@caelo-cms/provisioning 0.11.9 → 0.11.11

package/src/runtime-secrets.test.ts

@@ -115,7 +115,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run },
     );
-    expect(outcomes.map((o) => o.status)).toEqual(Array(6).fill("present"));
+    expect(outcomes.map((o) => o.status)).toEqual(Array(7).fill("present"));
     expect(lines().some((l) => l.includes(" create ") || l.includes(" add "))).toBe(false);
   });
 
@@ -126,7 +126,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run, generate: () => `generated-value-${++n}` },
     );
-    expect(outcomes.map((o) => o.status)).toEqual(Array(6).fill("applied"));
+    expect(outcomes.map((o) => o.status)).toEqual(Array(7).fill("applied"));
     const creates = calls.filter((c) => c.line.startsWith("secrets create"));
     // #806 — the seal key is 32 random bytes in base64 (not the injected hex generator).
     const sealKey = creates.find((c) => c.line.includes("mcp-oauth-seal-key"))?.stdin ?? "";
@@ -145,10 +145,15 @@ describe("ensureGeneratedSecrets", () => {
         line: "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
         stdin: "generated-value-3",
       },
+      // #1329 — the staging gateway's role password: its own, never the live one's.
+      {
+        line: "secrets create caelo-production-public-staging-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
+        stdin: "generated-value-4",
+      },
       // #650 — the staging access gate's key.
       {
         line: "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-        stdin: "generated-value-4",
+        stdin: "generated-value-5",
       },
       // #806 — remote MCP's OAuth client starts as the "not configured"
       // placeholder; the Owner writes the real one from Settings → MCP.
@@ -178,11 +183,12 @@ describe("ensureGeneratedSecrets", () => {
       { run, generate: () => "generated" },
     );
     const creates = calls.filter((c) => c.line.startsWith("secrets create"));
-    expect(creates.map((c) => c.stdin).slice(0, 5)).toEqual([
+    expect(creates.map((c) => c.stdin).slice(0, 6)).toEqual([
       "operator-set",
       "generated",
       "generated",
       "generated",
+      "generated",
       "{}",
     ]);
     for (const c of calls) expect(c.line).not.toContain("operator-set");
@@ -194,6 +200,7 @@ describe("ensureGeneratedSecrets", () => {
       "secrets versions list caelo-production-internal-secret": [ok("")],
       "secrets versions list caelo-production-tool-approval-secret": [ok("v/1")],
       "secrets versions list caelo-production-public-role-password": [ok("v/1")],
+      "secrets versions list caelo-production-public-staging-role-password": [ok("v/1")],
       "secrets versions list caelo-production-staging-gate-secret": [ok("v/1")],
       "secrets versions list caelo-production-operator-oauth-client": [ok("v/1")],
       "secrets versions list caelo-production-mcp-oauth-seal-key": [ok("v/1")],
@@ -209,6 +216,7 @@ describe("ensureGeneratedSecrets", () => {
       "present",
       "present",
       "present",
+      "present",
     ]);
     expect(calls.filter((c) => c.line.startsWith("secrets versions add"))).toEqual([
       {
@@ -243,7 +251,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: { kind: "automatic" } },
       { run, generate: () => "v" },
     );
-    expect(outcomes.map((o) => o.status)).toEqual(Array(6).fill("applied"));
+    expect(outcomes.map((o) => o.status)).toEqual(Array(7).fill("applied"));
     expect(outcomes.every((o) => o.detail?.includes("gcp.resourceLocations"))).toBe(true);
     const creates = lines().filter((l) => l.startsWith("secrets create"));
     // One refused automatic attempt; then every secret — the refused one
@@ -253,6 +261,7 @@ describe("ensureGeneratedSecrets", () => {
       "secrets create caelo-production-internal-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-tool-approval-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
+      "secrets create caelo-production-public-staging-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       // #652 — the staging gate's key follows the same path.
       "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-operator-oauth-client --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
@@ -284,7 +293,7 @@ describe("ensureGeneratedSecrets", () => {
       { run, generate: () => "v" },
     );
     expect(outcomes.every((o) => o.status === "failed")).toBe(true);
-    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(6);
+    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(7);
   });
 });
 
