service, and the gcp proxy service.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import type { GcloudRunner } from "./gcloud-retry.js";
+import {
+  cloneServiceSpec,
+  ensureReleaseServices,
+  gcpProxyDeployArgs,
+  type ReleaseServicesTarget,
+} from "./mcp-auth-proxy-setup.js";
+import { MCP_AUTH_PROXY_TIMEOUT_SECONDS } from "./stack-contract.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+
+/** Answers by the longest matching command prefix; anything else is an error. */
+function fakeGcloud(answers: Record<string, GcloudResult>) {
+  const calls: string[] = [];
+  const run: GcloudRunner = async (args) => {
+    const line = args.join(" ");
+    calls.push(line);
+    const key = Object.keys(answers)
+      .filter((k) => line.startsWith(k))
+      .sort((a, b) => b.length - a.length)[0];
+    return key ? (answers[key] as GcloudResult) : fail(`unexpected: ${line}`);
+  };
+  return { run, calls };
+}
+
+const IMAGE = "europe-west1-docker.pkg.dev/caelo-website/caelo-cms-images";
+const PROXY_SA = "caelo-production-mcp-proxy-sa@acme.iam.gserviceaccount.com";
+
+const firebase: ReleaseServicesTarget = {
+  provider: "gcp-firebase",
+  projectId: "acme",
+  region: "europe-west1",
+  env: "production",
+  domain: "acme.com",
+  mcpAuthProxyImageRef: `${IMAGE}/mcp-auth-proxy@sha256:${"c".repeat(64)}`,
+};
+const gcp: ReleaseServicesTarget = { ...firebase, provider: "gcp" };
+
+/** The old gateway service as `gcloud run services describe --format=json` shows it. */
+const OLD_GATEWAY = {
+  apiVersion: "serving.knative.dev/v1",
+  kind: "Service",
+  metadata: {
+    name: "caelo-production-gateway-bbb",
+    namespace: "123456",
+    uid: "u-1",
+    resourceVersion: "AAY",
+    generation: 42,
+    creationTimestamp: "2026-01-01T00:00:00Z",
+    selfLink:
+      "/apis/serving.knative.dev/v1/namespaces/123456/services/caelo-production-gateway-bbb",
+    labels: {
+      "cloud.googleapis.com/location": "europe-west1",
+      "goog-terraform-provisioned": "true",
+      team: "web",
+    },
+    annotations: {
+      "run.googleapis.com/ingress": "all",
+      "run.googleapis.com/ingress-status": "all",
+      "serving.knative.dev/creator": "someone@acme.com",
+      "serving.knative.dev/lastModifier": "someone@acme.com",
+      "run.googleapis.com/operation-id": "op-1",
+      "run.googleapis.com/client-name": "gcloud",
+    },
+  },
+  spec: {
+    template: {
+      metadata: {
+        name: "caelo-production-gateway-bbb-00042-abc",
+        labels: {
+          "client.knative.dev/nonce": "n",
+          "run.googleapis.com/startupProbeType": "Default",
+        },
+        annotations: {
+          "autoscaling.knative.dev/maxScale": "10",
+          "run.googleapis.com/network-interfaces": '[{"network":"caelo-production-vpc"}]',
+          "run.googleapis.com/vpc-access-egress": "private-ranges-only",
+          "run.googleapis.com/client-name": "gcloud",
+          "run.googleapis.com/client-version": "500.0.0",
+        },
+      },
+      spec: {
+        serviceAccountName: "caelo-production-gateway-sa@acme.iam.gserviceaccount.com",
+        timeoutSeconds: 3600,
+        containers: [
+          {
+            image: `${IMAGE}/gateway@sha256:${"b".repeat(64)}`,
+            env: [
+              { name: "CAELO_PROVIDER", value: "gcp-firebase" },
+              {
+                name: "PUBLIC_DATABASE_PASSWORD",
+                valueFrom: {
+                  secretKeyRef: { name: "caelo-production-public-role-password", key: "latest" },
+                },
+              },
+            ],
+          },
+        ],
+      },
+    },
+    traffic: [{ revisionName: "caelo-production-gateway-bbb-00041-old", percent: 100 }],
+  },
+  status: {
+    url: "https://caelo-production-gateway-bbb-xyz.a.run.app",
+    latestReadyRevisionName: "x",
+  },
+};
+
+describe("cloneServiceSpec", () => {
+  const clone = JSON.parse(
+    cloneServiceSpec(JSON.stringify(OLD_GATEWAY), "caelo-production-data-gateway"),
+  );
+
+  it("names the copy and drops the source's identity, status and tool stamps", () => {
+    expect(clone.metadata).toEqual({
+      name: "caelo-production-data-gateway",
+      labels: { team: "web" },
+      annotations: { "run.googleapis.com/ingress": "all" },
+    });
+    expect(clone.status).toBeUndefined();
+    expect(clone.spec.template.metadata.name).toBeUndefined();
+    expect(clone.spec.template.metadata.labels).toEqual({});
