@caelo-cms/provisioning 0.11.9 → 0.11.11

package/src/stack-converge.ts

@@ -23,12 +23,13 @@
  *     Storage volume + mount), added in the same `services update` when
  *     missing.
  *   - {@link planSecretFiles} / {@link planRequestTimeout} (#806): the
- *     gateway's secret file (the remote-MCP OAuth client) and its request
+ *     MCP-Auth-Proxy.s secret file (the remote-MCP OAuth client) and its request
  *     timeout, in the same `services update`.
  *   - {@link planCpuIdle}: request-based CPU where the contract wants it
  *     (`SERVICE_CPU_IDLE`), in the same `services update`.
  */
 
+import { isIpLiteral } from "@caelo-cms/shared";
 import { removeDefaultFirewallRules } from "./default-firewall.js";
 import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
 import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
@@ -38,8 +39,10 @@ import {
   ADMIN_MEMORY_DEFAULT,
   type AdminEnvInputs,
   adminEnvContract,
+  CLOUD_RUN_SLUGS,
   type CloudRunEnvVar,
   type CloudRunSlug,
+  DATABASE_URL_VARS,
   databaseUrls,
   type GcpProvider,
   gatewayEnvContract,
@@ -47,6 +50,7 @@ import {
   type IamTarget,
   iamMember,
   type MediaVolumeContract,
+  mcpAuthProxyEnvContract,
   memoryQuantityMiB,
   RETIRED_IAM_BINDINGS,
   RETIRED_RUNTIME_SECRETS,
@@ -167,7 +171,7 @@ function maskUrlPassword(value: string): string {
  * gcloud's list flags split on `,`; a value containing one needs the
  * `^<delim>^` escape syntax (`gcloud topic escaping`).
  */
-function listFlag(flag: string, pairs: string[]): string {
+export function listFlag(flag: string, pairs: string[]): string {
   const joined = pairs.join(",");
   if (!pairs.some((p) => p.includes(","))) return `${flag}=${joined}`;
   const delim = ["@", "|", "#", "~", ";"].find((d) => !pairs.some((p) => p.includes(d)));
@@ -306,21 +310,42 @@ export function planContractEnv(
      * refused rather than silently doubled.
      */
     readonly extraEnv?: Readonly<Partial<Record<CloudRunSlug, readonly CloudRunEnvVar[]>>>;
+    /**
+     * #1338 — the database host the converge just set up (the instance's
+     * DNS name, cloudsql-tls.ts), in place of the one the services dialled
+     * when the plan was read.
+     */
+    readonly databaseHost?: string;
   } = {},
 ):
   | {
       readonly ok: true;
       readonly services: Record<CloudRunSlug, { flags: string[]; changes: EnvChange[] }>;
+      /**
+       * #1338 — the services still dial the instance's IP, which no
+       * verify-full connection can use; their database URLs were left as
+       * they are. Only a converge moves them (cloudsql-tls.ts); a roll must
+       * not start while this is true.
+       */
+      readonly databaseHostPending: boolean;
     }
   | { readonly ok: false; readonly error: string } {
-  const host = liveDatabaseHost(services.admin.liveEnv);
-  if (!host.ok) {
+  const live = liveDatabaseHost(services.admin.liveEnv);
+  if (!opts.databaseHost && !live.ok) {
     return {
       ok: false,
-      error: `the Cloud SQL host is unknown: the admin service (${services.admin.serviceName}) ${host.error}`,
+      error: `the Cloud SQL host is unknown: the admin service (${services.admin.serviceName}) ${live.error}`,
     };
   }
-  const runtime: RuntimeEnvInputs = { ...install, databaseUrls: databaseUrls(host.host) };
+  const host = opts.databaseHost ?? (live.ok ? live.host : "");
+  const databaseHostPending = isIpLiteral(host);
+  // An IP cannot carry a verify-full URL (databaseUrls refuses it): the URLs
+  // are planned from a placeholder name and then left untouched, so the
+  // rest of the env still plans and the caller can see what is pending.
+  const runtime: RuntimeEnvInputs = {
+    ...install,
+    databaseUrls: databaseUrls(databaseHostPending ? "pending.invalid" : host),
+  };
   let inputs: AdminEnvInputs;
   if (install.provider === "gcp-firebase") {
     // The site id carries a random suffix Pulumi generated at install time.
@@ -340,36 +365,33 @@ export function planContractEnv(
   } else {
     inputs = { ...runtime, provider: "gcp" };
   }
-  const skip = new Set(opts.leaveUntouched ?? []);
+  const skip = new Set([
+    ...(opts.leaveUntouched ?? []),
+    ...(databaseHostPending ? [...DATABASE_URL_VARS.admin, ...DATABASE_URL_VARS.gateway] : []),
+  ]);
   const desired = (slug: CloudRunSlug, contract: readonly CloudRunEnvVar[]) => {
     const extra = opts.extraEnv?.[slug] ?? [];
     const clash = extra.find((e) => contract.some((c) => c.name === e.name));
     if (clash) throw new Error(`${slug}: ${clash.name} is both in the contract and extra env`);
     return [...contract, ...extra].filter((e) => !skip.has(e.name));
   };
-  let adminDesired: CloudRunEnvVar[];
-  let gatewayDesired: CloudRunEnvVar[];
+  let contracts: Record<CloudRunSlug, CloudRunEnvVar[]>;
   try {
-    adminDesired = desired("admin", adminEnvContract(inputs));
-    gatewayDesired = desired("gateway", gatewayEnvContract(runtime));
+    contracts = {
+      admin: desired("admin", adminEnvContract(inputs)),
+      gateway: desired("gateway", gatewayEnvContract(runtime)),
+      "mcp-auth-proxy": desired("mcp-auth-proxy", mcpAuthProxyEnvContract(install)),
+    };
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
-  const admin = planEnvUpdate(services.admin.liveEnv, adminDesired, RETIRED_SERVICE_ENV.admin);
-  if (!admin.ok) return { ok: false, error: `admin: ${admin.error}` };
-  const gateway = planEnvUpdate(
-    services.gateway.liveEnv,
-    gatewayDesired,
-    RETIRED_SERVICE_ENV.gateway,
-  );
-  if (!gateway.ok) return { ok: false, error: `gateway: ${gateway.error}` };
-  return {
-    ok: true,
-    services: {
-      admin: { flags: admin.flags, changes: admin.changes },
-      gateway: { flags: gateway.flags, changes: gateway.changes },
-    },
-  };
+  const out = {} as Record<CloudRunSlug, { flags: string[]; changes: EnvChange[] }>;
+  for (const slug of CLOUD_RUN_SLUGS) {
+    const plan = planEnvUpdate(services[slug].liveEnv, contracts[slug], RETIRED_SERVICE_ENV[slug]);
+    if (!plan.ok) return { ok: false, error: `${slug}: ${plan.error}` };
+    out[slug] = { flags: plan.flags, changes: plan.changes };
+  }
+  return { ok: true, services: out, databaseHostPending };
 }
 