@@ -314,7 +323,7 @@ describe("rotateRuntimeSecret", () => {
     projectId: "acme",
     region: "europe-west1",
     env: "production",
-    services: { admin: "adm-svc", gateway: "gw-svc" },
+    services: { admin: "adm-svc", gateway: "gw-svc", "mcp-auth-proxy": "px-svc" },
     sqlInstance: "caelo-production-pg-1",
   };
   const ref = (name: string, secret: string, version = "latest") => ({
@@ -329,6 +338,7 @@ describe("rotateRuntimeSecret", () => {
       service([
         ref("ADMIN_DATABASE_PASSWORD", "postgres-password"),
         ref("PUBLIC_ADMIN_DATABASE_PASSWORD", "postgres-password"),
+        ref("PUBLIC_STAGING_ADMIN_DATABASE_PASSWORD", "postgres-password"),
         ref("CAELO_SECRET_KEK", "secret-kek"),
         ref("CAELO_INTERNAL_SECRET", "internal-secret"),
         ref("CAELO_TOOL_APPROVAL_SECRET", "tool-approval-secret"),
@@ -337,6 +347,10 @@ describe("rotateRuntimeSecret", () => {
     "run services describe gw-svc": [
       service([ref("PUBLIC_DATABASE_PASSWORD", "public-role-password")]),
     ],
+    // #1328 — the proxy reads none of the rotatable database secrets.
+    "run services describe px-svc": [
+      service([ref("CAELO_MCP_OAUTH_SEAL_KEY", "mcp-oauth-seal-key")]),
+    ],
     "auth print-access-token": [ok("tok\n")],
   });
 
@@ -451,7 +465,10 @@ describe("rotateRuntimeSecret", () => {
     const { run, lines } = fakeGcloud({
       "run services describe adm-svc": [
         service([
-          { name: "ADMIN_DATABASE_URL", value: "postgres://admin_role:pw@10.0.0.3:5432/cms_admin" },
+          {
+            name: "ADMIN_DATABASE_URL",
+            value: "postgres://admin_role:pw@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin",
+          },
         ]),
       ],
     });
@@ -534,17 +551,23 @@ describe("parseAdminConfig", () => {
   it("marks an admin still on an inline-password URL (jobs on its image need upgrade first)", () => {
     const cfg = parseAdminConfig(
       admin([
-        { name: "ADMIN_DATABASE_URL", value: "postgres://admin_role:pw@10.0.0.3:5432/cms_admin" },
+        {
+          name: "ADMIN_DATABASE_URL",
+          value: "postgres://admin_role:pw@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin",
+        },
       ]),
     );
-    expect(cfg?.databaseHost).toBe("10.0.0.3");
+    expect(cfg?.databaseHost).toBe("db1.p-label.europe-west1.sql-psa.goog");
     expect(cfg?.secretEnv).toBe(false);
   });
 
   it("marks an admin that reads the password from Secret Manager", () => {
     const cfg = parseAdminConfig(
       admin([
-        { name: "ADMIN_DATABASE_URL", value: "postgresql://admin_role@10.0.0.3:5432/cms_admin" },
+        {
+          name: "ADMIN_DATABASE_URL",
+          value: "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin",
+        },
         {
           name: "ADMIN_DATABASE_PASSWORD",
           valueFrom: {
@@ -559,10 +582,10 @@ describe("parseAdminConfig", () => {
 
 describe("migrationJobEnvArgs", () => {
   it("gives the job password-less URLs and the password as a secret reference", () => {
-    const args = migrationJobEnvArgs("10.20.0.3");
+    const args = migrationJobEnvArgs("db1.p-label.europe-west1.sql-psa.goog");
     expect(args).toEqual([
-      "--set-env-vars=ADMIN_DATABASE_URL=postgresql://admin_role@10.20.0.3:5432/cms_admin?sslmode=require,PUBLIC_ADMIN_DATABASE_URL=postgresql://admin_role@10.20.0.3:5432/cms_public?sslmode=require",
-      "--set-secrets=ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest,PUBLIC_ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest",
+      "--set-env-vars=ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem,PUBLIC_ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem,PUBLIC_STAGING_ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      "--set-secrets=ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest,PUBLIC_ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest,PUBLIC_STAGING_ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest",
     ]);
   });
 });