+    expect(clone.spec.template.metadata.annotations).toEqual({
+      "autoscaling.knative.dev/maxScale": "10",
+      "run.googleapis.com/network-interfaces": '[{"network":"caelo-production-vpc"}]',
+      "run.googleapis.com/vpc-access-egress": "private-ranges-only",
+    });
+  });
+
+  it("keeps the configuration — image, env, secrets, account, timeout — and routes all traffic to the new revision", () => {
+    expect(clone.spec.template.spec).toEqual(OLD_GATEWAY.spec.template.spec);
+    expect(clone.spec.traffic).toEqual([{ percent: 100, latestRevision: true }]);
+    expect(clone.apiVersion).toBe("serving.knative.dev/v1");
+    expect(clone.kind).toBe("Service");
+  });
+
+  it("refuses to copy a service that runs no gateway image (the proxy the old service became)", () => {
+    const proxy = structuredClone(OLD_GATEWAY);
+    (proxy.spec.template.spec.containers[0] as { image: string }).image =
+      `${IMAGE}/mcp-auth-proxy@sha256:${"c".repeat(64)}`;
+    expect(() => cloneServiceSpec(JSON.stringify(proxy), "x")).toThrow("not a Caelo gateway image");
+  });
+});
+
+describe("gcpProxyDeployArgs", () => {
+  it("deploys the proxy load-balancer-only, public, at zero instances, without a VPC, with its two secrets", () => {
+    const args = gcpProxyDeployArgs(gcp);
+    expect(args.slice(0, 3)).toEqual(["run", "deploy", "caelo-production-mcp-auth-proxy"]);
+    expect(args).toContain(`--image=${gcp.mcpAuthProxyImageRef}`);
+    expect(args).toContain(`--service-account=${PROXY_SA}`);
+    expect(args).toContain("--ingress=internal-and-cloud-load-balancing");
+    expect(args).toContain("--allow-unauthenticated");
+    expect(args).toContain("--min-instances=0");
+    expect(args).toContain("--cpu-throttling");
+    expect(args).toContain(`--timeout=${MCP_AUTH_PROXY_TIMEOUT_SECONDS}`);
+    expect(args.some((a) => a.startsWith("--network") || a.startsWith("--vpc"))).toBe(false);
+    expect(args).toContain(
+      "--set-env-vars=CAELO_PROVIDER=gcp,CAELO_REMOTE_MCP=available,CAELO_TRUSTED_PROXY_HOPS=2,CAELO_OPERATOR_OAUTH_CLIENT_FILE=/secrets/operator-oauth-client/client.json,CAELO_ADMIN_URL=https://admin.acme.com,CAELO_MCP_PUBLIC_URL=https://acme.com",
+    );
+    expect(args).toContain(
+      "--set-secrets=CAELO_MCP_OAUTH_SEAL_KEY=caelo-production-mcp-oauth-seal-key:latest,/secrets/operator-oauth-client/client.json=caelo-production-operator-oauth-client:latest",
+    );
+    // Nothing that would hand it a database: no URL, no password.
+    expect(args.join(" ")).not.toMatch(/DATABASE|public-role-password|postgres-password/);
+  });
+});
+
+/** The account and its two grants, as a fresh install answers them. */
+const accountAndGrants = {
+  [`iam service-accounts describe ${PROXY_SA}`]: fail("NOT_FOUND: does not exist"),
+  "iam service-accounts create caelo-production-mcp-proxy-sa": ok(),
+  "secrets add-iam-policy-binding": ok(),
+};
+
+describe("ensureReleaseServices", () => {
+  it("gcp-firebase: creates the account, grants exactly its two secrets and copies the old gateway", async () => {
+    const written: string[] = [];
+    let cleaned = false;
+    const { run, calls } = fakeGcloud({
+      ...accountAndGrants,
+      "run services describe caelo-production-data-gateway": fail("NOT_FOUND: could not be found"),
+      "run services list": ok("caelo-production-gateway-bbb\n"),
+      "run services describe caelo-production-gateway-bbb": ok(JSON.stringify(OLD_GATEWAY)),
+      "run services replace": ok(),
+    });
+    const outcomes = await ensureReleaseServices(firebase, {
+      run,
+      writeSpecFile: (json) => {
+        written.push(json);
+        return {
+          path: "/tmp/spec.json",
+          cleanup: () => {
+            cleaned = true;
+          },
+        };
+      },
+    });
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "present", "present", "applied"]);
+    expect(calls.filter((c) => c.startsWith("secrets add-iam-policy-binding"))).toEqual([
+      `secrets add-iam-policy-binding caelo-production-mcp-oauth-seal-key --project=acme --member=serviceAccount:${PROXY_SA} --role=roles/secretmanager.secretAccessor --condition=None --quiet`,
+      `secrets add-iam-policy-binding caelo-production-operator-oauth-client --project=acme --member=serviceAccount:${PROXY_SA} --role=roles/secretmanager.secretAccessor --condition=None --quiet`,
+    ]);
+    // Never a project role.
