belt-pay 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 614581460579c56502eed359de29c1f36f746c3a8697b6ba3aa073266740649b
-  data.tar.gz: 00d84db5eb7ce1c47f23f666b8eab1511ace5745e2ad18e48e8c9753b2751503
+  metadata.gz: 6949c31f8f5adaec1e1a6c6d08e36bac5fb3cdac59fd2054a46be18869fa196c
+  data.tar.gz: e07b2808dc053c34235ea4ec6ef183858c43401279a5f3d4b1c92ce7b46d2af1
 SHA512:
-  metadata.gz: 51d01a9a411c28d3e080352bb265553b8de72d24e0166f953248910926b55bd139aa9a7864c7b7ba504a9a8470a12ef013ce1b5153f441c653ef97e847f1e65f
-  data.tar.gz: 4b8e05e523ca9abc3400a3455dfa7fb3b1adc0bd409eef90ed8856878e8938719663d45001ecbb3434e42fa17da07160be33f257acb753c900f9704ac05a7779
+  metadata.gz: 5ba551d781ba509f1aa8b93f47c84b8d22e6af8727659f7643ec73d6876b58811c7383fd8780c086a1c38dd8eefc3a546efc11297ab9ea2856be0c4a6fcb58ba
+  data.tar.gz: 0e0b3dddaa5d235ba5d10362cc7d9d737ebfbc5f69649620b0adc5d42eb43d92a884560947a47cc53604f2080fd5179106eaab3015d527c6c274b9cd6f3f83b9

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.0.3 — 2026-10-02
+
+- Add Belt-native `pay:setup`, `pay:show`, and `pay:edit` tasks through Belt's
+  gem Rake-task extension mechanism. Select an environment with `BELT_ENV` or standard
+  task-argument syntax such as `belt 'pay:setup[dev]'`.
+- Make `belt pay:setup` the happy path: it prompts without echo for Stripe's API and
+  webhook signing secrets, preserves either existing value when left blank, and writes
+  directly through the AWS SDK.
+- Add `belt pay:show` and `belt pay:edit` for inspecting and securely editing each
+  environment's Stripe JSON secret in AWS Secrets Manager.
+- Detect the Belt app name, AWS profile, and region from the selected environment,
+  with environment-variable and explicit overrides for custom setups.
+- Retain the packaged `belt-pay secrets:*` executable as a backward-compatible alias,
+  pin the AWS Secrets Manager SDK, and include the pinned Rake runtime required for
+  task dispatch in fresh Belt apps.
+
 ## 0.0.2 — 2026-09-05
 
 - **Plan DSL (convention over configuration).** Declare subscription plans, their

data/README.md

@@ -167,6 +167,54 @@ The Stripe secret should contain:
 }
 ```
 
+### Setting Up and Managing Secrets
+
+Belt Pay hooks into Belt through its standard gem-provided Rake task mechanism. The
+guided happy path uses `BELT_ENV` to select the environment:
+
+```bash
+BELT_ENV=dev belt pay:setup
+```
+
+It prompts without echo for the Stripe secret key and webhook signing secret, then
+writes them directly through the AWS SDK. Leave either prompt blank to preserve its
+existing value, so you can run setup once for the API key and again after Stripe gives
+you the webhook signing secret.
+
+You can also pass the environment with standard Rake task-argument syntax:
+
+```bash
+belt 'pay:setup[dev]'
+```
+
+Rails-like inspection and arbitrary JSON editing remain available for advanced use:
+
+```bash
+BELT_ENV=dev belt pay:show
+EDITOR="code --wait" BELT_ENV=dev belt pay:edit
+# Or: belt 'pay:show[dev]' / belt 'pay:edit[dev]'
+```
+
+`pay:show` prints the complete decrypted JSON to stdout. `pay:edit` opens it with
+`$VISUAL` or `$EDITOR`, validates that the result is a JSON object, and writes a new
+Secrets Manager version only when the content changed. Its temporary file is mode
+`0600` and is removed when the editor closes. All write paths refuse to overwrite a
+secret that changed while the command was open.
+
+The tasks detect the application name from Terraform, the AWS profile from
+`infrastructure/<env>/belt.rb`, and the region from Terraform or AWS environment
+variables. Custom setups can override those values with `APP_NAME`,
+`BELT_PAY_SECRET_NAME`, `AWS_PROFILE`, and `AWS_REGION`:
+
+```bash
+APP_NAME=my_app BELT_ENV=prod AWS_PROFILE=my-prod-profile belt pay:setup
+BELT_PAY_SECRET_NAME=custom-stripe-secret BELT_ENV=prod belt pay:edit
+```
+
+Because `pay:show` intentionally reveals credentials, avoid redirecting its output to
+logs or sharing it in chat. The packaged `belt-pay secrets:*` executable remains as a
+backward-compatible alias, but the Belt-native tasks are the preferred interface.