package/src/runtime-secrets.ts

@@ -5,7 +5,8 @@
  * Pulumi) creates and maintains, through gcloud:
  *
  *   - {@link ensureGatewayServiceAccount}: the gateway's own run SA, so it
- *     can be granted only the secrets the gateway reads.
+ *     can be granted only the secrets the gateway reads; the same for the
+ *     MCP-Auth-Proxy ({@link ensureMcpAuthProxyServiceAccount}, #1328).
  *   - {@link ensureGeneratedSecrets}: the secrets in
  *     `CLI_GENERATED_SECRETS` (stack-contract.ts). The wizard runs it before
  *     `pulumi up`, upgrade on every roll, so installs that predate a secret
@@ -23,9 +24,16 @@
 import { randomBytes } from "node:crypto";
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
-import { gatewayServiceAccountEmail, gatewayServiceAccountId, gcpSecretId } from "./gcp-names.js";
+import {
+  gatewayServiceAccountEmail,
+  gatewayServiceAccountId,
+  gcpSecretId,
+  mcpAuthProxyServiceAccountEmail,
+  mcpAuthProxyServiceAccountId,
+} from "./gcp-names.js";
 import {
   CLI_GENERATED_SECRETS,
+  CLOUD_RUN_SLUGS,
   type CloudRunSlug,
   DATABASE_ROLE_SECRET,
   type DatabaseRole,
@@ -84,14 +92,47 @@ const ALREADY_EXISTS = /ALREADY_EXISTS|already exists/i;
 // ===========================================================================
 
 /** Create the gateway's run SA unless it exists. */
-export async function ensureGatewayServiceAccount(
+export function ensureGatewayServiceAccount(
+  install: { readonly projectId: string; readonly env: string },
+  deps: RuntimeDeps = {},
+): Promise<EnsureOutcome> {
+  return ensureServiceAccount(
+    install.projectId,
+    gatewayServiceAccountId(install.env),
+    gatewayServiceAccountEmail(install.projectId, install.env),
+    `Caelo ${install.env} gateway`,
+    deps,
+  );
+}
+
+/**
+ * #1328 — create the MCP-Auth-Proxy's run SA unless it exists. It gets no
+ * role here or anywhere: only `secretAccessor` on its two secrets
+ * (stack-contract.ts runtimeSecretBindings).
+ */
+export function ensureMcpAuthProxyServiceAccount(
   install: { readonly projectId: string; readonly env: string },
   deps: RuntimeDeps = {},
+): Promise<EnsureOutcome> {
+  return ensureServiceAccount(
+    install.projectId,
+    mcpAuthProxyServiceAccountId(install.env),
+    mcpAuthProxyServiceAccountEmail(install.projectId, install.env),
+    `Caelo ${install.env} MCP-Auth-Proxy`,
+    deps,
+  );
+}
+
+async function ensureServiceAccount(
+  projectId: string,
+  accountId: string,
+  email: string,
+  displayName: string,
+  deps: RuntimeDeps,
 ): Promise<EnsureOutcome> {
   const run = deps.run ?? defaultGcloud;
-  const email = gatewayServiceAccountEmail(install.projectId, install.env);
   const id = `service account ${email}`;
-  const project = `--project=${install.projectId}`;
+  const project = `--project=${projectId}`;
   const describe = await run([
     "iam",
     "service-accounts",
@@ -108,9 +149,9 @@ export async function ensureGatewayServiceAccount(
     "iam",
     "service-accounts",
     "create",
-    gatewayServiceAccountId(install.env),
+    accountId,
     project,
-    `--display-name=Caelo ${install.env} gateway`,
+    `--display-name=${displayName}`,
     "--quiet",
   ]);
   if (create.ok || ALREADY_EXISTS.test(create.stderr)) return { id, status: "applied" };
@@ -470,7 +511,7 @@ async function checkRotationReaders(
   const isSecret = (live: { kind: string; secret?: string } | undefined) =>
     live?.kind === "secret" &&
     (live.secret === secretId || (live.secret?.endsWith(`/secrets/${secretId}`) ?? false));
-  for (const service of ["admin", "gateway"] as const) {
+  for (const service of CLOUD_RUN_SLUGS) {
     const vars = Object.entries(SERVICE_SECRET_ENV[service])
       .filter(([, s]) => s === secret)
       .map(([name]) => name);
@@ -531,6 +572,12 @@ async function setSqlUserPassword(
   http: HttpFetch,
   sleep: Sleep,
   user: { projectId: string; instance: string; role: string; password: string },
+  /**
+   * `update` sets an existing user's password (`users.update`); `create`
+   * adds the user with it (`users.insert`, #1329: the staging gateway's
+   * login on an install from before it).
+   */
+  mode: "update" | "create",
 ): Promise<{ ok: true } | { ok: false; error: string }> {
   const token = await run(["auth", "print-access-token"]);
   const bearer = token.ok ? token.stdout.trim() : "";
@@ -546,11 +593,17 @@ async function setSqlUserPassword(
     ok: false as const,
     error: `${what}: HTTP ${res.status} ${(await res.text()).slice(0, 500)}`,
   });
-  const put = await http(
-    `${project}/instances/${encodeURIComponent(user.instance)}/users?name=${encodeURIComponent(user.role)}`,
-    { method: "PUT", headers, body: JSON.stringify({ name: user.role, password: user.password }) },
-  );
-  if (!put.ok) return failed("update the user", put);
+  const users = `${project}/instances/${encodeURIComponent(user.instance)}/users`;
+  const body = JSON.stringify({ name: user.role, password: user.password });
+  const put =
+    mode === "update"
+      ? await http(`${users}?name=${encodeURIComponent(user.role)}`, {
+          method: "PUT",
+          headers,
+          body,
+        })
+      : await http(users, { method: "POST", headers, body });
+  if (!put.ok) return failed(mode === "update" ? "update the user" : "create the user", put);
   type Operation = {
     name?: string;
     status?: string;
@@ -652,12 +705,13 @@ export async function rotateRuntimeSecret(
     }
     const previous = current.stdout;
     const setPassword = (role: string, password: string) =>
-      setSqlUserPassword(run, http, sleep, {
-        projectId: target.projectId,
-        instance,
-        role,
-        password,
-      });
+      setSqlUserPassword(
+        run,
+        http,
+        sleep,
+        { projectId: target.projectId, instance, role, password },
+        "update",
+      );
     const changed: string[] = [];
     const restore = async (): Promise<string> => {
       const failed: string[] = [];
@@ -696,7 +750,7 @@ export async function rotateRuntimeSecret(
   steps.push(`added a new version to ${secretId}`);
 
