belt 0.0.6 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 76046d0c4aaddd1c8942c45cdb1c33de12162b7c5c216ba983dbb45af03f70a6
-  data.tar.gz: 61dd611eb73b87bc1d5ed1424b43d1afff08a068099d84063d077edc714baa5e
+  metadata.gz: d587a60fbaef9f5755a1746b766d5fdc6e6bf6efbc34ee58e3901b0324fbc199
+  data.tar.gz: ac3bca34eb3552cf18693605b4c42ba11d11ea1d5437d201b6db838443951c28
 SHA512:
-  metadata.gz: 6d529b9340152b9d64be1358a72c807b1328bd7134a7b50baefe8bce678079ff08b8df2586beb9ac93a97552326905a90ed1b6b3d232071d85a36e37a5e2bd50
-  data.tar.gz: c9b2cf12958c61e053b32baa5101873222f5162da2e41ebf0f4e7c1ad6969278dcb618e89bd6bced53eaf0fb0849167a91c9364505083b2ccffcd1b19a200c7c
+  metadata.gz: fdcd4a4c7efbce1ef89e394f86f3b3252307f4e4d1462ff8582bd0de6fb5ce9d3e7d34cceacc43dd3d50c3165ef1e7f01592b220dcddeb246d81c371fcb59281
+  data.tar.gz: 8ba38580f372f91d188aad8fc843435dc7f35ef90b7142027f9201317761f4de231d310ab58f5f5536400d6060925d425fcc8d208716381048f96bb6db15b574

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.0.7
+
+- Fixed `discover_gem_paths` to use `Gem.loaded_specs` instead of `Gem::Specification.each` — the latter silently returns nothing on Lambda's vendored bundle layout, causing gem controllers/models to not be found
+
 ## 0.0.5
 
 - Eliminated regex from `Belt::ActionRouter` — uses pure segment-by-segment string comparison (resolves CodeQL alerts)

data/exe/belt

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require_relative '../lib/belt/cli'
+
+Belt::CLI.start(ARGV)

data/lib/belt/action_router.rb

@@ -144,9 +144,15 @@ module Belt
         next unless File.exist?(full_path)
 
         require full_path
-        # After requiring, try to find the constant
+        # After requiring, try to find the constant (top-level or namespaced)
         class_name = "#{controller_name.split(%r{[_/]}).map(&:capitalize).join}Controller"
         return Object.const_get(class_name) if Object.const_defined?(class_name)
+
+        # Try under namespace module (e.g., BrablogControllers::PostsController)
+        if Object.const_defined?(@namespace_module_name)
+          ns = Object.const_get(@namespace_module_name)
+          return ns.const_get(class_name) if ns.const_defined?(class_name)
+        end
       end
 
       raise Belt::ActionNotFound, "Controller not found: #{controller_name}"

data/lib/belt/cli/app_detection.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Belt
+  module CLI
+    module AppDetection
+      def detect_app_name
+        routes_file = 'infrastructure/routes.tf.rb'
+        if File.exist?(routes_file)
+          match = File.read(routes_file).match(/namespace :(\w+)/)
+          return match[1] if match
+        end
+        File.basename(Dir.pwd)
+      end
+    end
+  end
+end