 // ===========================================================================
@@ -618,16 +640,24 @@ export function liveIngress(serviceJson: string): string | null {
  * the serving one and the app-roll's rollback target stay as they are. On
  * `gcp` the stack declares load-balancer-only and `staging-domain enable`
  * (admin-domain.ts) opens it deliberately, so this never runs there.
+ *
+ * #1328 — both public services of a gcp-firebase install: the data gateway
+ * (the Firebase rewrite, the health probe) and the MCP-Auth-Proxy (remote-MCP
+ * clients, and until #1331 the staging mapping it forwards).
  */
-async function ensureGatewayIngress(
+async function ensurePublicIngress(
   install: InstallTarget,
+  slug: "gateway" | "mcp-auth-proxy",
   run: GcloudRunner,
 ): Promise<InvariantOutcome> {
-  const service = install.services.gateway;
+  const service = install.services[slug];
   const base = {
     id: `ingress all on ${service}`,
     onFailure: "abort" as const,
-    why: "the gcp-firebase stack's gateway ingress (#650); the health check, the staging domain and remote MCP reach its run.app URL",
+    why:
+      slug === "gateway"
+        ? "the gcp-firebase stack's gateway ingress (#650); Firebase Hosting and the health check reach its run.app URL"
+        : "the gcp-firebase stack's MCP-Auth-Proxy ingress (#1328); remote-MCP clients, the health check and the staging domain reach its run.app URL",
   };
   const where = [`--region=${install.region}`, `--project=${install.projectId}`];
   const describe = await run(["run", "services", "describe", service, ...where, "--format=json"]);
@@ -697,7 +727,10 @@ export async function ensureStackInvariants(
     outcomes.push(await ensureCdnPolicy(install, run));
     outcomes.push(await ensureSvgDownloads(install, run));
   }
-  if (install.provider === "gcp-firebase") outcomes.push(await ensureGatewayIngress(install, run));
+  if (install.provider === "gcp-firebase") {
+    outcomes.push(await ensurePublicIngress(install, "gateway", run));
+    outcomes.push(await ensurePublicIngress(install, "mcp-auth-proxy", run));
+  }
   outcomes.push(...(await removeDefaultFirewallRules(install.projectId, { run })));
 
   return {
@@ -1183,6 +1216,35 @@ export function planCpuIdle(live: boolean, desired: boolean): RollAdditionsPlan
   };
 }
 