   const failures: string[] = [];
-  for (const service of ["admin", "gateway"] as const) {
+  for (const service of CLOUD_RUN_SLUGS) {
     if (!serviceSecrets(service).includes(secret)) continue;
     const name = target.services[service];
     const [update, flip] = rollArgs(name, target.region, target.projectId) as [string[], string[]];
@@ -766,7 +820,12 @@ export async function readSecretValue(
 export async function ensureDatabaseRolePassword(
   target: DatabaseRoleTarget,
   role: DatabaseRole,
-  deps: RuntimeDeps & { readonly http?: HttpFetch; readonly password?: string } = {},
+  deps: RuntimeDeps & {
+    readonly http?: HttpFetch;
+    readonly password?: string;
+    /** Create the Cloud SQL user with the password instead (it does not exist yet, #1329). */
+    readonly create?: boolean;
+  } = {},
 ): Promise<EnsureOutcome> {
   const run = deps.run ?? defaultGcloud;
   const sleep = deps.sleep ?? realSleep;
@@ -778,11 +837,12 @@ export async function ensureDatabaseRolePassword(
     if (!value.ok) return { id, status: "failed", error: value.error };
     password = value.value;
   }
-  const set = await setSqlUserPassword(run, http, sleep, {
-    projectId: target.projectId,
-    instance: target.sqlInstance,
-    role,
-    password,
-  });
+  const set = await setSqlUserPassword(
+    run,
+    http,
+    sleep,
+    { projectId: target.projectId, instance: target.sqlInstance, role, password },
+    deps.create === true ? "create" : "update",
+  );
   return set.ok ? { id, status: "applied" } : { id, status: "failed", error: set.error };
 }