data/lib/belt/cli/bucket_security.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+module Belt
+  module CLI
+    module BucketSecurity
+      def audit_bucket_security(bucket)
+        {
+          versioning: check_versioning(bucket),
+          encryption: check_encryption(bucket),
+          public_access_block: check_public_access_block(bucket),
+          tls_policy: check_tls_policy(bucket)
+        }
+      end
+
+      def print_security_audit(audit)
+        puts "\nSecurity audit:"
+        puts "  #{audit[:versioning] ? '✓' : '✗'} Versioning"
+        puts "  #{audit[:encryption] ? '✓' : '✗'} Encryption (AES-256)"
+        puts "  #{audit[:public_access_block] ? '✓' : '✗'} Public access block"
+        puts "  #{audit[:tls_policy] ? '✓' : '✗'} TLS-only policy"
+      end
+
+      def check_versioning(bucket)
+        output = safe_capture('aws', 's3api', 'get-bucket-versioning', '--bucket', bucket, '--output', 'json')
+        return false unless output
+
+        data = JSON.parse(output)
+        data['Status'] == 'Enabled'
+      rescue JSON::ParserError
+        false
+      end
+
+      def check_encryption(bucket)
+        output = safe_capture('aws', 's3api', 'get-bucket-encryption', '--bucket', bucket, '--output', 'json')
+        return false unless output
+
+        data = JSON.parse(output)
+        rules = data.dig('ServerSideEncryptionConfiguration', 'Rules') || []
+        rules.any? { |r| r.dig('ApplyServerSideEncryptionByDefault', 'SSEAlgorithm') }
+      rescue JSON::ParserError
+        false
+      end
+
+      def check_public_access_block(bucket)
+        output = safe_capture('aws', 's3api', 'get-public-access-block', '--bucket', bucket, '--output', 'json')
+        return false unless output
+
+        data = JSON.parse(output)
+        config = data['PublicAccessBlockConfiguration'] || {}
+        config['BlockPublicAcls'] && config['IgnorePublicAcls'] &&
+          config['BlockPublicPolicy'] && config['RestrictPublicBuckets']
+      rescue JSON::ParserError
+        false
+      end
+
+      def check_tls_policy(bucket)
+        output = safe_capture('aws', 's3api', 'get-bucket-policy', '--bucket', bucket, '--output', 'json')
+        return false unless output
+
+        data = JSON.parse(output)
+        policy = JSON.parse(data['Policy'])
+        statements = policy['Statement'] || []
+        statements.any? do |s|
+          s['Effect'] == 'Deny' &&
+            s.dig('Condition', 'Bool', 'aws:SecureTransport') == 'false'
+        end
+      rescue JSON::ParserError, TypeError
+        false
+      end
+
+      def harden_bucket(bucket, audit)
+        unless audit[:versioning]
+          enable_versioning(bucket)
+          puts '  enable  versioning'
+        end
+        unless audit[:encryption]
+          enable_encryption(bucket)
+          puts '  enable  AES-256 encryption'
+        end
+        unless audit[:public_access_block]
+          block_public_access(bucket)
+          puts '  enable  public access block'
+        end
+        return if audit[:tls_policy]
+
+        apply_tls_policy(bucket)
+        puts '  enable  TLS-only bucket policy'
+      end
+
+      private
+
+      def enable_versioning(bucket)
+        run!('aws', 's3api', 'put-bucket-versioning', '--bucket', bucket,
+             '--versioning-configuration', 'Status=Enabled')
+      end
+
+      def enable_encryption(bucket)
+        config = '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"},"BucketKeyEnabled":true}]}'
+        run!('aws', 's3api', 'put-bucket-encryption', '--bucket', bucket,
+             '--server-side-encryption-configuration', config)
+      end
+
+      def block_public_access(bucket)
+        run!('aws', 's3api', 'put-public-access-block', '--bucket', bucket,
+             '--public-access-block-configuration',
+             'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true')
+      end
+
+      def apply_tls_policy(bucket)
+        policy = {
+          Version: '2012-10-17',
+          Statement: [{
+            Sid: 'DenyInsecureConnections', Effect: 'Deny', Principal: '*', Action: 's3:*',
+            Resource: ["arn:aws:s3:::#{bucket}", "arn:aws:s3:::#{bucket}/*"],
+            Condition: { Bool: { 'aws:SecureTransport' => 'false' } }
+          }]
+        }
+        run!('aws', 's3api', 'put-bucket-policy', '--bucket', bucket, '--policy', JSON.generate(policy))
+      end
+    end
+  end
+end