+/**
+ * Whether the service's revision template egresses into a VPC (Direct VPC
+ * egress, the stacks' `vpcAccess.networkInterfaces`).
+ */
+export function liveDirectVpc(serviceJson: string): boolean {
+  const svc = JSON.parse(serviceJson) as {
+    spec?: { template?: { metadata?: { annotations?: Record<string, string> } } };
+  };
+  return Boolean(
+    svc.spec?.template?.metadata?.annotations?.["run.googleapis.com/network-interfaces"],
+  );
+}
+
+/**
+ * #1328 — `--clear-network` when a service the contract keeps off the VPC
+ * still egresses into it. The MCP-Auth-Proxy on gcp-firebase is the service
+ * that was the gateway, which reached Cloud SQL's private IP that way; the
+ * proxy talks to the admin's public URL only, so it loses the route to the
+ * database's network together with its database credentials.
+ */
+export function planNoVpc(live: boolean): RollAdditionsPlan {
+  if (!live) return { ok: true, flags: [], changes: [] };
+  return {
+    ok: true,
+    flags: ["--clear-network"],
+    changes: ["VPC egress (private ranges) → none"],
+  };
+}
+
 /**
  * The single `gcloud run services update` that rolls a service to a new
  * image, its run SA and its env changes, so all land in one new revision.