package/src/scheduler-setup.test.ts

@@ -0,0 +1,201 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The scheduler tick's setup (scheduler-setup.ts) against a fake gcloud. The
+ * load-bearing assertions are the trust boundary (#1140): the scheduler's
+ * account may sign as itself, pass the admin's IAP, start workflows and
+ * write logs — no secret, database, storage, run or IAM-admin right — and
+ * the one Cloud Scheduler job starts the workflow at the knob's cadence.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import {
+  ensureSchedulerTick,
+  SCHEDULER_FORBIDDEN_ROLES,
+  SCHEDULER_TICK_PATH,
+  type SchedulerTickTarget,
+  schedulerWorkflowSource,
+  tickOrigin,
+} from "./scheduler-setup.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+
+const SA = "caelo-production-scheduler@acme.iam.gserviceaccount.com";
+const MEMBER = `serviceAccount:${SA}`;
+
+const TARGET: SchedulerTickTarget = {
+  projectId: "acme",
+  region: "europe-west1",
+  env: "production",
+  adminUrl: "https://admin.acme.com",
+  resource: { kind: "backend-services", service: "caelo-production-admin-backend-1a2b" },
+  intervalMinutes: 5,
+};
+
+function fakeGcloud(overrides: [RegExp, GcloudResult][] = []) {
+  const calls: string[][] = [];
+  const sources: string[] = [];
+  const rules: [RegExp, GcloudResult][] = [
+    ...overrides,
+    [/^iam service-accounts describe/, fail("NOT_FOUND")],
+    [/^scheduler jobs describe/, fail("NOT_FOUND")],
+  ];
+  const run = async (args: string[]) => {
+    calls.push(args);
+    const src = args.find((a) => a.startsWith("--source="));
+    if (src) sources.push(await Bun.file(src.slice("--source=".length)).text());
+    const line = args.join(" ");
+    return rules.find(([re]) => re.test(line))?.[1] ?? ok("");
+  };
+  return { run, calls, sources };
+}
+
+const flag = (args: string[], name: string) =>
+  args.find((a) => a.startsWith(`--${name}=`))?.slice(name.length + 3);
+
+function grants(calls: string[][]) {
+  return calls
+    .filter((c) => c.includes("add-iam-policy-binding"))
+    .map((c) => ({
+      where: c.slice(0, c.indexOf("add-iam-policy-binding") + 2).join(" "),
+      member: flag(c, "member"),
+      role: flag(c, "role") as string,
+    }));
+}
+
+const sleep = async () => {};
+
+describe("ensureSchedulerTick", () => {
+  it("grants the scheduler only self-signing, IAP access, workflow start and logs", async () => {
+    const { run, calls } = fakeGcloud();
+    const r = await ensureSchedulerTick(TARGET, { run, sleep });
+    expect(r.ok).toBe(true);
+    const mine = grants(calls).filter((g) => g.member === MEMBER);
+    expect(mine.map((g) => [g.where, g.role])).toEqual([
+      [`iam service-accounts add-iam-policy-binding ${SA}`, "roles/iam.serviceAccountTokenCreator"],
+      ["projects add-iam-policy-binding acme", "roles/workflows.invoker"],
+      ["projects add-iam-policy-binding acme", "roles/logging.logWriter"],
+      [
+        "iap web add-iam-policy-binding --resource-type=backend-services",
+        "roles/iap.httpsResourceAccessor",
+      ],
+    ]);
+    for (const g of mine) {
+      for (const forbidden of SCHEDULER_FORBIDDEN_ROLES) {
+        expect(g.role.startsWith(forbidden)).toBe(false);
+      }
+    }
+    // Nobody else is granted anything.
+    expect(grants(calls).every((g) => g.member === MEMBER)).toBe(true);
+    // The IAP grant names the admin's resource.
+    const iap = calls.find((c) => c[0] === "iap") as string[];
+    expect(iap).toContain("--resource-type=backend-services");
+    expect(iap).toContain("--service=caelo-production-admin-backend-1a2b");
+  });
+
+  it("signs as itself only: token creator on its own account, never on another", async () => {
+    const { run, calls } = fakeGcloud();
+    await ensureSchedulerTick(TARGET, { run, sleep });
+    const saGrants = calls.filter(
+      (c) => c[0] === "iam" && c[1] === "service-accounts" && c[2] === "add-iam-policy-binding",
+    );
+    expect(saGrants.map((c) => c[3])).toEqual([SA]);
+  });
+
+  it("deploys the workflow as the scheduler account and schedules it every 5 minutes", async () => {
+    const { run, calls, sources } = fakeGcloud();
+    await ensureSchedulerTick(TARGET, { run, sleep });
+    const deploy = calls.find((c) => c[0] === "workflows" && c[1] === "deploy") as string[];