data/lib/belt/cli/env_resolver.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Belt
+  module CLI
+    module EnvResolver
+      def self.resolve(args)
+        if args.first && !args.first.start_with?('-')
+          args.shift
+        else
+          ENV.fetch('BELT_ENV', nil)
+        end
+      end
+    end
+  end
+end

data/lib/belt/cli/environment_command.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'erb'
+require_relative 'app_detection'
+
+module Belt
+  module CLI
+    class EnvironmentCommand
+      TEMPLATE_DIR = File.expand_path('../../templates/environment', __dir__)
+
+      include AppDetection
+
+      def self.run(args)
+        env_name = args.shift
+
+        if env_name.nil? || env_name.empty?
+          puts 'Usage: belt generate environment <name>'
+          puts "\nExamples:"
+          puts '  belt generate environment dev01'
+          puts '  belt generate environment staging'
+          puts '  belt generate environment prod'
+          exit 1
+        end
+
+        new(env_name).generate
+      end
+
+      def initialize(env_name)
+        @env_name = env_name.downcase.gsub(/[^a-z0-9_-]/, '')
+        @app_name = detect_app_name
+      end
+
+      def generate
+        dest_dir = "infrastructure/#{@env_name}"
+
+        if Dir.exist?(dest_dir)
+          puts "Environment '#{@env_name}' already exists at #{dest_dir}/"
+          exit 1
+        end
+
+        puts "Creating environment: #{@env_name}"
+        FileUtils.mkdir_p(dest_dir)
+
+        templates.each do |template_name, dest_file|
+          dest_path = File.join(dest_dir, dest_file)
+          write_template(template_name, dest_path)
+          puts "  create  #{dest_path}"
+        end
+
+        puts "\n✓ Environment '#{@env_name}' created!"
+        puts "\nNext steps:"
+        puts "  cd #{dest_dir}"
+        puts '  terraform init'
+        puts '  terraform plan'
+        puts '  terraform apply'
+      end
+
+      private
+
+      def templates
+        {
+          'main.tf.erb' => 'main.tf',
+          'backend.tf.erb' => 'backend.tf',
+          'variables.tf.erb' => 'variables.tf',
+          'terraform.tfvars.erb' => 'terraform.tfvars'
+        }
+      end
+
+      def write_template(template_name, dest_path)
+        template_path = File.join(TEMPLATE_DIR, template_name)
+        content = ERB.new(File.read(template_path), trim_mode: '-').result(binding)
+        File.write(dest_path, content)
+      end
+    end
+  end
+end

data/lib/belt/cli/frontend_command.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'erb'
+require 'json'
+require_relative 'app_detection'
+
+module Belt
+  module CLI
+    class FrontendCommand
+      TEMPLATE_DIR = File.expand_path('../../templates/frontend', __dir__)
+      FRAMEWORKS = %w[react vue svelte].freeze
+
+      include AppDetection
+
+      def self.run(args)
+        framework = args.shift
+
+        if framework.nil? || !FRAMEWORKS.include?(framework)
+          puts "Usage: belt generate frontend <#{FRAMEWORKS.join('|')}>"
+          puts "\nScaffolds a frontend application with build tooling and API client."
+          puts "\nExamples:"
+          puts '  belt generate frontend react'
+          puts '  belt generate frontend vue'
+          exit 1
+        end
+
+        new(framework).generate
+      end
+
+      def initialize(framework)
+        @framework = framework
+        @app_name = detect_app_name
+        @module_name = @app_name.split(/[-_]/).map(&:capitalize).join
+      end
+
+      def generate
+        dest_dir = 'frontend'
+
+        if Dir.exist?(dest_dir) && !Dir.empty?(dest_dir)
+          puts "Directory 'frontend/' already exists and is not empty."
+          exit 1
+        end
+
+        puts "Creating #{@framework} frontend application..."
+        framework_dir = File.join(TEMPLATE_DIR, @framework)
+
+        unless Dir.exist?(framework_dir)
+          puts "✗ Template not found for '#{@framework}'. Available: #{FRAMEWORKS.join(', ')}"
+          exit 1
+        end
+
+        copy_template(framework_dir, dest_dir)
+
+        puts "\n✓ Frontend (#{@framework}) created in frontend/"
+        puts "\nNext steps:"
+        puts '  cd frontend && npm install && npm run dev'
+        puts '  belt setup frontend <env>    # Generate CloudFront + S3 infrastructure'
+        puts '  belt deploy frontend <env>   # Build and deploy to AWS'
+      end
+
+      private
+
+      def copy_template(src_dir, dest_dir)
+        Dir.glob("#{src_dir}/**/*", File::FNM_DOTMATCH).each do |src|
+          next if File.directory?(src)
+          next if src.end_with?('/..') || src.end_with?('/.')
+
+          rel_path = src.sub("#{src_dir}/", '')
+          dest_path = File.join(dest_dir, rel_path.sub(/\.erb\z/, ''))
+
+          FileUtils.mkdir_p(File.dirname(dest_path))
+
+          if src.end_with?('.erb')
+            content = ERB.new(File.read(src), trim_mode: '-').result(binding)
+            File.write(dest_path, content)
+          else
+            FileUtils.cp(src, dest_path)
+          end
+          puts "  create  #{dest_path}"
+        end
+      end
+    end
+  end
+end

