@caelo-cms/provisioning 0.3.15 → 0.3.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caelo-cms/provisioning",
-  "version": "0.3.15",
+  "version": "0.3.17",
   "private": false,
   "license": "MPL-2.0",
   "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -38,7 +38,7 @@
     "prepublishOnly": "tsc -b --force && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json"
   },
   "dependencies": {
-    "@caelo-cms/shared": "^0.3.15",
+    "@caelo-cms/shared": "^0.3.17",
     "@clack/prompts": "1.3.0",
     "@pulumi/aws": "^7",
     "@pulumi/awsx": "^3",

package/stacks/gcp-firebase/index.ts

@@ -546,20 +546,42 @@ const adminDomainMapping = provisionAdminDomain
 // shipped. If your provider build is older than v8.x, run
 // `gcloud beta run services update <admin-service> --iap` as a
 // post-up step. The stack provisions the IAM bindings either way.
-// v0.3.13 — For IAP-protected Cloud Run, the correct IAM role
-// for allowlisted-user access is `roles/run.invoker`, NOT
-// `roles/iap.httpsResourceAccessor` (Cloud Run IAM rejects that
-// role on both v1 and v2 APIs with "Role is not supported for
-// this resource"). IAP authenticates the user via Google; after
-// auth passes, IAP forwards the request to Cloud Run, which
-// checks `run.invoker` on the authenticated identity. So
-// granting `run.invoker` to the user email IS the IAP allowlist.
+// v0.3.17 — Native IAP on Cloud Run requires TWO bindings per
+// allowlisted user (testing showed iap-only isn't enough — Cloud
+// Run still rejects with 403 Forbidden after IAP forwards):
+//
+//   1. `roles/iap.httpsResourceAccessor` on the IAP WEB layer —
+//      lets the user pass IAP authentication.
+//      Resource: `gcp.iap.WebCloudRunServiceIamMember`
+//      (matches `gcloud beta iap web add-iam-policy-binding`).
+//
+//   2. `roles/run.invoker` on the Cloud Run service v2 IAM —
+//      lets Cloud Run accept the IAP-forwarded request. Without
+//      this, Cloud Run's own auth gate rejects with "Your client
+//      does not have permission".
+//
+// Both are needed for IAP-protected Cloud Run to actually serve
+// requests to the operator.
 for (const principal of iapAllowlist) {
-  new gcp.cloudrunv2.ServiceIamMember(
-    `${namePrefix}-admin-iap-${principal.replace(/[^a-z0-9]/gi, "-").slice(0, 40)}`,
+  const slug = principal.replace(/[^a-z0-9]/gi, "-").slice(0, 40);
+
+  new gcp.iap.WebCloudRunServiceIamMember(
+    `${namePrefix}-admin-iap-${slug}`,
     {
+      project,
       location: region,
+      cloudRunServiceName: adminSvc.name,
+      role: "roles/iap.httpsResourceAccessor",
+      member: principal,
+    },
+    opts,
+  );
+
+  new gcp.cloudrunv2.ServiceIamMember(
+    `${namePrefix}-admin-invoker-${slug}`,
+    {
       project,
+      location: region,
       name: adminSvc.name,
       role: "roles/run.invoker",
       member: principal,