+    expect(calls.some((c) => c.startsWith("projects add-iam-policy-binding"))).toBe(false);
+    // The copy's source is the service the proxy prefix finds — the old gateway.
+    expect(calls).toContain(
+      "run services list --region europe-west1 --project acme --filter metadata.name~^caelo-production-gateway --format=value(metadata.name)",
+    );
+    expect(JSON.parse(written[0] as string).metadata.name).toBe("caelo-production-data-gateway");
+    expect(calls).toContain(
+      "run services replace /tmp/spec.json --region=europe-west1 --project=acme --quiet",
+    );
+    expect(cleaned).toBe(true);
+    // No new image is deployed: the copy runs what serves today.
+    expect(calls.some((c) => c.startsWith("run deploy"))).toBe(false);
+  });
+
+  it("gcp-firebase: a data gateway that exists already is left alone", async () => {
+    const { run, calls } = fakeGcloud({
+      [`iam service-accounts describe ${PROXY_SA}`]: ok(`${PROXY_SA}\n`),
+      "secrets add-iam-policy-binding": ok(),
+      "run services describe caelo-production-data-gateway": ok("caelo-production-data-gateway\n"),
+    });
+    const outcomes = await ensureReleaseServices(firebase, { run });
+    expect(outcomes.map((o) => o.status)).toEqual(["present", "present", "present", "present"]);
+    expect(calls.some((c) => c.includes("replace") || c.includes("create"))).toBe(false);
+  });
+
+  it("gcp-firebase: refuses to copy when the old service already runs the proxy image", async () => {
+    const proxy = structuredClone(OLD_GATEWAY);
+    (proxy.spec.template.spec.containers[0] as { image: string }).image =
+      `${IMAGE}/mcp-auth-proxy@sha256:${"c".repeat(64)}`;
+    const { run, calls } = fakeGcloud({
+      ...accountAndGrants,
+      "run services describe caelo-production-data-gateway": fail("NOT_FOUND: could not be found"),
+      "run services list": ok("caelo-production-gateway-bbb\n"),
+      "run services describe caelo-production-gateway-bbb": ok(JSON.stringify(proxy)),
+    });
+    const outcomes = await ensureReleaseServices(firebase, { run });
+    const last = outcomes.at(-1);
+    expect(last?.status).toBe("failed");
+    expect(last?.error).toContain("Re-run the installer");
+    expect(calls.some((c) => c.startsWith("run services replace"))).toBe(false);
+  });
+
+  it("gcp: deploys the proxy service with the release's image when it is missing", async () => {
+    const { run, calls } = fakeGcloud({
+      ...accountAndGrants,
+      "run services describe caelo-production-mcp-auth-proxy": fail(
+        "NOT_FOUND: could not be found",
+      ),
+      "run deploy caelo-production-mcp-auth-proxy": ok(),
+    });
+    const outcomes = await ensureReleaseServices(gcp, { run });
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "present", "present", "applied"]);
+    expect(calls).toContain(gcpProxyDeployArgs(gcp).join(" "));
+  });
+
+  it("gcp: an existing proxy service is not deployed again", async () => {
+    const { run, calls } = fakeGcloud({
+      [`iam service-accounts describe ${PROXY_SA}`]: ok(`${PROXY_SA}\n`),
+      "secrets add-iam-policy-binding": ok(),
+      "run services describe caelo-production-mcp-auth-proxy": ok(
+        "caelo-production-mcp-auth-proxy\n",
+      ),
+    });
+    const outcomes = await ensureReleaseServices(gcp, { run });
+    expect(outcomes.at(-1)?.status).toBe("present");
+    expect(calls.some((c) => c.startsWith("run deploy"))).toBe(false);
+  });
+
+  it("stops before any service when a grant fails (Cloud Run would refuse the revision)", async () => {
+    const { run, calls } = fakeGcloud({
+      ...accountAndGrants,
+      "secrets add-iam-policy-binding caelo-production-operator-oauth-client": fail(
+        "PERMISSION_DENIED: secretmanager.secrets.setIamPolicy",
+      ),
+    });
+    const outcomes = await ensureReleaseServices(gcp, { run });
+    expect(outcomes.map((o) => o.status)).toEqual(["applied", "present", "failed"]);
+    expect(calls.some((c) => c.startsWith("run "))).toBe(false);
+  });
+
+  it("stops at once when the account cannot be read", async () => {
+    const { run, calls } = fakeGcloud({
+      [`iam service-accounts describe ${PROXY_SA}`]: fail("PERMISSION_DENIED"),
+    });
+    const outcomes = await ensureReleaseServices(firebase, { run });
+    expect(outcomes).toHaveLength(1);
+    expect(outcomes[0]?.status).toBe("failed");
+    expect(calls).toHaveLength(1);
+  });
+});