+    expect(deploy[2]).toBe("caelo-production-scheduler-tick");
+    expect(flag(deploy, "service-account")).toBe(SA);
+    expect(flag(deploy, "location")).toBe("europe-west1");
+    expect(sources[0]).toContain(`url: "https://admin.acme.com${SCHEDULER_TICK_PATH}"`);
+    const create = calls.find(
+      (c) => c[0] === "scheduler" && c[1] === "jobs" && c[2] === "create",
+    ) as string[];
+    expect(create[4]).toBe("caelo-production-scheduler-tick");
+    expect(flag(create, "schedule")).toBe("*/5 * * * *");
+    expect(flag(create, "time-zone")).toBe("Etc/UTC");
+    expect(flag(create, "uri")).toBe(
+      "https://workflowexecutions.googleapis.com/v1/projects/acme/locations/europe-west1/workflows/caelo-production-scheduler-tick/executions",
+    );
+    expect(flag(create, "oauth-service-account-email")).toBe(SA);
+    // OAuth (a googleapis.com target), never an OIDC token IAP would refuse.
+    expect(create.some((a) => a.startsWith("--oidc"))).toBe(false);
+  });
+
+  it("updates the existing job on a re-run, at the knob's new cadence", async () => {
+    const { run, calls } = fakeGcloud([[/^scheduler jobs describe/, ok("projects/acme/…")]]);
+    const r = await ensureSchedulerTick({ ...TARGET, intervalMinutes: 1 }, { run, sleep });
+    expect(r.ok).toBe(true);
+    const update = calls.find(
+      (c) => c[0] === "scheduler" && c[1] === "jobs" && c[2] === "update",
+    ) as string[];
+    expect(flag(update, "schedule")).toBe("* * * * *");
+    expect(calls.some((c) => c[0] === "scheduler" && c[2] === "create")).toBe(false);
+  });
+
+  it("refuses an interval outside 1-15 minutes before touching the project", async () => {
+    const { run, calls } = fakeGcloud();
+    const r = await ensureSchedulerTick({ ...TARGET, intervalMinutes: 30 }, { run, sleep });
+    expect(r.ok).toBe(false);
+    expect(r.ok ? "" : r.error).toContain("between 1 and 15");
+    expect(calls).toEqual([]);
+  });
+
+  it("refuses an admin URL that is not a plain https origin", async () => {
+    for (const bad of ["http://admin.acme.com", "https://admin.acme.com/x", "https://a@b.com"]) {
+      const { run, calls } = fakeGcloud();
+      const r = await ensureSchedulerTick({ ...TARGET, adminUrl: bad }, { run, sleep });
+      expect(r.ok).toBe(false);
+      expect(calls).toEqual([]);
+    }
+  });
+
+  it("stops at the first failing step and says which", async () => {
+    const { run, calls } = fakeGcloud([[/^workflows deploy/, fail("PERMISSION_DENIED: nope")]]);
+    const r = await ensureSchedulerTick(TARGET, { run, sleep });
+    expect(r.ok).toBe(false);
+    expect(r.ok ? "" : r.error).toContain("deploy workflow caelo-production-scheduler-tick");
+    expect(calls.some((c) => c[0] === "scheduler")).toBe(false);
+  });
+});
+
+describe("schedulerWorkflowSource", () => {
+  const src = schedulerWorkflowSource({ serviceAccount: SA, origin: "https://admin.acme.com" });
+
+  it("signs a JWT for the admin origin as the scheduler itself", () => {
+    expect(src).toContain(`iss: "${SA}"`);
+    expect(src).toContain(`sub: "${SA}"`);
+    expect(src).toContain('aud: "https://admin.acme.com/*"');
+    expect(src).toContain(
+      `url: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${SA}:signJwt"`,
+    );
+    expect(src).toContain("type: OAuth2");
+    expect(src).toContain(`exp: \${now + 600}`);
+  });
+
+  it("posts the tick with the signed JWT and a bounded timeout", () => {
+    expect(src).toContain('url: "https://admin.acme.com/api/internal/scheduler/tick"');
+    expect(src).toContain(`Authorization: \${"Bearer " + signed.body.signedJwt}`);
+    expect(src).toMatch(/timeout: (\d+)/);
+    const timeout = Number(/timeout: (\d+)/.exec(src)?.[1]);
+    expect(timeout).toBeGreaterThan(300);
+    expect(timeout).toBeLessThanOrEqual(1800);
+  });
+});
+
+describe("tickOrigin", () => {
+  it("accepts the admin's origin, with or without a trailing slash", () => {
+    expect(tickOrigin("https://admin.acme.com/")).toEqual({
+      ok: true,
+      origin: "https://admin.acme.com",
+    });
+    expect(tickOrigin("https://caelo-production-admin-x-ew.a.run.app")).toEqual({
+      ok: true,
+      origin: "https://caelo-production-admin-x-ew.a.run.app",
+    });
+  });
+});