+
 ## Common Patterns
 
 ### Annual Subscription (Feature Gating)

data/exe/belt-pay

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'belt/pay/cli'
+
+exit Belt::Pay::CLI.start(ARGV)

data/lib/belt/generators/pay_generator.rb

@@ -315,9 +315,11 @@ module Belt
                  # ...
                end
 
-            3. Create your Stripe API keys in Secrets Manager:
-               Secret name: <app_name>-<env>-stripe
-               Keys: stripe_secret_key, stripe_webhook_secret
+            3. Add your Stripe API keys to Secrets Manager:
+               BELT_ENV=<env> belt pay:setup
+
+               Values are prompted without echo. Leave the webhook secret blank
+               until Stripe gives it to you, then run setup again.
 
             4. Deploy:
                belt apply <env>

data/lib/belt/pay/cli.rb

@@ -0,0 +1,298 @@
+# frozen_string_literal: true
+
+require 'io/console'
+require 'json'
+require 'optparse'
+require 'shellwords'
+require 'tempfile'
+require 'aws-sdk-secretsmanager'
+
+module Belt
+  module Pay
+    class CLI
+      class Error < StandardError; end
+
+      COMMANDS = %w[secrets:setup secrets:show secrets:edit].freeze
+
+      def self.start(args, input: $stdin, out: $stdout, err: $stderr)
+        new(args, input: input, out: out, err: err).run
+        0
+      rescue Error, OptionParser::ParseError => e
+        err.puts "Error: #{e.message}"
+        err.puts "Run `belt tasks --grep pay` for available Belt Pay commands."
+        1
+      rescue Aws::Errors::ServiceError => e
+        err.puts "AWS error: #{e.message}"
+        1
+      end
+
+      def initialize(args, input:, out:, err:)
+        @args = args.dup
+        @input = input
+        @out = out
+        @err = err
+        @options = {}
+      end
+
+      def run
+        command = @args.shift
+        if command.nil? || %w[help --help -h].include?(command)
+          @out.puts help
+          return
+        end
+
+        raise Error, "unknown command #{command.inspect}" unless COMMANDS.include?(command)
+
+        parse_options!
+        resolve_context!
+
+        case command
+        when 'secrets:setup' then setup
+        when 'secrets:show' then show
+        when 'secrets:edit' then edit
+        end
+      end
+
+      private
+
+      def parse_options!
+        parser.parse!(@args)
+        @environment = @args.shift || ENV['BELT_ENV']
+        raise Error, 'environment is required (for example, dev or prod)' if blank?(@environment)
+        raise Error, "unexpected argument #{@args.first.inspect}" unless @args.empty?
+      end
+
+      def parser
+        OptionParser.new do |opts|
+          opts.banner = 'Usage: belt-pay secrets:setup|secrets:show|secrets:edit ENV [options]'
+
+          opts.on('--app-name NAME', 'Override the detected Belt application name') do |value|
+            @options[:app_name] = value
+          end
+          opts.on('--secret-name NAME', 'Override the Secrets Manager secret name') do |value|
+            @options[:secret_name] = value
+          end
+          opts.on('--profile PROFILE', 'Override the AWS profile') do |value|
+            @options[:profile] = value
+          end
+          opts.on('--region REGION', 'Override the AWS region') do |value|
+            @options[:region] = value
+          end
+          opts.on('-h', '--help', 'Show this help') do
+            @out.puts help
+            exit 0
+          end
+        end
+      end
+
+      def resolve_context!