package/src/staging-database.test.ts

@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import type { GcloudRunner } from "./gcloud-retry.js";
+import type { HttpFetch } from "./runtime-secrets.js";
+import { ensureStagingDatabase } from "./staging-database.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+const noSleep = async () => {};
+const install = { projectId: "acme", env: "production", credentials: "operator" } as const;
+
+/** gcloud with an instance `pg-1`, the databases and users given, and a staging password secret. */
+function fakeGcloud(state: { databases: string[]; users: string[] }) {
+  const calls: string[] = [];
+  const run: GcloudRunner = async (args) => {
+    const line = args.join(" ");
+    calls.push(line);
+    if (line.startsWith("sql instances list")) return ok("pg-1\n");
+    if (line.startsWith("sql databases list")) return ok(`${state.databases.join("\n")}\n`);
+    if (line.startsWith("sql users list")) return ok(`${state.users.join("\n")}\n`);
+    if (line.startsWith("sql databases create")) return ok();
+    if (line.startsWith("secrets versions access latest")) return ok("s3cret-staging");
+    if (line.startsWith("auth print-access-token")) return ok("tok\n");
+    return fail(`unexpected: ${line}`);
+  };
+  return { run, calls };
+}
+
+/** The Cloud SQL Admin API, finishing every operation at once. */
+function fakeHttp() {
+  const requests: { method: string; url: string; body?: string }[] = [];
+  const http: HttpFetch = async (url, init) => {
+    requests.push({ method: init.method, url, ...(init.body ? { body: init.body } : {}) });
+    return { ok: true, status: 200, text: async () => JSON.stringify({ status: "DONE" }) };
+  };
+  return { http, requests };
+}
+
+describe("ensureStagingDatabase (#1329)", () => {
+  it("creates the database and the login on an install from before them", async () => {
+    const { run, calls } = fakeGcloud({
+      databases: ["cms_admin", "cms_public"],
+      users: ["admin_role", "public_role"],
+    });
+    const { http, requests } = fakeHttp();
+    const outcomes = await ensureStagingDatabase(install, { run, http, sleep: noSleep });
+    expect(outcomes.map((o) => [o.id, o.status])).toEqual([
+      ["database cms_public_staging", "applied"],
+      ["database role public_staging_role", "applied"],
+    ]);
+    expect(calls).toContain(
+      "sql databases create cms_public_staging --instance=pg-1 --project=acme --quiet",
+    );
+    // The password goes in the request body, read from its own secret.
+    expect(calls).toContain(
+      "secrets versions access latest --secret=caelo-production-public-staging-role-password --project=acme",
+    );
+    expect(requests).toEqual([
+      {
+        method: "POST",
+        url: "https://sqladmin.googleapis.com/v1/projects/acme/instances/pg-1/users",
+        body: JSON.stringify({ name: "public_staging_role", password: "s3cret-staging" }),
+      },
+    ]);
+    expect(calls.some((c) => c.includes("s3cret-staging"))).toBe(false);
+  });
+
+  it("leaves an install that has both alone, re-applying the password", async () => {
+    const { run, calls } = fakeGcloud({
+      databases: ["cms_admin", "cms_public", "cms_public_staging"],
+      users: ["admin_role", "public_role", "public_staging_role"],
+    });
+    const { http, requests } = fakeHttp();
+    const outcomes = await ensureStagingDatabase(install, { run, http, sleep: noSleep });
+    expect(outcomes.map((o) => o.status)).toEqual(["present", "present"]);
+    expect(calls.some((c) => c.startsWith("sql databases create"))).toBe(false);
+    expect(requests.map((r) => [r.method, r.url])).toEqual([
+      [
+        "PUT",
+        "https://sqladmin.googleapis.com/v1/projects/acme/instances/pg-1/users?name=public_staging_role",
+      ],
+    ]);
+  });
+
+  it("reports a refused create with the permission it needs", async () => {
+    const calls: string[] = [];
+    const run: GcloudRunner = async (args) => {
+      const line = args.join(" ");
+      calls.push(line);
+      if (line.startsWith("sql instances list")) return ok("pg-1\n");
+      if (line.startsWith("sql databases list")) return ok("cms_admin\n");
+      if (line.startsWith("sql databases create")) return fail("PERMISSION_DENIED: nope");
+      return ok("public_staging_role\n");
+    };
+    const { http } = fakeHttp();
+    const [db] = await ensureStagingDatabase(install, { run, http, sleep: noSleep });
+    expect(db?.status).toBe("failed");
+    expect(db?.error).toContain("cloudsql.databases.create");
+  });
+
+  it("fails without an instance and creates nothing", async () => {
+    const calls: string[] = [];
+    const run: GcloudRunner = async (args) => {
+      calls.push(args.join(" "));
+      return ok("");
+    };
+    const outcomes = await ensureStagingDatabase(install, { run, sleep: noSleep });
+    expect(outcomes).toHaveLength(1);
+    expect(outcomes[0]?.status).toBe("failed");
+    expect(calls).toHaveLength(1);
+  });
+});