data/lib/belt/cli/frontend_deploy_command.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+require 'open3'
+require_relative 'app_detection'
+require_relative 'env_resolver'
+
+module Belt
+  module CLI
+    class FrontendDeployCommand
+      include AppDetection
+
+      def self.run(args)
+        env = EnvResolver.resolve(args)
+
+        if env.nil?
+          puts 'Usage: belt deploy frontend <environment>'
+          puts "\nBuilds the frontend app and deploys to S3 + invalidates CloudFront."
+          puts 'You can also set BELT_ENV to skip the environment argument.'
+          puts "\nExamples:"
+          puts '  belt deploy frontend wups'
+          puts '  belt deploy frontend dev01'
+          puts '  BELT_ENV=wups belt deploy frontend'
+          exit 1
+        end
+
+        new(env).run
+      end
+
+      def initialize(env)
+        @env = env
+        @app_name = detect_app_name
+        @env_dir = "infrastructure/#{@env}"
+      end
+
+      def run
+        validate!
+        build_frontend
+        sync_to_s3
+        invalidate_cloudfront
+        url = fetch_frontend_url
+        puts "\n✅ Frontend deployed to #{@env}!"
+        puts "   #{url}" if url
+      end
+
+      private
+
+      def validate!
+        unless Dir.exist?('frontend')
+          abort 'Error: No frontend/ directory found. Run `belt generate frontend react` first.'
+        end
+        return if File.exist?('frontend/package.json')
+
+        abort 'Error: frontend/package.json not found.'
+      end
+
+      def build_frontend
+        puts '📦 Installing dependencies...'
+        install_cmd = File.exist?('frontend/package-lock.json') ? %w[npm ci] : %w[npm install]
+        run!(*install_cmd, chdir: 'frontend')
+
+        puts '🏗️  Building frontend...'
+        api_url = fetch_api_url
+        env = api_url ? { 'VITE_API_URL' => api_url } : {}
+        run!(env, 'npm', 'run', 'build', chdir: 'frontend')
+      end
+
+      def sync_to_s3
+        bucket = fetch_bucket_name
+        abort "Error: Could not determine S3 bucket. Run `belt apply #{@env}` first." unless bucket
+
+        puts "☁️  Deploying to S3... (#{bucket})"
+
+        # Hashed assets get immutable cache headers
+        run!('aws', 's3', 'sync', 'frontend/dist/', "s3://#{bucket}", '--delete',
+             '--size-only', '--cache-control', 'public, max-age=31536000, immutable',
+             '--exclude', 'index.html')
+
+        # index.html always revalidates
+        run!('aws', 's3', 'cp', 'frontend/dist/index.html', "s3://#{bucket}/index.html",
+             '--cache-control', 'no-cache')
+      end
+
+      def invalidate_cloudfront
+        dist_id = fetch_distribution_id
+        unless dist_id
+          puts '⚠️  No CloudFront distribution found (skipping cache invalidation)'
+          return
+        end
+
+        puts '🔄 Invalidating CloudFront cache...'
+        run!('aws', 'cloudfront', 'create-invalidation', '--distribution-id', dist_id, '--paths', '/*',
+             out: File::NULL)
+        puts '✅ CloudFront cache invalidated'
+      end
+
+      def fetch_api_url
+        output, status = Open3.capture2('terraform', 'output', '-raw', 'api_url', chdir: @env_dir)
+        status.success? && !output.strip.empty? ? output.strip : nil
+      end
+
+      def fetch_bucket_name
+        output, status = Open3.capture2('terraform', 'output', '-raw', 'frontend_bucket_name', chdir: @env_dir)
+        status.success? && !output.strip.empty? ? output.strip : nil
+      end
+
+      def fetch_distribution_id
+        output, status = Open3.capture2('terraform', 'output', '-raw', 'frontend_distribution_id', chdir: @env_dir)
+        status.success? && !output.strip.empty? ? output.strip : nil
+      end
+
+      def fetch_frontend_url
+        output, status = Open3.capture2('terraform', 'output', '-raw', 'frontend_url', chdir: @env_dir)
+        status.success? && !output.strip.empty? ? output.strip : nil
+      end
+
+      def run!(*args, **)
+        env = args.first.is_a?(Hash) ? args.shift : {}
+        return if system(env, *args, **)
+
+        abort "\n✗ Command failed: #{args.shelljoin}"
+      end
+    end
+  end
+end