+        @root = find_project_root
+        env_dir = File.join(@root, 'infrastructure', @environment)
+        raise Error, "environment not found: #{env_dir}" unless Dir.exist?(env_dir)
+
+        @app_name = @options[:app_name] || ENV['APP_NAME'] || detect_app_name(env_dir)
+        raise Error, 'could not determine the application name; pass --app-name or set APP_NAME' if blank?(@app_name)
+
+        @secret_name = @options[:secret_name] || ENV['BELT_PAY_SECRET_NAME'] ||
+                       "#{@app_name}-#{@environment}-stripe"
+        @profile = @options[:profile] || ENV['AWS_PROFILE'] || detect_profile(env_dir)
+        @region = @options[:region] || ENV['AWS_REGION'] || ENV['AWS_DEFAULT_REGION'] || detect_region(env_dir)
+
+        ENV['AWS_PROFILE'] = @profile unless blank?(@profile)
+        @client = Aws::SecretsManager::Client.new(region: @region)
+      end
+
+      def setup
+        response = fetch_secret
+        original = parse_secret(response.secret_string)
+        updated = original.dup
+
+        secret_key = hidden_prompt('Stripe secret key [blank keeps existing]')
+        webhook_secret = hidden_prompt('Stripe webhook signing secret [blank keeps existing]')
+        updated['stripe_secret_key'] = secret_key unless blank?(secret_key)
+        updated['stripe_webhook_secret'] = webhook_secret unless blank?(webhook_secret)
+
+        update_secret(response, original, updated)
+      end
+
+      def show
+        response = fetch_secret
+        @out.puts JSON.pretty_generate(parse_secret(response.secret_string))
+      end
+
+      def edit
+        response = fetch_secret
+        original = parse_secret(response.secret_string)
+        edited = edit_json(original)
+
+        update_secret(response, original, edited)
+      end
+
+      def update_secret(response, original, updated)
+        if updated == original
+          @out.puts "Secret unchanged: #{@secret_name}"
+          return
+        end
+
+        latest = fetch_secret
+        if latest.version_id != response.version_id
+          raise Error, "#{@secret_name} changed while it was open; reopen it and apply your edits again"
+        end
+
+        @client.put_secret_value(
+          secret_id: @secret_name,
+          secret_string: JSON.generate(updated)
+        )
+        @out.puts "Updated secret: #{@secret_name}"
+      end
+
+      def fetch_secret
+        response = @client.get_secret_value(secret_id: @secret_name)
+        raise Error, "#{@secret_name} is binary; belt-pay only supports JSON string secrets" if response.secret_string.nil?
+
+        response
+      end
+
+      def parse_secret(value)
+        parsed = JSON.parse(value)
+        raise Error, "#{@secret_name} must contain a JSON object" unless parsed.is_a?(Hash)
+
+        parsed
+      rescue JSON::ParserError => e
+        raise Error, "#{@secret_name} does not contain valid JSON: #{e.message}"
+      end
+
+      def hidden_prompt(label)
+        @out.print "#{label}: "
+        @out.flush
+        value = if @input.respond_to?(:tty?) && @input.tty? && @input.respond_to?(:noecho)
+                  @input.noecho { @input.gets }
+                else
+                  @input.gets
+                end
+        @out.puts
+        raise Error, 'input ended before both Stripe secrets were read' if value.nil?
+
+        value.chomp
+      end
+
+      def edit_json(secret)
+        editor = ENV['VISUAL'] || ENV['EDITOR']
+        raise Error, 'set $VISUAL or $EDITOR before running secrets:edit' if blank?(editor)
+
+        Tempfile.create(["belt-pay-#{@environment}-", '.json']) do |file|
+          File.chmod(0o600, file.path)
+          file.write("#{JSON.pretty_generate(secret)}\n")
+          file.flush
+
+          success = system(*Shellwords.split(editor), file.path)
+          raise Error, 'editor exited unsuccessfully; secret was not updated' unless success
+
+          file.rewind
+          parse_secret(file.read)
+        end
+      end
+
+      def find_project_root
+        dir = File.expand_path(Dir.pwd)
+        loop do
+          routes = [
+            File.join(dir, 'config', 'routes.rb'),
+            File.join(dir, 'config', 'routes.tf.rb'),
+            File.join(dir, 'infrastructure', 'routes.tf.rb')
+          ]
+          return dir if routes.any? { |path| File.file?(path) }
+
+          parent = File.dirname(dir)
+          break if parent == dir
+
+          dir = parent
+        end
+
+        raise Error, 'could not find a Belt application; run this command inside one'
+      end
+
+      def detect_app_name(env_dir)
+        from_assignment(File.join(env_dir, 'terraform.tfvars'), 'app_name') ||
+          from_variable_default(File.join(env_dir, 'variables.tf'), 'app_name') ||
+          Dir.glob(File.join(@root, 'infrastructure', '*', 'terraform.tfvars')).sort.filter_map do |path|
+            from_assignment(path, 'app_name')
+          end.first ||
+          Dir.glob(File.join(@root, 'infrastructure', '*', 'variables.tf')).sort.filter_map do |path|
+            from_variable_default(path, 'app_name')
+          end.first ||
+          File.basename(@root)
+      end
+
+      def detect_profile(env_dir)
+        path = File.join(env_dir, 'belt.rb')
+        return unless File.file?(path)
+
+        File.read(path)[/config\.aws_profile\s*=\s*['\"]([^'\"]+)['\"]/, 1]
+      end
+
+      def detect_region(env_dir)
+        from_assignment(File.join(env_dir, 'terraform.tfvars'), 'aws_region') ||
+          from_variable_default(File.join(env_dir, 'variables.tf'), 'aws_region') ||
+          'us-east-1'
+      end
+
+      def from_assignment(path, key)
+        return unless File.file?(path)
+
+        File.read(path)[/^\s*#{Regexp.escape(key)}\s*=\s*['\"]([^'\"]+)['\"]/, 1]
+      end
+
+      def from_variable_default(path, key)
+        return unless File.file?(path)
+
+        block = File.read(path)[/variable\s+['\"]#{Regexp.escape(key)}['\"]\s*\{(.*?)\}/m, 1]
+        block&.match(/^\s*default\s*=\s*['\"]([^'\"]+)['\"]/)&.captures&.first
+      end
+
+      def blank?(value)
+        value.nil? || value.strip.empty?