package/src/staging-database.ts

@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The staging database on an existing GCP install (issue #1329, gateway
+ * hardening P3b-1, epic #763 E10).
+ *
+ * A new install gets `cms_public_staging` and its gateway login
+ * `public_staging_role` from the stack (`gcp.sql.Database` / `gcp.sql.User`).
+ * An install from before has neither, and an update must bring them
+ * without a terminal (CLAUDE.md §11.C): the converge — `cms-provision
+ * upgrade` or the in-cloud converge job behind Settings → Updates — runs
+ * {@link ensureStagingDatabase} before the migrations, which need the
+ * database (migrate.ts `public-staging`, cms_admin migration 0530).
+ *
+ * Both go through the Cloud SQL Admin API, the way the stack creates them,
+ * so the next `pulumi up` adopts the same objects. The database is created
+ * with gcloud (no secret involved); the user through the Admin API with the
+ * password in the request body (runtime-secrets.ts `ensureDatabaseRolePassword`),
+ * read from its CLI-generated secret `public-staging-role-password`, never
+ * on argv. The Admin API makes the new user a member of cloudsqlsuperuser;
+ * the revoke that follows (public-role-isolation.ts) and the role audit
+ * take care of it, as for public_role. Idempotent: an install that has both
+ * only gets the password re-applied.
+ */
+
+import { findSqlInstance } from "./gateway-credentials.js";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
+import {
+  type EnsureOutcome,
+  ensureDatabaseRolePassword,
+  type HttpFetch,
+} from "./runtime-secrets.js";
+import { type GcloudCredentials, lookupFailure } from "./upgrade/gcp-lookup.js";
+
+/** The staging site's database (#1329). */
+export const STAGING_DATABASE = "cms_public_staging";
+
+/** The staging gateway's login (#1329). */
+export const STAGING_DATABASE_ROLE = "public_staging_role";
+
+/** The names gcloud lists, one per line. */
+function names(stdout: string): string[] {
+  return stdout
+    .split("\n")
+    .map((l) => l.trim())
+    .filter(Boolean);
+}
+
+/**
+ * Create `cms_public_staging` and `public_staging_role` where the install
+ * lacks them, and set the role's password to its secret. Reports instead of
+ * throwing; a `failed` outcome names the next step.
+ */
+export async function ensureStagingDatabase(
+  install: {
+    readonly projectId: string;
+    readonly env: string;
+    readonly credentials: GcloudCredentials;
+  },
+  deps: { readonly run?: GcloudRunner; readonly sleep?: Sleep; readonly http?: HttpFetch } = {},
+): Promise<EnsureOutcome[]> {
+  const run = deps.run ?? defaultGcloud;
+  const sleep = deps.sleep ?? realSleep;
+  const lookup = await findSqlInstance(install, { run });
+  if (lookup.status !== "found") {
+    return [
+      {
+        id: `database ${STAGING_DATABASE}`,
+        status: "failed",
+        error: lookupFailure(lookup, "Cloud SQL instance", install.credentials),
+      },
+    ];
+  }
+  const instance = lookup.name;
+  const where = [`--instance=${instance}`, `--project=${install.projectId}`];
+  return [
+    await ensureDatabase(run, sleep, instance, where),
+    await ensureRole(run, deps, install, instance, where),
+  ];
+}
+
+async function ensureDatabase(
+  run: GcloudRunner,
+  sleep: Sleep,
+  instance: string,
+  where: readonly string[],
+): Promise<EnsureOutcome> {
+  const id = `database ${STAGING_DATABASE}`;
+  const listed = await run(["sql", "databases", "list", ...where, "--format=value(name)"]);
+  if (!listed.ok) {
+    return {
+      id,
+      status: "failed",
+      error: `gcloud sql databases list on ${instance}: ${listed.stderr.trim()}`,
+    };
+  }
+  if (names(listed.stdout).includes(STAGING_DATABASE)) return { id, status: "present" };
+  const created = await runWithRetry(run, sleep, [
+    "sql",
+    "databases",
+    "create",
+    STAGING_DATABASE,
+    ...where,
+    "--quiet",
+  ]);
+  if (!created.ok) {
+    return {
+      id,
+      status: "failed",
+      error: `gcloud sql databases create ${STAGING_DATABASE} on ${instance}: ${created.stderr.trim()}. The account running this needs cloudsql.databases.create on the project; re-run once it has.`,
+    };
+  }
+  return { id, status: "applied", detail: `created on ${instance}` };
+}
+
+async function ensureRole(
+  run: GcloudRunner,
+  deps: { readonly sleep?: Sleep; readonly http?: HttpFetch },
+  install: { readonly projectId: string; readonly env: string },
+  instance: string,
+  where: readonly string[],
+): Promise<EnsureOutcome> {
+  const id = `database role ${STAGING_DATABASE_ROLE}`;
+  const listed = await run(["sql", "users", "list", ...where, "--format=value(name)"]);
+  if (!listed.ok) {
+    return {
+      id,
+      status: "failed",
+      error: `gcloud sql users list on ${instance}: ${listed.stderr.trim()}`,
+    };
+  }
+  const exists = names(listed.stdout).includes(STAGING_DATABASE_ROLE);
+  const outcome = await ensureDatabaseRolePassword(
+    { projectId: install.projectId, env: install.env, sqlInstance: instance },
+    STAGING_DATABASE_ROLE,
+    {
+      run,
+      ...(deps.sleep ? { sleep: deps.sleep } : {}),
+      ...(deps.http ? { http: deps.http } : {}),
+      create: !exists,
+    },
+  );
+  if (outcome.status === "failed") return { ...outcome, id };
+  return exists
+    ? { id, status: "present", detail: "password re-applied" }
+    : { id, status: "applied", detail: `created on ${instance}` };
+}

package/src/state-store.test.ts

@@ -36,7 +36,8 @@ function fakeBucket() {
   return { objects, calls, run };
 }
 
-const PASSWORD_URL = "postgres://admin_role:hunter2hunter2@10.0.0.3:5432/cms_admin";
+const PASSWORD_URL =
+  "postgres://admin_role:hunter2hunter2@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin";
 
 let root = "";
 beforeEach(() => {