data/lib/belt/cli/frontend_setup_command.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'erb'
+require_relative 'app_detection'
+require_relative 'env_resolver'
+
+module Belt
+  module CLI
+    class FrontendSetupCommand
+      TEMPLATE_DIR = File.expand_path('../../templates/frontend_infra', __dir__)
+
+      include AppDetection
+
+      def self.run(args)
+        env = EnvResolver.resolve(args)
+
+        if env.nil?
+          puts 'Usage: belt setup frontend <environment>'
+          puts "\nGenerates S3 + CloudFront Terraform for frontend hosting."
+          puts 'You can also set BELT_ENV to skip the environment argument.'
+          puts "\nExamples:"
+          puts '  belt setup frontend wups'
+          puts '  belt setup frontend dev01'
+          puts '  BELT_ENV=wups belt setup frontend'
+          exit 1
+        end
+
+        new(env).run
+      end
+
+      def initialize(env)
+        @env = env
+        @app_name = detect_app_name
+        @env_dir = "infrastructure/#{@env}"
+      end
+
+      def run
+        validate!
+        generate_frontend_tf
+        puts "\n✓ Frontend infrastructure generated for '#{@env}'!"
+        puts "\nRun `belt apply #{@env}` to create the S3 bucket and CloudFront distribution."
+        puts "Then `belt deploy frontend #{@env}` to build and deploy."
+      end
+
+      private
+
+      def validate!
+        return if Dir.exist?(@env_dir)
+
+        abort "Error: Environment '#{@env}' not found at #{@env_dir}/.\n" \
+              "Create it with: belt generate environment #{@env}"
+      end
+
+      def generate_frontend_tf
+        dest = File.join(@env_dir, 'frontend.tf')
+        template_path = File.join(TEMPLATE_DIR, 'frontend.tf.erb')
+        content = ERB.new(File.read(template_path), trim_mode: '-').result(binding)
+        File.write(dest, content)
+        puts "  create  #{dest}"
+      end
+    end
+  end
+end