+      end
+
+      def help
+        <<~HELP
+          Manage a Belt application's Stripe secret in AWS Secrets Manager.
+
+          Usage:
+            belt-pay secrets:setup ENV [options]
+            belt-pay secrets:show ENV [options]
+            belt-pay secrets:edit ENV [options]
+
+          Commands:
+            secrets:setup        Prompt without echo for Stripe's secret values
+            secrets:show         Print the decrypted JSON secret
+            secrets:edit         Edit the secret with $VISUAL or $EDITOR
+
+          Options:
+            --app-name NAME      Override the detected application name
+            --secret-name NAME   Override <app>-<environment>-stripe
+            --profile PROFILE    Override the environment's AWS profile
+            --region REGION      Override the detected AWS region
+            -h, --help           Show this help
+
+          Environment:
+            BELT_ENV             Environment when ENV is omitted
+            AWS_PROFILE          AWS profile (overrides infrastructure/ENV/belt.rb)
+            AWS_REGION           AWS region (default: us-east-1)
+            VISUAL, EDITOR       Editor command for secrets:edit
+
+          Examples:
+            belt-pay secrets:setup dev
+            belt-pay secrets:show dev
+            belt-pay secrets:edit prod --profile my-prod-profile
+            BELT_ENV=staging belt-pay secrets:setup
+
+          Security:
+            secrets:setup reads values without echo and sends them directly through the
+            AWS SDK. secrets:show writes the complete secret to stdout. secrets:edit uses
+            a mode-0600 temporary file, validates JSON, and removes the file afterward.
+        HELP
+      end
+    end
+  end
+end

data/lib/belt/pay/version.rb

@@ -2,6 +2,6 @@
 
 module Belt
   module Pay
-    VERSION = '0.0.2'
+    VERSION = '0.0.3'
   end
 end

data/lib/tasks/pay.rake

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'belt/pay/cli'
+
+run_pay_secret_command = lambda do |command, environment|
+  args = ["secrets:#{command}"]
+  args << environment unless environment.nil? || environment.to_s.strip.empty?
+
+  status = Belt::Pay::CLI.start(args)
+  exit status unless status.zero?
+end
+
+namespace :pay do
+  desc 'Prompt without echo for Stripe secrets (BELT_ENV or pay:setup[env])'
+  task :setup, [:environment] do |_task, args|
+    run_pay_secret_command.call(:setup, args[:environment])
+  end
+
+  desc 'Print the decrypted Stripe secret (BELT_ENV or pay:show[env])'
+  task :show, [:environment] do |_task, args|
+    run_pay_secret_command.call(:show, args[:environment])
+  end
+
+  desc 'Edit the Stripe secret as JSON (BELT_ENV or pay:edit[env])'
+  task :edit, [:environment] do |_task, args|
+    run_pay_secret_command.call(:edit, args[:environment])
+  end
+end

metadata

@@ -1,14 +1,28 @@
 --- !ruby/object:Gem::Specification
 name: belt-pay
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Stowzilla
-bindir: bin
+bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-secretsmanager
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.136.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.136.0
 - !ruby/object:Gem::Dependency
   name: belt
   requirement: !ruby/object:Gem::Requirement
@@ -23,6 +37,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0.2'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 13.4.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 13.4.2
 - !ruby/object:Gem::Dependency
   name: stripe
   requirement: !ruby/object:Gem::Requirement
@@ -43,18 +71,21 @@ description: Belt plugin providing payment collection, subscriptions, and billin
 email:
 - andy@stowzilla.com
 - adam@stowzilla.com
-executables: []
+executables:
+- belt-pay
 extensions: []
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
 - LICENSE
 - README.md
+- exe/belt-pay
 - lib/belt-pay.rb
 - lib/belt/generators/pay_generator.rb
 - lib/belt/pay.rb
 - lib/belt/pay/billable.rb
 - lib/belt/pay/checkout.rb
+- lib/belt/pay/cli.rb
 - lib/belt/pay/configuration.rb
 - lib/belt/pay/controllers/webhooks_controller.rb
 - lib/belt/pay/customer_provisioner.rb
@@ -73,6 +104,7 @@ files:
 - lib/belt/pay/transaction.rb
 - lib/belt/pay/version.rb
 - lib/belt/pay/webhook_handler.rb
+- lib/tasks/pay.rake
 homepage: https://github.com/stowzilla/belt-pay
 licenses:
 - MIT