@caelo-cms/provisioning 0.3.7 → 0.3.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caelo-cms/provisioning",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "private": false,
   "license": "MPL-2.0",
   "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -38,7 +38,7 @@
     "prepublishOnly": "tsc -b --force && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json"
   },
   "dependencies": {
-    "@caelo-cms/shared": "^0.3.7",
+    "@caelo-cms/shared": "^0.3.9",
     "@clack/prompts": "1.3.0",
     "@pulumi/aws": "^7",
     "@pulumi/awsx": "^3",

package/stacks/gcp-firebase/index.ts

@@ -59,10 +59,20 @@ const iapAllowlist =
 const env = pulumi.getStack() as "dev" | "staging" | "production";
 const namePrefix = `caelo-${env}`;
 const adminDomain = `admin.${domain}`;
-// Firebase site IDs are GLOBALLY unique across all Firebase projects.
-// Default uses the namePrefix; operator can override if the default
-// collides with another project's site.
-const firebaseSiteId = cfg.get("firebaseSiteId") || `${namePrefix}-site`;
+// Firebase site IDs are GLOBALLY unique across all Firebase projects —
+// and reserved for ~30 days even after the parent project is deleted.
+// A fixed default like `caelo-production-site` collides on re-install
+// or after a failed run against a soft-deleted project. The suffix is
+// a `random.RandomId` so it persists in Pulumi state across `up` runs
+// but stays unique across installs. Operator override stays available
+// for branded URLs (e.g. `cms.example.com` → `cms-example-com`).
+const firebaseSiteSuffix = new random.RandomId(`${namePrefix}-firebase-site-suffix`, {
+  byteLength: 3, // 6 hex chars — `caelo-production-site-abc123`
+});
+const firebaseSiteIdOverride = cfg.get("firebaseSiteId");
+const firebaseSiteId: pulumi.Input<string> = firebaseSiteIdOverride
+  ? firebaseSiteIdOverride
+  : pulumi.interpolate`${namePrefix}-site-${firebaseSiteSuffix.hex}`;
 
 const gcpProvider = new gcp.Provider(`${namePrefix}-gcp`, { project, region });
 const opts = { provider: gcpProvider };
@@ -454,12 +464,18 @@ const adminSvc = cloudRunService({
 // v0.3.1 — Firebase Hosting uses a Google-managed service identity
 // to proxy traffic via `rewrites` to Cloud Run. Grant it
 // `roles/run.invoker` on the gateway so /api/** requests succeed.
-// The SA name follows the standard `service-<project-number>@
-// gcp-sa-firebasehosting.iam.gserviceaccount.com` shape. We fetch
-// the project number via `gcp.organizations.getProject` rather than
-// hardcoding it.
-const projectInfo = gcp.organizations.getProjectOutput({ projectId: project }, opts);
-const firebaseHostingSa = pulumi.interpolate`serviceAccount:service-${projectInfo.number}@gcp-sa-firebasehosting.iam.gserviceaccount.com`;
+//
+// v0.3.9 — The Firebase Hosting service identity SA is created
+// on-demand, not when the API is merely enabled. Constructing the
+// email by name and granting IAM to it fails with "Service account
+// ... does not exist". `gcp.projects.ServiceIdentity` triggers
+// creation and returns the email; we depend on it so the binding
+// always sees the SA. Same pattern the gcp stack uses for IAP.
+const firebaseHostingIdentity = new gcp.projects.ServiceIdentity(
+  `${namePrefix}-firebasehosting-identity`,
+  { project, service: "firebasehosting.googleapis.com" },
+  opts,
+);
 
 new gcp.cloudrun.IamMember(
   `${namePrefix}-gateway-firebase-invoker`,
@@ -468,9 +484,9 @@ new gcp.cloudrun.IamMember(
     project,
     service: gatewaySvc.name,
     role: "roles/run.invoker",
-    member: firebaseHostingSa,
+    member: pulumi.interpolate`serviceAccount:${firebaseHostingIdentity.email}`,
   },
-  opts,
+  { ...opts, dependsOn: [firebaseHostingIdentity] },
 );
 
 // =========================================================================